@sealkeeper/schema 0.4.4 → 0.4.5

package/dist/operator-domains.d.ts

@@ -0,0 +1,104 @@
+import { z } from 'zod';
+export declare const DNS_RECORD_LABEL = "_sealkeeper";
+export declare const DNS_RECORD_PREFIX = "sealkeeper-verify=";
+export declare const DNS_IDENTITY_KIND = "https://sealkeeper.run/seal/identity/dns";
+export declare const DNS_IDENTITY_PROVIDER = "https://sealkeeper.run";
+export declare const OPERATOR_VERIFICATION: {
+    readonly graceDays: 14;
+    readonly recheckHours: 24;
+    readonly maxDomains: 5;
+};
+export declare const DomainName: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+export type DomainName = z.infer<typeof DomainName>;
+export declare const AddDomainRequest: z.ZodObject<{
+    domain: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+}, z.core.$strict>;
+export type AddDomainRequest = z.infer<typeof AddDomainRequest>;
+export declare const DomainParams: z.ZodObject<{
+    id: z.ZodUUID;
+}, z.core.$strict>;
+export type DomainParams = z.infer<typeof DomainParams>;
+export declare const DomainStatus: z.ZodEnum<{
+    lapsed: "lapsed";
+    lapsing: "lapsing";
+    pending: "pending";
+    verified: "verified";
+}>;
+export type DomainStatus = z.infer<typeof DomainStatus>;
+export declare const OperatorDomain: z.ZodObject<{
+    id: z.ZodUUID;
+    domain: z.ZodString;
+    record: z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$strict>;
+    status: z.ZodEnum<{
+        lapsed: "lapsed";
+        lapsing: "lapsing";
+        pending: "pending";
+        verified: "verified";
+    }>;
+    verifiedAt: z.ZodNullable<z.ZodISODateTime>;
+    lastCheckedAt: z.ZodNullable<z.ZodISODateTime>;
+    lapsedAt: z.ZodNullable<z.ZodISODateTime>;
+    graceEndsAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strict>;
+export type OperatorDomain = z.infer<typeof OperatorDomain>;
+export declare const DomainsResponse: z.ZodObject<{
+    domains: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        domain: z.ZodString;
+        record: z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strict>;
+        status: z.ZodEnum<{
+            lapsed: "lapsed";
+            lapsing: "lapsing";
+            pending: "pending";
+            verified: "verified";
+        }>;
+        verifiedAt: z.ZodNullable<z.ZodISODateTime>;
+        lastCheckedAt: z.ZodNullable<z.ZodISODateTime>;
+        lapsedAt: z.ZodNullable<z.ZodISODateTime>;
+        graceEndsAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+    graceDays: z.ZodInt;
+}, z.core.$strict>;
+export type DomainsResponse = z.infer<typeof DomainsResponse>;
+export declare const DomainLookup: z.ZodEnum<{
+    failed: "failed";
+    found: "found";
+    missing: "missing";
+}>;
+export type DomainLookup = z.infer<typeof DomainLookup>;
+export declare const DomainCheckResponse: z.ZodObject<{
+    domain: z.ZodObject<{
+        id: z.ZodUUID;
+        domain: z.ZodString;
+        record: z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strict>;
+        status: z.ZodEnum<{
+            lapsed: "lapsed";
+            lapsing: "lapsing";
+            pending: "pending";
+            verified: "verified";
+        }>;
+        verifiedAt: z.ZodNullable<z.ZodISODateTime>;
+        lastCheckedAt: z.ZodNullable<z.ZodISODateTime>;
+        lapsedAt: z.ZodNullable<z.ZodISODateTime>;
+        graceEndsAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strict>;
+    lookup: z.ZodEnum<{
+        failed: "failed";
+        found: "found";
+        missing: "missing";
+    }>;
+}, z.core.$strict>;
+export type DomainCheckResponse = z.infer<typeof DomainCheckResponse>;
+export declare const domainRecord: (domain: string, token: string) => {
+    name: string;
+    value: string;
+};

