@openvtc/trust-tasks 0.2.57 → 0.2.59

package/src/_runtime/codes.ts

@@ -0,0 +1,151 @@
+/**
+ * Error codes — SPEC.md §8.3 (standard) and §8.5 (extended).
+ *
+ * Hand-written. Mirrors `error.rs` in trust-tasks-rs, including its acceptance
+ * of both the framework 0.2 lowerCamelCase spellings and the frozen 0.1
+ * snake_case ones, so a 0.2 consumer can still read an error response from a
+ * 0.1 peer.
+ */
+
+/** The framework-defined standard error codes (SPEC.md §8.3). */
+export const STANDARD_CODES = [
+  "malformedRequest",
+  "unsupportedType",
+  "unsupportedVersion",
+  "expired",
+  "proofRequired",
+  "proofInvalid",
+  "permissionDenied",
+  "wrongRecipient",
+  "identityMismatch",
+  "taskFailed",
+  "unavailable",
+  "internalError",
+] as const;
+
+export type StandardCode = (typeof STANDARD_CODES)[number];
+
+/**
+ * Framework 0.1 snake_case spellings, mapped to their 0.2 lowerCamelCase form.
+ * `expired` and `unavailable` are single words and unchanged.
+ */
+const LEGACY_STANDARD: Readonly<Record<string, StandardCode>> = {
+  malformed_request: "malformedRequest",
+  unsupported_type: "unsupportedType",
+  unsupported_version: "unsupportedVersion",
+  proof_required: "proofRequired",
+  proof_invalid: "proofInvalid",
+  permission_denied: "permissionDenied",
+  wrong_recipient: "wrongRecipient",
+  identity_mismatch: "identityMismatch",
+  task_failed: "taskFailed",
+  internal_error: "internalError",
+};
+
+const STANDARD_SET: ReadonlySet<string> = new Set(STANDARD_CODES);
+
+/**
+ * Normalize a wire `code` to its canonical 0.2 spelling when it is a standard
+ * code, or return it unchanged.
+ *
+ * A consumer comparing a received code against {@link STANDARD_CODES} must
+ * normalize first, or a 0.1 peer's `proof_required` reads as an unrecognized
+ * extended code and falls through to `taskFailed` (§8.5), losing the meaning.
+ */
+export function normalizeCode(code: string): string {
+  if (STANDARD_SET.has(code)) return code;
+  return LEGACY_STANDARD[code] ?? code;
+}
+
+/** Whether `code` is a standard §8.3 code, in either casing. */
+export function isStandardCode(code: string): code is StandardCode {
+  return STANDARD_SET.has(normalizeCode(code));
+}
+
+/**
+ * The local part of an extended code: a lowercase letter, then letters of
+ * either case, digits, or underscores.
+ *
+ * Both casings are accepted so framework 0.2 lowerCamelCase locals
+ * (`documentRevoked`) and frozen 0.1 snake_case locals (`document_revoked`)
+ * parse under one rule. SPEC §4.10 item 4 SHOULDs lowerCamelCase for new
+ * specifications; only the first character is required to be lowercase.
+ */
+const LOCAL_RE = /^[a-z][A-Za-z0-9_]*$/;
+
+/** One path segment of a slug: lowercase, hyphen-separated (§6.1). */
+const SEGMENT_RE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+
+function validNamespace(namespace: string): boolean {
+  return namespace.length > 0 && namespace.split("/").every((s) => SEGMENT_RE.test(s));
+}
+
+/**
+ * Build an extended error code under a specification's own slug (SPEC §8.5).
+ *
+ * `typeUri` is normally a generated module's `TYPE_URI`, so the namespace
+ * cannot drift from the type's identity — the same guarantee
+ * `Payload::extended_code` gives in Rust. The `#response` fragment is stripped:
+ * an error raised while handling a response still belongs to the bare slug.
+ *
+ * @throws if the derived slug or `local` is malformed.
