@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/registry/record/list/0.1/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/registry/record/list/0.1/payload.schema.json
  */
 
-/**
- * Whether the record asserts an authorization or a recognition relationship.
- */
-export type RecordType = "authorization" | "recognition";
+import type { Ext, RecordType, TrustRecord } from "../../../../_shared/components.js";
+
 
 /**
  * An administrator lists all trust records held by the registry.
@@ -14,12 +12,6 @@ export type RecordType = "authorization" | "recognition";
 export interface RegistryRecordListPayload {
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryRecordListResponsePayload {
   /**
    * All trust records held by the registry.
@@ -27,27 +19,9 @@ export interface RegistryRecordListResponsePayload {
   records: TrustRecord[];
   ext?: Ext;
 }
-export interface TrustRecord {
-  entity_id: string;
-  authority_id: string;
-  action: string;
-  resource: string;
-  /**
-   * Present on recognition records: whether the action+resource is recognised.
-   */
-  recognized?: boolean;
-  /**
-   * Present on authorization records: whether the action+resource authorization is confirmed.
-   */
-  authorized?: boolean;
-  /**
-   * Opaque governance context attached to the record.
-   */
-  context?: {
-    [k: string]: unknown | undefined;
-  };
-  record_type: RecordType;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, RecordType, TrustRecord };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/record/list/0.1" as const;
@@ -269,6 +243,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -282,5 +257,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/registry/record/put/0.1/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/registry/record/put/0.1/payload.schema.json
  */
 
-/**
- * Whether the record asserts an authorization or a recognition relationship.
- */
-export type RecordType = "authorization" | "recognition";
+import type { Ext, RecordType, TrustRecord } from "../../../../_shared/components.js";
+
 
 /**
  * An administrator asks a trust registry to create or replace the trust record at its four-part key (entity+authority+action+resource). Create-or-update in one task, following the vault/upsert precedent; the optional `expectedExisting` assertion recovers the strict create-only / update-only semantics of the superseded registry/record/create and registry/record/update tasks.
@@ -19,33 +17,6 @@ export interface RegistryRecordPutPayload {
   expectedExisting?: boolean;
   ext?: Ext;
 }
-export interface TrustRecord {
-  entity_id: string;
-  authority_id: string;
-  action: string;
-  resource: string;
-  /**
-   * Present on recognition records: whether the action+resource is recognised.
-   */
-  recognized?: boolean;
-  /**
-   * Present on authorization records: whether the action+resource authorization is confirmed.
-   */
-  authorized?: boolean;
-  /**
-   * Opaque governance context attached to the record.
-   */
-  context?: {
-    [k: string]: unknown | undefined;
-  };
-  record_type: RecordType;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryRecordPutResponsePayload {
   /**
    * Whether the record was stored.
@@ -62,6 +33,9 @@ export interface RegistryRecordPutResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, RecordType, TrustRecord };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/record/put/0.1" as const;
 
@@ -126,6 +100,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "message": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Optional human-readable detail."
         },
         "ext": {
@@ -222,6 +197,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "message": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Optional human-readable detail."
         },
         "ext": {
@@ -304,6 +280,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -317,5 +294,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/registry/record/query/0.1/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/registry/record/query/0.1/payload.schema.json
  */
 
-/**
- * Whether the record asserts an authorization or a recognition relationship.
- */
-export type RecordType = "authorization" | "recognition";
+import type { Ext, RecordType, TrustRecord } from "../../../../_shared/components.js";
+
 
