@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/vta/contexts/get/1.0/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vta/contexts/get/1.0/payload.schema.json
  */
 
+import type { ContextRecord, Ext } from "../../../../_shared/components.js";
+
+
 export interface VTAContextsGetPayload {
   /**
    * Context id. For a nested context this is the full path (`parent/leaf`).
@@ -10,50 +13,9 @@ export interface VTAContextsGetPayload {
   id: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-/**
- * A context as the VTA holds it.
- */
-export interface ContextRecord {
-  /**
-   * Context id. For a nested context this is the full path (`parent/leaf`), not the leaf alone — an ACL scope naming this context must use this value verbatim.
-   */
-  id: string;
-  /**
-   * Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name.
-   */
-  name: string;
-  /**
-   * DID this context acts as, when one has been assigned. Absent means the context has no identity of its own yet — not that it has been denied one.
-   */
-  did?: string;
-  /**
-   * Free-form description.
-   */
-  description?: string;
-  /**
-   * Id of the context this one nests under. Absent for a top-level context. Authority granted at a parent reaches its children, so this member is load-bearing for anyone reasoning about scope.
-   */
-  parent?: string;
-  /**
-   * Resolved path from the root context, as the VTA derives it from the parent chain. Consumers MUST treat this as derived state: it is recomputed by the maintainer and is not independently settable.
-   */
-  basePath: string;
-  /**
-   * RFC 3339.
-   */
-  createdAt: string;
-  /**
-   * RFC 3339.
-   */
-  updatedAt: string;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ContextRecord, Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/contexts/get/1.0" as const;
@@ -123,6 +85,7 @@ export const PAYLOAD_SCHEMA = {
         "name": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 256,
           "description": "Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name."
         },
         "did": {
@@ -131,6 +94,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "description": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Free-form description."
         },
         "parent": {
@@ -201,6 +165,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "name": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 256,
           "description": "Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name."
         },
         "did": {
@@ -209,6 +174,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "description": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Free-form description."
         },
         "parent": {
@@ -258,6 +224,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -271,5 +238,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/contexts/list/1.0/payload.ts

@@ -3,18 +3,15 @@
  * Source: specs/vta/contexts/list/1.0/payload.schema.json
  */
 
+import type { ContextRecord, Ext } from "../../../../_shared/components.js";
+
+
 /**
  * Request payload for vta/contexts/list. Takes no filters: the result is already narrowed to what the caller may reach.
  */
 export interface VTAContextsListPayload {
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Success response to vta/contexts/list. Type https://trusttasks.org/spec/vta/contexts/list/1.0#response.
  */
@@ -25,44 +22,9 @@ export interface VTAContextsListResponsePayload {
   contexts: ContextRecord[];
   ext?: Ext;
 }
-/**
- * A context as the VTA holds it.
- */
-export interface ContextRecord {
-  /**
-   * Context id. For a nested context this is the full path (`parent/leaf`), not the leaf alone — an ACL scope naming this context must use this value verbatim.
-   */
-  id: string;
-  /**
-   * Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name.
-   */
-  name: string;
-  /**
-   * DID this context acts as, when one has been assigned. Absent means the context has no identity of its own yet — not that it has been denied one.
-   */
-  did?: string;
-  /**
-   * Free-form description.
-   */
-  description?: string;
-  /**
-   * Id of the context this one nests under. Absent for a top-level context. Authority granted at a parent reaches its children, so this member is load-bearing for anyone reasoning about scope.
-   */
-  parent?: string;
-  /**
-   * Resolved path from the root context, as the VTA derives it from the parent chain. Consumers MUST treat this as derived state: it is recomputed by the maintainer and is not independently settable.
-   */
-  basePath: string;
-  /**
-   * RFC 3339.
-   */
-  createdAt: string;
-  /**
-   * RFC 3339.
-   */
-  updatedAt: string;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ContextRecord, Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/contexts/list/1.0" as const;
@@ -151,6 +113,7 @@ export const PAYLOAD_SCHEMA = {
         "name": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 256,
           "description": "Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name."
         },
         "did": {
@@ -159,6 +122,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "description": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Free-form description."
         },
         "parent": {
@@ -245,6 +209,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "name": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 256,
           "description": "Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name."
         },
         "did": {
@@ -253,6 +218,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "description": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Free-form description."
         },
         "parent": {
@@ -292,6 +258,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -305,5 +272,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/contexts/preview-delete/1.0/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vta/contexts/preview-delete/1.0/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * Request payload for vta/contexts/preview-delete: what deleting this context would destroy, computed without destroying it.
  */
@@ -13,12 +16,6 @@ export interface VTAContextsPreviewDeletePayload {
   id: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Success response to vta/contexts/preview-delete. Every array is what WOULD be affected; nothing has been. Type https://trusttasks.org/spec/vta/contexts/preview-delete/1.0#response.
  */
@@ -50,6 +47,9 @@ export interface VTAContextsPreviewDeleteResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/contexts/preview-delete/1.0" as const;
 