+ */
+export function extendedCode(typeUri: string, local: string): string {
+  const slug = slugFromTypeUri(typeUri);
+  if (!LOCAL_RE.test(local)) {
+    throw new Error(
+      `extendedCode: local part ${JSON.stringify(local)} must match ${LOCAL_RE} ` +
+        `(a lowercase first character, then letters, digits or underscores)`,
+    );
+  }
+  return `${slug}:${local}`;
+}
+
+/**
+ * Build an extended error code under a *family namespace* — a proper path
+ * prefix of the specification's slug (SPEC §8.5 rule 2).
+ *
+ * For a condition whose meaning is defined once across a family rather than
+ * per specification, such as `did-management:unknownDomain` on every
+ * `did-management/*` task. Prefer {@link extendedCode} otherwise: a family
+ * namespace claims the condition means the same thing across every sibling.
+ *
+ * `namespace` is checked against the slug derived from `typeUri` rather than
+ * taken on trust, so §8.5's prefix rule holds by construction. A sibling's slug
+ * is rejected — it shares a prefix but is not itself one, which is exactly the
+ * confusion §8.5 forbids.
+ *
+ * @throws if `namespace` is neither the slug nor a path prefix of it.
+ */
+export function familyCode(typeUri: string, namespace: string, local: string): string {
+  const slug = slugFromTypeUri(typeUri);
+  const segments = slug.split("/");
+  const permitted = segments.map((_, i) => segments.slice(0, i + 1).join("/"));
+  if (!permitted.includes(namespace)) {
+    throw new Error(
+      `familyCode: namespace ${JSON.stringify(namespace)} is neither the slug ` +
+        `${JSON.stringify(slug)} nor a path prefix of it (SPEC §8.5 rule 2). ` +
+        `Permitted: ${permitted.map((p) => JSON.stringify(p)).join(", ")}`,
+    );
+  }
+  if (!LOCAL_RE.test(local)) {
+    throw new Error(`familyCode: local part ${JSON.stringify(local)} must match ${LOCAL_RE}`);
+  }
+  return `${namespace}:${local}`;
+}
+
+/** The slug of a Type URI, with any `#request` / `#response` fragment removed. */
+export function slugFromTypeUri(typeUri: string): string {
+  const PREFIX = "https://trusttasks.org/spec/";
+  if (!typeUri.startsWith(PREFIX)) {
+    throw new Error(`not a Trust Task Type URI: ${JSON.stringify(typeUri)}`);
+  }
+  const rest = typeUri.slice(PREFIX.length).split("#")[0]!;
+  // Trailing segment is the MAJOR.MINOR version; everything before it is the slug.
+  const parts = rest.split("/");
+  const slug = parts.slice(0, -1).join("/");
+  if (!validNamespace(slug)) {
+    throw new Error(`Type URI ${JSON.stringify(typeUri)} yielded an invalid slug`);
+  }
+  return slug;
+}

package/src/_runtime/consume.ts

@@ -0,0 +1,229 @@
+/**
+ * Inbound-document orchestration for SPEC.md §7.2 items 4–8.
+ *
+ * Hand-written. Mirrors `consume.rs` in trust-tasks-rs, deliberately closely:
+ * a TypeScript consumer and a Rust one must reach the same verdict on the same
+ * document, or the two reference implementations disagree about what conforms.
+ *
+ * ```ts
+ * import { consumeInbound, StaticTransport, AclGrant_v0_1 } from "@openvtc/trust-tasks";
+ *
+ * const outcome = await consumeInbound({
+ *   transport,
+ *   spec: AclGrant_v0_1.SPEC,
+ *   proofPolicy: { kind: "verify", verify: myVerifier },
+ *   doc,
+ *   myVid: "did:web:maintainer.example",
+ *   now: Date.now(),
+ *   newErrorId: () => crypto.randomUUID(),
+ *   handler: async (accepted, parties) =>
+ *     respondWith(accepted, crypto.randomUUID(), buildResponse(parties)),
+ * });
+ *
+ * switch (outcome.kind) {
+ *   case "handled":    emit(outcome.response); break;
+ *   case "rejected":   emit(outcome.error); break;
+ *   case "suppressed": logSuppressed(); break;
+ * }
+ * ```
+ *
+ * Items 1 (framework schema), 2 (payload schema) and 3 (unknown `type`) are
+ * *not* attempted here — they belong to the caller's parse and dispatch, and by
+ * the time you hold a typed document they have already succeeded.
