@openvtc/trust-tasks 0.27.8 → 0.28.0

package/dist/_runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/_runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,aAAa,GAQd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,UAAU,EACV,cAAc,EACd,aAAa,EACb,eAAe,GAEhB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,MAAM,EACN,cAAc,GAKf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,MAAM,GAQP,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EACL,cAAc,EACd,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,WAAW,EACX,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,GAElB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,cAAc,GAIf,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/_runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,aAAa,GAQd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,UAAU,EACV,cAAc,EACd,aAAa,EACb,eAAe,GAEhB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,MAAM,EACN,cAAc,GAKf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,MAAM,GAQP,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,kBAAkB,GAInB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EACL,cAAc,EACd,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,WAAW,EACX,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,GAElB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,cAAc,GAIf,MAAM,aAAa,CAAC"}

package/dist/_runtime/type-uri.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Parsed Trust Task *Type URI* — every form SPEC.md §6.1 defines: the public
+ * registry's canonical form, and the two shapes a third-party specification
+ * (SPEC.md §6.5) may use under any other authority:
+ *
+ * ```text
+ * https://trusttasks.org/spec/<slug>/<MAJOR.MINOR>          public registry
+ * <prefix>/spec/<slug>/<MAJOR.MINOR>                        path form (https, DID URL, …)
+ * urn:<NID>:<prefix>:spec:<slug-segments>:<MAJOR.MINOR>     URN form
+ * ```
+ *
+ * each optionally followed by `#request` or `#response` (§4.4.1). A Type URI
+ * whose scheme is `urn` must use the URN form, and every other scheme the path
+ * form; `http` is refused in every form. {@link formatTypeUri} reproduces the
+ * parsed string exactly — a Type URI is a name, compared by its whole string
+ * (§6.1), so the authority is kept verbatim and is part of identity: the same
+ * slug under two authorities is two specifications.
+ *
+ * Hand-written. Mirrors `type_uri.rs` in trust-tasks-rs, whose unit tests are
+ * the source of most of the vectors in `test/type-uri.test.ts`.
+ */
+/** The `#request` / `#response` fragment of a Type URI (SPEC §4.4.1). */
+export type TypeUriVariant = "request" | "response";
+/** A parsed Type URI. Plain data; build a string back with {@link formatTypeUri}. */
+export interface TypeUri {
+    /**
+     * Everything before `/spec/` (path form) or `:spec:` (URN form), verbatim —
+     * e.g. `https://trusttasks.org`, `did:web:acme.example`, `urn:example:tasks`.
+     */
+    readonly authority: string;
+    /** `"path"` — `<authority>/spec/<slug>/<M.N>`; `"urn"` — `<authority>:spec:<seg>:…:<M.N>`. */
+    readonly form: "path" | "urn";
+    /** The slug, `/`-separated in both forms (`payments:settle` in a URN is `payments/settle`). */
+    readonly slug: string;
+    readonly major: number;
+    readonly minor: number;
+    /** The fragment, or `null` when absent (semantically equivalent to `"request"`, §4.4.1). */
+    readonly variant: TypeUriVariant | null;
+}
+/** Why a string is not a Type URI — the cases of Rust's `ParseTypeUriError`. */
+export type TypeUriErrorKind = 
+/** No scheme, a malformed one, or `http` (refused in every form, §6.1). */
+"scheme"
+/** Neither the path form nor (for `urn:`) the URN form. */
+ | "shape"
+/** The slug fails the §6.1 grammar. */
+ | "slug"
+/** The slug is in the §6.1 reserved namespace and is not a framework slug. */
+ | "reservedSlug"
+/** The version is not `MAJOR.MINOR` (§5.1). */
+ | "version"
+/** A fragment other than `#request` / `#response`. */
+ | "fragment";
+/** Thrown by {@link parseTypeUri}. */
+export declare class TypeUriError extends Error {
+    readonly kind: TypeUriErrorKind;
+    /** The string that failed to parse (for `slug` / `version` / `fragment`, the offending part). */
+    readonly input: string;
+    constructor(kind: TypeUriErrorKind, input: string, message: string);
+}
+/** The public registry's authority. */
+export declare const REGISTRY_TYPE_URI_AUTHORITY = "https://trusttasks.org";
+/**
+ * The framework slugs permitted inside the §6.1 reservation. A third
+ * hand-maintained copy of `#/properties/slug/anyOf[1]/enum` in
+ * `specs/spec.meta.schema.json` (Rust's `is_allowed_framework_slug` is the
+ * second); `test/type-uri.test.ts` reads that file and fails if they disagree.
