@openvtc/trust-tasks 0.19.18 → 0.19.20

package/dist/persona/profile/put/1.0/payload.d.ts

@@ -2,7 +2,7 @@
  * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
  * Source: specs/persona/profile/put/1.0/payload.schema.json
  */
-import type { ClaimType, ExpectedVersion_PersonaV0_1 as ExpectedVersion, Ext, ProfileEntry, ProofRung, Provenance, Slot, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../../_shared/components.js";
+import type { ClaimType, ExpectedVersion_PersonaV0_1 as ExpectedVersion, Ext, FaceReach, ProfileEntry, ProofRung, Provenance, Slot, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../../_shared/components.js";
 /**
  * Create or replace one profile: a named, ordered projection over the holder's attribute pool. Entries reference pool attributes rather than copying them, so a fact edited once is edited everywhere it appears.
  */
@@ -21,6 +21,10 @@ export interface PersonaProfilePutPayload {
      * @maxItems 256
      */
     entries: ProfileEntry[];
+    /**
+     * Where this face may be worn. Omit to keep the face's current reach — anywhere, for a new face. Unlike the rest of a put, omission does not reset it: a reach is a restriction the holder set, and a producer that predates this member must not widen a face to anywhere by saving an unrelated edit. To widen, send `{"kind": "anywhere"}`. Narrowing it while the face is worn outside the new reach is refused (`boundOutsideReach`), naming the contexts: the holder takes it off there first, deliberately.
+     */
+    reach?: FaceReach;
     /**
      * Vault identifiers of credentials associated with this profile as inventory — what this persona can prove — as distinct from the evidence relationship a credentialBacked attribute expresses. The two answer different questions and a consumer MUST NOT read one as the other.
      *
@@ -52,7 +56,7 @@ export interface PersonaProfilePutResponsePayload {
     ext?: Ext;
 }
 /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
-export type { ClaimType, ExpectedVersion, Ext, ProfileEntry, ProofRung, Provenance, Slot, Ulid, ValueType, Version };
+export type { ClaimType, ExpectedVersion, Ext, FaceReach, ProfileEntry, ProofRung, Provenance, Slot, Ulid, ValueType, Version };
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/persona/profile/put/1.0";
 /** Stable alias for this specification's request payload shape. */
@@ -97,6 +101,10 @@ export declare const PAYLOAD_SCHEMA: {
             };
             readonly description: "Ordered; the order is display order. An empty array is legal and means a profile that discloses nothing — useful as a starting point, and not the same as no profile at all.";
         };
+        readonly reach: {
+            readonly $ref: "#/$defs/FaceReach";
+            readonly description: "Where this face may be worn. Omit to keep the face's current reach — anywhere, for a new face. Unlike the rest of a put, omission does not reset it: a reach is a restriction the holder set, and a producer that predates this member must not widen a face to anywhere by saving an unrelated edit. To widen, send `{\"kind\": \"anywhere\"}`. Narrowing it while the face is worn outside the new reach is refused (`boundOutsideReach`), naming the contexts: the holder takes it off there first, deliberately.";
+        };
         readonly credentialRefs: {
             readonly type: "array";
             readonly maxItems: 256;
@@ -189,6 +197,39 @@ export declare const PAYLOAD_SCHEMA: {
             readonly type: "integer";
             readonly minimum: 0;
         };
+        readonly FaceReach: {
+            readonly title: "FaceReach";
+            readonly description: "Where a pool face may be worn. `anywhere` is the default and what an absent member means. `only` names the contexts it may be worn in, and a maintainer MUST refuse to wear it in any other (persona/binding/set `outsideReach`).\n\nA tagged object rather than a bare list of contexts, deliberately: an empty list has been read as both 'unrestricted' and 'nowhere' in this family's neighbours, and a shape where the two cannot be confused is worth more than one where they must be remembered. So `only` requires at least one context, and 'nowhere' is not a reach — it is a retired face.\n\nA context-local face has no reach: it lives in its context and is worn there by construction.";
+            readonly oneOf: readonly [{
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "anywhere";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "contextIds"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "only";
+                    };
+                    readonly contextIds: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 256;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                };
+            }];
+        };
         readonly ProfileEntry: {
             readonly title: "ProfileEntry";
             readonly description: "One line of a profile, in exactly one of four forms. Together they are the whole of a profile's flexibility, and each exists for a case the others handle badly.\n\n`{ref}` — use the pool attribute, live. Editing the pool updates every profile that references it, which is the point.\n\n`{ref, pinVersion}` — use the value as it was at that version. For a profile that must keep presenting the value a counterparty already verified.\n\n`{ref, override}` — the same fact, a different value here. (\"In the gaming profile my display name is different.\")\n\n`{inline}` — a value that never enters the pool, and so never leaks into another profile.\n\nOmission is exclusion; there is no removal marker.\n\nAny form MAY carry a `slot` naming the role the entry plays in the profile — see `Slot`. A maintainer MUST refuse a profile in which two entries carry the same slot: a slot exists to answer one question with one entry.";
@@ -281,7 +322,7 @@ export declare const PAYLOAD_SCHEMA: {
         };
         readonly Provenance: {
             readonly title: "Provenance";
-            readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.";
+            readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.";
             readonly type: "object";
             readonly required: readonly ["kind"];
             readonly oneOf: readonly [{
@@ -338,6 +379,26 @@ export declare const PAYLOAD_SCHEMA: {
                         readonly description: "When true (the default and the only useful setting), a distinct value is minted for each verifier.";
                     };
                 };
+            }, {
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "source", "derivedAt"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "derived";
