@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/push/register/0.1/payload.ts

@@ -3,15 +3,16 @@
  * Source: specs/push/register/0.1/payload.schema.json
  */
 
-/**
- * The platform push channel (token). Held by the gateway only — never disclosed to any other party.
- */
-export type PushRegistration = Apns | Fcm | WebPush;
+import type { Apns, Ext, Fcm, PushRegistration, WakeHandle, WebPush } from "../../../_shared/components.js";
+
 
 /**
  * A device registers its platform push token (APNs / FCM / Web Push) with a push gateway and names the controller VTA permitted to provision its trigger allowlist. The gateway returns an opaque WakeHandle; the raw token is held by the gateway only. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
 export interface PushRegisterPayload {
+  /**
+   * The platform push channel (token). Held by the gateway only — never disclosed to any other party.
+   */
   registration: PushRegistration;
   /**
    * The DID of the VTA permitted to provision this handle's trigger allowlist (push/provision). The device conveys the resulting handle to this VTA via device/set-wake.
@@ -19,71 +20,16 @@ export interface PushRegisterPayload {
   controllerVtaDid: string;
   ext?: Ext;
 }
-export interface Apns {
-  platform: "apns";
-  /**
-   * APNs device token (hex string issued by Apple Push Notification service).
-   */
-  token: string;
-  /**
-   * APNs topic — typically the app bundle identifier the gateway pushes to.
-   */
-  topic: string;
-  /**
-   * Which APNs environment issued the token. Maintainers route to the matching APNs endpoint.
-   */
-  environment?: "sandbox" | "production";
-}
-export interface Fcm {
-  platform: "fcm";
-  /**
-   * Firebase Cloud Messaging registration token. The gateway sends a data message (not a notification message) so the app controls wake and display.
-   */
-  token: string;
-}
-export interface WebPush {
-  platform: "webpush";
-  /**
-   * RFC 8030 Web Push subscription endpoint.
-   */
-  endpoint: string;
+export interface PushRegisterResponsePayload {
   /**
-   * Web Push (RFC 8291) encryption keys. Note: per the push binding the payload remains contentless regardless of this encryption.
+   * The opaque gateway-issued handle (gateway address + handle). Conveyed onward; reveals no token.
    */
-  keys: {
-    /**
-     * base64url-encoded P-256 ECDH public key.
-     */
-    p256dh: string;
-    /**
-     * base64url-encoded auth secret.
-     */
-    auth: string;
-  };
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-export interface PushRegisterResponsePayload {
   wakeHandle: WakeHandle;
   ext?: Ext;
 }
-/**
- * The opaque gateway-issued handle (gateway address + handle). Conveyed onward; reveals no token.
- */
-export interface WakeHandle {
-  /**
-   * The push gateway that issued this handle and acts on it — a DID (DIDComm-reachable gateway) or an https URL (REST gateway). A trigger sends its contentless wake request here.
-   */
-  gateway: string;
-  /**
-   * Opaque gateway-issued identifier for the device's push channel. Reveals no platform token. Rotates whenever the device re-registers a new platform token with the gateway; the device then re-conveys the fresh handle via device/set-wake.
-   */
-  handle: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Apns, Ext, Fcm, PushRegistration, WakeHandle, WebPush };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/push/register/0.1" as const;
@@ -452,6 +398,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -465,5 +412,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/push/register/0.2/payload.ts

@@ -3,15 +3,16 @@
  * Source: specs/push/register/0.2/payload.schema.json
  */
 
-/**
- * The platform push channel (token). Held by the gateway only — never disclosed to any other party.
- */
-export type PushRegistration = Apns | Fcm | WebPush;
+import type { Apns, Ext, Fcm, PushRegistration, WakeHandle, WebPush } from "../../../_shared/components.js";
+
 