@@ -250,6 +250,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -263,5 +264,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/contexts/update/1.0/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vta/contexts/update/1.0/payload.schema.json
  */
 
+import type { ContextPolicy, ContextRecord, Ext } from "../../../../_shared/components.js";
+
+
 /**
  * Request payload for vta/contexts/update. Every member except `id` is optional and omitting one leaves that field unchanged — this is a patch, not a replacement.
  */
@@ -23,82 +26,16 @@ export interface VTAContextsUpdatePayload {
    * New description.
    */
   description?: string;
-  contextPolicy?: ContextPolicy;
-  ext?: Ext;
-}
-/**
- * Replacement policy for the context. Supplied whole: the members present in the new policy are the policy, and one omitted from it becomes unrestricted rather than retaining its previous value.
- */
-export interface ContextPolicy {
-  /**
-   * VIDs permitted to receive presentations from this context. Absent: any verifier. Present-but-empty: none.
-   */
-  trustedVerifiers?: string[];
-  /**
-   * Credential types that may be presented from this context. Absent: any type. Present-but-empty: none.
-   */
-  presentableTypes?: string[];
   /**
-   * Key ids the signing oracle may be invoked on within this context. Absent: every key the context holds. Present-but-empty: no keys.
+   * Replacement policy for the context. Supplied whole: the members present in the new policy are the policy, and one omitted from it becomes unrestricted rather than retaining its previous value.
    */
-  signableKeys?: string[];
-  /**
-   * Whether material in this context may leave it through an export. Defaults to true; set it to false for a context whose contents must not be extractable.
-   */
-  exportAllowed?: boolean;
-  /**
-   * Resource limits for the context. Shape is maintainer-defined.
-   */
-  quotas?: {
-    [k: string]: unknown | undefined;
-  };
-  ext?: Ext;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-/**
- * A context as the VTA holds it.
- */
-export interface ContextRecord {
-  /**
-   * Context id. For a nested context this is the full path (`parent/leaf`), not the leaf alone — an ACL scope naming this context must use this value verbatim.
-   */
-  id: string;
-  /**
-   * Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name.
-   */
-  name: string;
-  /**
-   * DID this context acts as, when one has been assigned. Absent means the context has no identity of its own yet — not that it has been denied one.
-   */
-  did?: string;
-  /**
-   * Free-form description.
-   */
-  description?: string;
-  /**
-   * Id of the context this one nests under. Absent for a top-level context. Authority granted at a parent reaches its children, so this member is load-bearing for anyone reasoning about scope.
-   */
-  parent?: string;
-  /**
-   * Resolved path from the root context, as the VTA derives it from the parent chain. Consumers MUST treat this as derived state: it is recomputed by the maintainer and is not independently settable.
-   */
-  basePath: string;
-  /**
-   * RFC 3339.
-   */
-  createdAt: string;
-  /**
-   * RFC 3339.
-   */
-  updatedAt: string;
+  contextPolicy?: ContextPolicy;
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ContextPolicy, ContextRecord, Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/contexts/update/1.0" as const;
 
@@ -139,6 +76,7 @@ export const PAYLOAD_SCHEMA = {
     "name": {
       "type": "string",
       "minLength": 1,
+      "maxLength": 256,
       "description": "New human-readable name."
     },
     "did": {
@@ -147,6 +85,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "description": {
       "type": "string",
+      "maxLength": 1024,
       "description": "New description."
     },
     "contextPolicy": {
@@ -185,6 +124,7 @@ export const PAYLOAD_SCHEMA = {
         "name": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 256,
           "description": "Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name."
         },
         "did": {
@@ -193,6 +133,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "description": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Free-form description."
         },
         "parent": {
@@ -305,6 +246,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "name": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 256,
           "description": "Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name."
         },
         "did": {
@@ -313,6 +255,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "description": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Free-form description."
         },
         "parent": {
@@ -404,6 +347,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -417,5 +361,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/contexts/update-did/1.0/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vta/contexts/update-did/1.0/payload.schema.json
  */
 
