@openvtc/trust-tasks 0.3.0 → 0.4.0

package/dist/task-consent/decision/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/task-consent/decision/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC;AAK3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/task-consent/decision/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC;AAK3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/dist/task-consent/granted/0.1/payload.d.ts

@@ -2,6 +2,10 @@
  * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
  * Source: specs/task-consent/granted/0.1/payload.schema.json
  */
+/**
+ * The salted wire digest of the approved task — the same value the matching task-consent/request carried and the decision echoed. The requester already holds it; it is repeated here only so the requester can correlate the notice to the pending task it should now re-submit. It confers nothing: the executor's single-use grant lookup at re-submit is the authorization.
+ */
+export type DigestMultibase = string;
 /**
  * Fire-and-forget notice from the executor to the requester that its pending task has reached the approval threshold and a single-use grant is waiting, so the requester re-submits at once instead of polling. Non-load-bearing by design: the grant check at re-submit is the real gate, so a lost or spurious notice costs at most one poll cycle.
  */
@@ -10,10 +14,7 @@ export interface TaskConsentGrantedPayload {
      * Always `granted`. A denial sends no notice — the requester's re-submit discovers it, and a notice that could carry a denial would tempt a consumer into treating this advisory channel as the authoritative outcome, which it is not.
      */
     status: "granted";
-    /**
-     * The salted wire digest of the approved task — the same value the matching task-consent/request carried and the decision echoed. The requester already holds it; it is repeated here only so the requester can correlate the notice to the pending task it should now re-submit. It confers nothing: the executor's single-use grant lookup at re-submit is the authorization.
-     */
-    payloadDigest: string;
+    payloadDigest: DigestMultibase;
     /**
      * Type URI of the approved task, for correlation and display at the requester. Advisory on the same terms as the digest — the executor re-derives everything it enforces from the re-submitted payload itself.
      */
@@ -29,7 +30,7 @@ export interface Ext {
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/task-consent/granted/0.1";
 /** Stable alias for this specification's request payload shape. */
-export type Payload = TaskConsentGrantedPayload;
+export type Payload = DigestMultibase;
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are

package/dist/task-consent/granted/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/task-consent/granted/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,sDAA+D,CAAC;AAExF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/task-consent/granted/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,eAAe,CAAC;IAC/B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,sDAA+D,CAAC;AAExF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,eAAe,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC"}

package/dist/task-consent/granted/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/task-consent/granted/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2BH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAA+D,CAAC;AAKxF;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/task-consent/granted/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6BH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAA+D,CAAC;AAKxF;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/dist/task-consent/request/0.1/payload.d.ts

@@ -2,6 +2,10 @@
  * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
  * Source: specs/task-consent/request/0.1/payload.schema.json
  */
+/**
+ * The binding between what the approver sees and what executes. Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the payload, the task type, and the `challenge` as salt. The decision echoes it; the executor re-derives it from the payload it is about to run and refuses on mismatch. Salted because an unsalted digest over a low-entropy payload is a confirmation oracle for anyone who observes it in transit.
+ */
+export type DigestMultibase = string;
 /**
  * The executor asks an enrolled approver device to authorize one pending privileged task, presenting the effects it computed by dry-running the real handler against its own prior state. The executor signs this document; the approver renders only what it verifies under that signature.
  */
@@ -14,10 +18,7 @@ export interface TaskConsentRequestPayload {
      * Type URI of the task awaiting approval. It is bound into `payloadDigest`: without that binding, two tasks whose payloads canonicalize identically would share a digest, and an approval for a benign task would authorize a destructive one.
      */
     taskType: string;
-    /**
-     * The binding between what the approver sees and what executes. Digest of the canonical (RFC 8785 JCS) payload, the task type, and the `challenge` as salt. The decision echoes it; the executor re-derives it from the payload it is about to run and refuses on mismatch. Salted because an unsalted digest over a low-entropy payload is a confirmation oracle for anyone who observes it in transit.
-     */
-    payloadDigest: string;
+    payloadDigest: DigestMultibase;
     /**
      * Authoritative SPEC §7.3 item 13 side-effect class of the pending task, derived by the executor from the compiled handler it is about to invoke. NEVER taken from the registry: a registry that decided this would be a consent kill-switch, downgradeable by publishing a new version with a weaker class.
      */
@@ -154,7 +155,7 @@ export interface TaskConsentRequestResponsePayload {
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/task-consent/request/0.1";
 /** Stable alias for this specification's request payload shape. */
-export type Payload = TaskConsentRequestPayload;
+export type Payload = DigestMultibase;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/task-consent/request/0.1#response";
 /** Stable alias for this specification's success-response payload shape. */