 /**
  * A device registers its platform push token (APNs / FCM / Web Push) with a push gateway and names the controller VTA permitted to provision its trigger allowlist. The gateway returns an opaque WakeHandle; the raw token is held by the gateway only. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
 export interface PushRegisterPayload {
+  /**
+   * The platform push channel (token). Held by the gateway only — never disclosed to any other party.
+   */
   registration: PushRegistration;
   /**
    * The DID of the VTA permitted to provision this handle's trigger allowlist (push/provision). The device conveys the resulting handle to this VTA via device/set-wake.
@@ -19,71 +20,16 @@ export interface PushRegisterPayload {
   controllerVtaDid: string;
   ext?: Ext;
 }
-export interface Apns {
-  platform: "apns";
-  /**
-   * APNs device token (hex string issued by Apple Push Notification service).
-   */
-  token: string;
-  /**
-   * APNs topic — typically the app bundle identifier the gateway pushes to.
-   */
-  topic: string;
-  /**
-   * Which APNs environment issued the token. Maintainers route to the matching APNs endpoint.
-   */
-  environment?: "sandbox" | "production";
-}
-export interface Fcm {
-  platform: "fcm";
-  /**
-   * Firebase Cloud Messaging registration token. The gateway sends a data message (not a notification message) so the app controls wake and display.
-   */
-  token: string;
-}
-export interface WebPush {
-  platform: "webpush";
-  /**
-   * RFC 8030 Web Push subscription endpoint.
-   */
-  endpoint: string;
+export interface PushRegisterResponsePayload {
   /**
-   * Web Push (RFC 8291) encryption keys. Note: per the push binding the payload remains contentless regardless of this encryption.
+   * The opaque gateway-issued handle (gateway address + handle). Conveyed onward; reveals no token.
    */
-  keys: {
-    /**
-     * base64url-encoded P-256 ECDH public key.
-     */
-    p256dh: string;
-    /**
-     * base64url-encoded auth secret.
-     */
-    auth: string;
-  };
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-export interface PushRegisterResponsePayload {
   wakeHandle: WakeHandle;
   ext?: Ext;
 }
-/**
- * The opaque gateway-issued handle (gateway address + handle). Conveyed onward; reveals no token.
- */
-export interface WakeHandle {
-  /**
-   * The push gateway that issued this handle and acts on it — a DID (DIDComm-reachable gateway) or an https URL (REST gateway). A trigger sends its contentless wake request here.
-   */
-  gateway: string;
-  /**
-   * Opaque gateway-issued identifier for the device's push channel. Reveals no platform token. Rotates whenever the device re-registers a new platform token with the gateway; the device then re-conveys the fresh handle via device/set-wake.
-   */
-  handle: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Apns, Ext, Fcm, PushRegistration, WakeHandle, WebPush };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/push/register/0.2" as const;
@@ -452,6 +398,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -465,5 +412,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/push/wake/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/push/wake/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * A trigger (the device's mediator or its VTA) asks the push gateway to deliver a contentless wake to a handle. Carries ONLY the push binding's contentless hint fields — never Trust Task content. The gateway authorizes against the handle's allowlist, then fires the doorbell. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
@@ -29,12 +32,6 @@ export interface PushWakePayload {
   urgency?: "interactive" | "background";
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PushWakeResponsePayload {
   /**
    * Outcome of the wake: `delivered` (push service accepted) or `token-unregistered` (dead token; handle dropped — see push/wake:token_unregistered).
@@ -43,6 +40,9 @@ export interface PushWakeResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/push/wake/0.1" as const;
 
@@ -194,6 +194,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -207,5 +208,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/push/wake/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/push/wake/0.2/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * A trigger (the device's mediator or its VTA) asks the push gateway to deliver a contentless wake to a handle. Carries ONLY the push binding's contentless hint fields — never Trust Task content. The gateway authorizes against the handle's allowlist, then fires the doorbell. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
@@ -29,12 +32,6 @@ export interface PushWakePayload {
   urgency?: "interactive" | "background";
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PushWakeResponsePayload {
   /**
    * Outcome of the wake: `delivered` (push service accepted) or `tokenUnregistered` (dead token; handle dropped — see push/wake:token_unregistered).
@@ -43,6 +40,9 @@ export interface PushWakeResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/push/wake/0.2" as const;
 
@@ -194,6 +194,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -207,5 +208,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/registry/_shared/0.1/registry.ts

@@ -9,3 +9,9 @@
 export interface SharedDefinitionsForTheRegistrySpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { QueryContext, RecordType, TrustRecord } from "../../../_shared/components.js";

package/src/registry/authorization/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/registry/authorization/0.1/payload.schema.json
  */
 
+import type { Ext, QueryContext } from "../../../_shared/components.js";
+
+
 /**
  * TRQP v2.0 authorization query: ask a trust registry whether an entity is authorized by an authority for a given action+resource. Field names are verbatim from the TRQP authorization request/response schemas so the same payload serves the plain HTTP TRQP binding and the Trust Task binding.
  */
@@ -26,26 +29,6 @@ export interface RegistryAuthorizationPayload {
   context?: QueryContext;
   ext?: Ext;
 }
-/**
- * Optional TRQP query context. `time` requests evaluation as of a given instant; `locator` is an authority-defined hint for locating records.
- */
-export interface QueryContext {
-  /**
-   * Evaluate the query as of this RFC3339 (Z offset) instant. Blank/absent uses current server time.
-   */
-  time?: string;
-  /**
-   * Optional hint for systems that need extra information to locate the records in question (authorization queries).
-   */
-  locator?: string;
-  [k: string]: string | undefined;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryAuthorizationResponsePayload {
   entity_id: string;
   authority_id: string;
@@ -71,6 +54,9 @@ export interface RegistryAuthorizationResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, QueryContext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/authorization/0.1" as const;
 
