@openvtc/trust-tasks 0.3.0 → 0.4.1

package/dist/task-consent/decision/0.1/payload.d.ts

@@ -2,10 +2,18 @@
  * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
  * Source: specs/task-consent/decision/0.1/payload.schema.json
  */
+/**
+ * Echoes the digest of the task being authorized, in the encoding `task-consent/request` carried it. The executor re-derives it from the payload it is about to execute and refuses on mismatch — this is what makes the approved payload the executed payload, cryptographically rather than by convention.
+ */
+export type DigestMultibase = string;
 /**
  * The approver's answer. `deny` aborts the pending request; a subsequent submit of the same task starts a fresh one.
  */
 export type Decision = "approve" | "deny";
+/**
+ * The digest this decision concerned, in the encoding `task-consent/request` carried it.
+ */
+export type DigestMultibase1 = string;
 /**
  * An enrolled approver authorizes (or refuses) one pending privileged task, bound to the exact payload it was shown. The proof on this document — not the transport session that carried it — is the authorization.
  */
@@ -14,10 +22,7 @@ export interface TaskConsentDecisionPayload {
      * Echoes the task-consent/request this decision answers, binding it to that one pending request. An executor MUST consume the challenge at execution rather than on receipt of this decision: a decision authorizes exactly one execution, and consuming it earlier lets an executor's own retry legitimately replay it.
      */
     challenge: string;
-    /**
-     * Echoes the digest of the task being authorized. The executor re-derives it from the payload it is about to execute and refuses on mismatch — this is what makes the approved payload the executed payload, cryptographically rather than by convention.
-     */
-    payloadDigest: string;
+    payloadDigest: DigestMultibase;
     decision: Decision;
     /**
      * OPTIONAL human-facing note, most useful on a `deny`.
@@ -39,10 +44,7 @@ export interface TaskConsentDecisionResponsePayload {
      * `granted` = the threshold is met and the requester's re-submit will now execute. `pending` = the approval was recorded but more are needed. `denied` = the request was aborted.
      */
     status: "granted" | "pending" | "denied";
-    /**
-     * The digest this decision concerned.
-     */
-    payloadDigest: string;
+    payloadDigest: DigestMultibase1;
     /**
      * Distinct approvals recorded so far.
      */
@@ -56,7 +58,7 @@ export interface TaskConsentDecisionResponsePayload {
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/task-consent/decision/0.1";
 /** Stable alias for this specification's request payload shape. */
-export type Payload = Decision;
+export type Payload = DigestMultibase;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/task-consent/decision/0.1#response";
 /** Stable alias for this specification's success-response payload shape. */

package/dist/task-consent/decision/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/task-consent/decision/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAE1C;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD;;OAEG;IACH,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACzC;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC;AAE/B,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/task-consent/decision/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AACrC;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAC1C;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEtC;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,eAAe,CAAC;IAC/B,QAAQ,EAAE,QAAQ,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD;;OAEG;IACH,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACzC,aAAa,EAAE,gBAAgB,CAAC;IAChC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,eAAe,CAAC;AAEtC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}

package/dist/task-consent/decision/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/task-consent/decision/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC;AAK3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/task-consent/decision/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyDH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC;AAK3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/dist/task-consent/granted/0.1/payload.d.ts