 /**
  * An administrator queries a trust registry's stored records by an optional four-part key. All four parts supplied: an exact fetch of one record (notFound on a miss). Fewer parts: a filtered, cursor-paginated enumeration — fixing the pagination gap the superseded registry/record/list conceded. Key field names are verbatim TRQP (snake_case), matching the registry/* family.
@@ -38,12 +36,6 @@ export interface RegistryRecordQueryPayload {
   limit?: number;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryRecordQueryResponsePayload {
   /**
    * The matching trust records. Exactly one entry on a fully keyed fetch; zero or more per page on an enumeration.
@@ -55,27 +47,9 @@ export interface RegistryRecordQueryResponsePayload {
   nextCursor?: string | null;
   ext?: Ext;
 }
-export interface TrustRecord {
-  entity_id: string;
-  authority_id: string;
-  action: string;
-  resource: string;
-  /**
-   * Present on recognition records: whether the action+resource is recognised.
-   */
-  recognized?: boolean;
-  /**
-   * Present on authorization records: whether the action+resource authorization is confirmed.
-   */
-  authorized?: boolean;
-  /**
-   * Opaque governance context attached to the record.
-   */
-  context?: {
-    [k: string]: unknown | undefined;
-  };
-  record_type: RecordType;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, RecordType, TrustRecord };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/record/query/0.1" as const;
@@ -337,6 +311,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -350,5 +325,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/registry/record/read/0.1/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/registry/record/read/0.1/payload.schema.json
  */
 
-/**
- * Whether the record asserts an authorization or a recognition relationship.
- */
-export type RecordType = "authorization" | "recognition";
+import type { Ext, RecordType } from "../../../../_shared/components.js";
+
 
 /**
  * An administrator reads the full trust record identified by the four TRQP identifiers (both the recognized and authorized facets, unlike the filtered TRQP query responses).
@@ -18,12 +16,6 @@ export interface RegistryRecordReadPayload {
   resource: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryRecordReadResponsePayloadATrustRecord {
   entity_id: string;
   authority_id: string;
@@ -37,6 +29,9 @@ export interface RegistryRecordReadResponsePayloadATrustRecord {
   record_type: RecordType;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, RecordType };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/record/read/0.1" as const;
 
@@ -229,6 +224,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -242,5 +238,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/registry/record/update/0.1/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/registry/record/update/0.1/payload.schema.json
  */
 
-/**
- * Whether the record asserts an authorization or a recognition relationship.
- */
-export type RecordType = "authorization" | "recognition";
+import type { Ext, RecordType, TrustRecord } from "../../../../_shared/components.js";
+
 
 /**
  * An administrator asks a trust registry to update an existing trust record. The record key (entity+authority+action+resource) must already exist.
@@ -15,33 +13,6 @@ export interface RegistryRecordUpdatePayload {
   record: TrustRecord;
   ext?: Ext;
 }
-export interface TrustRecord {
-  entity_id: string;
-  authority_id: string;
-  action: string;
-  resource: string;
-  /**
-   * Present on recognition records: whether the action+resource is recognised.
-   */
-  recognized?: boolean;
-  /**
-   * Present on authorization records: whether the action+resource authorization is confirmed.
-   */
-  authorized?: boolean;
-  /**
-   * Opaque governance context attached to the record.
-   */
-  context?: {
-    [k: string]: unknown | undefined;
-  };
-  record_type: RecordType;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryRecordUpdateResponsePayload {
   /**
    * Whether the record was updated.
@@ -54,6 +25,9 @@ export interface RegistryRecordUpdateResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, RecordType, TrustRecord };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/record/update/0.1" as const;
 
@@ -282,6 +256,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -295,5 +270,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/sync/_shared/0.1/sync-event.ts

@@ -9,3 +9,9 @@
 export interface SyncEventSharedDefinitionForServerPushedSyncNotifications {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { AclChangedEvent_SyncV0_1 as AclChangedEvent, PolicyChangedEvent_SyncV0_1 as PolicyChangedEvent, SyncEvent_SyncV0_1 as SyncEvent, VaultDeletedEvent_SyncV0_1 as VaultDeletedEvent, VaultUpsertedEvent_SyncV0_1 as VaultUpsertedEvent } from "../../../_shared/components.js";

package/src/sync/_shared/0.2/sync-event.ts

@@ -9,3 +9,9 @@
 export interface SyncEventSharedDefinitionForServerPushedSyncNotifications {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { AclChangedEvent_SyncV0_2 as AclChangedEvent, PolicyChangedEvent_SyncV0_2 as PolicyChangedEvent, SyncEvent_SyncV0_2 as SyncEvent, VaultDeletedEvent_SyncV0_2 as VaultDeletedEvent, VaultUpsertedEvent_SyncV0_2 as VaultUpsertedEvent } from "../../../_shared/components.js";

