@openvtc/trust-tasks 0.27.5 → 0.27.6

package/src/vault/list/0.3/payload.ts

@@ -8,6 +8,8 @@ import type { AndroidApp_VaultV0_2 as AndroidApp, AttachmentRef_VaultV0_3 as Att
 
 /**
  * Query a vault maintainer for the metadata view of stored entries. All filters are AND-combined. Pagination is opaque-cursor based; the maintainer chooses page size within the caller's bound and its own ceiling. Secret material is NEVER returned by this task — even when the requesting consumer has VaultRead capability for the entry, the secret is only released via vault/release/0.1.
+ *
+ * @deprecated superseded by vault/list/0.4
  */
 export interface VaultListPayload {
   /**
@@ -73,6 +75,8 @@ export interface VaultListPayload {
 }
 /**
  * The success response to a vault/list request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vault/list/0.1#response.
+ *
+ * @deprecated superseded by vault/list/0.4
  */
 export interface VaultListResponsePayload {
   /**
@@ -103,13 +107,37 @@ export type { AndroidApp, AttachmentRef, Did, DigestMultibase, Ext, IosApp, Secr
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/list/0.3" as const;
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = "superseded by vault/list/0.4";
+
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated superseded by vault/list/0.4
+ */
 export type Payload = VaultListPayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vault/list/0.3#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated superseded by vault/list/0.4
+ */
 export type Response = VaultListResponsePayload;
 
 /**

package/src/vault/list/0.4/payload.ts

@@ -99,6 +99,22 @@ export type { AndroidApp, AttachmentRef, Did, DigestMultibase, Ext, IosApp, Secr
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/list/0.4" as const;
 
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
 /** Stable alias for this specification's request payload shape. */
 export type Payload = VaultListPayload;
 

package/src/vault/proxy-login/0.1/payload.ts

@@ -8,6 +8,8 @@ import type { AndroidApp_VaultV0_1 as AndroidApp, ConsumerContext, Did_VaultV0_1
 
 /**
  * Consumer requests that the vault maintainer perform a login at the bound third-party site on the consumer's behalf, using the entry's secret material WITHOUT releasing it to the consumer. The maintainer returns a SessionBlob in a pluggable cipher envelope (see vault/_shared/0.1/sealed-envelope) containing the resulting cookies/headers the consumer can use to operate the session — but never the long-term credential.
+ *
+ * @deprecated superseded by vault/proxy-login/0.2
  */
 export interface VaultProxyLoginPayload {
   /**
@@ -36,6 +38,7 @@ export interface VaultProxyLoginPayload {
   ttlSecondsHint?: number;
   ext?: Ext;
 }
+/** @deprecated superseded by vault/proxy-login/0.2 */
 export interface VaultProxyLoginResponsePayload {
   /**
    * Pluggable cipher envelope containing the SessionBlob cleartext (see `vault/_shared/0.1/session-blob`). The consumer unseals to recover cookies/headers, then injects into its browser session for the bound origin. Consumers reject envelope kinds they don't implement with `vault/proxy-login:envelopeUnsupported`.
@@ -50,13 +53,37 @@ export type { AndroidApp, ConsumerContext, Did, DidcommAuthcryptEnvelope, Ext, H
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/proxy-login/0.1" as const;
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = "superseded by vault/proxy-login/0.2";
+
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated superseded by vault/proxy-login/0.2
+ */
 export type Payload = VaultProxyLoginPayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vault/proxy-login/0.1#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated superseded by vault/proxy-login/0.2
+ */
 export type Response = VaultProxyLoginResponsePayload;
 
 /**

package/src/vault/proxy-login/0.2/payload.ts

@@ -50,6 +50,22 @@ export type { AndroidApp, ConsumerContext, Did, DidcommAuthcryptEnvelope, Ext, H
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/proxy-login/0.2" as const;
 
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
 /** Stable alias for this specification's request payload shape. */
 export type Payload = VaultProxyLoginPayload;
 

package/src/vault/release/0.1/payload.ts

@@ -8,6 +8,8 @@ import type { AndroidApp_VaultV0_1 as AndroidApp, ConsumerContext, Did_VaultV0_1
 
