@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/vtc/auth/recognise/challenge/0.1/payload.ts

@@ -3,15 +3,12 @@
  * Source: specs/vtc/auth/recognise/challenge/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../../_shared/components.js";
+
+
 export interface VTCAuthRecogniseChallengePayload {
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface VTCAuthRecogniseChallengeResponsePayload {
   /**
    * Single-use, unpredictable value to bind into the presentation. Consumed on first use regardless of verdict.
@@ -24,6 +21,9 @@ export interface VTCAuthRecogniseChallengeResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/auth/recognise/challenge/0.1" as const;
 
@@ -149,6 +149,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -162,5 +163,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vtc/backup/export/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vtc/backup/export/0.1/payload.schema.json
  */
 
+import type { BackupEnvelope, EncryptionParams, Ext, KdfParams } from "../../../../_shared/components.js";
+
+
 export interface VTCBackupExportPayload {
   /**
    * Argon2id passphrase the envelope is encrypted under. Minimum 12 characters; the consumer rejects shorter.
@@ -14,84 +17,17 @@ export interface VTCBackupExportPayload {
   includeAudit?: boolean;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface VTCBackupExportResponsePayload {
-  envelope: BackupEnvelope;
-  ext?: Ext;
-}
-/**
- * The encrypted full-state backup.
- */
-export interface BackupEnvelope {
   /**
-   * Envelope schema version.
+   * The encrypted full-state backup.
    */
-  version: number;
-  /**
-   * Envelope format tag, e.g. `vtc-backup-v1`.
-   */
-  format: string;
-  /**
-   * When the export was taken.
-   */
-  createdAt: string;
-  /**
-   * DID of the community exported from, when it has one. An import cross-checks this against the running community.
-   */
-  sourceDid?: string | null;
-  /**
-   * Version of the software that produced the envelope.
-   */
-  sourceVersion: string;
-  kdf: KdfParams;
-  encryption: EncryptionParams;
-  /**
-   * Whether the audit log and its signed checkpoints are inside `ciphertext`.
-   */
-  includesAudit: boolean;
-  /**
-   * base64url(AEAD(JSON(payload))).
-   */
-  ciphertext: string;
-}
-export interface KdfParams {
-  /**
-   * KDF identifier, e.g. `argon2id`.
-   */
-  algorithm: string;
-  /**
-   * base64url, 32 bytes.
-   */
-  salt: string;
-  /**
-   * Argon2id memory cost (KiB).
-   */
-  mCost: number;
-  /**
-   * Argon2id time cost (iterations).
-   */
-  tCost: number;
-  /**
-   * Argon2id parallelism.
-   */
-  pCost: number;
-}
-export interface EncryptionParams {
-  /**
-   * AEAD identifier, e.g. `aes-256-gcm`.
-   */
-  algorithm: string;
-  /**
-   * base64url, 12 bytes.
-   */
-  nonce: string;
+  envelope: BackupEnvelope;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { BackupEnvelope, EncryptionParams, Ext, KdfParams };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/backup/export/0.1" as const;
 
@@ -462,6 +398,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -475,5 +412,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vtc/backup/import/0.1/payload.ts

@@ -3,7 +3,13 @@
  * Source: specs/vtc/backup/import/0.1/payload.schema.json
  */
 
