@bsv/dpp-profiles 0.3.0-beta.1

package/manifests/exchange/untp-0.7.0-jose@1.json

@@ -0,0 +1,191 @@
+{
+  "manifestVersion": "1",
+  "id": "untp-0.7.0-jose",
+  "version": "1",
+  "profile": "untp-0.7.0-jose@1",
+  "kind": "exchange",
+  "status": "proposed",
+  "title": "UNTP 0.7.0 credentials secured with JOSE, pilot exchange profile",
+  "description": "A pilot interoperability profile for the UN Transparency Protocol's 0.7.0 release, tagged v0.7.0 on 4 May 2026 at the specification's GitLab home: product passport, traceability event and conformity credentials in the W3C Verifiable Credentials Data Model 2.0, secured as compact JWS under VC-JOSE-COSE, mapped to and from native evidence with every loss visible. The schema and context artefacts are pinned by digest from that tag. UNTP compatibility is a distinct claim from any regulatory conformance, and verification by UNTP's own test tooling is a further claim this profile does not make.",
+  "representation": "untp-0.7.0-jose@1",
+  "mediaType": "application/vc+jwt",
+  "dataModel": "W3C Verifiable Credentials Data Model 2.0 with the UNTP 0.7.0 vocabularies",
+  "specification": "spec/exchange.md",
+  "artefacts": [
+    {
+      "id": "untp-specification",
+      "kind": "specification",
+      "uri": "https://opensource.unicc.org/un/unece/uncefact/spec-untp/-/tree/v0.7.0",
+      "version": "0.7.0",
+      "retrieval": "not-retrieved",
+      "notes": "The 0.7.0 release, tagged v0.7.0 on 4 May 2026 at the GitLab home (main last active 4 September 2026, revision df03d8f87e74f676ccfece87ba77cd8f804fe111). The GitHub repository uncefact/spec-untp is archived at 0.6.1 and points here. No 1.0 release exists. The documentation site untp.unece.org refuses non-browser clients, so the tag is the pinnable source; the specification text is many pages and carries no single digest, and the four artefacts below are pinned individually."
+    },
+    {
+      "id": "untp-dpp-schema",
+      "kind": "json-schema",
+      "uri": "https://opensource.unicc.org/un/unece/uncefact/spec-untp/-/raw/v0.7.0/artefacts/schema/v0.7.0/dpp/DigitalProductPassport.json",
+      "version": "0.7.0",
+      "retrieval": "pinned",
+      "notes": "The DigitalProductPassport JSON Schema at v0.7.0, 50362 bytes. Its published location https://untp.unece.org/artefacts/schema/v0.7.0/dpp/DigitalProductPassport.json answered 403 to a non-browser client on 2026-09-06. The schema defines credentialStatus as a BitstringStatusListEntry, renderMethod and issuingSoftware beside the credential subject; a credential validated against it names the UNTP context.",
+      "digest": "42c51943ab23547d5287899fd12b214b19b006c28d105a70ff390f8551b12653",
+      "licence": "GPL-3.0-only, the licence of the spec-untp repository at tag v0.7.0; pinned by digest and not copied into this repository pending a licence review"
+    },
+    {
+      "id": "untp-dpp-context",
+      "kind": "jsonld-context",
+      "uri": "https://opensource.unicc.org/un/unece/uncefact/spec-untp/-/raw/v0.7.0/artefacts/contexts/v0.7.0/untp-context.jsonld",
+      "version": "0.7.0",
+      "retrieval": "pinned",
+      "notes": "The one UNTP JSON-LD context at v0.7.0, 105396 bytes, shared by every credential type; its published location is https://vocabulary.uncefact.org/untp/0.7.0/context/, which answered 403 to a non-browser client on 2026-09-06. The UNTP test suite resolves a credential's schema from this context URL.",
+      "digest": "fbd4824e30d3cfc5cba949e1efe19b4c9ebaee056abe7aaf1c6b139a7bf91b0c",
+      "licence": "GPL-3.0-only, the licence of the spec-untp repository at tag v0.7.0; pinned by digest and not copied into this repository pending a licence review"
+    },
+    {
+      "id": "untp-dte-schema",
+      "kind": "json-schema",
+      "uri": "https://opensource.unicc.org/un/unece/uncefact/spec-untp/-/raw/v0.7.0/artefacts/schema/v0.7.0/dte/DigitalTraceabilityEvent.json",
+      "version": "0.7.0",
+      "retrieval": "pinned",
+      "digest": "a1fa17b743d729e5cb7d1e7db689b87cc0bc655395a625b7ae6f9d195ecc84f9",
+      "licence": "GPL-3.0-only, the licence of the spec-untp repository at tag v0.7.0; pinned by digest and not copied into this repository pending a licence review",
+      "notes": "The DigitalTraceabilityEvent JSON Schema at v0.7.0, 47175 bytes."