 /**
  * Consumer requests that the maintainer release the cleartext secret material of a vault entry. The response carries the secret in a pluggable cipher envelope (see vault/_shared/0.1/sealed-envelope); the cleartext shape is `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. This is the fallback when proxy-login is not viable (`vault/proxy-login:notProxyable`) or when the consumer needs the raw secret for a flow the maintainer cannot perform (e.g. autofill into a desktop app, copy-to-clipboard for offline use).
+ *
+ * @deprecated superseded by vault/release/0.2
  */
 export interface VaultReleasePayload {
   entryId: string;
@@ -29,6 +31,7 @@ export interface VaultReleasePayload {
   ttlSecondsHint?: number;
   ext?: Ext;
 }
+/** @deprecated superseded by vault/release/0.2 */
 export interface VaultReleaseResponsePayload {
   /**
    * Pluggable cipher envelope. Cleartext is a `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. Consumers reject envelope kinds they don't implement with `vault/release:envelopeUnsupported`.
@@ -51,13 +54,37 @@ export type { AndroidApp, ConsumerContext, Did, DidcommAuthcryptEnvelope, Ext, H
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/release/0.1" as const;
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = "superseded by vault/release/0.2";
+
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated superseded by vault/release/0.2
+ */
 export type Payload = VaultReleasePayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vault/release/0.1#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated superseded by vault/release/0.2
+ */
 export type Response = VaultReleaseResponsePayload;
 
 /**

package/src/vault/release/0.2/payload.ts

@@ -51,6 +51,22 @@ export type { AndroidApp, ConsumerContext, Did, DidcommAuthcryptEnvelope, Ext, H
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/release/0.2" as const;
 
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
 /** Stable alias for this specification's request payload shape. */
 export type Payload = VaultReleasePayload;
 

package/src/vault/sign-trust-task/0.1/payload.ts

@@ -8,6 +8,8 @@ import type { ConsumerContext, Ext, StepUpProof_VaultV0_1 as StepUpProof } from
 
 /**
  * Consumer asks the maintainer to attach a Data Integrity proof (eddsa-jcs-2022) to a Trust Task envelope, signing as the principal DID of a `did-self-issued` or `didcomm-peer` vault entry. The long-term signing key never leaves the maintainer. This is the per-envelope signing complement to `vault/proxy-login/0.1`'s session-credential minting: proxy-login mints a session at session-start; sign-trust-task signs individual follow-up tasks during the session.
+ *
+ * @deprecated superseded by vault/sign-trust-task/0.2
  */
 export interface VaultSignTrustTaskPayload {
   /**
@@ -65,6 +67,7 @@ export interface UnsignedTrustTaskEnvelope {
   };
   ext?: Ext;
 }
+/** @deprecated superseded by vault/sign-trust-task/0.2 */
 export interface VaultSignTrustTaskResponsePayload {
   /**
    * The supplied `unsignedEnvelope` with a Data Integrity `proof` attached. `proof.verificationMethod` is `<principalDid>#<signingKeyId>`; `proof.proofPurpose` is `assertionMethod` only when the envelope's `type` is a `https://trusttasks.org` request of `auth/step-up/approve-response`, `task-consent/decision` or `confirm/response` (the closed list of attestations), and `authentication` for every other, operational, document — decided by the maintainer from `type`, never by the consumer; `proof.cryptosuite` is `eddsa-jcs-2022`. All other members of the envelope (`id`, `type`, `issuer`, `recipient`, `issuedAt`, `expiresAt`, `payload`, `ext`) are unchanged from the request.
@@ -79,13 +82,37 @@ export type { ConsumerContext, Ext, StepUpProof };
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/sign-trust-task/0.1" as const;
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = "superseded by vault/sign-trust-task/0.2";
+
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated superseded by vault/sign-trust-task/0.2
+ */
 export type Payload = VaultSignTrustTaskPayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vault/sign-trust-task/0.1#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated superseded by vault/sign-trust-task/0.2
+ */
 export type Response = VaultSignTrustTaskResponsePayload;
 