+import type { BackupEnvelope, EncryptionParams, Ext, KdfParams } from "../../../../_shared/components.js";
+
+
 export interface VTCBackupImportPayload {
+  /**
+   * The envelope returned by `vtc/backup/export`.
+   */
   backup: BackupEnvelope;
   /**
    * The passphrase the envelope was encrypted under.
@@ -15,79 +21,6 @@ export interface VTCBackupImportPayload {
   confirm?: boolean;
   ext?: Ext;
 }
-/**
- * The envelope returned by `vtc/backup/export`.
- */
-export interface BackupEnvelope {
-  /**
-   * Envelope schema version.
-   */
-  version: number;
-  /**
-   * Envelope format tag, e.g. `vtc-backup-v1`.
-   */
-  format: string;
-  /**
-   * When the export was taken.
-   */
-  createdAt: string;
-  /**
-   * DID of the community exported from, when it has one. An import cross-checks this against the running community.
-   */
-  sourceDid?: string | null;
-  /**
-   * Version of the software that produced the envelope.
-   */
-  sourceVersion: string;
-  kdf: KdfParams;
-  encryption: EncryptionParams;
-  /**
-   * Whether the audit log and its signed checkpoints are inside `ciphertext`.
-   */
-  includesAudit: boolean;
-  /**
-   * base64url(AEAD(JSON(payload))).
-   */
-  ciphertext: string;
-}
-export interface KdfParams {
-  /**
-   * KDF identifier, e.g. `argon2id`.
-   */
-  algorithm: string;
-  /**
-   * base64url, 32 bytes.
-   */
-  salt: string;
-  /**
-   * Argon2id memory cost (KiB).
-   */
-  mCost: number;
-  /**
-   * Argon2id time cost (iterations).
-   */
-  tCost: number;
-  /**
-   * Argon2id parallelism.
-   */
-  pCost: number;
-}
-export interface EncryptionParams {
-  /**
-   * AEAD identifier, e.g. `aes-256-gcm`.
-   */
-  algorithm: string;
-  /**
-   * base64url, 12 bytes.
-   */
-  nonce: string;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface VTCBackupImportResponsePayload {
   /**
    * `preview` when `confirm` was not set; `imported` after a restore.
@@ -110,6 +43,9 @@ export interface VTCBackupImportResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { BackupEnvelope, EncryptionParams, Ext, KdfParams };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/backup/import/0.1" as const;
 
@@ -197,6 +133,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "message": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Human-readable summary for the operator."
         },
         "ext": {
@@ -381,6 +318,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "message": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Human-readable summary for the operator."
         },
         "ext": {
@@ -535,6 +473,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -548,5 +487,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vtc/ceremonies/list/0.1/payload.ts

@@ -3,15 +3,12 @@
  * Source: specs/vtc/ceremonies/list/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 export interface VTCCeremoniesListPayload {
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface VTCCeremoniesListResponsePayload {
   /**
    * Every ceremony this maintainer implements.
@@ -56,6 +53,9 @@ export interface CeremonyManifest {
   factsTemplate?: {};
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/ceremonies/list/0.1" as const;
 
@@ -124,6 +124,7 @@ export const PAYLOAD_SCHEMA = {
         "purpose": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 128,
           "description": "Governance purpose this ceremony decides, e.g. join, removal."
         },
         "pkg": {
@@ -139,6 +140,7 @@ export const PAYLOAD_SCHEMA = {
         "label": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 256,
           "description": "Human-readable name for an operator UI."
         },
         "wired": {
@@ -148,6 +150,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "blurb": {
           "type": "string",
+          "maxLength": 256,
           "description": "One-line explanation shown beside the label."
         },
         "fields": {
@@ -216,6 +219,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "purpose": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 128,
           "description": "Governance purpose this ceremony decides, e.g. join, removal."
         },
         "pkg": {
@@ -231,6 +235,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "label": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 256,
           "description": "Human-readable name for an operator UI."
         },
         "wired": {
@@ -240,6 +245,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "blurb": {
           "type": "string",
+          "maxLength": 256,
           "description": "One-line explanation shown beside the label."
         },
         "fields": {
@@ -279,6 +285,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -292,5 +299,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vtc/community/profile/show/0.1/payload.ts

@@ -3,73 +3,23 @@
  * Source: specs/vtc/community/profile/show/0.1/payload.schema.json
  */
 