+    },
+    {
+      "id": "untp-dcc-schema",
+      "kind": "json-schema",
+      "uri": "https://opensource.unicc.org/un/unece/uncefact/spec-untp/-/raw/v0.7.0/artefacts/schema/v0.7.0/dcc/ConformityCredential.json",
+      "version": "0.7.0",
+      "retrieval": "pinned",
+      "digest": "3fef068faece5975daa799c8f2d1db675c902f9a4e2c6d3c5fb6833799a73af1",
+      "licence": "GPL-3.0-only, the licence of the spec-untp repository at tag v0.7.0; pinned by digest and not copied into this repository pending a licence review",
+      "notes": "The ConformityCredential JSON Schema at v0.7.0, 44904 bytes. Pinned for completeness of the profile; nothing in this programme issues or verifies a conformity credential."
+    },
+    {
+      "id": "w3c-vc-jose-cose",
+      "kind": "specification",
+      "uri": "https://www.w3.org/TR/vc-jose-cose/",
+      "version": "current TR at review",
+      "retrieval": "not-retrieved"
+    }
+  ],
+  "proofSuites": [
+    {
+      "id": "ES256K",
+      "support": "issue-and-verify",
+      "keyRule": "The issuer's secp256k1 credential key, published under its DID as an assertion method; verified independently with a second JOSE library.",
+      "consumerMustConfirm": true,
+      "notes": "A JOSE library that omits ES256K is a compatibility limit, not a signature defect. UNTP's own test suite (uncefact/tests-untp, technical interoperability, verifiable credentials) verifies enveloping proofs with EdDSA on Ed25519 under a did:web issuer and a Bitstring status entry, and names no other algorithm, so a credential secured under this suite is not verifiable by that tooling; a consumer that requires the tooling's verification needs an Ed25519 signing capability this profile does not define."
+    },
+    {
+      "id": "ES256",
+      "support": "optional-dedicated-key",
+      "keyRule": "A dedicated P-256 credential key, separately authorised and published with its relationship to the issuer and to the BSV actor. Never derived by the secp256k1 BRC-42 rule; never an ES256K signature relabelled.",
+      "consumerMustConfirm": true
+    }
+  ],
+  "anchoring": {
+    "format": "bsv-attestation-anchor-v1",
+    "bytesCommitted": "the exact compact JWS bytes as issued",
+    "attestationIdRule": "the credential's own id",
+    "subjectRule": "one product identifier the credential signs; a multi-product credential names the selected one",
+    "attestationType": "UNTP-DPP, UNTP-DTE or UNTP-DCC by credential type"
+  },
+  "nativeEvidenceExtension": {
+    "schema": "contracts/native-evidence-extension.schema.json",
+    "version": "1",
+    "carried": "optional",
+    "notes": "A credential that references existing native evidence carries the extension under urn:bsv:dpp:native-evidence:1; the native evidence exists first and the credential is signed over the references, so no digest is circular."
+  },
+  "mappings": [
+    {
+      "nativeOperation": "ACTIVATE",
+      "externalEvent": "product passport issuance; a manufacture traceability event only with manufacturing evidence",
+      "requires": "manufacturing facility, time and responsible party for a manufacture event",
+      "withoutEvidence": "insufficient-data"
+    },
+    {
+      "nativeOperation": "SOLD",
+      "externalEvent": "a transformation or transaction event only with actual movement or custody evidence",
+      "requires": "source, destination and custody evidence; a change of token control is not a shipment",
+      "withoutEvidence": "insufficient-data"
+    },
+    {
+      "nativeOperation": "RESOLD",
+      "externalEvent": "as for SOLD",
+      "requires": "as for SOLD",
+      "withoutEvidence": "insufficient-data"
+    },
+    {
+      "nativeOperation": "TRANSFER",
+      "externalEvent": "a change of custody only with custody evidence",
+      "requires": "custody evidence beyond the token transfer",
+      "withoutEvidence": "insufficient-data"
+    },
+    {
+      "nativeOperation": "REPAIRED",
+      "externalEvent": "a traceability event of the repair, with the repair facts",
+      "requires": "what was done, by whom and when",
+      "withoutEvidence": "insufficient-data"
+    },
+    {
+      "nativeOperation": "EDIT",
+      "externalEvent": "a revised product passport credential; no physical event",
+      "requires": "nothing physical",
+      "withoutEvidence": "transformed"
+    },
+    {
+      "nativeOperation": "RECYCLED",
+      "externalEvent": "an end-of-life traceability event, distinguishing disposition from a process whose outputs carry new identities",
+      "requires": "recycling evidence",
+      "withoutEvidence": "insufficient-data"
+    }
+  ],
+  "storage": {
+    "nativeClaim": "the signed dpp-lifecycle-v1 object, when the event has one",
+    "originalSecured": "the exact compact JWS as issued, with mediaType, byteLength, sha256, credentialId, issuer, receivedAt, schemaRefs and the intake report reference",
+    "decoded": "the parsed credential, for reading",
+    "projection": "any derived document, with its own identity and exporter signature, naming its source"
+  },
+  "unsupported": [
+    {
+      "id": "sd-jwt-holder-presentation",
+      "reason": "Selected only when a real restricted-disclosure use case names it; ordinary JSON filtering is not cryptographic selective disclosure."