package/dist/operator-domains.js

@@ -0,0 +1,85 @@
+import { z } from 'zod';
+// Operator verification by DNS TXT (VOU-185), gold's operator_verified at
+// launch. The operator adds a domain on the account page, puts a TXT
+// record at DNS_RECORD_LABEL.<domain> holding DNS_RECORD_PREFIX<token>, and
+// SealKeeper checks it. The API's routes live under /v1/me/domains.
+// The record name is this label, a dot and the domain.
+export const DNS_RECORD_LABEL = '_sealkeeper';
+// The record value is this prefix and the token.
+export const DNS_RECORD_PREFIX = 'sealkeeper-verify=';
+// The kind and provider of a DNS identity in a SEAL, SEAL standard section
+// 4a. kind is a URL, since dns is none of the four named kinds. SealKeeper
+// checked the record, so it is the provider.
+export const DNS_IDENTITY_KIND = 'https://sealkeeper.run/seal/identity/dns';
+export const DNS_IDENTITY_PROVIDER = 'https://sealkeeper.run';
+// How a verified domain lapses (26 September 2026, the grace period still
+// open). SealKeeper checks every verified domain again about every
+// recheckHours hours. A check that misses the record starts graceDays days
+// of grace, in which the operator stays verified and the goal warns, and
+// operator_verified goes false when it ends. A check that finds the record
+// again ends the grace. maxDomains is how many domains one operator may
+// add. The scoring job and the API read these, so they live here.
+export const OPERATOR_VERIFICATION = {
+    graceDays: 14,
+    recheckHours: 24,
+    maxDomains: 5,
+};
+// A host name in ASCII, lower case, at least two labels, the last starting
+// with a letter so an IP address never passes. An IDN goes in as its
+// xn-- form. A trailing dot is dropped first.
+const HOST = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+export const DomainName = z
+    .string()
+    .trim()
+    .toLowerCase()
+    .max(254)
+    .transform((d) => d.replace(/\.$/, ''))
+    .pipe(z.string().regex(HOST, 'a domain such as example.com'));
+// POST /v1/me/domains.
+export const AddDomainRequest = z.strictObject({ domain: DomainName });
+// POST /v1/me/domains/:id/check and DELETE /v1/me/domains/:id.
+export const DomainParams = z.strictObject({ id: z.uuid() });
+// pending, added and never found. verified, found at the last check.
+// lapsing, missed since lapsedAt and still verified until graceEndsAt.
+// lapsed, missed for the whole grace period and no longer verified.
+export const DomainStatus = z.enum([
+    'pending',
+    'verified',
+    'lapsing',
+    'lapsed',
+]);
+const Timestamp = z.iso.datetime();
+// One domain as its operator sees it, with the record to add. Private to
+// the signed in operator.
+export const OperatorDomain = z.strictObject({
+    id: z.uuid(),
+    domain: z.string().min(1).max(253),
+    record: z.strictObject({
+        name: z.string().min(1).max(300),
+        value: z.string().min(1).max(300),
+    }),
+    status: DomainStatus,
+    verifiedAt: Timestamp.nullable(),
+    lastCheckedAt: Timestamp.nullable(),
+    lapsedAt: Timestamp.nullable(),
+    graceEndsAt: Timestamp.nullable(),
+});
+// GET /v1/me/domains and the answer of POST /v1/me/domains.
+export const DomainsResponse = z.strictObject({
+    domains: z.array(OperatorDomain),
+    graceDays: z.int().positive(),
+});
+// What one lookup of the record found. found, the token is there. missing,
+// the name has no TXT record with it. failed, the lookup itself did not
+// answer, so nothing is known.
+export const DomainLookup = z.enum(['found', 'missing', 'failed']);
+// POST /v1/me/domains/:id/check.
+export const DomainCheckResponse = z.strictObject({
+    domain: OperatorDomain,
+    lookup: DomainLookup,
+});
+// The TXT record for a domain and a token.
+export const domainRecord = (domain, token) => ({
+    name: `${DNS_RECORD_LABEL}.${domain}`,
+    value: `${DNS_RECORD_PREFIX}${token}`,
+});

package/dist/policy.d.ts

@@ -0,0 +1,4 @@
+export declare const POLICY_VERSIONS: {
+    readonly terms: '2026-09-27';
+    readonly privacy: '2026-09-27';
+};