@@ -2,6 +2,10 @@
  * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
  * Source: specs/task-consent/granted/0.1/payload.schema.json
  */
+/**
+ * The salted wire digest of the approved task — the same value the matching task-consent/request carried and the decision echoed. The requester already holds it; it is repeated here only so the requester can correlate the notice to the pending task it should now re-submit. It confers nothing: the executor's single-use grant lookup at re-submit is the authorization.
+ */
+export type DigestMultibase = string;
 /**
  * Fire-and-forget notice from the executor to the requester that its pending task has reached the approval threshold and a single-use grant is waiting, so the requester re-submits at once instead of polling. Non-load-bearing by design: the grant check at re-submit is the real gate, so a lost or spurious notice costs at most one poll cycle.
  */
@@ -10,10 +14,7 @@ export interface TaskConsentGrantedPayload {
      * Always `granted`. A denial sends no notice — the requester's re-submit discovers it, and a notice that could carry a denial would tempt a consumer into treating this advisory channel as the authoritative outcome, which it is not.
      */
     status: "granted";
-    /**
-     * The salted wire digest of the approved task — the same value the matching task-consent/request carried and the decision echoed. The requester already holds it; it is repeated here only so the requester can correlate the notice to the pending task it should now re-submit. It confers nothing: the executor's single-use grant lookup at re-submit is the authorization.
-     */
-    payloadDigest: string;
+    payloadDigest: DigestMultibase;
     /**
      * Type URI of the approved task, for correlation and display at the requester. Advisory on the same terms as the digest — the executor re-derives everything it enforces from the re-submitted payload itself.
      */
@@ -29,7 +30,7 @@ export interface Ext {
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/task-consent/granted/0.1";
 /** Stable alias for this specification's request payload shape. */
-export type Payload = TaskConsentGrantedPayload;
+export type Payload = DigestMultibase;
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are

package/dist/task-consent/granted/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/task-consent/granted/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,sDAA+D,CAAC;AAExF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/task-consent/granted/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,eAAe,CAAC;IAC/B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,sDAA+D,CAAC;AAExF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,eAAe,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC"}

package/dist/task-consent/granted/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/task-consent/granted/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2BH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAA+D,CAAC;AAKxF;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/task-consent/granted/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6BH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAA+D,CAAC;AAKxF;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/dist/task-consent/request/0.1/payload.d.ts

@@ -2,6 +2,10 @@
  * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
  * Source: specs/task-consent/request/0.1/payload.schema.json
  */
+/**
+ * The binding between what the approver sees and what executes. Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the payload, the task type, and the `challenge` as salt. The decision echoes it; the executor re-derives it from the payload it is about to run and refuses on mismatch. Salted because an unsalted digest over a low-entropy payload is a confirmation oracle for anyone who observes it in transit.
+ */
+export type DigestMultibase = string;
 /**
  * The executor asks an enrolled approver device to authorize one pending privileged task, presenting the effects it computed by dry-running the real handler against its own prior state. The executor signs this document; the approver renders only what it verifies under that signature.
  */
@@ -14,10 +18,7 @@ export interface TaskConsentRequestPayload {
      * Type URI of the task awaiting approval. It is bound into `payloadDigest`: without that binding, two tasks whose payloads canonicalize identically would share a digest, and an approval for a benign task would authorize a destructive one.
      */
     taskType: string;
-    /**
-     * The binding between what the approver sees and what executes. Digest of the canonical (RFC 8785 JCS) payload, the task type, and the `challenge` as salt. The decision echoes it; the executor re-derives it from the payload it is about to run and refuses on mismatch. Salted because an unsalted digest over a low-entropy payload is a confirmation oracle for anyone who observes it in transit.
-     */
-    payloadDigest: string;
+    payloadDigest: DigestMultibase;
     /**
      * Authoritative SPEC §7.3 item 13 side-effect class of the pending task, derived by the executor from the compiled handler it is about to invoke. NEVER taken from the registry: a registry that decided this would be a consent kill-switch, downgradeable by publishing a new version with a weaker class.
      */
@@ -154,7 +155,7 @@ export interface TaskConsentRequestResponsePayload {
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/task-consent/request/0.1";
 /** Stable alias for this specification's request payload shape. */
-export type Payload = TaskConsentRequestPayload;
+export type Payload = DigestMultibase;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/task-consent/request/0.1#response";
 /** Stable alias for this specification's success-response payload shape. */

package/dist/task-consent/request/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/task-consent/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,CAAC;IACjD,QAAQ,EAAE,QAAQ,CAAC;IACnB;;OAEG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB;AACD;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;IACF;;OAEG;IACH,KAAK,CAAC,EAAE;QACN,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;IACF;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;CACH;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;OAEG;IACH,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,sDAA+D,CAAC;AAExF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAEhD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,+DAAwE,CAAC;AAE1G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/task-consent/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,eAAe,CAAC;IAC/B;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,CAAC;IACjD,QAAQ,EAAE,QAAQ,CAAC;IACnB;;OAEG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB;AACD;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;IACF;;OAEG;IACH,KAAK,CAAC,EAAE;QACN,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;IACF;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;KAClC,CAAC;CACH;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;OAEG;IACH,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,sDAA+D,CAAC;AAExF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,eAAe,CAAC;AAEtC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,+DAAwE,CAAC;AAE1G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}