 /**

package/src/vault/sign-trust-task/0.2/payload.ts

@@ -7,7 +7,7 @@ import type { ConsumerContext, Ext, StepUpProof_VaultV0_2 as StepUpProof } from
 
 
 /**
- * Consumer asks the maintainer to attach a Data Integrity proof (eddsa-jcs-2022) to a Trust Task envelope, signing as the principal DID of a `didSelfIssued` or `didcommPeer` vault entry. The long-term signing key never leaves the maintainer. This is the per-envelope signing complement to `vault/proxy-login/0.1`'s session-credential minting: proxy-login mints a session at session-start; sign-trust-task signs individual follow-up tasks during the session.
+ * Consumer asks the maintainer to attach a Data Integrity proof (eddsa-jcs-2022) to a Trust Task envelope, signing as the principal DID of a `didSelfIssued` or `didcommPeer` vault entry. The long-term signing key never leaves the maintainer. This is the per-envelope signing complement to `vault/proxy-login/0.2`'s session-credential minting: proxy-login mints a session at session-start; sign-trust-task signs individual follow-up tasks during the session.
  */
 export interface VaultSignTrustTaskPayload {
   /**
@@ -38,7 +38,7 @@ export interface UnsignedTrustTaskEnvelope {
    */
   threadId?: string;
   /**
-   * Type URI of the inner Trust Task (e.g. `https://trusttasks.org/spec/acl/grant/0.1`).
+   * Type URI of the inner Trust Task (e.g. `https://trusttasks.org/spec/acl/grant/0.2`).
    */
   type: string;
   /**
@@ -79,6 +79,22 @@ export type { ConsumerContext, Ext, StepUpProof };
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/sign-trust-task/0.2" as const;
 
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
 /** Stable alias for this specification's request payload shape. */
 export type Payload = VaultSignTrustTaskPayload;
 
@@ -101,7 +117,7 @@ export const PAYLOAD_SCHEMA = {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://trusttasks.org/spec/vault/sign-trust-task/0.2",
   "title": "Vault Sign Trust Task — payload",
-  "description": "Consumer asks the maintainer to attach a Data Integrity proof (eddsa-jcs-2022) to a Trust Task envelope, signing as the principal DID of a `didSelfIssued` or `didcommPeer` vault entry. The long-term signing key never leaves the maintainer. This is the per-envelope signing complement to `vault/proxy-login/0.1`'s session-credential minting: proxy-login mints a session at session-start; sign-trust-task signs individual follow-up tasks during the session.",
+  "description": "Consumer asks the maintainer to attach a Data Integrity proof (eddsa-jcs-2022) to a Trust Task envelope, signing as the principal DID of a `didSelfIssued` or `didcommPeer` vault entry. The long-term signing key never leaves the maintainer. This is the per-envelope signing complement to `vault/proxy-login/0.2`'s session-credential minting: proxy-login mints a session at session-start; sign-trust-task signs individual follow-up tasks during the session.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -159,7 +175,7 @@ export const PAYLOAD_SCHEMA = {
           "type": "string",
           "format": "uri",
           "minLength": 1,
-          "description": "Type URI of the inner Trust Task (e.g. `https://trusttasks.org/spec/acl/grant/0.1`)."
+          "description": "Type URI of the inner Trust Task (e.g. `https://trusttasks.org/spec/acl/grant/0.2`)."
         },
         "issuer": {
           "type": "string",
@@ -324,7 +340,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "type": "string",
           "format": "uri",
           "minLength": 1,
-          "description": "Type URI of the inner Trust Task (e.g. `https://trusttasks.org/spec/acl/grant/0.1`)."
+          "description": "Type URI of the inner Trust Task (e.g. `https://trusttasks.org/spec/acl/grant/0.2`)."
         },
         "issuer": {
           "type": "string",

package/src/vault/sync/0.1/payload.ts

@@ -8,6 +8,8 @@ import type { AclChangedEvent_SyncV0_1 as AclChangedEvent, AndroidApp_VaultV0_1
 