+import type { CommunityProfileView, Ext, PersonhoodGovernance } from "../../../../../_shared/components.js";
+
+
 export interface VTCCommunityProfileShowPayload {
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface VTCCommunityProfileShowResponsePayload {
-  profile: CommunityProfileView;
-  ext?: Ext;
-}
-/**
- * The community's profile as read, including the immutable `communityDid` an update cannot set.
- */
-export interface CommunityProfileView {
-  /**
-   * The community's own DID — the identifier every credential it issues names as `issuer`, and the one a member's credential binds them to. Immutable: set when the community is created and not settable through an update.
-   */
-  communityDid: string;
-  /**
-   * When the community was created. Immutable, like `communityDid`.
-   */
-  createdAt?: string;
-  name: string;
-  description?: string;
-  logoUrl?: string | null;
-  publicUrl?: string | null;
-  contactEmail?: string | null;
-  language: string;
-  /**
-   * Which identifier form the community expects members to issue relationship credentials under. `attributed` means the member's membership DID, so an edge names them; `pairwise` means a relationship DID unique to each counterparty. A declaration, not an enforcement: the member still chooses per relationship, and a community that wants to require one form does so in its own policy. Absent means the community has not declared one; implementations default to `pairwise`, matching the DTG Credentials recommendation.
-   */
-  relationshipIdentifierDefault?: "attributed" | "pairwise";
-  /**
-   * Opaque community-defined extension bag.
-   */
-  extensions?: {};
-  /**
-   * Trust-registry reachability. Populated on reads; not settable.
-   */
-  registryStatus?: "active" | "degraded";
-  personhood?: PersonhoodGovernance;
-}
-/**
- * What this community's governance asserts about the personhood of its members.
- */
-export interface PersonhoodGovernance {
-  /**
-   * Governance requires that members are real humans. Defaults to `false` when absent: a community that has not considered the question asserts nothing, which is the only safe default for a claim a verifier may rely on.
-   */
-  realHuman?: boolean;
-  /**
-   * Governance requires that each person holds at most one membership in **this** community. Per-community by definition — the glossary says "exactly one membership in that VTC" — so a single community can satisfy it without any network above it.
-   */
-  singleMembership?: boolean;
-  /**
-   * DIDs of the identity-verification providers whose credentials this community accepts as personhood evidence. A community that vets its own members in person lists its own community DID here — it is acting as its own IDVP, which §IDVC permits. An empty list means no list has been published, not that everything is accepted.
-   */
-  acceptedIdvps?: string[];
   /**
-   * Where the governance framework these assertions refer to can be read.
+   * The community's profile as read, including the immutable `communityDid` an update cannot set.
    */
-  governanceFrameworkUrl?: string | null;
+  profile: CommunityProfileView;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { CommunityProfileView, Ext, PersonhoodGovernance };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/community/profile/show/0.1" as const;
 
@@ -155,10 +105,12 @@ export const PAYLOAD_SCHEMA = {
         },
         "name": {
           "type": "string",
-          "minLength": 1
+          "minLength": 1,
+          "maxLength": 256
         },
         "description": {
-          "type": "string"
+          "type": "string",
+          "maxLength": 1024
         },
         "logoUrl": {
           "type": [
@@ -300,10 +252,12 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "name": {
           "type": "string",
-          "minLength": 1
+          "minLength": 1,
+          "maxLength": 256
         },
         "description": {
-          "type": "string"
+          "type": "string",
+          "maxLength": 1024
         },
         "logoUrl": {
           "type": [
@@ -399,6 +353,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -412,5 +367,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vtc/community/profile/update/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vtc/community/profile/update/0.1/payload.schema.json
  */
 