package/dist/policy.js

@@ -0,0 +1,10 @@
+// The versions of the terms of service and the privacy policy, as the
+// "Last updated" date each page shows, YYYY-MM-DD. The single source of
+// truth. The web renders both pages' dates from here and the API stamps them
+// on an operator when it creates the row and on an agent when it registers,
+// as what was accepted (VOU-121). The client never sends them. Change a date
+// here when the matching page changes.
+export const POLICY_VERSIONS = {
+    terms: '2026-09-27',
+    privacy: '2026-09-27',
+};

package/dist/runtime.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+export declare const RUNTIMES: readonly ['claude-code', 'codex', 'cursor', 'gemini-cli', 'openclaw', 'mastra', 'other', 'unknown'];
+export declare const Runtime: z.ZodEnum<{
+    "claude-code": "claude-code";
+    codex: "codex";
+    cursor: "cursor";
+    "gemini-cli": "gemini-cli";
+    mastra: "mastra";
+    openclaw: "openclaw";
+    other: "other";
+    unknown: "unknown";
+}>;
+export type Runtime = z.infer<typeof Runtime>;
+export declare const DEFAULT_RUNTIME: Runtime;
+export declare const RUNTIME_LABELS: Readonly<Record<Runtime, string>>;
+export declare const RUNTIME_NAMES: ReadonlySet<string>;
+export declare function isRuntimeName(name: string): boolean;

package/dist/runtime.js

@@ -0,0 +1,61 @@
+import { z } from 'zod';
+// What an agent runs in, such as Claude Code or Codex. Declared by the
+// operator at registration or with a signed PATCH, never inferred from
+// events, since events do not say which adapter sent them. `other` is a
+// runtime not on this list, `unknown` is an agent that has not said, which
+// is every agent registered before runtimes existed and every agent a CLI
+// without runtimes registers.
+export const RUNTIMES = [
+    'claude-code',
+    'codex',
+    'cursor',
+    'gemini-cli',
+    'openclaw',
+    'mastra',
+    'other',
+    'unknown',
+];
+export const Runtime = z.enum(RUNTIMES);
+// The runtime an agent has until it says otherwise.
+export const DEFAULT_RUNTIME = 'unknown';
+// How a runtime reads in prose, on the web and in the CLI.
+export const RUNTIME_LABELS = {
+    'claude-code': 'Claude Code',
+    codex: 'Codex',
+    cursor: 'Cursor',
+    'gemini-cli': 'Gemini CLI',
+    openclaw: 'OpenClaw',
+    mastra: 'Mastra',
+    other: 'Other',
+    unknown: 'Unknown',
+};
+// Names that say what an agent runs in rather than which agent it is, such
+// as claude-code or codex. A soft list. The CLI nudges once when an agent
+// is about to be registered under one, and keeping it is allowed. The API
+// never refuses one, so the list can grow without breaking anybody.
+export const RUNTIME_NAMES = new Set([
+    'aider',
+    'amp',
+    'claude',
+    'claude-code',
+    'cline',
+    'codex',
+    'codex-cli',
+    'continue',
+    'copilot',
+    'cursor',
+    'cursor-agent',
+    'devin',
+    'gemini',
+    'gemini-cli',
+    'goose',
+    'mastra',
+    'openclaw',
+    'opencode',
+    'roo-code',
+    'windsurf',
+]);
+// True when name is on the soft list above.
+export function isRuntimeName(name) {
+    return RUNTIME_NAMES.has(name);
+}

package/dist/seal-conformance.js

@@ -114,6 +114,8 @@ export async function sealConformanceCases() {
             signed({ ...base, ver: undefined }),
             'unsupported_version',
         ],
+        // Intended. Platinum is reserved on LADDER and is not a Level under ver
+        // 1 or 2 (standard, section 9). It becomes valid only with a ver bump.
         [
             'the wrong shape, a level not in the standard',
             signed({ ...base, level: 'platinum' }),

