@openvtc/trust-tasks 0.19.12 → 0.19.14

package/src/persona/attribute/list/1.0/payload.ts

@@ -223,6 +223,38 @@ export const PAYLOAD_SCHEMA = {
         "version": {
           "$ref": "#/$defs/Version"
         },
+        "retainedVersions": {
+          "type": "array",
+          "maxItems": 64,
+          "description": "Earlier versions of this attribute the maintainer still holds, and why. A maintainer that keeps a replaced value to serve `pinVersion` MUST list it here: a holder who overwrote a value may reasonably believe it gone, and this is how they learn otherwise. Values are not included — the holder reads one through the profile that pins it, or removes it with persona/attribute/purge-version. Absent when none are held.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "version",
+              "pinnedBy"
+            ],
+            "properties": {
+              "version": {
+                "$ref": "#/$defs/Version"
+              },
+              "updatedAt": {
+                "type": "string",
+                "format": "date-time",
+                "description": "When this version was written."
+              },
+              "pinnedBy": {
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 256,
+                "items": {
+                  "$ref": "#/$defs/Ulid"
+                },
+                "description": "The profiles pinning this version — the reason it is kept. A version no profile pins is not retained."
+              }
+            }
+          }
+        },
         "createdAt": {
           "type": "string",
           "format": "date-time"
@@ -233,6 +265,12 @@ export const PAYLOAD_SCHEMA = {
         }
       }
     },
+    "Ulid": {
+      "title": "Ulid",
+      "description": "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.",
+      "type": "string",
+      "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$"
+    },
     "Version": {
       "title": "Version",
       "description": "A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.",
@@ -363,12 +401,6 @@ export const PAYLOAD_SCHEMA = {
       "minLength": 1,
       "maxLength": 128,
       "pattern": "^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$"
-    },
-    "Ulid": {
-      "title": "Ulid",
-      "description": "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.",
-      "type": "string",
-      "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$"
     }
   }
 } as const;
@@ -475,6 +507,38 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "version": {
           "$ref": "#/$defs/Version"
         },
+        "retainedVersions": {
+          "type": "array",
+          "maxItems": 64,
+          "description": "Earlier versions of this attribute the maintainer still holds, and why. A maintainer that keeps a replaced value to serve `pinVersion` MUST list it here: a holder who overwrote a value may reasonably believe it gone, and this is how they learn otherwise. Values are not included — the holder reads one through the profile that pins it, or removes it with persona/attribute/purge-version. Absent when none are held.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "version",
+              "pinnedBy"
+            ],
+            "properties": {
+              "version": {
+                "$ref": "#/$defs/Version"
+              },
+              "updatedAt": {
+                "type": "string",
+                "format": "date-time",
+                "description": "When this version was written."
+              },
+              "pinnedBy": {
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 256,
+                "items": {
+                  "$ref": "#/$defs/Ulid"
+                },
+                "description": "The profiles pinning this version — the reason it is kept. A version no profile pins is not retained."
+              }
+            }
+          }
+        },
         "createdAt": {
           "type": "string",
           "format": "date-time"
@@ -485,6 +549,12 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         }
       }
     },
+    "Ulid": {
+      "title": "Ulid",
+      "description": "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.",
+      "type": "string",
+      "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$"
+    },
     "Version": {
       "title": "Version",
       "description": "A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.",
@@ -615,12 +685,6 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "minLength": 1,
       "maxLength": 128,
       "pattern": "^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$"
-    },
-    "Ulid": {
-      "title": "Ulid",
-      "description": "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.",
-      "type": "string",
-      "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$"
     }
   }
 } as const;