package/dist/task-consent/request/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/task-consent/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwJH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAA+D,CAAC;AAKxF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,+DAAwE,CAAC;AAK1G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/task-consent/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA0JH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAA+D,CAAC;AAKxF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,+DAAwE,CAAC;AAK1G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/dist/trust-task-next-step/0.1/payload.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/trust-task-next-step/0.1/payload.schema.json
+ */
+/**
+ * The recipient-suggested continuation reserved at SPEC.md §8.6: the original task was understood, but cannot complete in isolation, and this names what the recipient party expects in order to proceed.
+ *
+ * A next step is neither a success response nor a failure. The originating task is left open — a consumer that means 'no' returns a trust-task-error instead, and one that means 'done' returns the originating specification's #response variant.
+ *
+ * This specification declares no response anchor: a producer answers a next step by issuing a document of the expected type, not by responding to this one.
+ */
+export interface TrustTaskNextStepPayload {
+    /**
+     * The continuations the recipient will accept, in the producer's order of preference where the recipient has one. More than one entry means ALTERNATIVES — satisfying any single entry unblocks the exchange, never all of them. A recipient that needs several things done first names the one it wants next and issues a further next step afterwards; expressing a conjunction here would be a flow definition, which belongs to a ceremony rather than to a single response.
+     *
+     * @minItems 1
+     */
+    expects: [
+        {
+            /**
+             * The Type URI of the Trust Task the recipient expects next, including any #request fragment. A suggestion only: it confers no authorization to perform that task, and the producer applies its own policy before acting (see the specification's Security & Privacy section).
+             */
+            typeUri: string;
+            /**
+             * Human-readable explanation of why this continuation is expected. Non-normative; intended for operator UI and logs.
+             */
+            reason?: string;
+            /**
+             * Optional structured data the producer MAY use when composing the expected document — a challenge to echo, an identifier to quote, a presentation definition to satisfy. Its shape is governed by the specification named in typeUri, not by this one. A producer MUST NOT treat a hint as authoritative for any value it can determine itself.
+             */
+            hint?: {};
+        },
+        ...{
+            /**
+             * The Type URI of the Trust Task the recipient expects next, including any #request fragment. A suggestion only: it confers no authorization to perform that task, and the producer applies its own policy before acting (see the specification's Security & Privacy section).
+             */
+            typeUri: string;
+            /**
+             * Human-readable explanation of why this continuation is expected. Non-normative; intended for operator UI and logs.
+             */
+            reason?: string;
+            /**
+             * Optional structured data the producer MAY use when composing the expected document — a challenge to echo, an identifier to quote, a presentation definition to satisfy. Its shape is governed by the specification named in typeUri, not by this one. A producer MUST NOT treat a hint as authoritative for any value it can determine itself.
+             */
+            hint?: {};
+        }[]
+    ];
+    /**
+     * What happens once an expected task completes. `resubmit` (the default) means the expected task is a PREREQUISITE and the producer re-issues the originating request to continue — a new document with a fresh id and the same threadId, which SPEC §8.4 distinguishes from a retry, since a retry is bit-for-bit identical and is not what happens here; this matches the established pattern of task-consent/granted, where the requester re-submits once approval lands. `proceed` means the expected task IS the continuation and the originating request is not re-issued, as in an offer answered by a request.
+     */
+    continuation?: "resubmit" | "proceed";
+    /**
+     * Identifies the Trust Task document this next step answers. SHOULD be populated, for the reason SPEC §8.2 gives for the identical member on an error response: threadId correlates the exchange only for a party that already saw the request, so a retained next step otherwise names neither the task it interrupted nor the instance.
+     */
+    inResponseTo?: {
+        /**
+         * The Type URI of the document being answered, including any fragment it carried.
+         */
+        typeUri: string;
+        /**
+         * The id of the specific document being answered (SPEC §4.3). Globally unique and never reused, so it names one instance where threadId names an exchange.
+         */
+        id?: string;
+    };
+    /**
+     * Human-readable description of why the task cannot complete in isolation. Non-normative. Subject to the same restraint as an error message: it reaches a party that may not be entitled to learn why.
+     */
+    message?: string;
+    ext?: Ext;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext {
+    [k: string]: unknown | undefined;
+}
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/trust-task-next-step/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = TrustTaskNextStepPayload;
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/trust-task-next-step/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/trust-task-next-step/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../src/trust-task-next-step/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,OAAO,EAAE;QACP;YACE;;eAEG;YACH,OAAO,EAAE,MAAM,CAAC;YAChB;;eAEG;YACH,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB;;eAEG;YACH,IAAI,CAAC,EAAE,EAAE,CAAC;SACX;QACD,GAAG;YACD;;eAEG;YACH,OAAO,EAAE,MAAM,CAAC;YAChB;;eAEG;YACH,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB;;eAEG;YACH,IAAI,CAAC,EAAE,EAAE,CAAC;SACX,EAAE;KACJ,CAAC;IACF;;OAEG;IACH,YAAY,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACtC;;OAEG;IACH,YAAY,CAAC,EAAE;QACb;;WAEG;QACH,OAAO,EAAE,MAAM,CAAC;QAChB;;WAEG;QACH,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;IACF;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,sDAA+D,CAAC;AAExF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,wBAAwB,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC"}

