@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/sync/event/0.2/payload.ts

@@ -3,214 +3,19 @@
  * Source: specs/sync/event/0.2/payload.schema.json
  */
 
-export type SyncEvent = VaultUpsertedEvent | VaultDeletedEvent | AclChangedEvent | PolicyChangedEvent;
-/**
- * A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.
- */
-export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
-/**
- * Discriminator for the kind of secret this entry holds. The secret material itself is NEVER returned in metadata views; the kind is exposed so consumers can render an appropriate UI affordance and so policy decisions can route by kind.
- */
-export type SecretKind =
-  | "password"
-  | "passkey"
-  | "oauthTokens"
-  | "didSelfIssued"
-  | "didcommPeer"
-  | "bearerToken"
-  | "sshKey"
-  | "custom";
+import type { AclChangedEvent_SyncV0_2 as AclChangedEvent, AndroidApp_VaultV0_2 as AndroidApp, AttachmentRef_VaultV0_1 as AttachmentRef, Did_VaultV0_2 as Did, Ext, IosApp_VaultV0_2 as IosApp, PolicyChangedEvent_SyncV0_2 as PolicyChangedEvent, SecretKind_VaultV0_2 as SecretKind, SiteTarget_VaultV0_2 as SiteTarget, SyncEvent_SyncV0_2 as SyncEvent, VaultDeletedEvent_SyncV0_2 as VaultDeletedEvent, VaultEntry_VaultV0_2 as VaultEntry, VaultUpsertedEvent_SyncV0_2 as VaultUpsertedEvent, WebOrigin_VaultV0_2 as WebOrigin } from "../../../_shared/components.js";
+
 
