@openvtc/trust-tasks 0.19.17 → 0.19.19

package/dist/vtc/invitations/deliver/0.1/payload.d.ts

@@ -0,0 +1,318 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/invitations/deliver/0.1/payload.schema.json
+ */
+import type { Ext } from "../../../../_shared/components.js";
+/**
+ * Deliver an issued invitation to the DID it admits: push an offer to that DID, or return the offer for a QR code. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface VTCInvitationsDeliverPayload {
+    /**
+     * Identifier of the invitation to deliver, as `vtc/invitations/list` reports it.
+     */
+    id: string;
+    /**
+     * `message`: the community sends a `credential-exchange/offer` to the invited DID over a transport that DID advertises. `offer`: the community returns the offer, for the inviter to hand over out of band — typically as a QR code.
+     */
+    channel: "message" | "offer";
+    ext?: Ext;
+}
+export interface VTCInvitationsDeliverResponsePayload {
+    /**
+     * The invitation's identifier, echoed.
+     */
+    id: string;
+    /**
+     * The channel used, echoed.
+     */
+    channel: "message" | "offer";
+    /**
+     * Present exactly when `channel` is `offer`: an OID4VCI Credential Offer object, carried verbatim, whose pre-authorized code redeems only for the invited DID. Its members are OID4VCI's and are deliberately not re-specified here.
+     */
+    offer?: {};
+    /**
+     * When this delivery's offer lapses. Never later than the invitation's own expiry.
+     */
+    expiresAt: string;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vtc/invitations/deliver/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCInvitationsDeliverPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vtc/invitations/deliver/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCInvitationsDeliverResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/vtc/invitations/deliver/0.1";
+    readonly title: "VTC Invitations Deliver — payload";
+    readonly description: "Deliver an issued invitation to the DID it admits: push an offer to that DID, or return the offer for a QR code. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["id", "channel"];
+    readonly properties: {
+        readonly id: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly description: "Identifier of the invitation to deliver, as `vtc/invitations/list` reports it.";
+        };
+        readonly channel: {
+            readonly type: "string";
+            readonly enum: readonly ["message", "offer"];
+            readonly description: "`message`: the community sends a `credential-exchange/offer` to the invited DID over a transport that DID advertises. `offer`: the community returns the offer, for the inviter to hand over out of band — typically as a QR code.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTC Invitations Deliver — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "channel", "expiresAt"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 256;
+                    readonly description: "The invitation's identifier, echoed.";
+                };
+                readonly channel: {
+                    readonly type: "string";
+                    readonly enum: readonly ["message", "offer"];
+                    readonly description: "The channel used, echoed.";
+                };
+                readonly offer: {
+                    readonly type: "object";
+                    readonly description: "Present exactly when `channel` is `offer`: an OID4VCI Credential Offer object, carried verbatim, whose pre-authorized code redeems only for the invited DID. Its members are OID4VCI's and are deliberately not re-specified here.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When this delivery's offer lapses. Never later than the invitation's own expiry.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTC Invitations Deliver — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "channel", "expiresAt"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 256;
+                    readonly description: "The invitation's identifier, echoed.";
+                };
+                readonly channel: {
+                    readonly type: "string";
+                    readonly enum: readonly ["message", "offer"];
+                    readonly description: "The channel used, echoed.";
+                };
+                readonly offer: {
+                    readonly type: "object";