+    },
+    {
+      "id": "regulatory-conformance",
+      "reason": "UNTP compatibility is a distinct claim from EU regulatory conformance, which needs the applicable legal instrument and its date."
+    },
+    {
+      "id": "untp-1.0",
+      "reason": "No 1.0 release exists (checked 2026-09-06 at the GitLab home); this profile pins the 0.7.0 tag and moves only by a new profile version."
+    },
+    {
+      "id": "untp-test-suite-verification",
+      "reason": "UNTP's test suite verifies EdDSA (Ed25519) enveloping proofs under did:web issuers only; the ES256K credentials this profile secures fail its securing-mechanism check before schema or context are examined. Passing that tooling is a separate claim needing an Ed25519 signing key and a did:web issuer, neither defined here."
+    }
+  ],
+  "sourceRefs": [
+    {
+      "id": "untp-0.7.0",
+      "name": "UN Transparency Protocol, release 0.7.0",
+      "reference": "https://opensource.unicc.org/un/unece/uncefact/spec-untp/-/tree/v0.7.0",
+      "version": "0.7.0",
+      "attribution": "UN/CEFACT",
+      "use": "The credential types, schemas and context this profile validates against, pinned by digest from the v0.7.0 tag."
+    },
+    {
+      "id": "w3c-vc-data-model-2",
+      "name": "W3C Verifiable Credentials Data Model 2.0",
+      "reference": "https://www.w3.org/TR/vc-data-model-2.0/",
+      "attribution": "W3C",
+      "use": "The data model."
+    },
+    {
+      "id": "w3c-vc-jose-cose",
+      "name": "W3C Securing Verifiable Credentials using JOSE and COSE",
+      "reference": "https://www.w3.org/TR/vc-jose-cose/",
+      "attribution": "W3C",
+      "use": "The compact JWS carriage."
+    }
+  ]
+}

package/manifests/exchange/vc-di-ecdsa-rdfc-2019@1.json

@@ -0,0 +1,74 @@
+{
+  "manifestVersion": "1",
+  "id": "vc-di-ecdsa-rdfc-2019",
+  "version": "1",
+  "profile": "vc-di-ecdsa-rdfc-2019@1",
+  "kind": "exchange",
+  "status": "current",
+  "title": "Externally issued VC 2.0 passport credentials secured with ecdsa-rdfc-2019",
+  "description": "The exchange profile for a passport credential another party issued in the W3C Verifiable Credentials Data Model 2.0, secured with a Data Integrity proof under the ecdsa-rdfc-2019 cryptosuite over a P-256 Multikey published in the issuer's did:web document, and committed by the exact UTF-8 bytes as issued. Verification and intake only: this repository issues nothing under it. Proof validity, issuer binding, subject binding, validity interval, status, issuer authority under a named policy and artefact availability are separate findings; an RDF proof that still holds over re-serialised bytes does not make those bytes the anchored ones.",
+  "representation": "vc-di-ecdsa-rdfc-2019@1",
+  "mediaType": "application/vc+ld+json",
+  "dataModel": "W3C Verifiable Credentials Data Model 2.0 with the owned external passport context urn:bsv:dpp:external-passport:context:1 for subject terms",
+  "specification": "spec/external-credential-profile.md",
+  "artefacts": [
+    { "id": "vc-v2-context", "kind": "jsonld-context", "uri": "https://www.w3.org/ns/credentials/v2", "version": "2.0", "digest": "59955ced6697d61e03f2b2556febe5308ab16842846f5b586d7f1f7adec92734", "retrieval": "pinned", "licence": "W3C document licence", "notes": "Retrieved 2026-09-06 (10131 bytes); carried at packages/vsc/artifacts/w3c/credentials-v2.jsonld and served at run time from the maintained @digitalbazaar/credentials-context package, which a test holds equal to the carried bytes." },
+    { "id": "data-integrity-v2-context", "kind": "jsonld-context", "uri": "https://w3id.org/security/data-integrity/v2", "version": "2", "digest": "67f21e6e33a6c14e5ccfd2fc7865f7474fb71a04af7e94136cb399dfac8ae8f4", "retrieval": "pinned", "licence": "W3C document licence", "notes": "Retrieved 2026-09-06 (2609 bytes); served at run time from @digitalbazaar/data-integrity-context 2.0.1." },
