@openvtc/trust-tasks 0.27.9 → 0.28.1

package/CHANGELOG.md

@@ -11,6 +11,125 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.28.1 — 2026-10-28
+
+
+### Added
+
+- **vta/contexts/delete**: 1.1 — settle host copies first; abandonHostCopies (#967)
+
+1.0 removed every local record and reported a host copy it could not
+  remove in daemonCleanupErrors after the fact, so the caller learned that
+  DIDs were still resolving only once the records — and the keys that
+  could remove them — were gone. A DID whose hosting server was no longer
+  registered refused the whole deletion, with no way to complete it through
+  this task: a context whose host had gone for good could not be deleted.
+
+  1.1 settles every host copy before anything local is removed. A copy
+  that cannot be confirmed removed (host down, refusing, unanswered, or no
+  longer known to the VTA) refuses with the new
+  vta/contexts/delete:hostCleanupFailed — retryable, details pinned by a
+  detailsSchema listing each DID, its server and why — and nothing local
+  is deleted. A producer shows those DIDs to a human and asks whether to
+  wait for the host or retry with the new abandonHostCopies, which
+  completes the deletion and reports the abandoned copies in
+  daemonCleanupErrors. A host answering that it no longer holds the log has
+  removed it, so a retry after a partial settle completes. The consumer
+  SHOULD bound the time spent on hosts, in total, to answer within the
+  requester's timeout.
+
+  abandonHostCopies is an explicitness flag like force, not a privilege,
+  and a producer MUST NOT set it on a first attempt without being told to.
+  A 1.1 consumer still accepts 1.0 and answers it as 1.0 specifies.
+
+  Regenerated the Rust, TypeScript, Go and Dart bindings; 1.0 is now
+  marked superseded. The stale-reference fixer moved create/1.0 and
+  preview-delete/1.0's links to 1.1.
+
+## 0.28.0 — 2026-10-27
+
+
+### Added
+
+- **ts, go**: Trust-task-error/0.6 and the unsupportedExtension and indeterminate standard codes (#961)
+
+* feat(ts)!: trust-task-error/0.6 and the unsupportedExtension and indeterminate standard codes
+
+  Framework 0.7.0 added unsupportedExtension to the standard codes, and the
+  indeterminate ruling (SPEC §8.3) adds indeterminate: the recipient could
+  not decide because something it needed and does not control could not
+  be obtained or checked, which is neither a refusal nor a failed
+  verification. Both live in the closed code list of the trust-task-error
+  payload schema, so they need a new version.
+
+  - specs/trust-task-error/0.6: both codes appended to the enum, and
+    extends: "0.5", which the build checks. References to 0.5 across the
+    registry therefore stay current, and no other spec changes.
+  - All four libraries recognize both codes and emit 0.6:
+    trust_task_error_type_uri(), TRUST_TASK_ERROR_TYPE_URI,
+    TrustTaskErrorTypeURI and trustTaskErrorTypeUri move together.
+    Rust's StandardCode is hand-written (trust-task-error is in
+    SKIP_SLUGS) and gains UnsupportedExtension and Indeterminate, with
+    indeterminate retryable by default as §8.3 gives it.
+  - The HTTPS binding's status table maps unsupportedExtension to 422 and
+    indeterminate to 503, in the binding prose, trust-tasks-https and
+    trust_tasks_https. The Dart package spells the new codes out so it
+    still builds against a core that predates them.
+
+  Breaking for @openvtc/trust-tasks only: StandardCode is a closed union
+  there, so an exhaustive switch over it stops compiling. Rust's
+  StandardCode is #[non_exhaustive] and Go's and Dart's are open string
+  types, so the change is additive for them.
+
+  Part of trustoverip/dtgwg-trust-tasks-spec#42.
+
+- **registry**: Declare carried protocols in front matter (#959)
+
+SPEC §9.4 Carried Protocols and §7.3 item 23 add a carries front-matter
+  object naming the external protocol, version, defining reference and
+  operation a specification carries.
+
+  - spec.meta.schema.json accepts carries (all four members required).
+  - The build records it in registry.json and checks §9.4 rule 1 across
+    the tree: a slug carries one operation in every live version, and no
+    two slugs carry the same operation of the same protocol version.
+  - The spec page shows a Carries row linking the protocol.
+  - registry/authorization/0.2 and registry/recognition/0.2 declare that
+    they carry TRQP 2.0's authorization and recognition operations; their
+    TRQP field-name sections now say so and name the party mapping.
+  - CONTRIBUTING-SPECS gains "Carrying another protocol".
+  - SPEC.md is regenerated from canonical main (bdf2cdd), which this
+    needs for the §9.4 anchor.
+
+  Part of trustoverip/dtgwg-trust-tasks-spec#43.
+
+
+
+### Specifications
+
+- **policy**: A consent decision carries its quorum and self-approval rule (#960)
+
+policy/_shared/0.3 gave requireConsent.minApprovals a default of 1 and
+  requireConsent.excludeRequester a default of false. JSON Schema defaults
+  are annotations, but generators apply them, so a decision that omitted
+  either sent a quorum of one, or let the requester approve itself, with
+  nothing on the wire to show that nobody had chosen it. SPEC §6.6 rule 5
+  now forbids a governance default in a shared schema component.
+
+  - policy/_shared/0.4: both members required, defaults removed.
+    task-consent/request/0.1 already requires both, so the policy decision
+    and the consent request now agree.
+  - policy/evaluate/0.4: policy/evaluate/0.3 re-pinned to the new
+    component, which is its only change; the Security & Privacy section
+    gains the four sub-headings a new version must carry.
+  - policy/get/0.1 and policy/active/0.1 stay on 0.3: they use only
+    PolicyModule, which is unchanged.
+  - Stale references in task-consent prose moved to policy/evaluate/0.4.
+  - Rust, TypeScript, Go and Dart regenerated. 0.1 to 0.3 of
+    policy/evaluate are now marked superseded by 0.4.
+
+  Part of trustoverip/dtgwg-trust-tasks-spec#39.
+
 ## 0.27.9 — 2026-10-27
 