+                    readonly description: "Present exactly when `channel` is `offer`: an OID4VCI Credential Offer object, carried verbatim, whose pre-authorized code redeems only for the invited DID. Its members are OID4VCI's and are deliberately not re-specified here.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When this delivery's offer lapses. Never later than the invitation's own expiry.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/invitations/deliver/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/vtc/invitations/deliver/0.1";
+        readonly title: "VTC Invitations Deliver — payload";
+        readonly description: "Deliver an issued invitation to the DID it admits: push an offer to that DID, or return the offer for a QR code. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["id", "channel"];
+        readonly properties: {
+            readonly id: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly description: "Identifier of the invitation to deliver, as `vtc/invitations/list` reports it.";
+            };
+            readonly channel: {
+                readonly type: "string";
+                readonly enum: readonly ["message", "offer"];
+                readonly description: "`message`: the community sends a `credential-exchange/offer` to the invited DID over a transport that DID advertises. `offer`: the community returns the offer, for the inviter to hand over out of band — typically as a QR code.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTC Invitations Deliver — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "channel", "expiresAt"];
+                readonly properties: {
+                    readonly id: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 256;
+                        readonly description: "The invitation's identifier, echoed.";
+                    };
+                    readonly channel: {
+                        readonly type: "string";
+                        readonly enum: readonly ["message", "offer"];
+                        readonly description: "The channel used, echoed.";
+                    };
+                    readonly offer: {
+                        readonly type: "object";
+                        readonly description: "Present exactly when `channel` is `offer`: an OID4VCI Credential Offer object, carried verbatim, whose pre-authorized code redeems only for the invited DID. Its members are OID4VCI's and are deliberately not re-specified here.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When this delivery's offer lapses. Never later than the invitation's own expiry.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/invitations/deliver/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTC Invitations Deliver — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "channel", "expiresAt"];
+                readonly properties: {
+                    readonly id: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 256;
+                        readonly description: "The invitation's identifier, echoed.";
+                    };
+                    readonly channel: {
+                        readonly type: "string";
+                        readonly enum: readonly ["message", "offer"];
+                        readonly description: "The channel used, echoed.";
+                    };
+                    readonly offer: {
+                        readonly type: "object";
+                        readonly description: "Present exactly when `channel` is `offer`: an OID4VCI Credential Offer object, carried verbatim, whose pre-authorized code redeems only for the invited DID. Its members are OID4VCI's and are deliberately not re-specified here.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When this delivery's offer lapses. Never later than the invitation's own expiry.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/vtc/invitations/deliver/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/vtc/invitations/deliver/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mCAAmC,CAAC;AAG7D;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC;IAC7B,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD,MAAM,WAAW,oCAAoC;IACnD;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC;IAC7B;;OAEG;IACH,KAAK,CAAC,EAAE,EAAE,CAAC;IACX;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,GAAG,EAAE,CAAC;AAEpB,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,yDAAkE,CAAC;AAE3F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,4BAA4B,CAAC;AAEnD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,kEAA2E,CAAC;AAE7G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,oCAAoC,CAAC;AAE5D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiFjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsD1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}