package/dist/trust-task-next-step/0.1/payload.js

@@ -0,0 +1,18 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/trust-task-next-step/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/trust-task-next-step/0.1";
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+};
+//# sourceMappingURL=payload.js.map

package/dist/trust-task-next-step/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../src/trust-task-next-step/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2EH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,sDAA+D,CAAC;AAKxF;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/dist/vta/credentials/issue/0.1/payload.d.ts

@@ -37,6 +37,8 @@ export interface Ext {
 }
 /**
  * The success response to a vta/credentials/issue request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vta/credentials/issue/0.1#response.
+ *
+ * This is the credentials/_shared IssuedCredential shape — same members, same required set — plus `supersedes` and `ext`. It states them inline rather than `$ref`-ing the shared definition because that definition sets `additionalProperties: false`, which under `allOf` would reject the two extra members. The shared CredentialId is still referenced. Keep the two in step by hand if either changes.
  */
 export interface VTACredentialsIssueResponsePayload {
     credentialId: CredentialId;

package/dist/vta/credentials/issue/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/vta/credentials/issue/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,EAAE,CAAC;IACX;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,UAAU,EAAE,EAAE,CAAC;IACf;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,YAAY,CAAC;AAEnC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/vta/credentials/issue/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,EAAE,CAAC;IACX;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;;;GAIG;AACH,MAAM,WAAW,kCAAkC;IACjD,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,UAAU,EAAE,EAAE,CAAC;IACf;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,YAAY,CAAC;AAEnC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}