+ */
+export declare const FRAMEWORK_RESERVED_SLUGS: readonly string[];
+/**
+ * Parse a Type URI in any SPEC §6.1 form.
+ *
+ * @throws {TypeUriError} if `typeUri` is not one — its `kind` says why.
+ */
+export declare function parseTypeUri(typeUri: string): TypeUri;
+/** {@link parseTypeUri}, returning `null` instead of throwing. */
+export declare function tryParseTypeUri(typeUri: string): TypeUri | null;
+/**
+ * The string form of `uri`. For a value {@link parseTypeUri} returned, exactly
+ * the string it parsed.
+ */
+export declare function formatTypeUri(uri: TypeUri): string;
+/**
+ * A sibling of `uri` at `major.minor`: the same authority, form, slug and
+ * variant, only the version changed. A declared-extension chain (SPEC §5.2)
+ * names only versions, so this is how it is walked — and why a chain never
+ * crosses authorities. (Rust's `TypeUri::with_version`.)
+ */
+export declare function typeUriWithVersion(uri: TypeUri, major: number, minor: number): TypeUri;
+/**
+ * Whether `a` and `b` name versions of the same specification: the same
+ * authority, form and slug. Two Type URIs with the same slug under different
+ * authorities are different specifications (SPEC §6.1).
+ */
+export declare function sameSpecification(a: TypeUri, b: TypeUri): boolean;
+//# sourceMappingURL=type-uri.d.ts.map

package/dist/_runtime/type-uri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-uri.d.ts","sourceRoot":"","sources":["../../src/_runtime/type-uri.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,yEAAyE;AACzE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,CAAC;AAEpD,qFAAqF;AACrF,MAAM,WAAW,OAAO;IACtB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;CACzC;AAED,gFAAgF;AAChF,MAAM,MAAM,gBAAgB;AAC1B,2EAA2E;AACzE,QAAQ;AACV,2DAA2D;GACzD,OAAO;AACT,uCAAuC;GACrC,MAAM;AACR,8EAA8E;GAC5E,cAAc;AAChB,+CAA+C;GAC7C,SAAS;AACX,sDAAsD;GACpD,UAAU,CAAC;AAEf,sCAAsC;AACtC,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAMnE;AAED,uCAAuC;AACvC,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAOpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAQpD,CAAC;AA4BH;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAmFrD;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAO/D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAOlD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAEjE"}

package/dist/_runtime/type-uri.js

@@ -0,0 +1,194 @@
+/**
+ * Parsed Trust Task *Type URI* — every form SPEC.md §6.1 defines: the public
+ * registry's canonical form, and the two shapes a third-party specification
+ * (SPEC.md §6.5) may use under any other authority:
+ *
+ * ```text
+ * https://trusttasks.org/spec/<slug>/<MAJOR.MINOR>          public registry
+ * <prefix>/spec/<slug>/<MAJOR.MINOR>                        path form (https, DID URL, …)
+ * urn:<NID>:<prefix>:spec:<slug-segments>:<MAJOR.MINOR>     URN form
+ * ```
+ *
+ * each optionally followed by `#request` or `#response` (§4.4.1). A Type URI
+ * whose scheme is `urn` must use the URN form, and every other scheme the path
+ * form; `http` is refused in every form. {@link formatTypeUri} reproduces the
+ * parsed string exactly — a Type URI is a name, compared by its whole string
+ * (§6.1), so the authority is kept verbatim and is part of identity: the same
+ * slug under two authorities is two specifications.
+ *
+ * Hand-written. Mirrors `type_uri.rs` in trust-tasks-rs, whose unit tests are
+ * the source of most of the vectors in `test/type-uri.test.ts`.