 /**
  * One-way push notification from the maintainer to a subscribing consumer. Carries a single SyncEvent (vault.upserted, vault.deleted, acl.changed, policy.changed). The consumer updates its cache and does NOT respond — there is no #response form. For offline catch-up the consumer uses vault/sync/0.1 to pull missed events.
  */
 export interface SyncEventPayload {
   event: SyncEvent;
-  ext?: Ext1;
-}
-export interface VaultUpsertedEvent {
-  kind: "vaultUpserted";
-  seq: number;
-  occurredAt: string;
-  entry: VaultEntry;
-}
-export interface VaultEntry {
-  /**
-   * Opaque vault-maintainer-assigned identifier for the entry. ULID/UUID/base32 are common; the wire spec only requires non-empty string equality.
-   */
-  id: string;
-  /**
-   * Identifier of the trust context (persona) the entry belongs to. Opaque string interpreted by the vault maintainer; corresponds to a single ContextRecord on the VTA side.
-   */
-  contextId: string;
-  /**
-   * One or more binding targets — web origins, mobile app identifiers, and/or DIDs — that this credential applies to. A request from any matching target uses this entry. A typical entry for a service that exists as both a website and mobile apps will list a web origin, an iOS bundle id, and an Android package id; passkeys for that service typically list only the origin (because iOS Associated Domains and Android Asset Links bind apps to the domain at the OS level).
-   *
-   * @minItems 1
-   */
-  targets: [SiteTarget, ...SiteTarget[]];
-  /**
-   * Human-readable display name (e.g. "Work GitHub", "Personal bank — checking"). Maintainers MAY enforce a maximum length; the wire spec does not.
-   */
-  label: string;
-  secretKind: SecretKind;
-  /**
-   * User-defined tags for organisation and filtering (e.g. ["family", "finance"]). Maintainers MAY enforce a maximum count; the wire spec does not.
-   */
-  tags?: string[];
-  /**
-   * Non-sensitive notes the user attached to the entry. Visible in metadata view (suitable for support contact, account number, expiry policy memos). SENSITIVE notes belong in the secret payload as a `secureNotes` field — those are only released by vault/release/0.1.
-   */
-  notes?: string;
-  /**
-   * Optional URI of an icon to display in the consumer UI. Maintainers MAY fetch and cache; consumers SHOULD treat as untrusted content and fetch via a sandboxed pipeline.
-   */
-  favicon?: string;
-  /**
-   * Opaque maintainer-defined selector strings fed to the policy engine when this entry is requested (e.g. "recent_uv_required", "network_class=corp", "step_up_push"). Consumers MUST treat selectors as opaque; they exist for policy authoring on the maintainer side.
-   */
-  selectors?: string[];
-  /**
-   * Names of additional fields the user has attached (e.g. ["security-question-1", "account-number"]). The VALUES live in the secret payload and are only delivered by vault/release/0.1. Exposing names in metadata lets the consumer render the right form layout before requesting release.
-   */
-  customFieldNames?: string[];
-  /**
-   * References to encrypted blobs associated with the entry (recovery codes, PEM files, screenshots of authenticator setup). The blobs themselves are fetched via a separate mechanism the maintainer documents; metadata view exposes only the descriptor.
-   */
-  attachments?: AttachmentRef[];
-  /**
-   * Optional time after which the credential is no longer expected to be valid (e.g. an OAuth refresh token's known expiry, a time-limited API token, an enterprise password rotation policy). Maintainers MAY surface this in the consumer UI as a warning.
-   */
-  expiresAt?: string;
-  /**
-   * Set by the maintainer (via HIBP integration or equivalent) when the password material associated with this entry is known to appear in a public breach. Consumers SHOULD surface this prominently. Cleared when the user rotates the password and the new password is not in any known breach.
-   */
-  breachedAt?: string;
-  /**
-   * Set whenever the password component of the secret payload is rotated. Maintainers MUST update this on every secret-material change for entries of kind `password` (or any kind that carries a password component). Used by consumers to surface rotation-overdue warnings.
-   */
-  passwordChangedAt?: string;
-  createdAt: string;
-  /**
-   * VID of the consumer that originally created the entry.
-   */
-  createdBy?: string;
-  updatedAt: string;
-  /**
-   * VID of the consumer that last modified the entry.
-   */
-  updatedBy?: string;
-  /**
-   * Most recent time the entry was used (either released or proxy-login performed). Maintainers MAY return this with reduced precision (e.g. hour-floored) when releasing to a less-trusted consumer.
-   */
-  lastUsedAt?: string;
-  /**
-   * Monotonic version counter incremented on every mutation. Used by consumers for optimistic-concurrency checks on vault/upsert and as the seq baseline for vault/sync.
-   */
-  version: number;
-  /**
-   * Optional cached DID the entry will act AS for DID-shaped flows — mirrors the `did` field of the entry's secret payload when `secretKind` carries one (`didSelfIssued`, `didcommPeer`). Absent for kinds that have no DID concept (`password`, `passkey`, `oauthTokens`, `bearerToken`, `sshKey`, `custom`). MAINTAINER-DERIVED, NOT CONSUMER-SUPPLIED: the maintainer MUST recompute this from the canonical secret at every upsert / secret rotation; a producer-supplied value on `vault/upsert/0.1` MUST be ignored (no error, but no honour). Read-only on the wire, present in metadata views so consumers can drive RP-side flows (e.g. fetch `/auth/challenge` keyed on the principal DID before requesting a proxy-login) without releasing the secret.
-   */
-  principalDid?: string;
   ext?: Ext;
 }
-export interface WebOrigin {
-  kind: "webOrigin";
-  /**
-   * Web origin per RFC 6454 (scheme + host + optional port), e.g. "https://github.com". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.
-   */
-  origin: string;
-}
-export interface Did {
-  kind: "did";
-  /**
-   * DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.
-   */
-  did: string;
-}
-export interface IosApp {
-  kind: "iosApp";
-  /**
-   * iOS bundle identifier in reverse-DNS form (e.g. "com.github.stwalkerster.codehub"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).
-   */
-  bundleId: string;
-  /**
-   * Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.
-   */
-  teamId?: string;
-}
-export interface AndroidApp {
-  kind: "androidApp";
-  /**
-   * Android package name in reverse-DNS form (e.g. "com.github.android").
-   */
-  packageName: string;
-  /**
-   * SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).
-   *
-   * @minItems 1
-   */
-  sha256CertFingerprints: [string, ...string[]];
-}
-export interface AttachmentRef {
-  /**
-   * Opaque maintainer-assigned id for this attachment; used to fetch the blob via a separate mechanism.
-   */
-  id: string;
-  /**
-   * User-supplied filename (e.g. "recovery-codes.txt").
-   */
-  name: string;
-  /**
-   * Size of the encrypted blob in bytes. Maintainers MAY enforce a maximum per attachment and per entry.
-   */
-  sizeBytes: number;
-  /**
-   * Hex-encoded SHA-256 of the encrypted blob bytes (post-encryption). Lets the consumer verify integrity after fetch.
-   */
-  sha256: string;
-  /**
-   * Optional MIME type hint for the consumer UI (e.g. "text/plain", "application/x-pem-file").
-   */
-  contentType?: string;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-export interface VaultDeletedEvent {
-  kind: "vaultDeleted";
-  seq: number;
-  occurredAt: string;
-  id: string;
-  contextId: string;
-  graceUntil: string;
-}
-export interface AclChangedEvent {
-  kind: "aclChanged";
-  seq: number;
-  occurredAt: string;
-  /**
-   * DID of the consumer whose ACL entry changed.
-   */
-  subject: string;
-  change: "granted" | "revoked" | "roleChanged" | "swapped" | "deviceDisabled" | "deviceWiped";
-}
-export interface PolicyChangedEvent {
-  kind: "policyChanged";
-  seq: number;
-  occurredAt: string;
-  policyId: string;
-  change: "created" | "updated" | "deleted";
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AclChangedEvent, AndroidApp, AttachmentRef, Did, Ext, IosApp, PolicyChangedEvent, SecretKind, SiteTarget, SyncEvent, VaultDeletedEvent, VaultEntry, VaultUpsertedEvent, WebOrigin };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/sync/event/0.2" as const;
@@ -448,7 +253,8 @@ export const PAYLOAD_SCHEMA = {
         "label": {
           "type": "string",
           "minLength": 1,
-          "description": "Human-readable display name (e.g. \"Work GitHub\", \"Personal bank — checking\"). Maintainers MAY enforce a maximum length; the wire spec does not."
+          "maxLength": 256,
+          "description": "Human-readable display name (e.g. \"Work GitHub\", \"Personal bank — checking\"). Bounded on the wire at 256 characters; a maintainer MAY enforce a shorter limit."
         },
         "secretKind": {
           "$ref": "#/$defs/SecretKind",
@@ -720,5 +526,6 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/task-consent/_shared/0.1/task-consent.ts