package/dist/vtc/invitations/deliver/0.1/payload.js

@@ -0,0 +1,183 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/invitations/deliver/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/invitations/deliver/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/invitations/deliver/0.1#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/vtc/invitations/deliver/0.1",
+    "title": "VTC Invitations Deliver — payload",
+    "description": "Deliver an issued invitation to the DID it admits: push an offer to that DID, or return the offer for a QR code. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "id",
+        "channel"
+    ],
+    "properties": {
+        "id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "description": "Identifier of the invitation to deliver, as `vtc/invitations/list` reports it."
+        },
+        "channel": {
+            "type": "string",
+            "enum": [
+                "message",
+                "offer"
+            ],
+            "description": "`message`: the community sends a `credential-exchange/offer` to the invited DID over a transport that DID advertises. `offer`: the community returns the offer, for the inviter to hand over out of band — typically as a QR code."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTC Invitations Deliver — response payload",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "channel",
+                "expiresAt"
+            ],
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 256,
+                    "description": "The invitation's identifier, echoed."
+                },
+                "channel": {
+                    "type": "string",
+                    "enum": [
+                        "message",
+                        "offer"
+                    ],
+                    "description": "The channel used, echoed."
+                },
+                "offer": {
+                    "type": "object",
+                    "description": "Present exactly when `channel` is `offer`: an OID4VCI Credential Offer object, carried verbatim, whose pre-authorized code redeems only for the invited DID. Its members are OID4VCI's and are deliberately not re-specified here."
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When this delivery's offer lapses. Never later than the invitation's own expiry."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTC Invitations Deliver — response payload",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "channel",
+                "expiresAt"
+            ],
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 256,
+                    "description": "The invitation's identifier, echoed."
+                },
+                "channel": {
+                    "type": "string",
+                    "enum": [
+                        "message",
+                        "offer"
+                    ],
+                    "description": "The channel used, echoed."
+                },
+                "offer": {
+                    "type": "object",
+                    "description": "Present exactly when `channel` is `offer`: an OID4VCI Credential Offer object, carried verbatim, whose pre-authorized code redeems only for the invited DID. Its members are OID4VCI's and are deliberately not re-specified here."
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When this delivery's offer lapses. Never later than the invitation's own expiry."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/vtc/invitations/deliver/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vtc/invitations/deliver/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA0CH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,yDAAkE,CAAC;AAK3F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,kEAA2E,CAAC;AAK7G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,yDAAyD;IAChE,OAAO,EAAE,mCAAmC;IAC5C,aAAa,EAAE,+OAA+O;IAC9P,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,IAAI;QACJ,SAAS;KACV;IACD,YAAY,EAAE;QACZ,IAAI,EAAE;YACJ,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,gFAAgF;SAChG;QACD,SAAS,EAAE;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,OAAO;aACR;YACD,aAAa,EAAE,oOAAoO;SACpP;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,4CAA4C;YACrD,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,IAAI;gBACJ,SAAS;gBACT,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,sCAAsC;iBACtD;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,SAAS;wBACT,OAAO;qBACR;oBACD,aAAa,EAAE,2BAA2B;iBAC3C;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,oOAAoO;iBACpP;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,kFAAkF;iBAClG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,4CAA4C;YACrD,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,IAAI;gBACJ,SAAS;gBACT,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,sCAAsC;iBACtD;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,SAAS;wBACT,OAAO;qBACR;oBACD,aAAa,EAAE,2BAA2B;iBAC3C;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,oOAAoO;iBACpP;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,kFAAkF;iBAClG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.19.17",
+  "version": "0.19.19",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/_runtime/consume.ts

@@ -432,7 +432,7 @@ export async function consumeInbound<P, R>(
           ok = false;
         }
         if (!ok) {
-          // A constant, never the verifier's own error text. SPEC §10.4
+          // A constant, never the verifier's own error text. SPEC §12.4
           // extends the §8.1 identity rule to every code, and a verifier's
           // vocabulary names DIDs it tried to resolve, whether a resolver
           // answered, and what a fetched DID document contained — a
@@ -577,7 +577,7 @@ export const ID_CONFLICT_WIRE_MESSAGE =
 
 /**
  * Wire message for a replay-record outage. A constant, so a store's hostname
- * or connection string never reaches the wire (SPEC §10.4).
+ * or connection string never reaches the wire (SPEC §12.4).
  */
 export const REPLAY_RECORD_UNAVAILABLE = "temporarily unavailable";
 