@@ -172,6 +158,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "message": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Additional human-readable detail about the authorization response."
         },
         "context": {
@@ -261,6 +248,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "message": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Additional human-readable detail about the authorization response."
         },
         "context": {
@@ -314,6 +302,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -327,5 +316,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/registry/did/rotate/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/registry/did/rotate/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * An administrator asks a trust registry to rotate the keys of the registry's own agent-managed did:webvh in place, preserving the DID while refreshing its key material. Field names are snake_case, frozen from the pre-existing deployed wire form this specification documents (matching the registry/* family convention).
  */
@@ -17,12 +20,6 @@ export interface RegistryDIDRotatePayload {
   label?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryDIDRotateResponsePayload {
   /**
    * The DID whose keys were rotated.
@@ -39,6 +36,9 @@ export interface RegistryDIDRotateResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/did/rotate/0.1" as const;
 
@@ -75,6 +75,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "label": {
       "type": "string",
+      "maxLength": 256,
       "description": "Operator-facing audit label for the rotation."
     },
     "ext": {
@@ -180,6 +181,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -193,5 +195,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/registry/recognition/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/registry/recognition/0.1/payload.schema.json
  */
 
+import type { Ext, QueryContext } from "../../../_shared/components.js";
+
+
 /**
  * TRQP v2.0 recognition query: ask a trust registry whether an entity is recognised by an authority for a given action+resource. Field names are verbatim from the TRQP recognition request/response schemas so the same payload serves the plain HTTP TRQP binding and the Trust Task binding.
  */
@@ -26,26 +29,6 @@ export interface RegistryRecognitionPayload {
   context?: QueryContext;
   ext?: Ext;
 }
-/**
- * Optional TRQP query context. `time` requests evaluation as of a given instant; `locator` is an authority-defined hint for locating records.
- */
-export interface QueryContext {
-  /**
-   * Evaluate the query as of this RFC3339 (Z offset) instant. Blank/absent uses current server time.
-   */
-  time?: string;
-  /**
-   * Optional hint for systems that need extra information to locate the records in question (authorization queries).
-   */
-  locator?: string;
-  [k: string]: string | undefined;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryRecognitionResponsePayload {
   entity_id: string;
   authority_id: string;
@@ -71,6 +54,9 @@ export interface RegistryRecognitionResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, QueryContext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/recognition/0.1" as const;
 
@@ -172,6 +158,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "message": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Additional human-readable detail about the recognition response."
         },
         "context": {
@@ -261,6 +248,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "message": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Additional human-readable detail about the recognition response."
         },
         "context": {
@@ -314,6 +302,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -327,5 +316,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/registry/record/create/0.1/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/registry/record/create/0.1/payload.schema.json
  */
 
-/**
- * Whether the record asserts an authorization or a recognition relationship.
- */
-export type RecordType = "authorization" | "recognition";
+import type { Ext, RecordType, TrustRecord } from "../../../../_shared/components.js";
+
 
 /**
  * An administrator asks a trust registry to create a new trust record (a recognition or authorization assertion). Idempotent per record key (entity+authority+action+resource); creating an existing key is an error.
@@ -15,33 +13,6 @@ export interface RegistryRecordCreatePayload {
   record: TrustRecord;
   ext?: Ext;
 }
-export interface TrustRecord {
-  entity_id: string;
-  authority_id: string;
-  action: string;
-  resource: string;
-  /**
-   * Present on recognition records: whether the action+resource is recognised.
-   */
-  recognized?: boolean;
-  /**
-   * Present on authorization records: whether the action+resource authorization is confirmed.
-   */
-  authorized?: boolean;
-  /**
-   * Opaque governance context attached to the record.
-   */
-  context?: {
-    [k: string]: unknown | undefined;
-  };
-  record_type: RecordType;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryRecordCreateResponsePayload {
   /**
    * Whether the record was created.
@@ -54,6 +25,9 @@ export interface RegistryRecordCreateResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, RecordType, TrustRecord };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/record/create/0.1" as const;
 
@@ -282,6 +256,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -295,5 +270,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/registry/record/delete/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/registry/record/delete/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * An administrator asks a trust registry to delete the trust record identified by the four TRQP identifiers.
  */
@@ -13,12 +16,6 @@ export interface RegistryRecordDeletePayload {
   resource: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryRecordDeleteResponsePayload {
   /**
    * Whether the record was deleted.
@@ -31,6 +28,9 @@ export interface RegistryRecordDeleteResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/record/delete/0.1" as const;
 
@@ -98,6 +98,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "message": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Optional human-readable detail."
         },
         "ext": {
@@ -138,6 +139,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "message": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Optional human-readable detail."
         },
         "ext": {
@@ -169,6 +171,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -182,5 +185,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;