package/dist/standing.d.ts

@@ -7,6 +7,25 @@ export declare const Level: z.ZodEnum<{
 }>;
 export type Level = z.infer<typeof Level>;
 export declare const LEVEL_RANK: Record<Level, number>;
+export declare const LADDER: readonly [{
+    readonly level: 'none';
+    readonly state: 'issued';
+}, {
+    readonly level: 'bronze';
+    readonly state: 'issued';
+}, {
+    readonly level: 'silver';
+    readonly state: 'issued';
+}, {
+    readonly level: 'gold';
+    readonly state: 'issued';
+}, {
+    readonly level: 'platinum';
+    readonly state: 'reserved';
+}];
+export type LadderLevel = (typeof LADDER)[number]['level'];
+export type LadderState = (typeof LADDER)[number]['state'];
+export declare const ISSUED_LEVELS: readonly Level[];
 export declare const StandingCounts: z.ZodObject<{
     events: z.ZodInt;
     history_days: z.ZodInt;
@@ -45,9 +64,6 @@ export declare const LEVEL_THRESHOLDS: {
     };
     readonly silver: {
         readonly verifiedTasks: 200;
-        readonly checkedOrConfirmed: 100;
-        readonly distinctOperators: 5;
-        readonly confirmedTasks: 25;
         readonly historyDays: 30;
         readonly reliability: 0.9;
         readonly safety: 0.9;
@@ -56,18 +72,21 @@ export declare const LEVEL_THRESHOLDS: {
         readonly modelDeclared: true;
     };
     readonly gold: {
-        readonly verifiedTasks: 1000;
-        readonly confirmedTasks: 250;
-        readonly confirmedOperators: 25;
+        readonly verifiedTasks: 200;
+        readonly confirmedTasks: 25;
+        readonly confirmedOperators: 3;
         readonly historySpanDays: 90;
         readonly activeDays: 60;
         readonly reliability: 0.95;
         readonly safety: 0.95;
-        readonly incidents180d: 0;
+        readonly cleanDays: 180;
         readonly operatorVerified: true;
-        readonly ratings: 10;
     };
 };
+export declare const OPERATOR_SILVER_CAP: {
+    readonly agents: 5;
+    readonly days: 30;
+};
 export declare function dormantDays(lastActive: Date | null, now: Date): number | null;
 export declare const isQuiet: (days: number | null) => boolean;
 export declare const Standing: z.ZodObject<{