+    { "id": "multikey-v1-context", "kind": "jsonld-context", "uri": "https://w3id.org/security/multikey/v1", "version": "1", "digest": "ba2c182de2d92f7e47184bcca8fcf0beaee6d3986c527bf664c195bbc7c58597", "retrieval": "pinned", "licence": "W3C document licence", "notes": "Retrieved 2026-09-06 (1010 bytes); served at run time from @digitalbazaar/multikey-context 2.0.1." },
+    { "id": "vc-data-model-2", "kind": "specification", "uri": "https://www.w3.org/TR/vc-data-model-2.0/", "version": "2.0 Recommendation", "retrieval": "not-retrieved", "notes": "The data model; the pinned context above is the artefact the implementation reads." },
+    { "id": "vc-di-ecdsa", "kind": "specification", "uri": "https://www.w3.org/TR/2025/REC-vc-di-ecdsa-20250515/", "version": "Recommendation of 15 May 2025", "retrieval": "not-retrieved", "notes": "The ecdsa-rdfc-2019 cryptosuite; implemented through the maintained @digitalbazaar/ecdsa-rdfc-2019-cryptosuite 1.3.0 and @digitalbazaar/ecdsa-multikey 1.8.0 (BSD-3-Clause) on @digitalbazaar/data-integrity 2.5.0 and jsonld-signatures 11.6.0, never a second cryptographic implementation." },
+    { "id": "rdf-canon", "kind": "specification", "uri": "https://www.w3.org/TR/rdf-canon/", "version": "RDFC-1.0", "retrieval": "not-retrieved", "notes": "The canonicalisation the suite applies, through rdf-canonize 5.0.0." },
+    { "id": "owned-external-passport-context", "kind": "jsonld-context", "uri": "urn:bsv:dpp:external-passport:context:1", "version": "1", "digest": "f2c50bc81d8ada697b4096377ccb24f6034c7dad06003a4424fe2145edb726b4", "retrieval": "owned", "notes": "packages/vsc/artifacts/external/dpp-external-passport-1.context.jsonld: a protected context with a vocabulary base for subject terms, served from these bytes and never fetched." },
+    { "id": "owned-external-passport-schema", "kind": "json-schema", "uri": "urn:bsv:dpp:external-passport:schema:1", "version": "1", "digest": "844b34250290d450207d87a3e82656ca301077eb129e5e793cf27bc9a0b07d63", "retrieval": "owned", "notes": "packages/vsc/artifacts/external/dpp-external-passport-1.schema.json: the structural shape the profile's schema check holds a credential to." }
+  ],
+  "proofSuites": [
+    { "id": "ecdsa-rdfc-2019", "support": "verify-only", "keyRule": "A P-256 Multikey (publicKeyMultibase prefix zDn) whose controller is the credential issuer and which the issuer's did:web document lists under assertionMethod; never the native BSV secp256k1 key, never derived by the BRC-42 rule, and never a P-384 or P-521 key, which this profile reports as unsupported rather than verified.", "consumerMustConfirm": false, "notes": "Verified with the maintained suite under RDFC-1.0 canonicalisation in safe mode, so an undeclared term is a failure and a re-serialised copy still verifies." }
+  ],
+  "anchoring": {
+    "format": "bsv-attestation-anchor-v1",
+    "bytesCommitted": "the exact UTF-8 bytes of the credential as issued, including its Data Integrity proof; a re-serialised copy has a different digest and is a different commitment even though its RDF proof verifies",
+    "attestationIdRule": "the credential id; a second credential under an identifier already secured is refused, never a replacement of the earlier bytes",
+    "subjectRule": "the one credentialSubject.id the credential signs; a passport identifier that differs from it is related only through an established subject-binding policy with an evidence reference",
+    "attestationType": "the credential's first type after VerifiableCredential"
+  },
+  "nativeEvidenceExtension": {
+    "schema": "contracts/native-evidence-extension.schema.json",
+    "version": "1",
+    "carried": "optional",
+    "notes": "An external credential may reference native evidence under urn:bsv:dpp:native-evidence:1; the native evidence exists first and each reference is verified independently."