package/src/sync/event/0.1/payload.ts

@@ -3,230 +3,19 @@
  * Source: specs/sync/event/0.1/payload.schema.json
  */
 
-export type SyncEvent = VaultUpsertedEvent | VaultDeletedEvent | AclChangedEvent | PolicyChangedEvent;
-/**
- * A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.
- */
-export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
-/**
- * Discriminator for the kind of secret this entry holds. The secret material itself is NEVER returned in metadata views; the kind is exposed so consumers can render an appropriate UI affordance and so policy decisions can route by kind.
- */
-export type SecretKind =
-  | "password"
-  | "passkey"
-  | "oauth-tokens"
-  | "did-self-issued"
-  | "didcomm-peer"
-  | "bearer-token"
-  | "ssh-key"
-  | "custom";
+import type { AclChangedEvent_SyncV0_1 as AclChangedEvent, AndroidApp_VaultV0_1 as AndroidApp, AttachmentRef_VaultV0_1 as AttachmentRef, Did_VaultV0_1 as Did, Ext, IosApp_VaultV0_1 as IosApp, PolicyChangedEvent_SyncV0_1 as PolicyChangedEvent, SecretKind_VaultV0_1 as SecretKind, SiteTarget_VaultV0_1 as SiteTarget, SyncEvent_SyncV0_1 as SyncEvent, VaultDeletedEvent_SyncV0_1 as VaultDeletedEvent, VaultEntry_VaultV0_1 as VaultEntry, VaultUpsertedEvent_SyncV0_1 as VaultUpsertedEvent, WebOrigin_VaultV0_1 as WebOrigin } from "../../../_shared/components.js";
+
 