@@ -9,3 +9,9 @@
 export interface TaskConsentSharedDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { Decision, Effect_TaskConsentV0_1 as Effect, Exposure, StatePin } from "../../../_shared/components.js";

package/src/task-consent/decision/0.1/payload.ts

@@ -3,18 +3,8 @@
  * Source: specs/task-consent/decision/0.1/payload.schema.json
  */
 
-/**
- * Echoes the digest of the task being authorized, in the encoding `task-consent/request` carried it. The executor re-derives it from the payload it is about to execute and refuses on mismatch — this is what makes the approved payload the executed payload, cryptographically rather than by convention.
- */
-export type DigestMultibase = string;
-/**
- * The approver's answer. `deny` aborts the pending request; a subsequent submit of the same task starts a fresh one.
- */
-export type Decision = "approve" | "deny";
-/**
- * The digest this decision concerned, in the encoding `task-consent/request` carried it.
- */
-export type DigestMultibase1 = string;
+import type { Decision, DigestMultibase, Ext } from "../../../_shared/components.js";
+
 
 /**
  * An enrolled approver authorizes (or refuses) one pending privileged task, bound to the exact payload it was shown. The proof on this document — not the transport session that carried it — is the authorization.
@@ -24,6 +14,9 @@ export interface TaskConsentDecisionPayload {
    * Echoes the task-consent/request this decision answers, binding it to that one pending request. An executor MUST consume the challenge at execution rather than on receipt of this decision: a decision authorizes exactly one execution, and consuming it earlier lets an executor's own retry legitimately replay it.
    */
   challenge: string;
+  /**
+   * Echoes the digest of the task being authorized, in the encoding `task-consent/request` carried it. The executor re-derives it from the payload it is about to execute and refuses on mismatch — this is what makes the approved payload the executed payload, cryptographically rather than by convention.
+   */
   payloadDigest: DigestMultibase;
   decision: Decision;
   /**
@@ -32,12 +25,6 @@ export interface TaskConsentDecisionPayload {
   reason?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Acknowledgement of the recorded decision, and whether the approval threshold is now met.
  */
@@ -46,7 +33,10 @@ export interface TaskConsentDecisionResponsePayload {
    * `granted` = the threshold is met and the requester's re-submit will now execute. `pending` = the approval was recorded but more are needed. `denied` = the request was aborted.
    */
   status: "granted" | "pending" | "denied";
-  payloadDigest: DigestMultibase1;
+  /**
+   * The digest this decision concerned, in the encoding `task-consent/request` carried it.
+   */
+  payloadDigest: DigestMultibase;
   /**
    * Distinct approvals recorded so far.
    */
@@ -58,6 +48,9 @@ export interface TaskConsentDecisionResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Decision, DigestMultibase, Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/task-consent/decision/0.1" as const;
 
