refactor: tighten ucan type surface

- UTCUnixTimestamp: alias → defined type. The compiler now catches
  accidental mixing with raw int64s carrying other units (e.g. nanos).
- Nonce: drop the alias. It was []byte and the call-site name already
  documents the role; the alias added a parallel name with no teeth.
- Link: drop the alias. The datamodels already used cid.Cid directly;
  the alias just created a dual public name for the same type.

Regenerates cborgen/dagjsongen output for delegation and invocation
datamodels so the optional timestamp pointer casts pick up the defined
type. No wire format change.

Author: frrist

execution/bindexec/task.go

@@ -21,7 +21,7 @@ func NewTask[A Arguments](
 	subject did.DID,
 	command ucan.Command,
 	argsBytes []byte,
-	nonce ucan.Nonce,
+	nonce []byte,
 ) (*Task[A], error) {
 	var args A
 	// if args is a pointer type, allocate the underlying value so

ucan/delegation/datamodel/cbor_gen.maps.go

@@ -22,7 +22,7 @@ type TokenPayloadModel1_0_0_rc1 struct {
 	// UCAN Policy Language.
 	Pol policy.Policy `cborgen:"pol" dagjsongen:"pol"`
 	// A unique, random nonce.
-	Nonce ucan.Nonce `cborgen:"nonce" dagjsongen:"nonce"`
+	Nonce []byte `cborgen:"nonce" dagjsongen:"nonce"`
 	// Arbitrary metadata.
 	Meta *datamodel.Raw `cborgen:"meta,omitempty" dagjsongen:"meta,omitempty"`
 	// "Not before" UTC Unix Timestamp in seconds (valid from).

ucan/delegation/datamodel/dag_json_gen.maps.go

@@ -99,7 +99,7 @@ func (d *Delegation) SignedBytes() []byte {
 // Nonce helps prevent replay attacks and ensures a unique CID per delegation.
 //
 // https://github.com/ucan-wg/spec/blob/main/README.md#nonce
-func (d *Delegation) Nonce() ucan.Nonce {
+func (d *Delegation) Nonce() []byte {
 	return d.sigPayload.TokenPayload1_0_0_rc1.Nonce
 }
 

ucan/delegation/datamodel/delegation.go

@@ -41,7 +41,7 @@ func WithNoExpiration() Option {
 }
 
 // WithNonce configures the nonce value for the UCAN.
-func WithNonce(nnc ucan.Nonce) Option {
+func WithNonce(nnc []byte) Option {
 	return func(cfg *delegationConfig) error {
 		cfg.nnc = nnc
 		return nil

ucan/delegation/delegation.go

@@ -13,7 +13,7 @@ type TaskModel struct {
 	Sub   did.DID       `cborgen:"sub" dagjsongen:"sub"`
 	Cmd   ucan.Command  `cborgen:"cmd" dagjsongen:"cmd"`
 	Args  datamodel.Raw `cborgen:"args" dagjsongen:"args"`
-	Nonce ucan.Nonce    `cborgen:"nonce" dagjsongen:"nonce"`
+	Nonce []byte    `cborgen:"nonce" dagjsongen:"nonce"`
 }
 
 type TokenPayloadModel1_0_0_rc1 struct {
@@ -32,7 +32,7 @@ type TokenPayloadModel1_0_0_rc1 struct {
 	// Arbitrary metadata.
 	Meta *datamodel.Raw `cborgen:"meta,omitempty" dagjsongen:"meta,omitempty"`
 	// A unique, random nonce.
-	Nonce ucan.Nonce `cborgen:"nonce" dagjsongen:"nonce"`
+	Nonce []byte `cborgen:"nonce" dagjsongen:"nonce"`
 	// The timestamp at which the invocation becomes invalid.
 	Exp *ucan.UTCUnixTimestamp `cborgen:"exp" dagjsongen:"exp"`
 	// The timestamp at which the invocation was created.

ucan/delegation/options.go

@@ -140,7 +140,7 @@ func (inv *Invocation) SignedBytes() []byte {
 // (such as deterministic Wasm modules or standards-abiding HTTP PUT requests).
 //
 // https://github.com/ucan-wg/invocation/blob/main/README.md#nonce
-func (inv *Invocation) Nonce() ucan.Nonce {
+func (inv *Invocation) Nonce() []byte {
 	return inv.sigPayload.TokenPayload1_0_0_rc1.Nonce
 }