 /**
  * One-way push notification from the maintainer to a subscribing consumer. Carries a single SyncEvent (vault.upserted, vault.deleted, acl.changed, policy.changed). The consumer updates its cache and does NOT respond — there is no #response form. For offline catch-up the consumer uses vault/sync/0.1 to pull missed events.
  */
 export interface SyncEventPayload {
   event: SyncEvent;
-  ext?: Ext1;
-}
-export interface VaultUpsertedEvent {
-  kind: "vault.upserted";
-  seq: number;
-  occurredAt: string;
-  entry: VaultEntry;
-}
-export interface VaultEntry {
-  /**
-   * Opaque vault-maintainer-assigned identifier for the entry. ULID/UUID/base32 are common; the wire spec only requires non-empty string equality.
-   */
-  id: string;
-  /**
-   * Identifier of the trust context (persona) the entry belongs to. Opaque string interpreted by the vault maintainer; corresponds to a single ContextRecord on the VTA side.
-   */
-  contextId: string;
-  /**
-   * One or more binding targets — web origins, mobile app identifiers, and/or DIDs — that this credential applies to. A request from any matching target uses this entry. A typical entry for a service that exists as both a website and mobile apps will list a web origin, an iOS bundle id, and an Android package id; passkeys for that service typically list only the origin (because iOS Associated Domains and Android Asset Links bind apps to the domain at the OS level).
-   *
-   * @minItems 1
-   */
-  targets: [SiteTarget, ...SiteTarget[]];
-  /**
-   * Human-readable display name (e.g. "Work GitHub", "Personal bank — checking"). Maintainers MAY enforce a maximum length; the wire spec does not.
-   */
-  label: string;
-  secretKind: SecretKind;
-  /**
-   * User-defined tags for organisation and filtering (e.g. ["family", "finance"]). Maintainers MAY enforce a maximum count; the wire spec does not.
-   */
-  tags?: string[];
-  /**
-   * Non-sensitive notes the user attached to the entry. Visible in metadata view (suitable for support contact, account number, expiry policy memos). SENSITIVE notes belong in the secret payload as a `secureNotes` field — those are only released by vault/release/0.1.
-   */
-  notes?: string;
-  /**
-   * Optional URI of an icon to display in the consumer UI. Maintainers MAY fetch and cache; consumers SHOULD treat as untrusted content and fetch via a sandboxed pipeline.
-   */
-  favicon?: string;
-  /**
-   * Opaque maintainer-defined selector strings fed to the policy engine when this entry is requested (e.g. "recent_uv_required", "network_class=corp", "step_up_push"). Consumers MUST treat selectors as opaque; they exist for policy authoring on the maintainer side.
-   */
-  selectors?: string[];
-  /**
-   * Names of additional fields the user has attached (e.g. ["security-question-1", "account-number"]). The VALUES live in the secret payload and are only delivered by vault/release/0.1. Exposing names in metadata lets the consumer render the right form layout before requesting release.
-   */
-  customFieldNames?: string[];
-  /**
-   * References to encrypted blobs associated with the entry (recovery codes, PEM files, screenshots of authenticator setup). The blobs themselves are fetched via a separate mechanism the maintainer documents; metadata view exposes only the descriptor.
-   */
-  attachments?: AttachmentRef[];
-  /**
-   * Optional time after which the credential is no longer expected to be valid (e.g. an OAuth refresh token's known expiry, a time-limited API token, an enterprise password rotation policy). Maintainers MAY surface this in the consumer UI as a warning.
-   */
-  expiresAt?: string;
-  /**
-   * Set by the maintainer (via HIBP integration or equivalent) when the password material associated with this entry is known to appear in a public breach. Consumers SHOULD surface this prominently. Cleared when the user rotates the password and the new password is not in any known breach.
-   */
-  breachedAt?: string;
-  /**
-   * Set whenever the password component of the secret payload is rotated. Maintainers MUST update this on every secret-material change for entries of kind `password` (or any kind that carries a password component). Used by consumers to surface rotation-overdue warnings.
-   */
-  passwordChangedAt?: string;
-  createdAt: string;
-  /**
-   * VID of the consumer that originally created the entry.
-   */
-  createdBy?: string;
-  updatedAt: string;
-  /**
-   * VID of the consumer that last modified the entry.
-   */
-  updatedBy?: string;
-  /**
-   * Most recent time the entry was used (either released or proxy-login performed). Maintainers MAY return this with reduced precision (e.g. hour-floored) when releasing to a less-trusted consumer.
-   */
-  lastUsedAt?: string;
-  /**
-   * Monotonic version counter incremented on every mutation. Used by consumers for optimistic-concurrency checks on vault/upsert and as the seq baseline for vault/sync.
-   */
-  version: number;
-  /**