+import type { CommunityProfileView, Ext, PersonhoodGovernance } from "../../../../../_shared/components.js";
+
+
 export interface VTCCommunityProfileUpdatePayload {
   name?: string;
   description?: string;
@@ -14,6 +17,9 @@ export interface VTCCommunityProfileUpdatePayload {
    * Set the community's declared relationship-identifier default. See `CommunityProfile.relationshipIdentifierDefault` in the `vtc/_shared/0.1/community` schema. Omit to leave it unchanged.
    */
   relationshipIdentifierDefault?: "attributed" | "pairwise";
+  /**
+   * Set the community's published personhood position. See `CommunityProfile.personhood` in the `vtc/_shared/0.1/community` schema. Replaces the whole object — a partial update would leave a verifier unable to tell an unset member from a cleared one. Omit to leave it unchanged.
+   */
   personhood?: PersonhoodGovernance;
   /**
    * Opaque community-defined extension bag (maintainer-capped).
@@ -21,34 +27,10 @@ export interface VTCCommunityProfileUpdatePayload {
   extensions?: {};
   ext?: Ext;
 }
-/**
- * Set the community's published personhood position. See `CommunityProfile.personhood` in the `vtc/_shared/0.1/community` schema. Replaces the whole object — a partial update would leave a verifier unable to tell an unset member from a cleared one. Omit to leave it unchanged.
- */
-export interface PersonhoodGovernance {
-  /**
-   * Governance requires that members are real humans. Defaults to `false` when absent: a community that has not considered the question asserts nothing, which is the only safe default for a claim a verifier may rely on.
-   */
-  realHuman?: boolean;
-  /**
-   * Governance requires that each person holds at most one membership in **this** community. Per-community by definition — the glossary says "exactly one membership in that VTC" — so a single community can satisfy it without any network above it.
-   */
-  singleMembership?: boolean;
-  /**
-   * DIDs of the identity-verification providers whose credentials this community accepts as personhood evidence. A community that vets its own members in person lists its own community DID here — it is acting as its own IDVP, which §IDVC permits. An empty list means no list has been published, not that everything is accepted.
-   */
-  acceptedIdvps?: string[];
+export interface VTCCommunityProfileUpdateResponsePayload {
   /**
-   * Where the governance framework these assertions refer to can be read.
+   * The community's profile as read, including the immutable `communityDid` an update cannot set.
    */
-  governanceFrameworkUrl?: string | null;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-export interface VTCCommunityProfileUpdateResponsePayload {
   profile: CommunityProfileView;
   /**
    * Names of the profile members this update actually changed, in the wire spelling. Empty when the submitted values all matched what was already stored. Lets a caller distinguish a no-op from an applied change without diffing the returned profile against the one it sent.
@@ -56,59 +38,9 @@ export interface VTCCommunityProfileUpdateResponsePayload {
   fieldsChanged?: string[];
   ext?: Ext;
 }
-/**
- * The community's profile as read, including the immutable `communityDid` an update cannot set.
- */
-export interface CommunityProfileView {
-  /**
-   * The community's own DID — the identifier every credential it issues names as `issuer`, and the one a member's credential binds them to. Immutable: set when the community is created and not settable through an update.
-   */
-  communityDid: string;
-  /**
-   * When the community was created. Immutable, like `communityDid`.
-   */
-  createdAt?: string;
-  name: string;
-  description?: string;
-  logoUrl?: string | null;
-  publicUrl?: string | null;
-  contactEmail?: string | null;
-  language: string;
-  /**
-   * Which identifier form the community expects members to issue relationship credentials under. `attributed` means the member's membership DID, so an edge names them; `pairwise` means a relationship DID unique to each counterparty. A declaration, not an enforcement: the member still chooses per relationship, and a community that wants to require one form does so in its own policy. Absent means the community has not declared one; implementations default to `pairwise`, matching the DTG Credentials recommendation.
-   */
-  relationshipIdentifierDefault?: "attributed" | "pairwise";
-  /**
-   * Opaque community-defined extension bag.
-   */
-  extensions?: {};
-  /**
-   * Trust-registry reachability. Populated on reads; not settable.
-   */
-  registryStatus?: "active" | "degraded";
-  personhood?: PersonhoodGovernance1;
-}
-/**
- * What this community's governance asserts about the personhood of its members.
- */
-export interface PersonhoodGovernance1 {
-  /**
-   * Governance requires that members are real humans. Defaults to `false` when absent: a community that has not considered the question asserts nothing, which is the only safe default for a claim a verifier may rely on.
-   */
-  realHuman?: boolean;
-  /**
-   * Governance requires that each person holds at most one membership in **this** community. Per-community by definition — the glossary says "exactly one membership in that VTC" — so a single community can satisfy it without any network above it.
-   */
-  singleMembership?: boolean;
-  /**
-   * DIDs of the identity-verification providers whose credentials this community accepts as personhood evidence. A community that vets its own members in person lists its own community DID here — it is acting as its own IDVP, which §IDVC permits. An empty list means no list has been published, not that everything is accepted.
-   */
-  acceptedIdvps?: string[];
-  /**
-   * Where the governance framework these assertions refer to can be read.
-   */
-  governanceFrameworkUrl?: string | null;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { CommunityProfileView, Ext, PersonhoodGovernance };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/community/profile/update/0.1" as const;
@@ -140,10 +72,12 @@ export const PAYLOAD_SCHEMA = {
   "properties": {
     "name": {
       "type": "string",
-      "minLength": 1
+      "minLength": 1,
+      "maxLength": 256
     },
     "description": {
-      "type": "string"
+      "type": "string",
+      "maxLength": 1024
     },
     "logoUrl": {
       "type": [
@@ -247,10 +181,12 @@ export const PAYLOAD_SCHEMA = {
         },
         "name": {
           "type": "string",
-          "minLength": 1
+          "minLength": 1,
+          "maxLength": 256
         },
         "description": {
-          "type": "string"
+          "type": "string",
+          "maxLength": 1024
         },
         "logoUrl": {
           "type": [
@@ -399,10 +335,12 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "name": {
           "type": "string",
-          "minLength": 1
+          "minLength": 1,
+          "maxLength": 256
         },
         "description": {
-          "type": "string"
+          "type": "string",
+          "maxLength": 1024
         },
         "logoUrl": {
           "type": [
@@ -498,6 +436,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -511,5 +450,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;