package/dist/task-consent/request/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/task-consent/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,CAAC;IACjD,QAAQ,EAAE,QAAQ,CAAC;IACnB;;OAEG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB;AACD;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;IACF;;OAEG;IACH,KAAK,CAAC,EAAE;QACN,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;IACF;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;CACH;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;OAEG;IACH,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,sDAA+D,CAAC;AAExF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAEhD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,+DAAwE,CAAC;AAE1G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/task-consent/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,eAAe,CAAC;IAC/B;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,CAAC;IACjD,QAAQ,EAAE,QAAQ,CAAC;IACnB;;OAEG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB;AACD;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;IACF;;OAEG;IACH,KAAK,CAAC,EAAE;QACN,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;IACF;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;CACH;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;OAEG;IACH,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,sDAA+D,CAAC;AAExF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,eAAe,CAAC;AAEtC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,+DAAwE,CAAC;AAE1G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}

package/dist/task-consent/request/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/task-consent/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwJH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAA+D,CAAC;AAKxF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,+DAAwE,CAAC;AAK1G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/task-consent/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA0JH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAA+D,CAAC;AAKxF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,+DAAwE,CAAC;AAK1G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/dist/vta/credentials/issue/0.1/payload.d.ts

@@ -37,6 +37,8 @@ export interface Ext {
 }
 /**
  * The success response to a vta/credentials/issue request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vta/credentials/issue/0.1#response.
+ *
+ * This is the credentials/_shared IssuedCredential shape — same members, same required set — plus `supersedes` and `ext`. It states them inline rather than `$ref`-ing the shared definition because that definition sets `additionalProperties: false`, which under `allOf` would reject the two extra members. The shared CredentialId is still referenced. Keep the two in step by hand if either changes.
  */
 export interface VTACredentialsIssueResponsePayload {
     credentialId: CredentialId;

package/dist/vta/credentials/issue/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/vta/credentials/issue/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,EAAE,CAAC;IACX;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,UAAU,EAAE,EAAE,CAAC;IACf;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,YAAY,CAAC;AAEnC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/vta/credentials/issue/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,EAAE,CAAC;IACX;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;;;GAIG;AACH,MAAM,WAAW,kCAAkC;IACjD,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,UAAU,EAAE,EAAE,CAAC;IACf;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,YAAY,CAAC;AAEnC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}