-   * Optional cached DID the entry will act AS for DID-shaped flows — mirrors the `did` field of the entry's secret payload when `secretKind` carries one (`did-self-issued`, `didcomm-peer`). Absent for kinds that have no DID concept (`password`, `passkey`, `oauth-tokens`, `bearer-token`, `ssh-key`, `custom`). MAINTAINER-DERIVED, NOT CONSUMER-SUPPLIED: the maintainer MUST recompute this from the canonical secret at every upsert / secret rotation; a producer-supplied value on `vault/upsert/0.1` MUST be ignored (no error, but no honour). Read-only on the wire, present in metadata views so consumers can drive RP-side flows (e.g. fetch `/auth/challenge` keyed on the principal DID before requesting a proxy-login) without releasing the secret.
-   */
-  principalDid?: string;
-  /**
-   * Archival-lifecycle state of this entry. Absent means `active`, so a maintainer that models no lifecycle omits it and every existing document stays valid. Deliberately carries no JSON Schema `default`: a declared default is materialised by generated bindings, which would make an absent `status` reappear as an explicit `"active"` on re-serialisation and break round-trip idempotence for every existing document. This member is what makes `vault/list`'s `status: "all"` selector usable: that view returns entries in every state by design, and without a state on the entry itself a consumer cannot tell which is which. An `archived` entry is hidden from ordinary listings but intact; a `deleted` entry is a tombstone inside its grace window, still restorable until `graceUntil` passes.
-   */
-  status?: "active" | "archived" | "deleted";
-  /**
-   * When the entry was archived. Present iff `status` is `archived`.
-   */
-  archivedAt?: string;
-  /**
-   * When the entry was soft-deleted. Present iff `status` is `deleted`. A soft delete is reversible: this records when the grace window opened, not when the entry ceased to exist.
-   */
-  deletedAt?: string;
-  /**
-   * Deadline after which a `deleted` entry is irreversibly purged. Present iff `status` is `deleted`. It is the one member a consumer showing a trash view actually needs — "deleted" without a deadline cannot be distinguished from "gone", and the difference is whether the holder can still get their credential back.
-   */
-  graceUntil?: string;
   ext?: Ext;
 }
-export interface WebOrigin {
-  kind: "web-origin";
-  /**
-   * Web origin per RFC 6454 (scheme + host + optional port), e.g. "https://github.com". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.
-   */
-  origin: string;
-}
-export interface Did {
-  kind: "did";
-  /**
-   * DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.
-   */
-  did: string;
-}
-export interface IosApp {
-  kind: "ios-app";
-  /**
-   * iOS bundle identifier in reverse-DNS form (e.g. "com.github.stwalkerster.codehub"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).
-   */
-  bundleId: string;
-  /**
-   * Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.
-   */
-  teamId?: string;
-}
-export interface AndroidApp {
-  kind: "android-app";
-  /**
-   * Android package name in reverse-DNS form (e.g. "com.github.android").
-   */
-  packageName: string;
-  /**
-   * SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).
-   *
-   * @minItems 1
-   */
-  sha256CertFingerprints: [string, ...string[]];
-}
-export interface AttachmentRef {
-  /**
-   * Opaque maintainer-assigned id for this attachment; used to fetch the blob via a separate mechanism.
-   */
-  id: string;
-  /**
-   * User-supplied filename (e.g. "recovery-codes.txt").
-   */
-  name: string;
-  /**
-   * Size of the encrypted blob in bytes. Maintainers MAY enforce a maximum per attachment and per entry.
-   */
-  sizeBytes: number;
-  /**
-   * Hex-encoded SHA-256 of the encrypted blob bytes (post-encryption). Lets the consumer verify integrity after fetch.
-   */
-  sha256: string;
-  /**
-   * Optional MIME type hint for the consumer UI (e.g. "text/plain", "application/x-pem-file").
-   */
-  contentType?: string;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-export interface VaultDeletedEvent {
-  kind: "vault.deleted";
-  seq: number;
-  occurredAt: string;
-  id: string;
-  contextId: string;
-  graceUntil: string;
-}
-export interface AclChangedEvent {
-  kind: "acl.changed";
-  seq: number;
-  occurredAt: string;
-  /**
-   * DID of the consumer whose ACL entry changed.
-   */
-  subject: string;
-  change: "granted" | "revoked" | "role_changed" | "swapped" | "device_disabled" | "device_wiped";
-}
-export interface PolicyChangedEvent {
-  kind: "policy.changed";
-  seq: number;
-  occurredAt: string;
-  policyId: string;
-  change: "created" | "updated" | "deleted";
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AclChangedEvent, AndroidApp, AttachmentRef, Did, Ext, IosApp, PolicyChangedEvent, SecretKind, SiteTarget, SyncEvent, VaultDeletedEvent, VaultEntry, VaultUpsertedEvent, WebOrigin };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/sync/event/0.1" as const;
@@ -464,7 +253,8 @@ export const PAYLOAD_SCHEMA = {
         "label": {
           "type": "string",
           "minLength": 1,
-          "description": "Human-readable display name (e.g. \"Work GitHub\", \"Personal bank — checking\"). Maintainers MAY enforce a maximum length; the wire spec does not."
+          "maxLength": 256,
+          "description": "Human-readable display name (e.g. \"Work GitHub\", \"Personal bank — checking\"). Bounded on the wire at 256 characters; a maintainer MAY enforce a shorter limit."
         },
         "secretKind": {
           "$ref": "#/$defs/SecretKind",
@@ -760,5 +550,6 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;