@@ -106,6 +99,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "reason": {
       "type": "string",
+      "maxLength": 500,
       "description": "OPTIONAL human-facing note, most useful on a `deny`."
     },
     "ext": {
@@ -271,6 +265,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -284,5 +279,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/task-consent/granted/0.1/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/task-consent/granted/0.1/payload.schema.json
  */
 
-/**
- * The salted wire digest of the approved task — the same value the matching task-consent/request carried and the decision echoed. The requester already holds it; it is repeated here only so the requester can correlate the notice to the pending task it should now re-submit. It confers nothing: the executor's single-use grant lookup at re-submit is the authorization.
- */
-export type DigestMultibase = string;
+import type { DigestMultibase, Ext } from "../../../_shared/components.js";
+
 
 /**
  * Fire-and-forget notice from the executor to the requester that its pending task has reached the approval threshold and a single-use grant is waiting, so the requester re-submits at once instead of polling. Non-load-bearing by design: the grant check at re-submit is the real gate, so a lost or spurious notice costs at most one poll cycle.
@@ -16,6 +14,9 @@ export interface TaskConsentGrantedPayload {
    * Always `granted`. A denial sends no notice — the requester's re-submit discovers it, and a notice that could carry a denial would tempt a consumer into treating this advisory channel as the authoritative outcome, which it is not.
    */
   status: "granted";
+  /**
+   * The salted wire digest of the approved task — the same value the matching task-consent/request carried and the decision echoed. The requester already holds it; it is repeated here only so the requester can correlate the notice to the pending task it should now re-submit. It confers nothing: the executor's single-use grant lookup at re-submit is the authorization.
+   */
   payloadDigest: DigestMultibase;
   /**
    * Type URI of the approved task, for correlation and display at the requester. Advisory on the same terms as the digest — the executor re-derives everything it enforces from the re-submitted payload itself.
@@ -23,12 +24,9 @@ export interface TaskConsentGrantedPayload {
   taskType: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DigestMultibase, Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/task-consent/granted/0.1" as const;
@@ -113,5 +111,6 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/task-consent/request/0.1/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/task-consent/request/0.1/payload.schema.json
  */
 
-/**
- * The binding between what the approver sees and what executes. Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the payload, the task type, and the `challenge` as salt. The decision echoes it; the executor re-derives it from the payload it is about to run and refuses on mismatch. Salted because an unsalted digest over a low-entropy payload is a confirmation oracle for anyone who observes it in transit.
- */
-export type DigestMultibase = string;
+import type { DigestMultibase, Effect_TaskConsentV0_1 as Effect, Exposure, Ext, StatePin } from "../../../_shared/components.js";
+
 