package/src/_shared/components.ts

@@ -213,6 +213,25 @@ export type ExpectedVersion_VtaV0_1 = number;
  * After which the bundle is collected: staged bytes discarded, tokens and chunk requests refused. Short by design. For a chunked transfer a recipient may move it later as chunks are exchanged, never past its own ceiling — each chunk response reports the current value.
  */
 export type ExpiresAt = string;
+/**
+ * Where a pool face may be worn. `anywhere` is the default and what an absent member means. `only` names the contexts it may be worn in, and a maintainer MUST refuse to wear it in any other (persona/binding/set `outsideReach`).
+ *
+ * A tagged object rather than a bare list of contexts, deliberately: an empty list has been read as both 'unrestricted' and 'nowhere' in this family's neighbours, and a shape where the two cannot be confused is worth more than one where they must be remembered. So `only` requires at least one context, and 'nowhere' is not a reach — it is a retired face.
+ *
+ * A context-local face has no reach: it lives in its context and is worn there by construction.
+ */
+export type FaceReach =
+  | {
+      kind: "anywhere";
+    }
+  | {
+      kind: "only";
+      /**
+       * @minItems 1
+       * @maxItems 256
+       */
+      contextIds: [string, ...string[]];
+    };
 /**
  * A colour **name**, resolved by each consumer against its own palette — never a hex value or any other literal. Two reasons, and both are about the consumer rather than the holder. A literal cannot be legible in a terminal, in a light theme and in a dark one at once, so a stored `#8B0000` is a colour that is wrong somewhere and the holder has no way to know where. And a consumer that reserves colours to mean something — an error, a warning, an irreversible act — must be able to keep a holder's decorative choice out of that channel; it cannot do that with an arbitrary value, and it can do it trivially with a closed set it maps itself. The eight members are chosen to be distinguishable from one another and deliberately carry no status connotation: none is named for success, warning or danger.
  */
@@ -329,6 +348,10 @@ export type ProofRung = "predicate" | "derived" | "selectiveDisclosure" | "whole
  * `credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.
  *
  * `generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.
+ *
+ * `derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.
+ *
+ * For how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.
  */
 export type Provenance =
   | {
@@ -363,6 +386,17 @@ export type Provenance =
        * When true (the default and the only useful setting), a distinct value is minted for each verifier.
        */
       perVerifier?: boolean;
+    }
+  | {
+      kind: "derived";
+      /**
+       * The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.
+       */
+      source: string;
+      /**
+       * When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it.
+       */
+      derivedAt: string;
     };
 /**
  * A device's platform push channel — the body the device registers with its push GATEWAY (push wake-up binding, https://trusttasks.org/binding/push/0.1; modeled on Aries RFC 0699/0734). The gateway holds this token and returns an opaque WakeHandle in exchange; the token is held by the gateway ONLY, never by the mediator or the maintainer/VTA. The gateway uses it to send a contentless wake-up when an authorized trigger asks — the push payload never carries Trust Task content. Tagged union over the discriminator `platform`.
@@ -1087,6 +1121,12 @@ export interface Attribute {
    * Set only where the holder decided it explicitly. Absent resolves from the claim-type registry.
    */
   release?: ReleaseRequirement;
+  /**
+   * Vault identifiers of credentials in which a third party endorses this value — a colleague vouching for a skill, an employer confirming a title. INVENTORY, not evidence: the value remains whatever its `provenance` says, and a vouched self-assertion is still self-asserted. Folding a vouch into `provenance` would make it render as attested, which is the one thing provenance exists to prevent. Not disclosed with the value; a holder who wants a counterparty to see an endorsement presents the credential itself. Absent when there are none.
+   *
+   * @maxItems 64
+   */
+  endorsements?: string[];
   version: Version_PersonaV0_1;
   /**
    * Earlier versions of this attribute the maintainer still holds, and why. A maintainer that keeps a replaced value to serve `pinVersion` MUST list it here: a holder who overwrote a value may reasonably believe it gone, and this is how they learn otherwise. Values are not included — the holder reads one through the profile that pins it, or removes it with persona/attribute/purge-version. Absent when none are held.
@@ -3348,6 +3388,15 @@ export interface Profile {
    * @maxItems 256
    */
   entries: ProfileEntry[];
+  reach?: FaceReach;
+  /**
+   * `retired`: the face is worn nowhere, is left out of pickers and default listings, and cannot be worn until reinstated (persona/profile/retire, persona/profile/reinstate). Its disclosure history and every value it carries are kept — retiring is 'stop being this', not 'forget this'. Absent reads as `active`.
+   */
+  status?: "active" | "retired";
+  /**
+   * When the face was retired. Present exactly when `status` is `retired`.
+   */
+  retiredAt?: string;
   /**
    * Vault identifiers of credentials associated with this profile as INVENTORY, distinct from the evidence relationship a `credentialBacked` attribute expresses. The two answer different questions — what can this persona prove, versus what backs this specific claim — and a consumer MUST NOT read one as the other.
    *