+ */
+/** Thrown by {@link parseTypeUri}. */
+export class TypeUriError extends Error {
+    kind;
+    /** The string that failed to parse (for `slug` / `version` / `fragment`, the offending part). */
+    input;
+    constructor(kind, input, message) {
+        super(message);
+        this.name = "TypeUriError";
+        this.kind = kind;
+        this.input = input;
+    }
+}
+/** The public registry's authority. */
+export const REGISTRY_TYPE_URI_AUTHORITY = "https://trusttasks.org";
+const SCHEME_RE = /^[A-Za-z][A-Za-z0-9+.-]*$/;
+const SEGMENT_RE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+const VERSION_RE = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+const U32_MAX = 0xffff_ffff;
+/**
+ * The framework slugs permitted inside the §6.1 reservation. A third
+ * hand-maintained copy of `#/properties/slug/anyOf[1]/enum` in
+ * `specs/spec.meta.schema.json` (Rust's `is_allowed_framework_slug` is the
+ * second); `test/type-uri.test.ts` reads that file and fails if they disagree.
+ */
+export const FRAMEWORK_RESERVED_SLUGS = Object.freeze([
+    "trust-task",
+    "trust-task-error",
+    "trust-task-ok",
+    "trust-task-next-step",
+    "trust-task-discovery",
+    "trust-task-control",
+    "trust-ceremony-receipt",
+]);
+/** Whether `slug` is in the §6.1 reserved namespace `^trust-(task|ceremony)($|-|/)`. */
+function isReservedNamespace(slug) {
+    const first = slug.split("/")[0];
+    return ["trust-task", "trust-ceremony"].some((stem) => first === stem || first.startsWith(`${stem}-`));
+}
+/** Throws unless `slug` satisfies the §6.1 grammar and reservation. */
+function checkSlug(slug) {
+    if (slug.length === 0 || !slug.split("/").every((s) => SEGMENT_RE.test(s))) {
+        throw new TypeUriError("slug", slug, `slug ${JSON.stringify(slug)} does not satisfy SPEC §6.1 grammar`);
+    }
+    if (isReservedNamespace(slug) && !FRAMEWORK_RESERVED_SLUGS.includes(slug)) {
+        throw new TypeUriError("reservedSlug", slug, `slug ${JSON.stringify(slug)} is reserved per SPEC §6.1`);
+    }
+}
+function parseVersion(s) {
+    const m = VERSION_RE.exec(s);
+    const major = m ? Number(m[1]) : NaN;
+    const minor = m ? Number(m[2]) : NaN;
+    if (!(major <= U32_MAX && minor <= U32_MAX)) {
+        throw new TypeUriError("version", s, `version ${JSON.stringify(s)} must be MAJOR.MINOR per SPEC §5.1`);
+    }
+    return [major, minor];
+}
+/**
+ * Parse a Type URI in any SPEC §6.1 form.
+ *
+ * @throws {TypeUriError} if `typeUri` is not one — its `kind` says why.
+ */
+export function parseTypeUri(typeUri) {
+    if (typeof typeUri !== "string") {
+        throw new TypeUriError("scheme", String(typeUri), "a Type URI must be a string");
+    }
+    const hash = typeUri.indexOf("#");
+    const bare = hash < 0 ? typeUri : typeUri.slice(0, hash);
+    const fragment = hash < 0 ? null : typeUri.slice(hash + 1);
+    let variant = null;
+    if (fragment !== null) {
+        if (fragment !== "request" && fragment !== "response") {
+            throw new TypeUriError("fragment", fragment, `only #request and #response fragments are permitted in a Type URI (got #${fragment})`);
+        }
+        variant = fragment;
+    }
+    // SPEC §6.1: any absolute URI, but never `http` — an `http` Type URI would
+    // normalise a transport-downgrade path for a consumer that dereferences it.
+    const colon = bare.indexOf(":");
+    const scheme = colon < 0 ? "" : bare.slice(0, colon);
+    if (!SCHEME_RE.test(scheme) || scheme.toLowerCase() === "http") {
+        throw new TypeUriError("scheme", typeUri, `Type URI must have a scheme other than http (SPEC §6.1): ${JSON.stringify(typeUri)}`);
+    }
+    const shape = () => new TypeUriError("shape", typeUri, `Type URI must be <prefix>/spec/<slug>/<major.minor>, or ` +
+        `urn:<nid>:<prefix>:spec:<slug-segments>:<major.minor>: ${JSON.stringify(typeUri)}`);
+    let authority;
+    let slug;
+    let version;
+    let form;
+    if (scheme.toLowerCase() === "urn") {
+        // `urn:<NID>:<prefix>:spec:<seg>:…:<MAJOR.MINOR>` — the slug is the
+        // segments between the first `:spec:` and the version.