+                    };
+                    readonly source: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly pattern: "^[a-z][A-Za-z0-9.-]*$";
+                        readonly description: "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.";
+                    };
+                    readonly derivedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it.";
+                    };
+                };
             }];
         };
         readonly ProofRung: {
@@ -442,6 +503,39 @@ export declare const RESPONSE_PAYLOAD_SCHEMA: {
             readonly type: "integer";
             readonly minimum: 0;
         };
+        readonly FaceReach: {
+            readonly title: "FaceReach";
+            readonly description: "Where a pool face may be worn. `anywhere` is the default and what an absent member means. `only` names the contexts it may be worn in, and a maintainer MUST refuse to wear it in any other (persona/binding/set `outsideReach`).\n\nA tagged object rather than a bare list of contexts, deliberately: an empty list has been read as both 'unrestricted' and 'nowhere' in this family's neighbours, and a shape where the two cannot be confused is worth more than one where they must be remembered. So `only` requires at least one context, and 'nowhere' is not a reach — it is a retired face.\n\nA context-local face has no reach: it lives in its context and is worn there by construction.";
+            readonly oneOf: readonly [{
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "anywhere";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "contextIds"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "only";
+                    };
+                    readonly contextIds: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 256;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                };
+            }];
+        };
         readonly ProfileEntry: {
             readonly title: "ProfileEntry";
             readonly description: "One line of a profile, in exactly one of four forms. Together they are the whole of a profile's flexibility, and each exists for a case the others handle badly.\n\n`{ref}` — use the pool attribute, live. Editing the pool updates every profile that references it, which is the point.\n\n`{ref, pinVersion}` — use the value as it was at that version. For a profile that must keep presenting the value a counterparty already verified.\n\n`{ref, override}` — the same fact, a different value here. (\"In the gaming profile my display name is different.\")\n\n`{inline}` — a value that never enters the pool, and so never leaks into another profile.\n\nOmission is exclusion; there is no removal marker.\n\nAny form MAY carry a `slot` naming the role the entry plays in the profile — see `Slot`. A maintainer MUST refuse a profile in which two entries carry the same slot: a slot exists to answer one question with one entry.";
@@ -534,7 +628,7 @@ export declare const RESPONSE_PAYLOAD_SCHEMA: {
         };
         readonly Provenance: {
             readonly title: "Provenance";
-            readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.";
+            readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.";
             readonly type: "object";
             readonly required: readonly ["kind"];
             readonly oneOf: readonly [{
@@ -591,6 +685,26 @@ export declare const RESPONSE_PAYLOAD_SCHEMA: {
                         readonly description: "When true (the default and the only useful setting), a distinct value is minted for each verifier.";
                     };
                 };
+            }, {
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "source", "derivedAt"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "derived";
+                    };
+                    readonly source: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly pattern: "^[a-z][A-Za-z0-9.-]*$";
+                        readonly description: "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.";
+                    };
+                    readonly derivedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it.";
+                    };
+                };
             }];
         };
         readonly ProofRung: {
@@ -654,6 +768,10 @@ export declare const SPEC: {
                 };
                 readonly description: "Ordered; the order is display order. An empty array is legal and means a profile that discloses nothing — useful as a starting point, and not the same as no profile at all.";
             };
+            readonly reach: {
+                readonly $ref: "#/$defs/FaceReach";
+                readonly description: "Where this face may be worn. Omit to keep the face's current reach — anywhere, for a new face. Unlike the rest of a put, omission does not reset it: a reach is a restriction the holder set, and a producer that predates this member must not widen a face to anywhere by saving an unrelated edit. To widen, send `{\"kind\": \"anywhere\"}`. Narrowing it while the face is worn outside the new reach is refused (`boundOutsideReach`), naming the contexts: the holder takes it off there first, deliberately.";
+            };
             readonly credentialRefs: {
                 readonly type: "array";
                 readonly maxItems: 256;
@@ -746,6 +864,39 @@ export declare const SPEC: {
                 readonly type: "integer";
                 readonly minimum: 0;
             };
+            readonly FaceReach: {
+                readonly title: "FaceReach";
+                readonly description: "Where a pool face may be worn. `anywhere` is the default and what an absent member means. `only` names the contexts it may be worn in, and a maintainer MUST refuse to wear it in any other (persona/binding/set `outsideReach`).\n\nA tagged object rather than a bare list of contexts, deliberately: an empty list has been read as both 'unrestricted' and 'nowhere' in this family's neighbours, and a shape where the two cannot be confused is worth more than one where they must be remembered. So `only` requires at least one context, and 'nowhere' is not a reach — it is a retired face.\n\nA context-local face has no reach: it lives in its context and is worn there by construction.";
+                readonly oneOf: readonly [{
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "anywhere";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "contextIds"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "only";
+                        };