package/src/persona/attribute/purge-version/1.0/payload.ts

@@ -0,0 +1,277 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/persona/attribute/purge-version/1.0/payload.schema.json
+ */
+
+import type { Ext, Ulid, Version_PersonaV0_1 as Version } from "../../../../_shared/components.js";
+
+
+/**
+ * Permanently remove earlier versions of one attribute that the maintainer kept because a profile pins them. The holder's override on retention: after a name change, the old name is kept only while something needs it, and this is how the holder says nothing does.
+ */
+export interface PersonaAttributePurgeVersionPayload {
+  attributeId: Ulid;
+  /**
+   * The retained versions to remove. Omit to remove every retained version of the attribute. The current version is never removed by this task — that is persona/attribute/delete.
+   *
+   * @minItems 1
+   * @maxItems 64
+   */
+  versions?: [Version, ...Version[]];
+  ext?: Ext;
+}
+/**
+ * Success response to persona/attribute/purge-version. Type https://trusttasks.org/spec/persona/attribute/purge-version/1.0#response. Purging a version that is not held is a success that purges nothing, so a repeated purge converges.
+ */
+export interface PersonaAttributePurgeVersionResponsePayload {
+  attributeId: Ulid;
+  /**
+   * The versions actually removed. Empty when none named was held.
+   *
+   * @maxItems 64
+   */
+  purged: Version[];
+  /**
+   * Profiles that pinned a purged version and now present that entry as stale — which is to say, disclose nothing for it until the holder repins or edits them. Named because a purge that quietly shortened what three faces present is the surprise this family exists to prevent. Absent when none did.
+   *
+   * @maxItems 256
+   */
+  stalePins?: {
+    profileId: Ulid;
+    pinVersion: Version;
+  }[];
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Ulid, Version };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/persona/attribute/purge-version/1.0" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = PersonaAttributePurgeVersionPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/persona/attribute/purge-version/1.0#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PersonaAttributePurgeVersionResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/persona/attribute/purge-version/1.0",
+  "title": "Persona Attribute Purge Version — payload",
+  "description": "Permanently remove earlier versions of one attribute that the maintainer kept because a profile pins them. The holder's override on retention: after a name change, the old name is kept only while something needs it, and this is how the holder says nothing does.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "attributeId"
+  ],
+  "properties": {
+    "attributeId": {
+      "$ref": "#/$defs/Ulid"
+    },
+    "versions": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 64,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/Version"
+      },
+      "description": "The retained versions to remove. Omit to remove every retained version of the attribute. The current version is never removed by this task — that is persona/attribute/delete."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Persona Attribute Purge Version — response payload",
+      "description": "Success response to persona/attribute/purge-version. Type https://trusttasks.org/spec/persona/attribute/purge-version/1.0#response. Purging a version that is not held is a success that purges nothing, so a repeated purge converges.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "attributeId",
+        "purged"
+      ],
+      "properties": {
+        "attributeId": {
+          "$ref": "#/$defs/Ulid"
+        },
+        "purged": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/Version"
+          },
+          "description": "The versions actually removed. Empty when none named was held."
+        },
+        "stalePins": {
+          "type": "array",
+          "maxItems": 256,
+          "description": "Profiles that pinned a purged version and now present that entry as stale — which is to say, disclose nothing for it until the holder repins or edits them. Named because a purge that quietly shortened what three faces present is the surprise this family exists to prevent. Absent when none did.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "profileId",
+              "pinVersion"
+            ],
+            "properties": {
+              "profileId": {
+                "$ref": "#/$defs/Ulid"
+              },
+              "pinVersion": {
+                "$ref": "#/$defs/Version"
+              }
+            }
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "Version": {
+      "title": "Version",
+      "description": "A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.",
+      "type": "integer",
+      "minimum": 1
+    },
+    "Ulid": {
+      "title": "Ulid",
+      "description": "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.",
+      "type": "string",
+      "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$"
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Persona Attribute Purge Version — response payload",
+      "description": "Success response to persona/attribute/purge-version. Type https://trusttasks.org/spec/persona/attribute/purge-version/1.0#response. Purging a version that is not held is a success that purges nothing, so a repeated purge converges.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "attributeId",
+        "purged"
+      ],
+      "properties": {
+        "attributeId": {
+          "$ref": "#/$defs/Ulid"
+        },
+        "purged": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/Version"
+          },
+          "description": "The versions actually removed. Empty when none named was held."
+        },
+        "stalePins": {
+          "type": "array",
+          "maxItems": 256,
+          "description": "Profiles that pinned a purged version and now present that entry as stale — which is to say, disclose nothing for it until the holder repins or edits them. Named because a purge that quietly shortened what three faces present is the surprise this family exists to prevent. Absent when none did.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "profileId",
+              "pinVersion"
+            ],
+            "properties": {
+              "profileId": {
+                "$ref": "#/$defs/Ulid"
+              },
+              "pinVersion": {
+                "$ref": "#/$defs/Version"
+              }
+            }
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "Version": {
+      "title": "Version",
+      "description": "A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.",
+      "type": "integer",
+      "minimum": 1
+    },
+    "Ulid": {
+      "title": "Ulid",
+      "description": "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.",
+      "type": "string",
+      "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$"
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/persona/attribute/put/1.0/payload.ts