+        const at = bare.indexOf(":spec:");
+        if (at < 0)
+            throw shape();
+        authority = bare.slice(0, at);
+        const rest = bare.slice(at + ":spec:".length);
+        const parts = authority.split(":");
+        const nid = parts[1];
+        const ns = parts.slice(2).join(":");
+        if (!nid || !ns || rest.includes("/"))
+            throw shape();
+        const cut = rest.lastIndexOf(":");
+        if (cut < 0)
+            throw shape();
+        slug = rest.slice(0, cut).replace(/:/g, "/");
+        version = rest.slice(cut + 1);
+        form = "urn";
+    }
+    else {
+        // `<prefix>/spec/<slug>/<MAJOR.MINOR>` — an https authority (with an
+        // optional path prefix), a DID URL, or any other scheme's prefix.
+        const at = bare.indexOf("/spec/");
+        if (at < 0)
+            throw shape();
+        authority = bare.slice(0, at);
+        const afterScheme = authority.slice(scheme.length + 1);
+        if (afterScheme.replace(/^\/+/, "").length === 0 ||
+            (scheme.toLowerCase() === "https" && !afterScheme.startsWith("//"))) {
+            throw shape();
+        }
+        const rest = bare.slice(at + "/spec/".length);
+        // The version is the final '/' segment; everything before it is the slug.
+        const cut = rest.lastIndexOf("/");
+        if (cut < 0)
+            throw shape();
+        slug = rest.slice(0, cut);
+        version = rest.slice(cut + 1);
+        form = "path";
+    }
+    checkSlug(slug);
+    const [major, minor] = parseVersion(version);
+    return { authority, form, slug, major, minor, variant };
+}
+/** {@link parseTypeUri}, returning `null` instead of throwing. */
+export function tryParseTypeUri(typeUri) {
+    try {
+        return parseTypeUri(typeUri);
+    }
+    catch (e) {
+        if (e instanceof TypeUriError)
+            return null;
+        throw e;
+    }
+}
+/**
+ * The string form of `uri`. For a value {@link parseTypeUri} returned, exactly
+ * the string it parsed.
+ */
+export function formatTypeUri(uri) {
+    const v = `${uri.major}.${uri.minor}`;
+    const base = uri.form === "urn"
+        ? `${uri.authority}:spec:${uri.slug.replace(/\//g, ":")}:${v}`
+        : `${uri.authority}/spec/${uri.slug}/${v}`;
+    return uri.variant === null ? base : `${base}#${uri.variant}`;
+}
+/**
+ * A sibling of `uri` at `major.minor`: the same authority, form, slug and
+ * variant, only the version changed. A declared-extension chain (SPEC §5.2)
+ * names only versions, so this is how it is walked — and why a chain never
+ * crosses authorities. (Rust's `TypeUri::with_version`.)
+ */
+export function typeUriWithVersion(uri, major, minor) {
+    return { ...uri, major, minor };
+}
+/**
+ * Whether `a` and `b` name versions of the same specification: the same
+ * authority, form and slug. Two Type URIs with the same slug under different
+ * authorities are different specifications (SPEC §6.1).