+  },
+  "mappings": [
+    { "nativeOperation": "ACTIVATE", "externalEvent": "none: an external passport credential is retained evidence about the product and drives no token operation", "requires": "a separately authorised native operation with its own authority and evidence", "withoutEvidence": "insufficient-data" },
+    { "nativeOperation": "SOLD", "externalEvent": "none", "requires": "as above", "withoutEvidence": "insufficient-data" },
+    { "nativeOperation": "RESOLD", "externalEvent": "none", "requires": "as above", "withoutEvidence": "insufficient-data" },
+    { "nativeOperation": "TRANSFER", "externalEvent": "none: a credential from any issuer cannot move token control", "requires": "the current controller's authorised transfer and the recipient's acceptance", "withoutEvidence": "insufficient-data" },
+    { "nativeOperation": "REPAIRED", "externalEvent": "none", "requires": "as above", "withoutEvidence": "insufficient-data" },
+    { "nativeOperation": "EDIT", "externalEvent": "none", "requires": "as above", "withoutEvidence": "insufficient-data" },
+    { "nativeOperation": "RECYCLED", "externalEvent": "none: a later independent credential does not reopen a retired lineage", "requires": "as above", "withoutEvidence": "insufficient-data" }
+  ],
+  "storage": {
+    "nativeClaim": "none; the credential is independent evidence",
+    "originalSecured": "the exact credential string as received, with mediaType, byteLength, sha256, credentialId, issuer, receivedAt, the profile identifier and the intake verification reference",
+    "decoded": "the strictly parsed credential, for reading and never re-serialised as the original",
+    "projection": "any derived document has its own identity and digest and inherits neither the original's proof nor its anchor"
+  },
+  "unsupported": [
+    { "id": "issuance", "reason": "This repository verifies and retains external credentials; it does not issue under this profile." },
+    { "id": "p384-and-p521-keys", "reason": "The suite can verify them; this profile declares P-256 only and reports other curves as unsupported until profiled." },
+    { "id": "ecdsa-jcs-2019", "reason": "JCS canonicalisation is a different suite with different exact-byte properties; not selected." },
+    { "id": "ecdsa-sd-2023", "reason": "Selective disclosure is selected only when a real restricted-disclosure use case names it." },
+    { "id": "multiple-credential-subjects", "reason": "One signed subject binds to one passport; a multi-subject credential is reported unsupported, never split." },
+    { "id": "embedded-issuer-objects", "reason": "The issuer is a DID string; an issuer object is unsupported rather than read for its id." },
+    { "id": "did-methods-other-than-did-web", "reason": "did:web with pinned documents or an explicitly bounded resolver is the initial method; others are unsupported until profiled." },
+    { "id": "holder-presentation", "reason": "No presentation protocol, challenge or holder binding is implemented." },
+    { "id": "jwt-securing", "reason": "Enveloping proofs (VC-JOSE-COSE) are a different representation; see untp-0.7.0-jose@1." },
+    { "id": "inline-contexts", "reason": "An inline context object could redefine signed terms; only the pinned context sets are accepted." }
+  ],
+  "sourceRefs": [
+    { "id": "w3c-vc-data-model-2", "name": "W3C Verifiable Credentials Data Model 2.0", "reference": "https://www.w3.org/TR/vc-data-model-2.0/", "attribution": "W3C", "use": "The data model and the pinned context." },
+    { "id": "w3c-vc-di-ecdsa", "name": "W3C Data Integrity ECDSA Cryptosuites v1.0", "reference": "https://www.w3.org/TR/2025/REC-vc-di-ecdsa-20250515/", "version": "Recommendation, 15 May 2025", "attribution": "W3C", "use": "The ecdsa-rdfc-2019 suite this profile verifies." },
+    { "id": "w3c-rdf-canon", "name": "W3C RDF Dataset Canonicalization", "reference": "https://www.w3.org/TR/rdf-canon/", "attribution": "W3C", "use": "The canonicalisation under the suite." },
+    { "id": "w3c-bitstring-status-list", "name": "W3C Bitstring Status List v1.0", "reference": "https://www.w3.org/TR/vc-bitstring-status-list/", "attribution": "W3C", "use": "The status mechanism, evaluated under the same bounded rules as the VSC profile." },