@@ -64,6 +64,25 @@ export interface PersonaAttributePutResponsePayload {
      */
     sharedWithProfileCount?: number;
   };
+  /**
+   * Every place this write changed what a persona presents: each binding whose projection was re-pushed because a face wearing it shows this attribute live. An edit propagates by design, and a holder told only that it saved cannot tell whether it refreshed one face or nine. Holder-authorized, so identifiers are returned. Absent when nothing was bound to a face showing it.
+   *
+   * @maxItems 256
+   */
+  refreshed?: {
+    profileId: Ulid;
+    contextId: string;
+    personaDid: string;
+  }[];
+  /**
+   * Faces that pin this attribute to an earlier version and so did NOT follow the edit — the counterparties that must keep seeing the value they verified. Named so the holder can decide, per face, whether that is still what they want. Absent when no face pins it.
+   *
+   * @maxItems 256
+   */
+  heldByPin?: {
+    profileId: Ulid;
+    pinVersion: Version;
+  }[];
   createdAt?: string;
   updatedAt: string;
   ext?: Ext;
@@ -192,6 +211,54 @@ export const PAYLOAD_SCHEMA = {
             }
           }
         },
+        "refreshed": {
+          "type": "array",
+          "maxItems": 256,
+          "description": "Every place this write changed what a persona presents: each binding whose projection was re-pushed because a face wearing it shows this attribute live. An edit propagates by design, and a holder told only that it saved cannot tell whether it refreshed one face or nine. Holder-authorized, so identifiers are returned. Absent when nothing was bound to a face showing it.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "profileId",
+              "contextId",
+              "personaDid"
+            ],
+            "properties": {
+              "profileId": {
+                "$ref": "#/$defs/Ulid"
+              },
+              "contextId": {
+                "type": "string",
+                "minLength": 1
+              },
+              "personaDid": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        },
+        "heldByPin": {
+          "type": "array",
+          "maxItems": 256,
+          "description": "Faces that pin this attribute to an earlier version and so did NOT follow the edit — the counterparties that must keep seeing the value they verified. Named so the holder can decide, per face, whether that is still what they want. Absent when no face pins it.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "profileId",
+              "pinVersion"
+            ],
+            "properties": {
+              "profileId": {
+                "$ref": "#/$defs/Ulid"
+              },
+              "pinVersion": {
+                "$ref": "#/$defs/Version"
+              }
+            }
+          }
+        },
         "createdAt": {
           "type": "string",
           "format": "date-time"
@@ -412,6 +479,54 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             }
           }
         },
+        "refreshed": {
+          "type": "array",
+          "maxItems": 256,
+          "description": "Every place this write changed what a persona presents: each binding whose projection was re-pushed because a face wearing it shows this attribute live. An edit propagates by design, and a holder told only that it saved cannot tell whether it refreshed one face or nine. Holder-authorized, so identifiers are returned. Absent when nothing was bound to a face showing it.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "profileId",
+              "contextId",
+              "personaDid"
+            ],
+            "properties": {
+              "profileId": {
+                "$ref": "#/$defs/Ulid"
+              },
+              "contextId": {
+                "type": "string",
+                "minLength": 1
+              },
+              "personaDid": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        },
+        "heldByPin": {
+          "type": "array",
+          "maxItems": 256,
+          "description": "Faces that pin this attribute to an earlier version and so did NOT follow the edit — the counterparties that must keep seeing the value they verified. Named so the holder can decide, per face, whether that is still what they want. Absent when no face pins it.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "profileId",
+              "pinVersion"
+            ],
+            "properties": {
+              "profileId": {
+                "$ref": "#/$defs/Ulid"
+              },
+              "pinVersion": {
+                "$ref": "#/$defs/Version"
+              }
+            }
+          }
+        },
         "createdAt": {
           "type": "string",
           "format": "date-time"