package/dist/vta/credentials/issue/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vta/credentials/issue/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA8DH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC;AAK3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vta/credentials/issue/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgEH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC;AAK3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/dist/vta/credentials/issue/0.2/payload.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/credentials/issue/0.2/payload.schema.json
+ */
+/**
+ * The success response to a vta/credentials/issue request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vta/credentials/issue/0.1#response.
+ *
+ * Composed from the shared IssuedCredential rather than restating it: that definition is the issuance receipt every issuer returns, and duplicating it here let the two drift silently. `unevaluatedProperties` closes the object after the `allOf` is applied, which is what makes the composition possible at all — `additionalProperties` is evaluated per-subschema against the whole object and would reject `supersedes` and `ext`.
+ */
+export type VTACredentialsIssueResponsePayload = IssuedCredentialBase;
+/**
+ * Stable identifier for an issued credential — the handle for revocation and audit. Opaque to the holder: it MUST be echoed verbatim when revoking and MUST NOT be parsed.
+ */
+export type CredentialId = string;
+export interface VTACredentialsIssuePayload {
+    /**
+     * DID of the credential's subject/holder (becomes credentialSubject.id).
+     */
+    holder: string;
+    /**
+     * The scoped claims to attest — the share's scope. Opaque to the framework; non-empty.
+     */
+    claims: {};
+    /**
+     * Additional credential type beyond VerifiableCredential (e.g. ScopedShareCredential). Some values name a claims profile defined by this specification (e.g. GovernancePolicyCredential), which constrains the shape of `claims`.
+     */
+    credentialType?: string;
+    /**
+     * Credential lifetime in seconds from issuance. The issuer MAY cap this.
+     */
+    validitySeconds: number;
+    /**
+     * Optional human-readable rationale, recorded for audit.
+     */
+    purpose?: string;
+    ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext {
+    [k: string]: unknown | undefined;
+}
+/**
+ * The members of an issuance receipt, deliberately left **open** so a consuming specification can `$ref` it under `allOf` and add its own, then close the result with `unevaluatedProperties: false`.
+ *
+ * A closure inside this definition would defeat that. Both `additionalProperties` and `unevaluatedProperties` are evaluated against the whole instance from within the subschema that declares them, and neither can see members the *outer* schema matched — so either one here rejects the consumer's extras. Only an `unevaluatedProperties` at the outer level sees everything the composition matched. Use `IssuedCredential` where a closed standalone shape is wanted.
+ */
+export interface IssuedCredentialBase {
+    credentialId: CredentialId;
+    /**
+     * The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework.
+     */
+    credential: {};
+    /**
+     * When the credential was minted.
+     */
+    issuedAt?: string;
+    /**
+     * When the credential's validUntil falls due.
+     */
+    expiresAt: string;
+}
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vta/credentials/issue/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTACredentialsIssueResponsePayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vta/credentials/issue/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTACredentialsIssueResponsePayload;
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/credentials/issue/0.2";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/credentials/issue/0.2#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/vta/credentials/issue/0.2/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/vta/credentials/issue/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,MAAM,kCAAkC,GAAG,oBAAoB,CAAC;AACtE;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,EAAE,CAAC;IACX;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,UAAU,EAAE,EAAE,CAAC;IACf;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,uDAAgE,CAAC;AAEzF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,kCAAkC,CAAC;AAEzD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,gEAAyE,CAAC;AAE3G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}

package/dist/vta/credentials/issue/0.2/payload.js

@@ -0,0 +1,31 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/credentials/issue/0.2/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vta/credentials/issue/0.2";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/credentials/issue/0.2#response";
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+};
+//# sourceMappingURL=payload.js.map

package/dist/vta/credentials/issue/0.2/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vta/credentials/issue/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA+DH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,uDAAgE,CAAC;AAKzF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,gEAAyE,CAAC;AAK3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/dist/vtc/relationships/request/0.1/payload.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/relationships/request/0.1/payload.schema.json
+ */
+/**
+ * A member asks another member to issue them a Verifiable Relationship Credential. Everything here is a hint: the issuing member decides, and declines with a trust-task-error carrying `vtc/relationships/request:declined` rather than a bespoke rejection message.
+ */
+export interface VTCRelationshipsRequestPayload {
+    /**
+     * Why the requester is asking, in their own words, for the issuing member to weigh. A hint and not a term — the issuing member is under no obligation to honour it, and MUST NOT treat its absence as a defect. Free text reaching a human, so a producer SHOULD keep it to what it is willing to have quoted back.
+     */
+    reason?: string;
+    ext?: Ext;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext {
+    [k: string]: unknown | undefined;
+}
+/**
+ * The issued credential. Returned only where the issuing member agreed; a decline is a trust-task-error, not a response with an empty field.
+ */
+export interface VTCRelationshipsRequestResponsePayload {
+    /**
+     * A signed W3C Verifiable Relationship Credential (opaque here). Its issuer MUST be the issuing member — the party that signed this response — and its credentialSubject.id MUST name the requester. The same shape `vtc/relationships/publish` accepts, so a requester can lodge it with the community unchanged.
+     */
+    vrc: {};
+    /**
+     * SHA-256 of the returned VRC, for out-of-band integrity checks. Matches the digest `vtc/relationships/publish` reports once the credential is lodged, so the two can be tied together without re-hashing.
+     */
+    vrcSha256?: string;
+    ext?: Ext;
+}
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vtc/relationships/request/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCRelationshipsRequestPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vtc/relationships/request/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCRelationshipsRequestResponsePayload;
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/relationships/request/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/relationships/request/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/vtc/relationships/request/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/vtc/relationships/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,sCAAsC;IACrD;;OAEG;IACH,GAAG,EAAE,EAAE,CAAC;IACR;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2DAAoE,CAAC;AAE7F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAErD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oEAA6E,CAAC;AAE/G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}