package/dist/vta/credentials/issue/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vta/credentials/issue/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA8DH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC;AAK3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vta/credentials/issue/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgEH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC;AAK3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/dist/vta/credentials/issue/0.2/payload.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/credentials/issue/0.2/payload.schema.json
+ */
+/**
+ * The success response to a vta/credentials/issue request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vta/credentials/issue/0.1#response.
+ *
+ * Composed from the shared IssuedCredential rather than restating it: that definition is the issuance receipt every issuer returns, and duplicating it here let the two drift silently. `unevaluatedProperties` closes the object after the `allOf` is applied, which is what makes the composition possible at all — `additionalProperties` is evaluated per-subschema against the whole object and would reject `supersedes` and `ext`.
+ */
+export type VTACredentialsIssueResponsePayload = IssuedCredentialBase;
+/**
+ * Stable identifier for an issued credential — the handle for revocation and audit. Opaque to the holder: it MUST be echoed verbatim when revoking and MUST NOT be parsed.
+ */
+export type CredentialId = string;
+export interface VTACredentialsIssuePayload {
+    /**
+     * DID of the credential's subject/holder (becomes credentialSubject.id).
+     */
+    holder: string;
+    /**
+     * The scoped claims to attest — the share's scope. Opaque to the framework; non-empty.
+     */
+    claims: {};
+    /**
+     * Additional credential type beyond VerifiableCredential (e.g. ScopedShareCredential). Some values name a claims profile defined by this specification (e.g. GovernancePolicyCredential), which constrains the shape of `claims`.
+     */
+    credentialType?: string;
+    /**
+     * Credential lifetime in seconds from issuance. The issuer MAY cap this.
+     */
+    validitySeconds: number;
+    /**
+     * Optional human-readable rationale, recorded for audit.
+     */
+    purpose?: string;
+    ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+    [k: string]: unknown | undefined;
+}
+/**
+ * The members of an issuance receipt, deliberately left **open** so a consuming specification can `$ref` it under `allOf` and add its own, then close the result with `unevaluatedProperties: false`.
+ *
+ * A closure inside this definition would defeat that. Both `additionalProperties` and `unevaluatedProperties` are evaluated against the whole instance from within the subschema that declares them, and neither can see members the *outer* schema matched — so either one here rejects the consumer's extras. Only an `unevaluatedProperties` at the outer level sees everything the composition matched. Use `IssuedCredential` where a closed standalone shape is wanted.
+ */
+export interface IssuedCredentialBase {
+    credentialId: CredentialId;
+    /**
+     * The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework.
+     */
+    credential: {};
+    /**
+     * When the credential was minted.
+     */
+    issuedAt?: string;
+    /**
+     * When the credential's validUntil falls due.
+     */
+    expiresAt: string;
+}
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vta/credentials/issue/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTACredentialsIssueResponsePayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vta/credentials/issue/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTACredentialsIssueResponsePayload;
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/credentials/issue/0.2";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/credentials/issue/0.2#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/vta/credentials/issue/0.2/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/vta/credentials/issue/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,MAAM,kCAAkC,GAAG,oBAAoB,CAAC;AACtE;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,EAAE,CAAC;IACX;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,UAAU,EAAE,EAAE,CAAC;IACf;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,kCAAkC,CAAC;AAEzD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}

package/dist/vta/credentials/issue/0.2/payload.js

@@ -0,0 +1,31 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/credentials/issue/0.2/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vta/credentials/issue/0.2";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/credentials/issue/0.2#response";
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+};
+//# sourceMappingURL=payload.js.map

package/dist/vta/credentials/issue/0.2/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vta/credentials/issue/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA+DH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC;AAK3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/dist/vtc/relationships/request/0.1/payload.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/relationships/request/0.1/payload.schema.json
+ */
+/**
+ * A member asks another member to issue them a Verifiable Relationship Credential. Everything here is a hint: the issuing member decides, and declines with a trust-task-error carrying `vtc/relationships/request:declined` rather than a bespoke rejection message.
+ */
+export interface VTCRelationshipsRequestPayload {
+    /**
+     * Why the requester is asking, in their own words, for the issuing member to weigh. A hint and not a term — the issuing member is under no obligation to honour it, and MUST NOT treat its absence as a defect. Free text reaching a human, so a producer SHOULD keep it to what it is willing to have quoted back.
+     */
+    reason?: string;
+    ext?: Ext;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext {
+    [k: string]: unknown | undefined;
+}
+/**
+ * The issued credential. Returned only where the issuing member agreed; a decline is a trust-task-error, not a response with an empty field.
+ */
+export interface VTCRelationshipsRequestResponsePayload {
+    /**
+     * A signed W3C Verifiable Relationship Credential (opaque here). Its issuer MUST be the issuing member — the party that signed this response — and its credentialSubject.id MUST name the requester. The same shape `vtc/relationships/publish` accepts, so a requester can lodge it with the community unchanged.
+     */
+    vrc: {};
+    /**
+     * SHA-256 of the returned VRC, for out-of-band integrity checks. Matches the digest `vtc/relationships/publish` reports once the credential is lodged, so the two can be tied together without re-hashing.
+     */
+    vrcSha256?: string;
+    ext?: Ext;
+}
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vtc/relationships/request/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCRelationshipsRequestPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vtc/relationships/request/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCRelationshipsRequestResponsePayload;
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/relationships/request/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/relationships/request/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/vtc/relationships/request/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/vtc/relationships/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,sCAAsC;IACrD;;OAEG;IACH,GAAG,EAAE,EAAE,CAAC;IACR;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAErD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oEAA6E,CAAC;AAE/G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}

package/dist/vtc/relationships/request/0.1/payload.js

@@ -0,0 +1,31 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/relationships/request/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/relationships/request/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/relationships/request/0.1#response";
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+};
+//# sourceMappingURL=payload.js.map

package/dist/vtc/relationships/request/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vtc/relationships/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiCH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2DAAoE,CAAC;AAK7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oEAA6E,CAAC;AAK/G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/_framework/0.3/framework.ts