+                        readonly contextIds: {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                            readonly maxItems: 256;
+                            readonly uniqueItems: true;
+                            readonly items: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                        };
+                    };
+                }];
+            };
             readonly ProfileEntry: {
                 readonly title: "ProfileEntry";
                 readonly description: "One line of a profile, in exactly one of four forms. Together they are the whole of a profile's flexibility, and each exists for a case the others handle badly.\n\n`{ref}` — use the pool attribute, live. Editing the pool updates every profile that references it, which is the point.\n\n`{ref, pinVersion}` — use the value as it was at that version. For a profile that must keep presenting the value a counterparty already verified.\n\n`{ref, override}` — the same fact, a different value here. (\"In the gaming profile my display name is different.\")\n\n`{inline}` — a value that never enters the pool, and so never leaks into another profile.\n\nOmission is exclusion; there is no removal marker.\n\nAny form MAY carry a `slot` naming the role the entry plays in the profile — see `Slot`. A maintainer MUST refuse a profile in which two entries carry the same slot: a slot exists to answer one question with one entry.";
@@ -838,7 +989,7 @@ export declare const SPEC: {
             };
             readonly Provenance: {
                 readonly title: "Provenance";
-                readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.";
+                readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.";
                 readonly type: "object";
                 readonly required: readonly ["kind"];
                 readonly oneOf: readonly [{
@@ -895,6 +1046,26 @@ export declare const SPEC: {
                             readonly description: "When true (the default and the only useful setting), a distinct value is minted for each verifier.";
                         };
                     };
+                }, {
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "source", "derivedAt"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "derived";
+                        };
+                        readonly source: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 64;
+                            readonly pattern: "^[a-z][A-Za-z0-9.-]*$";
+                            readonly description: "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.";
+                        };
+                        readonly derivedAt: {
+                            readonly type: "string";
+                            readonly format: "date-time";
+                            readonly description: "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it.";
+                        };
+                    };
                 }];
             };
             readonly ProofRung: {
@@ -1010,6 +1181,39 @@ export declare const RESPONSE_SPEC: {
                 readonly type: "integer";
                 readonly minimum: 0;
             };
+            readonly FaceReach: {
+                readonly title: "FaceReach";
+                readonly description: "Where a pool face may be worn. `anywhere` is the default and what an absent member means. `only` names the contexts it may be worn in, and a maintainer MUST refuse to wear it in any other (persona/binding/set `outsideReach`).\n\nA tagged object rather than a bare list of contexts, deliberately: an empty list has been read as both 'unrestricted' and 'nowhere' in this family's neighbours, and a shape where the two cannot be confused is worth more than one where they must be remembered. So `only` requires at least one context, and 'nowhere' is not a reach — it is a retired face.\n\nA context-local face has no reach: it lives in its context and is worn there by construction.";
+                readonly oneOf: readonly [{
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "anywhere";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "contextIds"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "only";
+                        };
+                        readonly contextIds: {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                            readonly maxItems: 256;
+                            readonly uniqueItems: true;
+                            readonly items: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                        };
+                    };
+                }];
+            };
             readonly ProfileEntry: {
                 readonly title: "ProfileEntry";
                 readonly description: "One line of a profile, in exactly one of four forms. Together they are the whole of a profile's flexibility, and each exists for a case the others handle badly.\n\n`{ref}` — use the pool attribute, live. Editing the pool updates every profile that references it, which is the point.\n\n`{ref, pinVersion}` — use the value as it was at that version. For a profile that must keep presenting the value a counterparty already verified.\n\n`{ref, override}` — the same fact, a different value here. (\"In the gaming profile my display name is different.\")\n\n`{inline}` — a value that never enters the pool, and so never leaks into another profile.\n\nOmission is exclusion; there is no removal marker.\n\nAny form MAY carry a `slot` naming the role the entry plays in the profile — see `Slot`. A maintainer MUST refuse a profile in which two entries carry the same slot: a slot exists to answer one question with one entry.";
@@ -1102,7 +1306,7 @@ export declare const RESPONSE_SPEC: {
             };
             readonly Provenance: {
                 readonly title: "Provenance";
-                readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.";
+                readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.";
                 readonly type: "object";
                 readonly required: readonly ["kind"];
                 readonly oneOf: readonly [{
@@ -1159,6 +1363,26 @@ export declare const RESPONSE_SPEC: {
                             readonly description: "When true (the default and the only useful setting), a distinct value is minted for each verifier.";
                         };
                     };
+                }, {
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "source", "derivedAt"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "derived";
+                        };
+                        readonly source: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 64;