+ */
+
+import {
+  enforceSpecPolicy,
+  rejectWith,
+  toErrorPayload,
+  validateBasic,
+  type ErrorResponse,
+  type RejectReason,
+  type SpecPolicy,
+  type TrustTaskDocument,
+} from "./document.js";
+import {
+  identityMismatchReason,
+  reject,
+  resolveParties,
+  type ResolvedParties,
+  type TransportHandler,
+} from "./transport.js";
+
+/** Verifies a document's Data Integrity proof (SPEC §4.7). */
+export interface ProofVerifier {
+  /** Resolve to `true` when the proof verifies against the in-band `issuer`. */
+  verify<P>(doc: TrustTaskDocument<P>): Promise<boolean> | boolean;
+}
+
+/**
+ * How {@link consumeInbound} treats a document's `proof` member (§7.2 item 7).
+ *
+ * The framework does not assume what integrity guarantees a consumer relies on.
+ * Some verify Data Integrity proofs in-band; some have transport-layer
+ * integrity (signed DIDComm, mTLS-bound HTTPS) and accept in-band proofs only
+ * opportunistically; some have none. Making the choice explicit at the call
+ * site is the point.
+ *
+ * `spec.isProofRequired` is consulted independently of the policy: a
+ * specification that requires a proof rejects a proofless document whichever
+ * policy is chosen.
+ */
+export type ProofPolicy =
+  /**
+   * Verify the proof when present. Failures map to `proofInvalid`. The safe
+   * default for any consumer that honours in-band proofs.
+   */
+  | { kind: "verify"; verify: ProofVerifier }
+  /**
+   * Reject a document that carries an in-band proof, with `malformedRequest`.
+   * For consumers with integrity from another layer that are deliberately not
+   * verifying in-band proofs — silently dropping a producer-supplied proof
+   * would mislead the producer about the guarantees of the exchange.
+   */
+  | { kind: "rejectIfPresent" }
+  /**
+   * SECURITY: accept any document, proof or not, without verifying. Only where
+   * the transport already provides equivalent end-to-end integrity. This is the
+   * explicit opt-out, and the name is deliberately uncomfortable to type.
+   */
+  | { kind: "acceptUnverified" };
+
+/** The outcome of {@link consumeInbound}. */
+export type ConsumeOutcome<R> =
+  /** Every check passed and the caller's handler produced a response. */
+  | { kind: "handled"; response: TrustTaskDocument<R> }
+  /**
+   * A framework check failed, or the handler refused. Either way the document
+   * is already addressed per §8.1 — emit it over the transport.
+   */
+  | { kind: "rejected"; error: ErrorResponse }
+  /**
+   * §8.1: the rejection was `identityMismatch` and the transport authenticated
+   * no sender, so no response may be emitted — one would be an oracle.
+   *
+   * Callers SHOULD log this: silent suppression is the spec rule, but
+   * *invisible* suppression is an operational footgun.