+import type { ContextRecord, Ext } from "../../../../_shared/components.js";
+
+
 export interface VTAContextsUpdateDIDPayload {
   /**
    * Context whose DID is being set.
@@ -14,50 +17,9 @@ export interface VTAContextsUpdateDIDPayload {
   did: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-/**
- * A context as the VTA holds it.
- */
-export interface ContextRecord {
-  /**
-   * Context id. For a nested context this is the full path (`parent/leaf`), not the leaf alone — an ACL scope naming this context must use this value verbatim.
-   */
-  id: string;
-  /**
-   * Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name.
-   */
-  name: string;
-  /**
-   * DID this context acts as, when one has been assigned. Absent means the context has no identity of its own yet — not that it has been denied one.
-   */
-  did?: string;
-  /**
-   * Free-form description.
-   */
-  description?: string;
-  /**
-   * Id of the context this one nests under. Absent for a top-level context. Authority granted at a parent reaches its children, so this member is load-bearing for anyone reasoning about scope.
-   */
-  parent?: string;
-  /**
-   * Resolved path from the root context, as the VTA derives it from the parent chain. Consumers MUST treat this as derived state: it is recomputed by the maintainer and is not independently settable.
-   */
-  basePath: string;
-  /**
-   * RFC 3339.
-   */
-  createdAt: string;
-  /**
-   * RFC 3339.
-   */
-  updatedAt: string;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ContextRecord, Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/contexts/update-did/1.0" as const;
@@ -133,6 +95,7 @@ export const PAYLOAD_SCHEMA = {
         "name": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 256,
           "description": "Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name."
         },
         "did": {
@@ -141,6 +104,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "description": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Free-form description."
         },
         "parent": {
@@ -211,6 +175,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "name": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 256,
           "description": "Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name."
         },
         "did": {
@@ -219,6 +184,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "description": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Free-form description."
         },
         "parent": {
@@ -268,6 +234,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -281,5 +248,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/credentials/issue/0.1/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/vta/credentials/issue/0.1/payload.schema.json
  */
 
-/**
- * Stable identifier for an issued credential — the handle for revocation and audit. Opaque to the holder: it MUST be echoed verbatim when revoking and MUST NOT be parsed.
- */
-export type CredentialId = string;
+import type { CredentialId, Ext } from "../../../../_shared/components.js";
+
 
 export interface VTACredentialsIssuePayload {
   /**
@@ -29,14 +27,11 @@ export interface VTACredentialsIssuePayload {
    * Optional human-readable rationale, recorded for audit.
    */
   purpose?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a vta/credentials/issue request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vta/credentials/issue/0.1#response.
  *
@@ -56,15 +51,15 @@ export interface VTACredentialsIssueResponsePayload {
    * credentialId of the previously-active credential this issuance revoked, for claims profiles with a single-active rule (GovernancePolicyCredential). Mirrors policy/activate's previousPolicyId: it makes the rotation auditable and reversible. Absent when nothing was displaced.
    */
   supersedes?: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { CredentialId, Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/credentials/issue/0.1" as const;
 
@@ -119,6 +114,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "purpose": {
       "type": "string",
+      "maxLength": 1024,
       "description": "Optional human-readable rationale, recorded for audit."
     },
     "ext": {
@@ -327,6 +323,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -340,5 +337,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/credentials/issue/0.2/payload.ts

@@ -3,16 +3,15 @@
  * Source: specs/vta/credentials/issue/0.2/payload.schema.json
  */
 
+import type { CredentialId, Ext, IssuedCredentialBase } from "../../../../_shared/components.js";
+
+
 /**
  * The success response to a vta/credentials/issue request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vta/credentials/issue/0.1#response.
  *
  * Composed from the shared IssuedCredential rather than restating it: that definition is the issuance receipt every issuer returns, and duplicating it here let the two drift silently. `unevaluatedProperties` closes the object after the `allOf` is applied, which is what makes the composition possible at all — `additionalProperties` is evaluated per-subschema against the whole object and would reject `supersedes` and `ext`.
  */
 export type VTACredentialsIssueResponsePayload = IssuedCredentialBase;
-/**
- * Stable identifier for an issued credential — the handle for revocation and audit. Opaque to the holder: it MUST be echoed verbatim when revoking and MUST NOT be parsed.
- */
-export type CredentialId = string;
 
 export interface VTACredentialsIssuePayload {
   /**
@@ -35,35 +34,15 @@ export interface VTACredentialsIssuePayload {
    * Optional human-readable rationale, recorded for audit.
    */
   purpose?: string;
-  ext?: Ext;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-/**
- * The members of an issuance receipt, deliberately left **open** so a consuming specification can `$ref` it under `allOf` and add its own, then close the result with `unevaluatedProperties: false`.
- *
- * A closure inside this definition would defeat that. Both `additionalProperties` and `unevaluatedProperties` are evaluated against the whole instance from within the subschema that declares them, and neither can see members the *outer* schema matched — so either one here rejects the consumer's extras. Only an `unevaluatedProperties` at the outer level sees everything the composition matched. Use `IssuedCredential` where a closed standalone shape is wanted.
- */
-export interface IssuedCredentialBase {
-  credentialId: CredentialId;
-  /**
-   * The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework.
-   */
-  credential: {};
   /**
-   * When the credential was minted.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  issuedAt?: string;
-  /**
-   * When the credential's validUntil falls due.
-   */
-  expiresAt: string;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { CredentialId, Ext, IssuedCredentialBase };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/credentials/issue/0.2" as const;
 
@@ -118,6 +97,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "purpose": {
       "type": "string",
+      "maxLength": 1024,
       "description": "Optional human-readable rationale, recorded for audit."
     },
     "ext": {
@@ -360,6 +340,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -373,5 +354,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;