 /**
  * The executor asks an enrolled approver device to authorize one pending privileged task, presenting the effects it computed by dry-running the real handler against its own prior state. The executor signs this document; the approver renders only what it verifies under that signature.
@@ -20,6 +18,9 @@ export interface TaskConsentRequestPayload {
    * Type URI of the task awaiting approval. It is bound into `payloadDigest`: without that binding, two tasks whose payloads canonicalize identically would share a digest, and an approval for a benign task would authorize a destructive one.
    */
   taskType: string;
+  /**
+   * The binding between what the approver sees and what executes. Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the payload, the task type, and the `challenge` as salt. The decision echoes it; the executor re-derives it from the payload it is about to run and refuses on mismatch. Salted because an unsalted digest over a low-entropy payload is a confirmation oracle for anyone who observes it in transit.
+   */
   payloadDigest: DigestMultibase;
   /**
    * Authoritative SPEC §7.3 item 13 side-effect class of the pending task, derived by the executor from the compiled handler it is about to invoke. NEVER taken from the registry: a registry that decided this would be a consent kill-switch, downgradeable by publishing a new version with a weaker class.
@@ -73,73 +74,6 @@ export interface TaskConsentRequestPayload {
   expiresAt: string;
   ext?: Ext;
 }
-/**
- * The authoritative SPEC §7.3 item 14 exposure class of the pending task, derived by the executor from the compiled handler it is about to invoke — never from the registry's declared value.
- */
-export interface Exposure {
-  /**
-   * Sensitivity of data the task returns to its caller.
-   */
-  discloses: "none" | "metadata" | "secret";
-  /**
-   * Whether execution exercises the subject's own authority to produce an attributable effect in the subject's name.
-   */
-  actsAsSubject: boolean;
-}
-/**
- * One consequence of executing the pending task, authored by the executor that is about to run it. An effect is produced by dry-running the real handler against the executor's own prior state — never by the requester, and never by re-implementing the handler's semantics elsewhere. A consent surface renders ONLY effects it received under the executor's signature.
- */
-export interface Effect {
-  /**
-   * Machine discriminator for rich rendering. Well-known kinds are registered in the prose (`documentChange`, `keyRotation`, `preRotationRefresh`, `resourceDelete`, `disclosure`), but the set is OPEN: handlers evolve faster than this schema, and an executor MUST be able to describe a consequence this version does not name. A surface that does not recognise a `kind` MUST still render `summary`.
-   */
-  kind: string;
-  /**
-   * REQUIRED human-facing sentence describing this consequence, authored by the executor. This is the ONLY member a consent surface is guaranteed to be able to render, and it is what makes an unrecognised `kind` degrade to something truthful rather than something invisible. A surface MUST render it verbatim; it MUST NOT substitute its own prose.
-   */
-  summary: string;
-  /**
-   * OPTIONAL RFC 6901 JSON Pointer locating the change within the subject resource (e.g. `/service/0`).
-   */
-  path?: string;
-  /**
-   * OPTIONAL prior value at `path`, from the executor's authoritative state. ABSENT means there was no prior value (a creation); an explicit `null` is treated identically, so an executor MUST NOT rely on the two being distinguishable. Structured members are for rich rendering only — `summary` is what a surface is obliged to show, and it is where an executor states a distinction this shape cannot carry.
-   */
-  before?: {
-    [k: string]: unknown | undefined;
-  };
-  /**
-   * OPTIONAL resulting value at `path` once the task executes. ABSENT means the value is removed (a deletion), under the same rule as `before`.
-   */
-  after?: {
-    [k: string]: unknown | undefined;
-  };
-  /**
-   * OPTIONAL kind-specific structured extras (e.g. `{ "commitments": 2 }` for `preRotationRefresh`).
-   */
-  detail?: {
-    [k: string]: unknown | undefined;
-  };
-}
-/**
- * The prior state the effects were computed against. A human in the loop makes the approval window minutes wide, so the state can move underneath a pending approval. The executor asserts this pin still holds at execution and refuses otherwise — without it, a lost update silently executes against state the approver never saw.
- */
-export interface StatePin {
-  /**
-   * Identifier of the pinned resource (usually the subject DID).
-   */
-  resource: string;
-  /**
-   * Opaque version identifier of the prior state (e.g. a did:webvh `versionId`). Compared for equality at execution; the executor MUST NOT attempt to order or interpret it.
-   */
-  version: string;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Synchronous acknowledgement from the approver device that a prompt was raised. The decision itself arrives separately as a task-consent/decision — a human is in the loop, so it cannot be a synchronous reply.
  */
@@ -155,6 +89,9 @@ export interface TaskConsentRequestResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DigestMultibase, Effect, Exposure, Ext, StatePin };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/task-consent/request/0.1" as const;
 
@@ -235,7 +172,8 @@ export const PAYLOAD_SCHEMA = {
       "description": "Static, human-facing second-order effects declared in the task's specification (SPEC §7.3 item 13). A fallback for handlers with no dry-run — per-task, not per-request, so it can say 'any document change rotates the update keys' but not which keys. Prefer `effects`.",
       "items": {
         "type": "string",
-        "minLength": 1
+        "minLength": 1,
+        "maxLength": 500
       }
     },
     "subject": {
@@ -306,6 +244,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "reason": {
           "type": "string",
+          "maxLength": 1024,
           "description": "REQUIRED when status is `refused`."
         },
         "ext": {
@@ -363,6 +302,7 @@ export const PAYLOAD_SCHEMA = {
         "summary": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 500,
           "description": "REQUIRED human-facing sentence describing this consequence, authored by the executor. This is the ONLY member a consent surface is guaranteed to be able to render, and it is what makes an unrecognised `kind` degrade to something truthful rather than something invisible. A surface MUST render it verbatim; it MUST NOT substitute its own prose."
         },
         "path": {
@@ -445,6 +385,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "reason": {
           "type": "string",
+          "maxLength": 1024,
           "description": "REQUIRED when status is `refused`."
         },
         "ext": {
@@ -502,6 +443,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "summary": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 500,
           "description": "REQUIRED human-facing sentence describing this consequence, authored by the executor. This is the ONLY member a consent surface is guaranteed to be able to render, and it is what makes an unrecognised `kind` degrade to something truthful rather than something invisible. A surface MUST render it verbatim; it MUST NOT substitute its own prose."
         },
         "path": {
@@ -570,6 +512,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -583,5 +526,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/trust-ceremony-receipt/0.1/payload.ts