 

package/dist/_runtime/codes.d.ts

@@ -7,7 +7,7 @@
  * 0.1 peer.
  */
 /** The framework-defined standard error codes (SPEC.md §8.3). */
-export declare const STANDARD_CODES: readonly ["malformedRequest", "unsupportedType", "unsupportedVersion", "expired", "proofRequired", "proofInvalid", "permissionDenied", "wrongRecipient", "identityMismatch", "idConflict", "cancelled", "taskFailed", "unavailable", "internalError"];
+export declare const STANDARD_CODES: readonly ["malformedRequest", "unsupportedType", "unsupportedVersion", "expired", "proofRequired", "proofInvalid", "permissionDenied", "wrongRecipient", "identityMismatch", "idConflict", "cancelled", "taskFailed", "unavailable", "internalError", "unsupportedExtension", "indeterminate"];
 /**
  * The framework-defined standard error codes, as a **closed** union.
  *

package/dist/_runtime/codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../../src/_runtime/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,iEAAiE;AACjE,eAAO,MAAM,cAAc,uPAejB,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAuB3D;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,YAAY,CAEjE;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CASnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAepF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD"}
+{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../../src/_runtime/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,iEAAiE;AACjE,eAAO,MAAM,cAAc,gSAkBjB,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAuB3D;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,YAAY,CAEjE;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CASnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAepF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD"}

package/dist/_runtime/codes.js

@@ -23,6 +23,9 @@ export const STANDARD_CODES = [
     "taskFailed",
     "unavailable",
     "internalError",
+    // New in trust-task-error/0.6 (SPEC.md §4.5.2, §8.3).
+    "unsupportedExtension",
+    "indeterminate",
 ];
 /**
  * Framework 0.1 snake_case spellings, mapped to their 0.2 lowerCamelCase form.