+                            readonly pattern: "^[a-z][A-Za-z0-9.-]*$";
+                            readonly description: "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.";
+                        };
+                        readonly derivedAt: {
+                            readonly type: "string";
+                            readonly format: "date-time";
+                            readonly description: "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it.";
+                        };
+                    };
                 }];
             };
             readonly ProofRung: {

package/dist/persona/profile/put/1.0/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/persona/profile/put/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,2BAA2B,IAAI,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,IAAI,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAGpN;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;QAClC;;WAEG;QACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAErH,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,qDAA8D,CAAC;AAEvF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,wBAAwB,CAAC;AAE/C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,8DAAuE,CAAC;AAEzG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiWjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsT1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/persona/profile/put/1.0/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,2BAA2B,IAAI,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,IAAI,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAG/N;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB;;OAEG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;QAClC;;WAEG;QACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAEhI,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,qDAA8D,CAAC;AAEvF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,wBAAwB,CAAC;AAE/C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,8DAAuE,CAAC;AAEzG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuajB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwX1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}

package/dist/persona/profile/put/1.0/payload.js

@@ -45,6 +45,10 @@ export const PAYLOAD_SCHEMA = {
             },
             "description": "Ordered; the order is display order. An empty array is legal and means a profile that discloses nothing — useful as a starting point, and not the same as no profile at all."
         },
+        "reach": {
+            "$ref": "#/$defs/FaceReach",
+            "description": "Where this face may be worn. Omit to keep the face's current reach — anywhere, for a new face. Unlike the rest of a put, omission does not reset it: a reach is a restriction the holder set, and a producer that predates this member must not widen a face to anywhere by saving an unrelated edit. To widen, send `{\"kind\": \"anywhere\"}`. Narrowing it while the face is worn outside the new reach is refused (`boundOutsideReach`), naming the contexts: the holder takes it off there first, deliberately."
+        },
         "credentialRefs": {
             "type": "array",
             "maxItems": 256,
@@ -148,6 +152,47 @@ export const PAYLOAD_SCHEMA = {
             "type": "integer",
             "minimum": 0
         },
+        "FaceReach": {
+            "title": "FaceReach",
+            "description": "Where a pool face may be worn. `anywhere` is the default and what an absent member means. `only` names the contexts it may be worn in, and a maintainer MUST refuse to wear it in any other (persona/binding/set `outsideReach`).\n\nA tagged object rather than a bare list of contexts, deliberately: an empty list has been read as both 'unrestricted' and 'nowhere' in this family's neighbours, and a shape where the two cannot be confused is worth more than one where they must be remembered. So `only` requires at least one context, and 'nowhere' is not a reach — it is a retired face.\n\nA context-local face has no reach: it lives in its context and is worn there by construction.",
+            "oneOf": [
+                {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "kind"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "anywhere"
+                        }
+                    }
+                },
+                {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "kind",
+                        "contextIds"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "only"
+                        },
+                        "contextIds": {
+                            "type": "array",
+                            "minItems": 1,
+                            "maxItems": 256,
+                            "uniqueItems": true,
+                            "items": {
+                                "type": "string",
+                                "minLength": 1
+                            }
+                        }
+                    }
+                }
+            ]
+        },
         "ProfileEntry": {
             "title": "ProfileEntry",
             "description": "One line of a profile, in exactly one of four forms. Together they are the whole of a profile's flexibility, and each exists for a case the others handle badly.\n\n`{ref}` — use the pool attribute, live. Editing the pool updates every profile that references it, which is the point.\n\n`{ref, pinVersion}` — use the value as it was at that version. For a profile that must keep presenting the value a counterparty already verified.\n\n`{ref, override}` — the same fact, a different value here. (\"In the gaming profile my display name is different.\")\n\n`{inline}` — a value that never enters the pool, and so never leaks into another profile.\n\nOmission is exclusion; there is no removal marker.\n\nAny form MAY carry a `slot` naming the role the entry plays in the profile — see `Slot`. A maintainer MUST refuse a profile in which two entries carry the same slot: a slot exists to answer one question with one entry.",
@@ -262,7 +307,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "Provenance": {
             "title": "Provenance",
-            "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
+            "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.",
             "type": "object",
             "required": [
                 "kind"
@@ -333,6 +378,31 @@ export const PAYLOAD_SCHEMA = {
                             "description": "When true (the default and the only useful setting), a distinct value is minted for each verifier."