@@ -0,0 +1,13 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/_framework/0.3/framework.schema.json
+ */
+
+/**
+ * Reusable $defs cross-referenced by individual Trust Task specifications. Not itself a Trust Task specification — the `_framework` directory is skipped by the registry build (folders starting with `_` are not discovered) and by the codegen (which only triggers on payload.schema.json). See SPEC.md §4.5.1 for the normative description of `ext`.
+ *
+ * Additive over 0.2: `Ext` is carried forward unchanged, and `DigestMultibase` is new. Specifications pinned to 0.2 remain valid; a draft specification re-pinning to 0.3 does so in place, errata-style, per SPEC.md §5.2 — the re-pin does not change any payload's effective wire shape.
+ */
+export interface TrustTasksFrameworkReusableJSONSchemaDefinitions {
+  [k: string]: unknown | undefined;
+}

package/src/audit/list/0.1/payload.ts

@@ -3,6 +3,15 @@
  * Source: specs/audit/list/0.1/payload.schema.json
  */
 
+/**
+ * Hash-chain link: the `entryHash` of the immediately-preceding entry. Present only on chained logs; its integrity is what audit/verify checks. Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the predecessor's immutable content — the same derivation as `entryHash`, so a verifier recomputes both the same way.
+ */
+export type DigestMultibase = string;
+/**
+ * Hash-chain commitment over this entry's immutable content. The next entry's `prevHash` points here. Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of that content; the canonicalization is what makes the commitment reproducible by a verifier that did not write the entry.
+ */
+export type DigestMultibase1 = string;
+
 export interface AuditListPayload {
   /**
    * Return only entries recorded at or after this time.
@@ -95,14 +104,8 @@ export interface AuditEnvelope {
    * Envelope-shape version at the maintainer, for consumers that need to reason about wire-shape evolution.
    */
   schemaVersion?: number;
-  /**
-   * Hash-chain link: the `entryHash` of the immediately-preceding entry. Present only on chained logs; its integrity is what audit/verify checks.
-   */
-  prevHash?: string;
-  /**
-   * Hash-chain commitment over this entry's immutable content. The next entry's `prevHash` points here.
-   */
-  entryHash?: string;
+  prevHash?: DigestMultibase;
+  entryHash?: DigestMultibase1;
   /**
    * Event-specific payload, keyed by `action`. Opaque to the framework; a consumer that does not recognise the action treats it as an unstructured record.
    */
@@ -116,7 +119,7 @@ export interface AuditEnvelope {
 export const TYPE_URI = "https://trusttasks.org/spec/audit/list/0.1" as const;
 
 /** Stable alias for this specification's request payload shape. */
-export type Payload = AuditListPayload;
+export type Payload = DigestMultibase;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/audit/list/0.1#response" as const;

package/src/audit/verify/0.1/payload.ts

@@ -3,6 +3,11 @@
  * Source: specs/audit/verify/0.1/payload.schema.json
  */
 
+/**
+ * The `entryHash` of the newest envelope reached, in the same multibase-multihash encoding the envelope carries it. Absent when the log is empty.
+ */
+export type DigestMultibase = string;
+
 /**
  * Request to verify the integrity of a maintainer's append-only audit hash chain. The request carries no parameters — verification is store-wide.
  */
@@ -39,10 +44,7 @@ export interface AuditVerifyResponsePayload {
    * Envelopes that could not be deserialized and so could not be checked. Reported at the same prominence as a break, not swallowed.
    */
   unparseableSkipped: number;
-  /**
-   * Hex `entryHash` of the newest envelope reached. Absent when the log is empty.
-   */
-  head?: string;
+  head?: DigestMultibase;
   chainBreak?: ChainBreak;
   ext?: Ext;
 }
@@ -68,7 +70,7 @@ export interface ChainBreak {
 export const TYPE_URI = "https://trusttasks.org/spec/audit/verify/0.1" as const;
 