package/dist/standing.js

@@ -2,13 +2,33 @@ import { z } from 'zod';
 // Standing levels from the SEAL standard, section 5, lowest first. none is
 // below bronze. Every scored agent version has one.
 export const Level = z.enum(['none', 'bronze', 'silver', 'gold']);
-// Higher is better. The leaderboard sorts on it before the score.
+// Higher is better. The leaderboard sorts on it before the score. Equal to
+// the level's index on LADDER.
 export const LEVEL_RANK = {
     none: 0,
     bronze: 1,
     silver: 2,
     gold: 3,
 };
+/*
+ * Every level of the standard, lowest first. issued levels are the ones a
+ * SEAL can carry. A reserved level is named and ordered but never issued,
+ * so no code may treat the highest issued level as the top of the ladder.
+ * Platinum is reserved. Level, LEVEL_RANK and the standing.level check
+ * constraint stay at the issued four, because the payload fields of a SEAL
+ * version are closed (standard, section 9) and published CLIs and offline
+ * verifiers reject a level they do not know. Platinum enters Level with a
+ * ver bump when it is issued.
+ */
+export const LADDER = [
+    { level: 'none', state: 'issued' },
+    { level: 'bronze', state: 'issued' },
+    { level: 'silver', state: 'issued' },
+    { level: 'gold', state: 'issued' },
+    { level: 'platinum', state: 'reserved' },
+];
+// The issued levels of LADDER in order, the same values as Level.options.
+export const ISSUED_LEVELS = LADDER.flatMap((step) => step.state === 'issued' ? [Level.parse(step.level)] : []);
 const Count = z.int().min(0);
 // The evidence counts of the SEAL standard, section 4, over the scoring
 // window (180 days) for one agent version. The names are the standard's, so
@@ -79,10 +99,14 @@ export const COUNTED_EVIDENCE = {
 };
 export const DAY_MS = 86_400_000;
 // The dormancy ladder of the SEAL standard, section 5, in whole days since
-// the agent's last accepted event. At quietDays the badge shows quiet and
-// the level stays. At dropOneDays and dropTwoDays the level drops one step
-// each. At noneDays the level is none and no SEAL is issued. The scoring
-// job applies it and the CLI explains it, so it lives here.
+// the agent's last accepted event. At quietDays the level stays and the
+// agent is quiet, which the agent answers carry (Standing.quiet, isQuiet)
+// and the badge and profile show. At dropOneDays and dropTwoDays the level
+// drops one step each. At noneDays the level is none and the scoring run
+// stores no_seal, so the SEAL routes withhold the SEAL until a run after
+// the agent is active again. An agent at none for any other reason still gets a SEAL
+// that says none. The scoring job applies the ladder and the CLI explains
+// it, so it lives here.
 export const DORMANCY = {
     quietDays: 14,
     dropOneDays: 30,
@@ -92,12 +116,14 @@ export const DORMANCY = {
 // SEAL standard levels, version 1 thresholds, section 5. Every one is a
 // minimum and all of a level's must hold. The scoring job applies them
 // (SCORING.levels in the API) and the CLI explains them, so they live here.
-// Seed tasks count in verifiedTasks and nowhere else, so they can carry an
-// agent to bronze and never to silver or gold on their own. Task counts
-// are counted evidence (CountedCounts), recalibrated on 26 September 2026
-// (VOU-139) from the simulation in apps/api/src/scoring/simulation.ts.
-// Silver was 250 verified, gold 2500 verified and 500 confirmed, in raw
-// tasks.
+// Task counts are counted evidence (CountedCounts), recalibrated on 26
+// September 2026 (VOU-139) from the simulation in
+// apps/api/src/scoring/simulation.ts. Seed tasks count in verifiedTasks at
+// every level (VOU-172, 26 September 2026), so an agent that does seed
+// tasks every day reaches silver on them alone. Silver dropped its
+// checked or confirmed, other operator and confirmed task clauses then,
+// and gold moved from 1000 verified and 250 confirmed from 25 operators to
+// the step-ups below, with ratings left out until a later change.
 export const LEVEL_THRESHOLDS = {
     bronze: {
         verifiedTasks: 25,
@@ -108,10 +134,6 @@ export const LEVEL_THRESHOLDS = {
     },
     silver: {
         verifiedTasks: 200,
-        // Server checked plus confirmed tasks, from at least distinctOperators.
-        checkedOrConfirmed: 100,
-        distinctOperators: 5,
-        confirmedTasks: 25,
         historyDays: 30,
         reliability: 0.9,
         safety: 0.9,
@@ -126,22 +148,37 @@ export const LEVEL_THRESHOLDS = {
         modelDeclared: true,
     },
     gold: {
-        verifiedTasks: 1000,
-        // Confirmed tasks, from at least confirmedOperators.
-        confirmedTasks: 250,
-        confirmedOperators: 25,
+        verifiedTasks: 200,
+        // Confirmed tasks posted by hand with no routine report, from at least
+        // confirmedOperators other operators.
+        confirmedTasks: 25,
+        confirmedOperators: 3,
         // Span from the first accepted event in the window, with activity on at
         // least activeDays of those days.
         historySpanDays: 90,
         activeDays: 60,
         reliability: 0.95,
         safety: 0.95,
-        incidents180d: 0,
+        // Whole days since the later of the agent's first accepted event and
+        // its last incident, the clean_days count, which stops here.
+        cleanDays: 180,
         operatorVerified: true,
-        // Ratings from silver or gold agents, net positive, at least this many.
-        ratings: 10,
     },
 };
+// The operator silver cap (VOU-182, 26 September 2026). At most `agents`
+// agents of one operator reach silver for the first time in any `days`
+// days. The first time an agent earns silver it takes a grant, one of the
+// operator's slots. An agent that finds no free slot is held at bronze
+// until the oldest grant in the window is `days` days old. An agent keeps
+// its grant through dormancy drops and version changes, and deleting it
+// does not free the slot. Gold is above silver, so it needs the grant too.
+// The scoring job applies it and the CLI explains it, so it lives here. A
+// higher number for verified operators (20 proposed) is open. It would sit
+// beside `agents` as its own key.
+export const OPERATOR_SILVER_CAP = {
+    agents: 5,
+    days: 30,
+};
 // Whole days from lastActive to now, never below zero. null when the agent
 // has sent no accepted event. The one place dormancy is counted.
 export function dormantDays(lastActive, now) {