+   */
+  | { kind: "suppressed"; reason: RejectReason };
+
+/** Wire-safe message for the `rejectIfPresent` path. */
+export const PROOF_NOT_ACCEPTED_BY_POLICY =
+  "in-band proof not accepted by consumer policy (SPEC §7.2 item 7)";
+
+export interface ConsumeOptions<P, R> {
+  transport: TransportHandler;
+  /** The generated module's `SPEC` (request) or `RESPONSE_SPEC` (response). */
+  spec: SpecPolicy;
+  proofPolicy: ProofPolicy;
+  doc: TrustTaskDocument<P>;
+  /** This consumer's own VID, for the §7.2 item 5 recipient check. */
+  myVid: string;
+  /** Milliseconds since the epoch, as from `Date.now()`. */
+  now: number;
+  /** Invoked at most once, only when a rejection needs an error-response id. */
+  newErrorId: () => string;
+  /** Business handler, called only once every framework check has passed. */
+  handler: (
+    doc: TrustTaskDocument<P>,
+    parties: ResolvedParties,
+  ) => Promise<TrustTaskDocument<R> | ErrorResponse> | TrustTaskDocument<R> | ErrorResponse;
+  /** Override the response `issuedAt` clock, for deterministic tests. */
+  clock?: () => string;
+}
+
+/**
+ * Run SPEC §7.2 items 4–8 against `doc`, then either call the handler or build
+ * the routed error response per §8.1.
+ *
+ * ⚠ A handler-returned {@link ErrorResponse} is passed through verbatim — the
+ * framework does not re-apply §8.1 routing to it. A handler rejecting for
+ * identity-style reasons MUST address the response itself (see `reject` in
+ * ./transport.js); `rejectWith` copies `doc.issuer` into `recipient`, which is
+ * safe for ordinary refusals but not for one that contests that identity.
+ */
+export async function consumeInbound<P, R>(
+  opts: ConsumeOptions<P, R>,
+): Promise<ConsumeOutcome<R>> {
+  const { transport, spec, proofPolicy, doc, myVid, now, newErrorId, handler, clock } = opts;
+
+  const route = (reason: RejectReason): ConsumeOutcome<R> => {
+    const error = reject(transport, doc, newErrorId(), reason, clock);
+    return error === undefined ? { kind: "suppressed", reason } : { kind: "rejected", error };
+  };
+
+  // §7.2 items 4 + 5a — expiry and wrong-recipient.
+  const basic = validateBasic(doc, now, myVid);
+  if (basic !== null) return route(basic);
+
+  // §7.2 item 6 — in-band vs transport-derived identity cross-check.
+  const resolved = resolveParties(transport, doc);
+  if ("error" in resolved) return route(identityMismatchReason(resolved.error));
+
+  // §7.2 item 7 clause B — the consumer's chosen proof policy.
+  if (doc.proof !== undefined) {
+    switch (proofPolicy.kind) {
+      case "verify": {
+        let ok: boolean;
+        try {
+          ok = await proofPolicy.verify.verify(doc);
+        } catch (e) {
+          ok = false;
+        }
+        if (!ok) {
+          return route({
+            code: "proofInvalid",
+            message: "proof verification failed",
+            retryable: false,
+          });
+        }
+        break;
+      }
+      case "rejectIfPresent":
+        return route({
+          code: "malformedRequest",
+          message: PROOF_NOT_ACCEPTED_BY_POLICY,
+          retryable: false,
+        });
+      case "acceptUnverified":
+        break;
+    }
+  }
+
+  // §7.2 items 5b + 7 clause A + 8 — the policy-driven checks, in one place so
+  // this pipeline and any binding-specific one cannot diverge on the check set.
+  const policy = enforceSpecPolicy(doc, spec);
+  if (policy !== null) return route(policy);
+
+  const result = await handler(doc, resolved.parties);
+  return isErrorResponse(result)
+    ? { kind: "rejected", error: result }
+    : { kind: "handled", response: result as TrustTaskDocument<R> };
+}
+
+/**
+ * Whether a handler returned an error response rather than a success response.
+ *
+ * Keys off the `trust-task-error` Type URI rather than payload shape: §8 makes
+ * the type the discriminator, and a success payload could coincidentally carry
+ * a `code` member.