+    { "id": "w3c-did-core", "name": "W3C Decentralized Identifiers v1.0", "reference": "https://www.w3.org/TR/did-core/", "attribution": "W3C", "use": "Issuer documents and the assertionMethod relationship." }
+  ]
+}

package/manifests/exchange/vsc-draft-compat@0.1.0.json

@@ -0,0 +1,64 @@
+{
+  "manifestVersion": "1",
+  "id": "vsc-draft-compat",
+  "version": "0.1.0",
+  "profile": "vsc-draft-compat@0.1.0",
+  "kind": "exchange",
+  "status": "current",
+  "title": "VSC draft compatibility, as implemented by @bsv/vsc",
+  "description": "The catalogue entry for the exchange profile spec/vsc-profile.md defines and packages/vsc implements: a documented subset of the Verifiable Supply Chain Community Group drafts at a pinned revision, with an owned context, genuine Ed25519Signature2020 and bbs-2023 proofs, authenticated status, scoped authority and custody graph validation. Not W3C certification and not full upstream conformance.",
+  "representation": "vsc-seal-json-v1",
+  "mediaType": "application/vc+ld+json",
+  "dataModel": "W3C Verifiable Credentials Data Model 2.0 with the VSC SEAL vocabulary under the owned context urn:bsv:vsc:context:0.1.0",
+  "specification": "spec/vsc-profile.md",
+  "artefacts": [
+    { "id": "vsc-core", "kind": "specification", "uri": "https://w3c-cg.github.io/vsc/specs/vsc-core.html", "version": "c279de3debcd6eab94a77034584d1750f5d65e6a", "retrieval": "not-retrieved", "notes": "Pinned by revision; the ledger records it as a public source." },
+    { "id": "vsc-requirements", "kind": "specification", "uri": "https://w3c-cg.github.io/vsc/specs/vsc-requirements.html", "version": "c279de3debcd6eab94a77034584d1750f5d65e6a", "retrieval": "not-retrieved" },
+    { "id": "vsc-upstream-context", "kind": "jsonld-context", "uri": "https://w3c-cg.github.io/vsc/", "version": "c279de3debcd6eab94a77034584d1750f5d65e6a", "retrieval": "unavailable", "notes": "The referenced context returns 404 at the pinned revision; the owned context below is served instead and no bytes are invented under a W3C URL." },
+    { "id": "owned-context", "kind": "jsonld-context", "uri": "urn:bsv:vsc:context:0.1.0", "version": "0.1.0", "digest": "3c74b79c50ebb151086c8bbe05222d0177a9d20c6f7b725b4e3a60645274cccc", "retrieval": "owned", "notes": "packages/vsc/artifacts/context-0.1.0.jsonld" },
+    { "id": "owned-seal-schema", "kind": "json-schema", "uri": "urn:bsv:vsc:schema:0.1.0", "version": "0.1.0", "digest": "839123ea6a2ca459c62143a9a38ece281a7b91e719dca057b28baf4d53106d15", "retrieval": "owned", "notes": "packages/vsc/artifacts/seal-0.1.0.schema.json" },
+    { "id": "owned-disclosure-schema", "kind": "json-schema", "uri": "urn:bsv:vsc:schema:0.1.0:disclosure", "version": "0.1.0", "digest": "94afb330c77d28454f98fa4ceb52e4dddc9c6abc8f34877c2917b47dc024c67d", "retrieval": "owned", "notes": "packages/vsc/artifacts/disclosure-0.1.0.schema.json" }
+  ],
+  "proofSuites": [
+    { "id": "Ed25519Signature2020", "support": "issue-and-verify", "keyRule": "An Ed25519 verification method authorised for assertion in the issuer's DID document; never the native BRC wallet or curve.", "consumerMustConfirm": false },
+    { "id": "bbs-2023", "support": "issue-and-verify", "keyRule": "A BLS12-381 multikey authorised for assertion; base and request-bound derived proofs.", "consumerMustConfirm": false, "notes": "The derivation API is a primitive; the caller authorises each optional disclosure pointer, and holder authentication is separate." }
+  ],
+  "anchoring": {
+    "format": "bsv-attestation-anchor-v1",
+    "bytesCommitted": "the exact UTF-8 bytes of the complete issued credential including its Data Integrity proof",
+    "attestationIdRule": "the credential id",
+    "subjectRule": "one signed product identifier; the attestation id is not a product id",
+    "attestationType": "VSC-SEAL"
+  },
+  "nativeEvidenceExtension": {
+    "schema": "contracts/native-evidence-extension.schema.json",
+    "version": "1",
+    "carried": "optional",
+    "notes": "An application token reference is signed within the urn:bsv:dpp:vocab:passport-binding:1 extension the registry already reads; the native evidence extension is the general form."