package/dist/tasks.d.ts

@@ -22,6 +22,28 @@ export declare const VerificationSpec: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"counterparty">;
 }, z.core.$strict>], "kind">;
 export type VerificationSpec = z.infer<typeof VerificationSpec>;
+export declare const PublicHashVerification: z.ZodObject<{
+    kind: z.ZodLiteral<"hash">;
+}, z.core.$strict>;
+export declare const PublicVerificationSpec: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"hash">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"schema">;
+    jsonSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"counterparty">;
+}, z.core.$strict>], "kind">;
+export type PublicVerificationSpec = z.infer<typeof PublicVerificationSpec>;
+export declare const ShownVerificationSpec: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"hash">;
+    sha256: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"schema">;
+    jsonSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"counterparty">;
+}, z.core.$strict>], "kind">;
+export type ShownVerificationSpec = z.infer<typeof ShownVerificationSpec>;
 export declare const TaskOutcome: z.ZodEnum<{
     failure: "failure";
     success: "success";
@@ -45,5 +67,5 @@ export type TaskTimestamps = {
 export declare function taskState(task: TaskTimestamps, now?: Date): TaskState;
 type JsonObject = Record<string, unknown>;
 export declare function redactJsonSchema(schema: JsonObject): JsonObject;
-export declare function publicVerification(spec: VerificationSpec): VerificationSpec;
+export declare function publicVerification(spec: VerificationSpec): PublicVerificationSpec;
 export {};

package/dist/tasks.js

@@ -20,6 +20,26 @@ export const VerificationSpec = z.discriminatedUnion('kind', [
     SchemaVerification,
     CounterpartyVerification,
 ]);
+// A hash task as everyone but its poster sees it, without the digest. With
+// the digest in hand a claimant could hash candidate answers offline until
+// one matched and submit only that one (VOU-181).
+export const PublicHashVerification = z.strictObject({
+    kind: z.literal('hash'),
+});
+// The spec every public read shows, from publicVerification below.
+export const PublicVerificationSpec = z.discriminatedUnion('kind', [
+    PublicHashVerification,
+    SchemaVerification,
+    CounterpartyVerification,
+]);
+// The spec a task response carries. The poster's own post and its signed
+// submission read show the full spec, every other response the public one,
+// so the digest is optional here and required in a post.
+export const ShownVerificationSpec = z.discriminatedUnion('kind', [
+    z.strictObject({ kind: z.literal('hash'), sha256: Sha256Hex.optional() }),
+    SchemaVerification,
+    CounterpartyVerification,
+]);
 export const TaskOutcome = z.enum(['success', 'failure']);
 export const TaskState = z.enum([
     'open',
@@ -123,10 +143,14 @@ export function redactJsonSchema(schema) {
     }
     return out;
 }
-// What GET /v1/tasks and GET /v1/tasks/:id show. Hash and counterparty specs
-// are already safe to show, a sha256 is one way.
+// What GET /v1/tasks and GET /v1/tasks/:id show. A hash task drops its
+// digest, which only the poster sees (VOU-181). A schema task shows its
+// redacted schema. A counterparty spec has nothing to hide.
 export function publicVerification(spec) {
-    if (spec.kind !== 'schema')
-        return spec;
-    return { kind: 'schema', jsonSchema: redactJsonSchema(spec.jsonSchema) };
+    if (spec.kind === 'hash')
+        return { kind: 'hash' };
+    if (spec.kind === 'schema') {
+        return { kind: 'schema', jsonSchema: redactJsonSchema(spec.jsonSchema) };
+    }
+    return spec;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealkeeper/schema",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "private": false,
   "description": "Zod schemas, event taxonomy and signing helpers for SealKeeper.",
   "license": "Apache-2.0",