+ */
+function isErrorResponse(doc: TrustTaskDocument<unknown>): doc is ErrorResponse {
+  return doc.type.split("#")[0]!.includes("/trust-task-error/");
+}
+
+/**
+ * Build a handler-side refusal addressed to the original producer.
+ *
+ * Convenience over `rejectWith` + `toErrorPayload` for the common case where a
+ * handler refuses for a business reason. Not safe for refusals that contest the
+ * in-band identity — see the warning on {@link consumeInbound}.
+ */
+export function refuse<P>(
+  request: TrustTaskDocument<P>,
+  id: string,
+  reason: RejectReason,
+  clock?: () => string,
+): ErrorResponse {
+  return rejectWith(request, id, toErrorPayload(reason), clock);
+}

package/src/_runtime/document.ts

@@ -0,0 +1,259 @@
+/**
+ * The Trust Task document envelope (SPEC.md §4) and the framework-level checks
+ * that operate on it.
+ *
+ * Hand-written. Mirrors `document.rs` in trust-tasks-rs.
+ */
+
+import type { StandardCode } from "./codes.js";
+
+/** A W3C Data Integrity Proof object (SPEC.md §4.7). Opaque to the framework. */
+export interface Proof {
+  type: string;
+  cryptosuite: string;
+  verificationMethod: string;
+  created: string;
+  proofPurpose: string;
+  proofValue: string;
+  [k: string]: unknown;
+}
+
+/** A single Trust Task document, per SPEC.md §4.2. */
+export interface TrustTaskDocument<P> {
+  /** Globally unique to this instance (§4.3). */
+  id: string;
+  /** Correlates this document with others in the same exchange (§4.9). */
+  threadId?: string;
+  /** The Type URI identifying specification and version (§4.4). */
+  type: string;
+  /** VID of the party responsible for the content (§4.8). */
+  issuer?: string;
+  /** VID of the party expected to act on the document (§4.8). */
+  recipient?: string;
+  issuedAt?: string;
+  expiresAt?: string;
+  payload: P;
+  "@context"?: unknown;
+  proof?: Proof;
+  /**
+   * Unrecognized top-level members. §7.2 says a consumer SHOULD preserve but
+   * MUST NOT act upon them, and §7.1 asks a forwarding producer to carry them
+   * through.
+   */
+  [k: string]: unknown;
+}
+
+/** The `payload` of an error response (SPEC.md §8.2). */
+export interface ErrorPayload {
+  code: string;
+  message?: string;
+  retryable: boolean;
+  retryAfter?: string;
+  details?: Record<string, unknown>;
+}
+
+/** A `trust-task-error` document. */
+export type ErrorResponse = TrustTaskDocument<ErrorPayload>;
+
+/**
+ * The per-specification declarations a consumer needs to apply SPEC §7.2 items
+ * 5b, 7 and 8. Generated modules export this as `SPEC` / `RESPONSE_SPEC`.
+ *
+ * Structurally typed on purpose, so the 285 generated modules need no import
+ * from this one.
+ */
+export interface SpecPolicy {
+  readonly typeUri: string;
+  /** §4.8.3 — opts out of the §4.8.2 audience-binding rule. */
+  readonly isBearer: boolean;
+  /** §7.3 item 8 — `proofRequirement.requirement` is REQUIRED. */
+  readonly isProofRequired: boolean;
+  /** §7.3 item 5 — the party filling `recipient` is REQUIRED. */
+  readonly isRecipientRequired: boolean;
+}
+
+/** Why a consumer rejected a document, and the §8.3 code it maps to. */
+export interface RejectReason {
+  code: StandardCode;
+  message: string;
+  retryable: boolean;
+  retryAfter?: string;
+  details?: Record<string, unknown>;
+}
+
+/** The Type URI a consumer emits error responses under. */
+export const TRUST_TASK_ERROR_TYPE_URI = "https://trusttasks.org/spec/trust-task-error/0.2";
+
+/**
+ * SPEC §7.2 items 4 and 5a — expiry and wrong-recipient.