+  },
+  "mappings": [
+    { "nativeOperation": "ACTIVATE", "externalEvent": "no automatic SEAL; a SEAL needs the actual event vector, status, authority and custody inputs", "requires": "real event evidence", "withoutEvidence": "insufficient-data" },
+    { "nativeOperation": "SOLD", "externalEvent": "no automatic SEAL", "requires": "real movement or custody evidence", "withoutEvidence": "insufficient-data" },
+    { "nativeOperation": "RESOLD", "externalEvent": "no automatic SEAL", "requires": "real movement or custody evidence", "withoutEvidence": "insufficient-data" },
+    { "nativeOperation": "TRANSFER", "externalEvent": "no automatic SEAL; a control transfer may have no lossless physical mapping", "requires": "custody evidence", "withoutEvidence": "insufficient-data" },
+    { "nativeOperation": "REPAIRED", "externalEvent": "no automatic SEAL", "requires": "repair evidence", "withoutEvidence": "insufficient-data" },
+    { "nativeOperation": "EDIT", "externalEvent": "no physical event", "requires": "nothing physical", "withoutEvidence": "unsupported" },
+    { "nativeOperation": "RECYCLED", "externalEvent": "no automatic SEAL", "requires": "recycling evidence", "withoutEvidence": "insufficient-data" }
+  ],
+  "storage": {
+    "nativeClaim": "the signed dpp-lifecycle-v1 object, when the event has one",
+    "originalSecured": "the exact credential string as issued",
+    "decoded": "the parsed SEAL",
+    "projection": "a derived disclosure, verified with its own suite and request binding, never compared to the anchored full bytes"
+  },
+  "unsupported": [
+    { "id": "upstream-context-interoperability", "reason": "The upstream context is unavailable at the pinned revision; the owned context is explicit." },
+    { "id": "upstream-conformance-suite", "reason": "No executable suite exists at the pinned revision." },
+    { "id": "presentation-transport", "reason": "The HTTPS presentation protocol and holder authentication are not implemented." },
+    { "id": "physical-object-binding", "reason": "Object DIDs may be carried; tag authentication and physical binding are separate capabilities." }
+  ],
+  "sourceRefs": [
+    { "id": "vsc-core", "name": "VSC Core draft", "reference": "https://w3c-cg.github.io/vsc/specs/vsc-core.html", "version": "c279de3debcd6eab94a77034584d1750f5d65e6a", "attribution": "Verifiable Supply Chain Community Group", "use": "The SEAL, custody and correction rules selected." },
+    { "id": "vsc-requirements", "name": "VSC Requirements draft", "reference": "https://w3c-cg.github.io/vsc/specs/vsc-requirements.html", "version": "c279de3debcd6eab94a77034584d1750f5d65e6a", "attribution": "Verifiable Supply Chain Community Group", "use": "Takes precedence where Core defers to it." }
+  ]
+}

package/manifests/general@1.json

@@ -0,0 +1,148 @@
+{
+  "manifestVersion": "1",
+  "kind": "industry",
+  "baseline": "native-baseline@1",
+  "roles": [
+    "passport-writer",
+    "attestation-issuer",
+    "registry",
+    "passport-reader"
+  ],
+  "schemaDialect": "https://json-schema.org/draft/2020-12/schema",
+  "accessPolicyRef": "spec/record-model.md#7-the-owner-tier-binding",
+  "accessTiers": [
+    {
+      "id": "public",
+      "description": "Anyone with the identifier.",
+      "storage": "on-chain public payload"
+    },
+    {
+      "id": "owner",
+      "description": "The current holder, travelling with possession rather than with an authorisation.",
+      "storage": "off-chain encrypted"
+    },
+    {
+      "id": "legitimate",
+      "description": "Persons with a legitimate interest, the Batteries Regulation Article 77(2) group generalised.",
+      "storage": "off-chain encrypted"
+    },
+    {
+      "id": "authority",
+      "description": "Notified bodies, market surveillance and other authorities.",
+      "storage": "off-chain encrypted"
+    }
+  ],
+  "extends": null,
+  "id": "general",
+  "version": 1,
+  "profile": "general@1",
+  "status": "superseded",
+  "supersededBy": "general@2",
+  "title": "General passport, version 1 (superseded)",
+  "description": "Version 1 declared field names, labels, obligations and tiers only: no types, units, constraints or provenance. It is served for as long as any state declares it and describes those states plainly, not as better structured than they were.",