package/dist/_runtime/codes.js.map

@@ -1 +1 @@
-{"version":3,"file":"codes.js","sourceRoot":"","sources":["../../src/_runtime/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,kBAAkB;IAClB,iBAAiB;IACjB,oBAAoB;IACpB,SAAS;IACT,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,aAAa;IACb,eAAe;CACP,CAAC;AA0CX;;;GAGG;AACH,MAAM,eAAe,GAA2C;IAC9D,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,mBAAmB,EAAE,oBAAoB;IACzC,cAAc,EAAE,eAAe;IAC/B,aAAa,EAAE,cAAc;IAC7B,iBAAiB,EAAE,kBAAkB;IACrC,eAAe,EAAE,gBAAgB;IACjC,iBAAiB,EAAE,kBAAkB;IACrC,WAAW,EAAE,YAAY;IACzB,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,YAAY;IACzB,cAAc,EAAE,eAAe;CAChC,CAAC;AAEF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACvC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAExC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAa;IACzD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,QAAQ,GAAG;YACzE,oEAAoE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,SAAiB,EAAE,KAAa;IAC1E,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,uBAAuB;YACvE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+CAA+C;YACtE,cAAc,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC"}
+{"version":3,"file":"codes.js","sourceRoot":"","sources":["../../src/_runtime/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,kBAAkB;IAClB,iBAAiB;IACjB,oBAAoB;IACpB,SAAS;IACT,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,aAAa;IACb,eAAe;IACf,sDAAsD;IACtD,sBAAsB;IACtB,eAAe;CACP,CAAC;AA0CX;;;GAGG;AACH,MAAM,eAAe,GAA2C;IAC9D,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,mBAAmB,EAAE,oBAAoB;IACzC,cAAc,EAAE,eAAe;IAC/B,aAAa,EAAE,cAAc;IAC7B,iBAAiB,EAAE,kBAAkB;IACrC,eAAe,EAAE,gBAAgB;IACjC,iBAAiB,EAAE,kBAAkB;IACrC,WAAW,EAAE,YAAY;IACzB,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,YAAY;IACzB,cAAc,EAAE,eAAe;CAChC,CAAC;AAEF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACvC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAExC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAa;IACzD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,QAAQ,GAAG;YACzE,oEAAoE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,SAAiB,EAAE,KAAa;IAC1E,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,uBAAuB;YACvE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+CAA+C;YACtE,cAAc,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC"}

package/dist/_runtime/document.d.ts

@@ -214,7 +214,7 @@ export interface RejectReason {
  * SHOULD accept it. (This comment said `0.3` while the value said `0.5`: the
  * value moved and the prose did not.)
  */
-export declare const TRUST_TASK_ERROR_TYPE_URI = "https://trusttasks.org/spec/trust-task-error/0.5";
+export declare const TRUST_TASK_ERROR_TYPE_URI = "https://trusttasks.org/spec/trust-task-error/0.6";
 /**
  * SPEC §7.2 items 4 and 5a — expiry and wrong-recipient.
  *

package/dist/_runtime/document.js

@@ -26,7 +26,7 @@ import { normalizeCode } from "./codes.js";
  * SHOULD accept it. (This comment said `0.3` while the value said `0.5`: the
  * value moved and the prose did not.)
  */
-export const TRUST_TASK_ERROR_TYPE_URI = "https://trusttasks.org/spec/trust-task-error/0.5";
+export const TRUST_TASK_ERROR_TYPE_URI = "https://trusttasks.org/spec/trust-task-error/0.6";
 /**
  * SPEC §7.2 items 4 and 5a — expiry and wrong-recipient.
  *

package/dist/_shared/components.d.ts

@@ -9558,6 +9558,45 @@ export interface PolicyDecision_PolicyV0_3 {
      */
     explanation?: string;
 }
+export interface PolicyDecision_PolicyV0_4 {
+    decision: "allow" | "deny" | "requireStepUp" | "requireConsent";
+    /**
+     * Vault-flow-specific. When decision == "allow" for a proxy-login/release request, whether the maintainer should proxy-login or release-for-fill. Default: proxy. Ignored for other task kinds.
+     */
+    mode?: "proxy" | "fill";
+    /**
+     * When decision == "requireStepUp", which method to demand.
+     */
+    stepUp?: {
+        method: "webauthnUv" | "pushApproval" | "totp";
+        ttlSeconds?: number;
+    };
+    /**
+     * When decision == "requireConsent", the approver constraint the enforcement point MUST satisfy — a signed consent decision from the named set, bound to the request's payloadDigest — before executing.
+     */
+    requireConsent?: {
+        /**
+         * Named set of enrolled approver devices permitted to approve this task (resolved by the enforcement point against its device registry).
+         */
+        approverSet: string;
+        /**
+         * REQUIRED, with no default: whether the requester may approve its own request is the community's choice, not this schema's (SPEC §6.6 rule 5). When true, the device that issued the request MUST NOT be accepted as the approver — forcing cross-device approval so a compromised requesting device cannot self-approve.
+         */
+        excludeRequester: boolean;
+        /**
+         * REQUIRED, with no default: the quorum is the community's choice, not this schema's (SPEC §6.6 rule 5), and an omitted quorum is malformedRequest rather than one. Number of distinct approvers from the set required before the task may execute.
+         */
+        minApprovals: number;
+    };
+    /**
+     * When decision == "allow", maximum lifetime of any issued session blob / released secret.
+     */
+    ttlSecondsCap?: number;
+    /**
+     * Human-readable explanation for diagnostic display.
+     */
+    explanation?: string;
+}
 /**
  * The structured input fed to a policy evaluator on every vault/proxy-login, vault/release, and policy/evaluate call.
  */