 /**
  * Consumer requests an incremental delta of vault changes since a given seq baseline. The maintainer returns an ordered list of upsert/delete/acl/policy events, followed by a new seq baseline the consumer SHOULD persist for the next sync. Pairs with sync/event/0.1 server-push notifications: a live consumer subscribes to push events; on reconnect after offline, it calls vault/sync to catch up.
+ *
+ * @deprecated superseded by vault/sync/0.3
  */
 export interface VaultSyncPayload {
   /**
@@ -24,6 +26,7 @@ export interface VaultSyncPayload {
   pageSize?: number;
   ext?: Ext;
 }
+/** @deprecated superseded by vault/sync/0.3 */
 export interface VaultSyncResponsePayload {
   /**
    * Ordered events; consumer applies in order. Each event carries its own `seq` (strictly monotonic, no gaps within a context). Shape is the same as sync/event/0.1's push form.
@@ -46,13 +49,37 @@ export type { AclChangedEvent, AndroidApp, AttachmentRef, Did, Ext, IosApp, Poli
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/sync/0.1" as const;
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = "superseded by vault/sync/0.3";
+
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated superseded by vault/sync/0.3
+ */
 export type Payload = VaultSyncPayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vault/sync/0.1#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated superseded by vault/sync/0.3
+ */
 export type Response = VaultSyncResponsePayload;
 
 /**

package/src/vault/sync/0.2/payload.ts

@@ -8,6 +8,8 @@ import type { AclChangedEvent_SyncV0_2 as AclChangedEvent, AndroidApp_VaultV0_2
 
 /**
  * Consumer requests an incremental delta of vault changes since a given seq baseline. The maintainer returns an ordered list of upsert/delete/acl/policy events, followed by a new seq baseline the consumer SHOULD persist for the next sync. Pairs with sync/event/0.1 server-push notifications: a live consumer subscribes to push events; on reconnect after offline, it calls vault/sync to catch up.
+ *
+ * @deprecated superseded by vault/sync/0.3
  */
 export interface VaultSyncPayload {
   /**
@@ -24,6 +26,7 @@ export interface VaultSyncPayload {
   pageSize?: number;
   ext?: Ext;
 }
+/** @deprecated superseded by vault/sync/0.3 */
 export interface VaultSyncResponsePayload {
   /**
    * Ordered events; consumer applies in order. Each event carries its own `seq` (strictly monotonic, no gaps within a context). Shape is the same as sync/event/0.1's push form.
@@ -46,13 +49,37 @@ export type { AclChangedEvent, AndroidApp, AttachmentRef, Did, Ext, IosApp, Poli
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/sync/0.2" as const;
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = "superseded by vault/sync/0.3";
+
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated superseded by vault/sync/0.3
+ */
 export type Payload = VaultSyncPayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vault/sync/0.2#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated superseded by vault/sync/0.3
+ */
 export type Response = VaultSyncResponsePayload;
 
 /**

package/src/vault/sync/0.3/payload.ts

@@ -7,7 +7,7 @@ import type { AclChangedEvent_SyncV0_2 as AclChangedEvent, AndroidApp_VaultV0_2
 
 
 /**
- * Consumer requests an incremental delta of vault changes since a given seq baseline. The maintainer returns an ordered list of upsert/delete/acl/policy events, followed by a new seq baseline the consumer SHOULD persist for the next sync. Pairs with sync/event/0.1 server-push notifications: a live consumer subscribes to push events; on reconnect after offline, it calls vault/sync to catch up.
+ * Consumer requests an incremental delta of vault changes since a given seq baseline. The maintainer returns an ordered list of upsert/delete/acl/policy events, followed by a new seq baseline the consumer SHOULD persist for the next sync. Pairs with sync/event/0.2 server-push notifications: a live consumer subscribes to push events; on reconnect after offline, it calls vault/sync to catch up.
  */
 export interface VaultSyncPayload {
   /**
@@ -26,7 +26,7 @@ export interface VaultSyncPayload {
 }
 export interface VaultSyncResponsePayload {
   /**
-   * Ordered events; consumer applies in order. Each event carries its own `seq` (strictly monotonic, no gaps within a context). Shape is the same as sync/event/0.1's push form.
+   * Ordered events; consumer applies in order. Each event carries its own `seq` (strictly monotonic, no gaps within a context). Shape is the same as sync/event/0.2's push form.
    */
   events: SyncEvent[];
   /**
@@ -46,6 +46,22 @@ export type { AclChangedEvent, AndroidApp, AttachmentRef, Did, Ext, IosApp, Poli
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/sync/0.3" as const;
 