 /** Stable alias for this specification's request payload shape. */
-export type Payload = AuditVerifyPayload;
+export type Payload = DigestMultibase;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/audit/verify/0.1#response" as const;

package/src/chat/message/0.1/payload.ts

@@ -3,6 +3,15 @@
  * Source: specs/chat/message/0.1/payload.schema.json
  */
 
+/**
+ * OPTIONAL. Multibase-encoded multihash over the attachment bytes, so the reference is itself verifiable and tamper-evident. Taken over the bytes as transferred, not over any JSON wrapper.
+ */
+export type DigestMultibase = string;
+/**
+ * Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the previous document, so a gap, reorder, or removal in the chain is detectable. The algorithm travels in the multihash rather than being fixed here.
+ */
+export type DigestMultibase1 = string;
+
 /**
  * A conversational message exchanged between an AI agent and a messaging-platform bridge. Signed by its author (via the document `proof`) and hash-linked to the previous message in the conversation (`prev`), so a third party can verify each message's author and ordering after the transport has closed — for audit and dispute resolution. Conversations and contacts are referenced by opaque, bridge-issued handles, never raw platform addresses.
  */
@@ -85,10 +94,7 @@ export interface AttachmentRef {
    * OPTIONAL. Size in bytes, if known ahead of fetch.
    */
   sizeBytes?: number;
-  /**
-   * OPTIONAL. Multihash digest of the attachment bytes, so the reference is itself verifiable and tamper-evident.
-   */
-  digest?: string;
+  digest?: DigestMultibase;
 }
 /**
  * OPTIONAL on the first message in a conversation; present on every message thereafter. Links to the previous message so the conversation forms a verifiable, ordered chain.
@@ -98,10 +104,7 @@ export interface ChainLink {
    * The `id` of the previous `chat/message` Trust Task document in this conversation.
    */
   id: string;
-  /**
-   * Multihash digest (e.g. `sha-256`) over the previous document, so a gap, reorder, or removal in the chain is detectable.
-   */
-  digest: string;
+  digest: DigestMultibase1;
 }
 /**
  * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
@@ -114,7 +117,7 @@ export interface Ext {
 export const TYPE_URI = "https://trusttasks.org/spec/chat/message/0.1" as const;
 
 /** Stable alias for this specification's request payload shape. */
-export type Payload = ChatMessagePayload;
+export type Payload = DigestMultibase;
 
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's

package/src/consent/request/1.0/payload.ts

@@ -3,6 +3,11 @@
  * Source: specs/consent/request/1.0/payload.schema.json
  */
 
+/**
+ * Optional multibase-encoded multihash over the rfc 8785 (jcs) canonicalization of the held first message, binding the request to concrete content.
+ */
+export type DigestMultibase = string;
+
 /**
  * A bridge asks the VTA whether an inbound conversation may reach an AI agent, prompting operator consent on first contact.
  */
@@ -20,10 +25,7 @@ export interface ConsentRequestPayload {
    * Optional operator-facing label (e.g. "Signal group 'Family'"). MUST NOT contain a raw platform address.
    */
   displayHint?: string;
-  /**
-   * Optional multihash digest of the held first message, binding the request to concrete content.
-   */
-  firstMessageDigest?: string;
+  firstMessageDigest?: DigestMultibase;
   /**
    * Optional VTA context path the bridge runs under, to scope approver resolution.
    */
@@ -80,7 +82,7 @@ export interface ConsentRequestResponsePayload {
 export const TYPE_URI = "https://trusttasks.org/spec/consent/request/1.0" as const;
 
 /** Stable alias for this specification's request payload shape. */
-export type Payload = ConsentRequestPayload;
+export type Payload = DigestMultibase;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/consent/request/1.0#response" as const;