+  "regulatoryLine": "A freeform product record; no regulatory mapping is claimed.",
+  "applicability": {
+    "categories": [],
+    "jurisdictions": [],
+    "statements": [
+      {
+        "text": "Version 1 recorded no legal basis per field; its regulatory line was the whole of its claim.",
+        "status": "needs-review"
+      }
+    ]
+  },
+  "schemaUri": "generated/payload-schema/general@1.public.schema.json",
+  "schemaDigest": "57ea63b53d5d52371cbea3f93c1771aace73cf88cd07263fb70480efeb6802a9",
+  "restrictedSchemaUri": "generated/payload-schema/general@1.restricted.schema.json",
+  "restrictedSchemaDigest": "d7411945df53d498ac188dd74c9b77bddac14e1a9cbe9fb6f0cc441acbb2deb2",
+  "contextRefs": [],
+  "stamps": [
+    {
+      "key": "notice",
+      "description": "The sample marker a demonstration record carries first; never product data.",
+      "valueType": "text"
+    },
+    {
+      "key": "profile",
+      "description": "The profile identifier the payload declares.",
+      "valueType": "id",
+      "const": "general"
+    },
+    {
+      "key": "profile_version",
+      "description": "The profile version the payload declares; a reader decodes under it and never under a newer one.",
+      "valueType": "integer",
+      "const": 1
+    },
+    {
+      "key": "object_did",
+      "description": "An optional physical-object DID carried in the public payload; carrying it does not implement physical binding.",
+      "valueType": "id"
+    },
+    {
+      "key": "dataCarrier",
+      "description": "The data-carrier identifier (chip UID) the lookup service indexes beside the passport identifier.",
+      "valueType": "id"
+    }
+  ],
+  "fields": [],
+  "eventMappings": [
+    {
+      "nativeOperation": "ACTIVATE",
+      "eventType": "Origin",
+      "externalEvent": "manufacture or commissioning",
+      "requires": "manufacturing or commissioning evidence naming the facility, time and responsible party; the native ACTIVATE alone records only that a passport was opened",
+      "withoutEvidence": "insufficient-data"
+    },
+    {
+      "nativeOperation": "SOLD",
+      "eventType": "Transfer",
+      "externalEvent": "physical move or change of custody",
+      "requires": "actual source and destination movement or custody evidence; a change of token control is not a shipment",
+      "withoutEvidence": "insufficient-data"
+    },
+    {
+      "nativeOperation": "RESOLD",
+      "eventType": "Transfer",
+      "externalEvent": "physical move or change of custody",
+      "requires": "actual source and destination movement or custody evidence",
+      "withoutEvidence": "insufficient-data"
+    },
+    {
+      "nativeOperation": "TRANSFER",
+      "eventType": "Transfer",
+      "externalEvent": "change of custody",
+      "requires": "custody evidence beyond the token transfer; the transfer of token control alone establishes neither physical movement nor legal title",
+      "withoutEvidence": "insufficient-data"
+    },
+    {
+      "nativeOperation": "REPAIRED",
+      "eventType": "Transformation",
+      "externalEvent": "modification (repair)",
+      "requires": "repair evidence naming what was done, by whom and when",
+      "withoutEvidence": "insufficient-data"
+    },
+    {
+      "nativeOperation": "EDIT",
+      "eventType": "Transformation",
+      "externalEvent": "metadata revision",
+      "requires": "nothing physical: an EDIT is a native metadata operation and maps to a record revision, not a physical transformation",
+      "withoutEvidence": "transformed"
+    },
+    {
+      "nativeOperation": "RECYCLED",
+      "eventType": "Disposition",
+      "externalEvent": "disposition, or a process creating new products or materials",
+      "requires": "recycling evidence distinguishing disposition of this item from a process whose outputs carry new identities",
+      "withoutEvidence": "insufficient-data"
+    }
+  ],
+  "sourceRefs": [],
+  "identity": {
+    "passportIdentifier": "A GS1 Digital Link URI (spec/record-model.md section 3).",
+    "granularities": [
+      "item"
+    ],
+    "parentRelations": []
+  }
+}