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
 /** Stable alias for this specification's request payload shape. */
 export type Payload = VaultSyncPayload;
 
@@ -68,7 +84,7 @@ export const PAYLOAD_SCHEMA = {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://trusttasks.org/spec/vault/sync/0.3",
   "title": "Vault Sync — payload",
-  "description": "Consumer requests an incremental delta of vault changes since a given seq baseline. The maintainer returns an ordered list of upsert/delete/acl/policy events, followed by a new seq baseline the consumer SHOULD persist for the next sync. Pairs with sync/event/0.1 server-push notifications: a live consumer subscribes to push events; on reconnect after offline, it calls vault/sync to catch up.",
+  "description": "Consumer requests an incremental delta of vault changes since a given seq baseline. The maintainer returns an ordered list of upsert/delete/acl/policy events, followed by a new seq baseline the consumer SHOULD persist for the next sync. Pairs with sync/event/0.2 server-push notifications: a live consumer subscribes to push events; on reconnect after offline, it calls vault/sync to catch up.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
@@ -109,7 +125,7 @@ export const PAYLOAD_SCHEMA = {
           "items": {
             "$ref": "#/$defs/SyncEvent"
           },
-          "description": "Ordered events; consumer applies in order. Each event carries its own `seq` (strictly monotonic, no gaps within a context). Shape is the same as sync/event/0.1's push form."
+          "description": "Ordered events; consumer applies in order. Each event carries its own `seq` (strictly monotonic, no gaps within a context). Shape is the same as sync/event/0.2's push form."
         },
         "newSinceSeq": {
           "type": "integer",
@@ -610,7 +626,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "items": {
             "$ref": "#/$defs/SyncEvent"
           },
-          "description": "Ordered events; consumer applies in order. Each event carries its own `seq` (strictly monotonic, no gaps within a context). Shape is the same as sync/event/0.1's push form."
+          "description": "Ordered events; consumer applies in order. Each event carries its own `seq` (strictly monotonic, no gaps within a context). Shape is the same as sync/event/0.2's push form."
         },
         "newSinceSeq": {
           "type": "integer",

package/src/vault/upsert/0.1/payload.ts

@@ -8,6 +8,8 @@ import type { AndroidApp_VaultV0_1 as AndroidApp, AttachmentRef_VaultV0_1 as Att
 
 /**
  * Create a new vault entry or update an existing one. The secret material — if present — rides inside a pluggable cipher envelope (see `vault/_shared/0.1/sealed-envelope`), so the Trust Task carries ciphertext and an authenticator, not plaintext. Updates may be partial: any populated metadata field replaces the current value; omitted fields are left untouched; explicit null clears the field (per `clearFields`). Optimistic-concurrency check via `expectedVersion`.
+ *
+ * @deprecated superseded by vault/upsert/0.4
  */
 export interface VaultUpsertPayload {
   /**
@@ -44,6 +46,7 @@ export interface VaultUpsertPayload {
   clearFields?: ("notes" | "favicon" | "expiresAt" | "tags" | "selectors" | "customFieldNames")[];
   ext?: Ext;
 }
+/** @deprecated superseded by vault/upsert/0.4 */
 export interface VaultUpsertResponsePayload {
   entry: VaultEntry;
   /**
@@ -59,13 +62,37 @@ export type { AndroidApp, AttachmentRef, Did, DidcommAuthcryptEnvelope, Ext, Hpk
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/upsert/0.1" as const;
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = "superseded by vault/upsert/0.4";
+
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated superseded by vault/upsert/0.4
+ */
 export type Payload = VaultUpsertPayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vault/upsert/0.1#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated superseded by vault/upsert/0.4
+ */
 export type Response = VaultUpsertResponsePayload;
 
 /**