+ */
+export function sameSpecification(a, b) {
+    return a.authority === b.authority && a.form === b.form && a.slug === b.slug;
+}
+//# sourceMappingURL=type-uri.js.map

package/dist/_runtime/type-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-uri.js","sourceRoot":"","sources":["../../src/_runtime/type-uri.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAqCH,sCAAsC;AACtC,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAmB;IAChC,iGAAiG;IACxF,KAAK,CAAS;IAEvB,YAAY,IAAsB,EAAE,KAAa,EAAE,OAAe;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,uCAAuC;AACvC,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAC9C,MAAM,UAAU,GAAG,+BAA+B,CAAC;AACnD,MAAM,UAAU,GAAG,oCAAoC,CAAC;AACxD,MAAM,OAAO,GAAG,WAAW,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACvE,YAAY;IACZ,kBAAkB;IAClB,eAAe;IACf,sBAAsB;IACtB,sBAAsB;IACtB,oBAAoB;IACpB,wBAAwB;CACzB,CAAC,CAAC;AAEH,wFAAwF;AACxF,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAClC,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACzG,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrC,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,IAAI,KAAK,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC,EAAE,WAAW,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,6BAA6B,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,GAA0B,IAAI,CAAC;IAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,QAAQ,EACR,2EAA2E,QAAQ,GAAG,CACvF,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAC/D,MAAM,IAAI,YAAY,CACpB,QAAQ,EACR,OAAO,EACP,4DAA4D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,GAAiB,EAAE,CAC/B,IAAI,YAAY,CACd,OAAO,EACP,OAAO,EACP,0DAA0D;QACxD,0DAA0D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CACtF,CAAC;IAEJ,IAAI,SAAiB,CAAC;IACtB,IAAI,IAAY,CAAC;IACjB,IAAI,OAAe,CAAC;IACpB,IAAI,IAAqB,CAAC;IAC1B,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QACnC,oEAAoE;QACpE,uDAAuD;QACvD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,EAAE,GAAG,CAAC;YAAE,MAAM,KAAK,EAAE,CAAC;QAC1B,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,KAAK,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,KAAK,EAAE,CAAC;QAC3B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,EAAE,GAAG,CAAC;YAAE,MAAM,KAAK,EAAE,CAAC;QAC1B,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvD,IACE,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAC5C,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EACnE,CAAC;YACD,MAAM,KAAK,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,0EAA0E;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,KAAK,EAAE,CAAC;QAC3B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;IAED,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,YAAY;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;IACtC,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,KAAK,KAAK;QAChB,CAAC,CAAC,GAAG,GAAG,CAAC,SAAS,SAAS,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;QAC9D,CAAC,CAAC,GAAG,GAAG,CAAC,SAAS,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;IAC/C,OAAO,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,KAAa,EAAE,KAAa;IAC3E,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAU,EAAE,CAAU;IACtD,OAAO,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC"}

package/dist/_shared/components.d.ts

@@ -9558,6 +9558,45 @@ export interface PolicyDecision_PolicyV0_3 {
      */
     explanation?: string;
 }
+export interface PolicyDecision_PolicyV0_4 {
+    decision: "allow" | "deny" | "requireStepUp" | "requireConsent";
+    /**
+     * Vault-flow-specific. When decision == "allow" for a proxy-login/release request, whether the maintainer should proxy-login or release-for-fill. Default: proxy. Ignored for other task kinds.
+     */
+    mode?: "proxy" | "fill";
+    /**
+     * When decision == "requireStepUp", which method to demand.
+     */
+    stepUp?: {
+        method: "webauthnUv" | "pushApproval" | "totp";
+        ttlSeconds?: number;
+    };
+    /**
+     * When decision == "requireConsent", the approver constraint the enforcement point MUST satisfy — a signed consent decision from the named set, bound to the request's payloadDigest — before executing.
+     */
+    requireConsent?: {
+        /**
+         * Named set of enrolled approver devices permitted to approve this task (resolved by the enforcement point against its device registry).
+         */
+        approverSet: string;
+        /**
+         * REQUIRED, with no default: whether the requester may approve its own request is the community's choice, not this schema's (SPEC §6.6 rule 5). When true, the device that issued the request MUST NOT be accepted as the approver — forcing cross-device approval so a compromised requesting device cannot self-approve.
+         */
+        excludeRequester: boolean;
+        /**
+         * REQUIRED, with no default: the quorum is the community's choice, not this schema's (SPEC §6.6 rule 5), and an omitted quorum is malformedRequest rather than one. Number of distinct approvers from the set required before the task may execute.
+         */
+        minApprovals: number;
+    };
+    /**
+     * When decision == "allow", maximum lifetime of any issued session blob / released secret.
+     */
+    ttlSecondsCap?: number;
+    /**
+     * Human-readable explanation for diagnostic display.
+     */
+    explanation?: string;
+}
 /**
  * The structured input fed to a policy evaluator on every vault/proxy-login, vault/release, and policy/evaluate call.
  */