                         }
                     }
+                },
+                {
+                    "additionalProperties": false,
+                    "required": [
+                        "kind",
+                        "source",
+                        "derivedAt"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "derived"
+                        },
+                        "source": {
+                            "type": "string",
+                            "minLength": 1,
+                            "maxLength": 64,
+                            "pattern": "^[a-z][A-Za-z0-9.-]*$",
+                            "description": "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share."
+                        },
+                        "derivedAt": {
+                            "type": "string",
+                            "format": "date-time",
+                            "description": "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it."
+                        }
+                    }
                 }
             ]
         },
@@ -460,6 +530,47 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             "type": "integer",
             "minimum": 0
         },
+        "FaceReach": {
+            "title": "FaceReach",
+            "description": "Where a pool face may be worn. `anywhere` is the default and what an absent member means. `only` names the contexts it may be worn in, and a maintainer MUST refuse to wear it in any other (persona/binding/set `outsideReach`).\n\nA tagged object rather than a bare list of contexts, deliberately: an empty list has been read as both 'unrestricted' and 'nowhere' in this family's neighbours, and a shape where the two cannot be confused is worth more than one where they must be remembered. So `only` requires at least one context, and 'nowhere' is not a reach — it is a retired face.\n\nA context-local face has no reach: it lives in its context and is worn there by construction.",
+            "oneOf": [
+                {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "kind"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "anywhere"
+                        }
+                    }
+                },
+                {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "kind",
+                        "contextIds"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "only"
+                        },
+                        "contextIds": {
+                            "type": "array",
+                            "minItems": 1,
+                            "maxItems": 256,
+                            "uniqueItems": true,
+                            "items": {
+                                "type": "string",
+                                "minLength": 1
+                            }
+                        }
+                    }
+                }
+            ]
+        },
         "ProfileEntry": {
             "title": "ProfileEntry",
             "description": "One line of a profile, in exactly one of four forms. Together they are the whole of a profile's flexibility, and each exists for a case the others handle badly.\n\n`{ref}` — use the pool attribute, live. Editing the pool updates every profile that references it, which is the point.\n\n`{ref, pinVersion}` — use the value as it was at that version. For a profile that must keep presenting the value a counterparty already verified.\n\n`{ref, override}` — the same fact, a different value here. (\"In the gaming profile my display name is different.\")\n\n`{inline}` — a value that never enters the pool, and so never leaks into another profile.\n\nOmission is exclusion; there is no removal marker.\n\nAny form MAY carry a `slot` naming the role the entry plays in the profile — see `Slot`. A maintainer MUST refuse a profile in which two entries carry the same slot: a slot exists to answer one question with one entry.",
@@ -574,7 +685,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "Provenance": {
             "title": "Provenance",
-            "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
+            "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.",
             "type": "object",
             "required": [
                 "kind"
@@ -645,6 +756,31 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
                             "description": "When true (the default and the only useful setting), a distinct value is minted for each verifier."
                         }
                     }
+                },
+                {
+                    "additionalProperties": false,
+                    "required": [
+                        "kind",
+                        "source",
+                        "derivedAt"
+                    ],
+                    "properties": {
+                        "kind": {
+                            "const": "derived"
+                        },
+                        "source": {
+                            "type": "string",
+                            "minLength": 1,
+                            "maxLength": 64,
+                            "pattern": "^[a-z][A-Za-z0-9.-]*$",
+                            "description": "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share."
+                        },
+                        "derivedAt": {
+                            "type": "string",
+                            "format": "date-time",
+                            "description": "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it."
+                        }
+                    }
                 }
             ]
         },