package/dist/vtc/relationships/request/0.1/payload.js

@@ -0,0 +1,31 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/relationships/request/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/relationships/request/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/relationships/request/0.1#response";
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+};
+//# sourceMappingURL=payload.js.map

package/dist/vtc/relationships/request/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vtc/relationships/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiCH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2DAAoE,CAAC;AAK7F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oEAA6E,CAAC;AAK/G;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;CACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/_framework/0.3/framework.ts

@@ -0,0 +1,13 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/_framework/0.3/framework.schema.json
+ */
+
+/**
+ * Reusable $defs cross-referenced by individual Trust Task specifications. Not itself a Trust Task specification — the `_framework` directory is skipped by the registry build (folders starting with `_` are not discovered) and by the codegen (which only triggers on payload.schema.json). See SPEC.md §4.5.1 for the normative description of `ext`.
+ *
+ * Additive over 0.2: `Ext` is carried forward unchanged, and `DigestMultibase` is new. Specifications pinned to 0.2 remain valid; a draft specification re-pinning to 0.3 does so in place, errata-style, per SPEC.md §5.2 — the re-pin does not change any payload's effective wire shape.
+ */
+export interface TrustTasksFrameworkReusableJSONSchemaDefinitions {
+  [k: string]: unknown | undefined;
+}

package/src/audit/list/0.1/payload.ts

@@ -3,6 +3,15 @@
  * Source: specs/audit/list/0.1/payload.schema.json
  */
 
+/**
+ * Hash-chain link: the `entryHash` of the immediately-preceding entry. Present only on chained logs; its integrity is what audit/verify checks. Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the predecessor's immutable content — the same derivation as `entryHash`, so a verifier recomputes both the same way.
+ */
+export type DigestMultibase = string;
+/**
+ * Hash-chain commitment over this entry's immutable content. The next entry's `prevHash` points here. Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of that content; the canonicalization is what makes the commitment reproducible by a verifier that did not write the entry.
+ */
+export type DigestMultibase1 = string;
+
 export interface AuditListPayload {
   /**
    * Return only entries recorded at or after this time.
@@ -95,14 +104,8 @@ export interface AuditEnvelope {
    * Envelope-shape version at the maintainer, for consumers that need to reason about wire-shape evolution.
    */
   schemaVersion?: number;
-  /**
-   * Hash-chain link: the `entryHash` of the immediately-preceding entry. Present only on chained logs; its integrity is what audit/verify checks.
-   */
-  prevHash?: string;
-  /**
-   * Hash-chain commitment over this entry's immutable content. The next entry's `prevHash` points here.
-   */
-  entryHash?: string;
+  prevHash?: DigestMultibase;
+  entryHash?: DigestMultibase1;
   /**
    * Event-specific payload, keyed by `action`. Opaque to the framework; a consumer that does not recognise the action treats it as an unstructured record.
    */
@@ -116,7 +119,7 @@ export interface AuditEnvelope {
 export const TYPE_URI = "https://trusttasks.org/spec/audit/list/0.1" as const;
 
 /** Stable alias for this specification's request payload shape. */
-export type Payload = AuditListPayload;
+export type Payload = DigestMultibase;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/audit/list/0.1#response" as const;