+ *
+ * ⚠ This is *not* the full §7.2 check. Items 1–3 (framework schema, payload
+ * schema, unknown `type`) belong to the caller's parse and dispatch; items 5b,
+ * 7 and 8 need the specification's policy and live in
+ * {@link enforceSpecPolicy}. {@link consumeInbound} bundles 4–8.
+ *
+ * @param now Milliseconds since the epoch, as from `Date.now()`.
+ */
+export function validateBasic<P>(
+  doc: TrustTaskDocument<P>,
+  now: number,
+  myVid: string,
+): RejectReason | null {
+  if (doc.expiresAt !== undefined) {
+    const expiresAt = Date.parse(doc.expiresAt);
+    if (Number.isNaN(expiresAt)) {
+      return {
+        code: "malformedRequest",
+        message: "expiresAt is not a valid RFC 3339 timestamp",
+        retryable: false,
+      };
+    }
+    // §4.2 / §7.2 item 4: inclusive bound — `now >= expiresAt` is expired.
+    if (expiresAt <= now) {
+      return {
+        code: "expired",
+        message: `document expired at ${doc.expiresAt}`,
+        retryable: false,
+      };
+    }
+  }
+
+  if (doc.recipient !== undefined && doc.recipient !== myVid) {
+    return {
+      code: "wrongRecipient",
+      message: "in-band recipient does not identify this consumer",
+      retryable: false,
+    };
+  }
+
+  return null;
+}
+
+/**
+ * SPEC §7.2 item 8 — a proof-bearing document on a non-bearer specification
+ * must carry an in-band `recipient`, so the proof binds the audience as well as
+ * the content (§4.8.2).
+ */
+export function enforceAudienceBinding<P>(
+  doc: TrustTaskDocument<P>,
+  spec: SpecPolicy,
+): RejectReason | null {
+  if (doc.proof !== undefined && doc.recipient === undefined && !spec.isBearer) {
+    return {
+      code: "malformedRequest",
+      message:
+        "proof present with no in-band recipient on a non-bearer specification " +
+        "(SPEC §4.8.2 audience binding)",
+      retryable: false,
+    };
+  }
+  return null;
+}
+
+/**
+ * The policy-driven subset of SPEC §7.2 — items 5b, 7 clause A, and 8.
+ *
+ * Single source of truth for the flag-driven checks, so a binding-specific
+ * pipeline and {@link consumeInbound} cannot diverge on the check set. Ordering
+ * matches trust-tasks-rs `enforce_spec_policy`: recipient, then proof, then
+ * audience binding.
+ */
+export function enforceSpecPolicy<P>(
+  doc: TrustTaskDocument<P>,
+  spec: SpecPolicy,
+): RejectReason | null {
+  if (doc.recipient === undefined && spec.isRecipientRequired) {
+    return {
+      code: "malformedRequest",
+      message:
+        "specification declares recipient REQUIRED but the document carries no in-band recipient",
+      retryable: false,
+    };
+  }
+  if (doc.proof === undefined && spec.isProofRequired) {
+    return {
+      code: "proofRequired",
+      message: "specification declares proof REQUIRED but the document carries none",
+      retryable: false,
+    };
+  }
+  return enforceAudienceBinding(doc, spec);
+}
+
+/**
+ * Build the error response for `request`, addressed to an explicit `recipient`.
+ *
+ * ⚠ Prefer {@link rejectWith} for ordinary refusals. This form exists for
+ * `identityMismatch`, where §8.1 forbids addressing the contested in-band
+ * issuer — see `TransportHandler.reject` in ./transport.js, which applies that rule.
+ */
+export function rejectWithRecipient<P>(
+  request: TrustTaskDocument<P>,
+  id: string,
+  payload: ErrorPayload,
+  recipient: string | undefined,
+  now: () => string = () => new Date().toISOString(),
+): ErrorResponse {
+  return {
+    id,
+    // §4.9: continue the thread, falling back to the request's own id.