@@ -3,14 +3,8 @@
  * Source: specs/trust-ceremony-receipt/0.1/payload.schema.json
  */
 
-/**
- * Multibase-multihash over the RFC 8785 (JCS) canonicalization of that definition. MUST equal the `ceremony.definitionDigest` every enumerated step carried. It is what stops the completion rule being changed after the fact by whoever controls the definition URI.
- */
-export type DigestMultibase = string;
-/**
- * Salted digest of the step document, computed as the specification's Conformance section defines. A verifier holding the document recomputes it; a verifier that does not hold the document still learns that the recorder committed to a specific one.
- */
-export type DigestMultibase1 = string;
+import type { DigestMultibase, Ext } from "../../_shared/components.js";
+
 
 /**
  * Evidence that one enactment of a Trust Ceremony completed (SPEC §4.11, §6.7).
@@ -32,6 +26,9 @@ export interface TrustCeremonyReceiptPayload {
    * The ceremony definition the enactment ran under (SPEC §6.7). REQUIRED here, unlike on the envelope: a receipt asserts that a flow COMPLETED, and completeness is meaningless without the rule that defines it.
    */
   definition: string;
+  /**
+   * Multibase-multihash over the RFC 8785 (JCS) canonicalization of that definition. MUST equal the `ceremony.definitionDigest` every enumerated step carried. It is what stops the completion rule being changed after the fact by whoever controls the definition URI.
+   */
   definitionDigest: DigestMultibase;
   /**
    * Whether the recorder considers the enactment complete.
@@ -74,7 +71,10 @@ export interface TrustCeremonyReceiptPayload {
        * The step document's `id` (SPEC §4.3) — globally unique and never reused, so it names one instance where the step name names a position in the flow, and so a verifier can locate the document the digest is over.
        */
       id: string;
-      digestMultibase: DigestMultibase1;
+      /**
+       * Salted digest of the step document, computed as the specification's Conformance section defines. A verifier holding the document recomputes it; a verifier that does not hold the document still learns that the recorder committed to a specific one.
+       */
+      digestMultibase: DigestMultibase;
       /**
        * Whether the step document carried `ceremony.terminal`. At least one enumerated step MUST carry it for the enactment to be complete.
        */
@@ -101,7 +101,10 @@ export interface TrustCeremonyReceiptPayload {
        * The step document's `id` (SPEC §4.3) — globally unique and never reused, so it names one instance where the step name names a position in the flow, and so a verifier can locate the document the digest is over.
        */
       id: string;
-      digestMultibase: DigestMultibase1;
+      /**
+       * Salted digest of the step document, computed as the specification's Conformance section defines. A verifier holding the document recomputes it; a verifier that does not hold the document still learns that the recorder committed to a specific one.
+       */
+      digestMultibase: DigestMultibase;
       /**
        * Whether the step document carried `ceremony.terminal`. At least one enumerated step MUST carry it for the enactment to be complete.
        */
@@ -110,12 +113,9 @@ export interface TrustCeremonyReceiptPayload {
   ];
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DigestMultibase, Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/trust-ceremony-receipt/0.1" as const;
@@ -267,5 +267,6 @@ export const SPEC = {
   isBearer: true,
   isProofRequired: true,
   isRecipientRequired: false,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/trust-task-control/0.1/payload.ts

@@ -153,6 +153,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "reason": {
       "type": "string",
+      "maxLength": 1024,
       "description": "Human-readable explanation of why the operation was requested. Non-normative; intended for operator UI and audit records. A consumer MUST NOT condition its handling of the operation on this value."
     },
     "ext": {
@@ -222,6 +223,7 @@ export const PAYLOAD_SCHEMA = {
               "description": {
                 "type": "string",
                 "minLength": 1,
+                "maxLength": 1024,
                 "description": "Human-readable statement of the effect that occurred."
               },
               "ref": {
@@ -310,6 +312,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
               "description": {
                 "type": "string",
                 "minLength": 1,
+                "maxLength": 1024,
                 "description": "Human-readable statement of the effect that occurred."
               },
               "ref": {
@@ -343,6 +346,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -356,5 +360,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/trust-task-discovery/0.1/payload.ts

@@ -267,6 +267,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -280,5 +281,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;