package/src/persona/binding/get/1.0/payload.ts

@@ -29,7 +29,11 @@ export interface PersonaBindingGetResponsePayload {
    */
   profileId?: Ulid;
   /**
-   * The holder's label for the bound profile, so an application can show which identity is in use. Names a composition; reveals none of it.
+   * The name the holder chose for this context to call the face (persona/binding/set `label`). Absent when they chose none.
+   */
+  label?: string;
+  /**
+   * The holder's OWN name for the bound face. A maintainer MUST omit it unless the caller is holder-authorized: it is the holder's filing, not something they told this context, and it can say far more than the face shows. A context-scoped caller reads `label`.
    */
   profileName?: string;
   /**
@@ -118,10 +122,16 @@ export const PAYLOAD_SCHEMA = {
           "$ref": "#/$defs/Ulid",
           "description": "Present when bound. An identifier only; a context-scoped caller cannot resolve it, because profile reads are holder-authorized."
         },
+        "label": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "description": "The name the holder chose for this context to call the face (persona/binding/set `label`). Absent when they chose none."
+        },
         "profileName": {
           "type": "string",
           "maxLength": 128,
-          "description": "The holder's label for the bound profile, so an application can show which identity is in use. Names a composition; reveals none of it."
+          "description": "The holder's OWN name for the bound face. A maintainer MUST omit it unless the caller is holder-authorized: it is the holder's filing, not something they told this context, and it can say far more than the face shows. A context-scoped caller reads `label`."
         },
         "claimCount": {
           "type": "integer",
@@ -189,10 +199,16 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "$ref": "#/$defs/Ulid",
           "description": "Present when bound. An identifier only; a context-scoped caller cannot resolve it, because profile reads are holder-authorized."
         },
+        "label": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "description": "The name the holder chose for this context to call the face (persona/binding/set `label`). Absent when they chose none."
+        },
         "profileName": {
           "type": "string",
           "maxLength": 128,
-          "description": "The holder's label for the bound profile, so an application can show which identity is in use. Names a composition; reveals none of it."
+          "description": "The holder's OWN name for the bound face. A maintainer MUST omit it unless the caller is holder-authorized: it is the holder's filing, not something they told this context, and it can say far more than the face shows. A context-scoped caller reads `label`."
         },
         "claimCount": {
           "type": "integer",

package/src/persona/binding/list/1.0/payload.ts

@@ -26,7 +26,11 @@ export interface PersonaBindingListResponsePayload {
     personaDid: string;
     bound: boolean;
     /**
-     * The holder's label for the bound profile. Names a composition; reveals none of it.
+     * The name the holder chose for this context to call the face. Absent when they chose none.
+     */
+    label?: string;
+    /**
+     * The holder's OWN name for the bound face. A maintainer MUST omit it unless the caller is holder-authorized; see persona/binding/get.
      */
     profileName?: string;
     claimCount?: number;
@@ -121,10 +125,16 @@ export const PAYLOAD_SCHEMA = {
               "bound": {
                 "type": "boolean"
               },
+              "label": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 128,
+                "description": "The name the holder chose for this context to call the face. Absent when they chose none."
+              },
               "profileName": {
                 "type": "string",
                 "maxLength": 128,
-                "description": "The holder's label for the bound profile. Names a composition; reveals none of it."
+                "description": "The holder's OWN name for the bound face. A maintainer MUST omit it unless the caller is holder-authorized; see persona/binding/get."
               },
               "claimCount": {
                 "type": "integer",
@@ -192,10 +202,16 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
               "bound": {
                 "type": "boolean"
               },
+              "label": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 128,
+                "description": "The name the holder chose for this context to call the face. Absent when they chose none."
+              },
               "profileName": {
                 "type": "string",
                 "maxLength": 128,
-                "description": "The holder's label for the bound profile. Names a composition; reveals none of it."
+                "description": "The holder's OWN name for the bound face. A maintainer MUST omit it unless the caller is holder-authorized; see persona/binding/get."
               },
               "claimCount": {
                 "type": "integer",

package/src/persona/binding/set/1.0/payload.ts

@@ -28,6 +28,10 @@ export interface PersonaBindingSetPayload {
    * @maxItems 32
    */
   publicEntries?: Ulid[];
+  /**
+   * What this context may call the face the persona wears here, chosen by the holder for this context. Returned by persona/binding/get and persona/binding/list in place of the holder's own name for the face, which is theirs and may say far more than they would tell a context ('the divorce'). Omit to give the context no name at all.
+   */
+  label?: string;
   expectedVersion?: ExpectedVersion;
   ext?: Ext;
 }
@@ -123,6 +127,12 @@ export const PAYLOAD_SCHEMA = {
       },
       "description": "Attributes the holder opts into publishing on the persona's own DID document or equivalent public surface. Empty by default and MUST remain empty unless explicitly set: everything else is a per-verifier projection, and a published value is one document every relying party sees identically — a permanent correlation point the rest of this family exists to avoid."
     },
+    "label": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "What this context may call the face the persona wears here, chosen by the holder for this context. Returned by persona/binding/get and persona/binding/list in place of the holder's own name for the face, which is theirs and may say far more than they would tell a context ('the divorce'). Omit to give the context no name at all."
+    },
     "expectedVersion": {
       "$ref": "#/$defs/ExpectedVersion"
     },