+    threadId: request.threadId ?? request.id,
+    type: TRUST_TASK_ERROR_TYPE_URI,
+    issuer: request.recipient,
+    recipient,
+    issuedAt: now(),
+    payload,
+  };
+}
+
+/**
+ * Build the error response for `request`, addressed to its original producer.
+ *
+ * ⚠ Not safe under a rejection that contests the in-band identity: it copies
+ * `request.issuer` into `recipient`, which under `identityMismatch` is the
+ * contested value §8.1 says MUST NOT be addressed. Use
+ * `TransportHandler.reject` (./transport.js) for those.
+ */
+export function rejectWith<P>(
+  request: TrustTaskDocument<P>,
+  id: string,
+  payload: ErrorPayload,
+  now?: () => string,
+): ErrorResponse {
+  return rejectWithRecipient(request, id, payload, request.issuer, now);
+}
+
+/** Turn a {@link RejectReason} into the §8.2 payload it maps to. */
+export function toErrorPayload(reason: RejectReason): ErrorPayload {
+  const payload: ErrorPayload = {
+    code: reason.code,
+    message: reason.message,
+    retryable: reason.retryable,
+  };
+  if (reason.retryAfter !== undefined) payload.retryAfter = reason.retryAfter;
+  if (reason.details !== undefined) payload.details = reason.details;
+  return payload;
+}
+
+/**
+ * Build the success-response document for `request`, per SPEC §4.4.1 — the
+ * request's Type URI with the `#response` fragment, the parties swapped, and
+ * the thread continued.
+ */
+export function respondWith<P, R>(
+  request: TrustTaskDocument<P>,
+  id: string,
+  payload: R,
+  now: () => string = () => new Date().toISOString(),
+): TrustTaskDocument<R> {
+  const bare = request.type.split("#")[0]!;
+  return {
+    id,
+    threadId: request.threadId ?? request.id,
+    type: `${bare}#response`,
+    issuer: request.recipient,
+    recipient: request.issuer,
+    issuedAt: now(),
+    payload,
+  };
+}

package/src/_runtime/index.ts

@@ -0,0 +1,60 @@
+/**
+ * The Trust Tasks framework runtime for TypeScript — the SPEC.md §7.2 consumer
+ * pipeline, the document envelope, and the transport seam.
+ *
+ * Hand-written, unlike everything else under `src/`, which is generated from
+ * the spec registry. Kept in the same package so a consumer gets the types and
+ * the checks that make them meaningful from one install, as trust-tasks-rs
+ * does.
+ *
+ * The entry point is {@link consumeInbound}.
+ */
+
+export {
+  TRUST_TASK_ERROR_TYPE_URI,
+  enforceAudienceBinding,
+  enforceSpecPolicy,
+  rejectWith,
+  rejectWithRecipient,
+  respondWith,
+  toErrorPayload,
+  validateBasic,
+  type ErrorPayload,
+  type ErrorResponse,
+  type Proof,
+  type RejectReason,
+  type SpecPolicy,
+  type TrustTaskDocument,
+} from "./document.js";
+
+export {
+  STANDARD_CODES,
+  extendedCode,
+  familyCode,
+  isStandardCode,
+  normalizeCode,
+  slugFromTypeUri,
+  type StandardCode,
+} from "./codes.js";
+
+export {
+  StaticTransport,
+  UnauthenticatedTransport,
+  identityMismatchReason,
+  reject,
+  resolveParties,
+  type ConsistencyError,
+  type ResolvedParties,
+  type TransportContext,
+  type TransportHandler,
+} from "./transport.js";
+
+export {
+  PROOF_NOT_ACCEPTED_BY_POLICY,
+  consumeInbound,
+  refuse,
+  type ConsumeOptions,
+  type ConsumeOutcome,
+  type ProofPolicy,
+  type ProofVerifier,
+} from "./consume.js";