package/src/credentials/_shared/0.2/credentials.ts

@@ -0,0 +1,15 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/credentials/_shared/0.2/credentials.schema.json
+ */
+
+/**
+ * The credential-minting core shared by every family that issues or revokes a Verifiable Credential (vta/credentials/*, vtc/endorsements/*, and future issuers). A family embeds these definitions rather than restating them, so the issuance receipt and the revocation receipt have one canonical shape across the registry. Families remain separate Trust Tasks because their trust semantics differ (approval plane, third-party verifiability, governance gating); only the mechanism is shared.
+ *
+ * Two levels of reuse are offered. A family whose response IS a receipt embeds `IssuedCredential` / `RevocationReceipt` whole, as vtc/endorsements does. A family whose response carries additional members alongside the receipt fields cannot do that — these definitions are `additionalProperties: false`, so composing one via `allOf` would reject the extra members — and instead references `CredentialId`, the identifier both receipts are keyed by, as vta/credentials does.
+ *
+ * `CredentialId` is hoisted and the other members are not, deliberately: it is the one field carrying a constraint worth stating once (non-empty), and the code generators mint a named type per `$def`, so hoisting a plain timestamp or the opaque credential object would wrap `expiresAt` and `credential` in newtypes for every consumer while deduplicating nothing but a description.
+ */
+export interface CredentialsSharedIssuanceAndRevocationDefinitions {
+  [k: string]: unknown | undefined;
+}

package/src/index.ts

@@ -7,6 +7,7 @@ export * from "./_runtime/index.js";
 
 export * as FrameworkShared_v0_1 from "./_framework/0.1/framework.js";
 export * as FrameworkShared_v0_2 from "./_framework/0.2/framework.js";
+export * as FrameworkShared_v0_3 from "./_framework/0.3/framework.js";
 export * as AclEntryShared_v0_1 from "./acl/_shared/0.1/acl-entry.js";
 export * as AclChangeRole_v0_1 from "./acl/change-role/0.1/payload.js";
 export * as AclGrant_v0_1 from "./acl/grant/0.1/payload.js";
@@ -70,6 +71,7 @@ export * as CredentialExchangePresent_v0_1 from "./credential-exchange/present/0
 export * as CredentialExchangeQuery_v0_1 from "./credential-exchange/query/0.1/payload.js";
 export * as CredentialExchangeRequest_v0_1 from "./credential-exchange/request/0.1/payload.js";
 export * as CredentialsShared_v0_1 from "./credentials/_shared/0.1/credentials.js";
+export * as CredentialsShared_v0_2 from "./credentials/_shared/0.2/credentials.js";
 export * as DeviceBindingShared_v0_1 from "./device/_shared/0.1/device-binding.js";
 export * as DeviceBindingShared_v0_2 from "./device/_shared/0.2/device-binding.js";
 export * as DeviceDisable_v0_1 from "./device/disable/0.1/payload.js";
@@ -241,6 +243,7 @@ export * as VtaContextsDidTemplatesList_v1_0 from "./vta/contexts/did-templates/
 export * as VtaContextsDidTemplatesRender_v1_0 from "./vta/contexts/did-templates/render/1.0/payload.js";
 export * as VtaContextsDidTemplatesUpdate_v1_0 from "./vta/contexts/did-templates/update/1.0/payload.js";
 export * as VtaCredentialsIssue_v0_1 from "./vta/credentials/issue/0.1/payload.js";
+export * as VtaCredentialsIssue_v0_2 from "./vta/credentials/issue/0.2/payload.js";
 export * as VtaCredentialsRevoke_v0_1 from "./vta/credentials/revoke/0.1/payload.js";
 export * as VtaDidTemplatesCreate_v1_0 from "./vta/did-templates/create/1.0/payload.js";
 export * as VtaDidTemplatesCreate_v2_0 from "./vta/did-templates/create/2.0/payload.js";
@@ -332,6 +335,7 @@ export * as VtcRegistryDiagnostics_v0_1 from "./vtc/registry/diagnostics/0.1/pay
 export * as VtcRelationshipsGraph_v0_1 from "./vtc/relationships/graph/0.1/payload.js";
 export * as VtcRelationshipsList_v0_1 from "./vtc/relationships/list/0.1/payload.js";
 export * as VtcRelationshipsPublish_v0_1 from "./vtc/relationships/publish/0.1/payload.js";
+export * as VtcRelationshipsRequest_v0_1 from "./vtc/relationships/request/0.1/payload.js";
 export * as VtcRelationshipsRevoke_v0_1 from "./vtc/relationships/revoke/0.1/payload.js";
 export * as VtcWebsiteFilesDelete_v0_1 from "./vtc/website/files/delete/0.1/payload.js";
 export * as VtcWebsiteFilesList_v0_1 from "./vtc/website/files/list/0.1/payload.js";