@openvtc/trust-tasks 0.19.17 → 0.19.19

package/src/persona/binding/get/1.0/payload.ts

@@ -41,6 +41,10 @@ export interface PersonaBindingGetResponsePayload {
    */
   claimCount?: number;
   boundAt?: string;
+  /**
+   * When this binding ends on its own. Absent when it lasts until changed. Context-visible: the context learns when the face stops being worn here, which is the thing the holder set it to tell.
+   */
+  until?: string;
   ext?: Ext;
 }
 
@@ -142,6 +146,11 @@ export const PAYLOAD_SCHEMA = {
           "type": "string",
           "format": "date-time"
         },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When this binding ends on its own. Absent when it lasts until changed. Context-visible: the context learns when the face stops being worn here, which is the thing the holder set it to tell."
+        },
         "ext": {
           "$ref": "#/$defs/Ext"
         }
@@ -219,6 +228,11 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "type": "string",
           "format": "date-time"
         },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When this binding ends on its own. Absent when it lasts until changed. Context-visible: the context learns when the face stops being worn here, which is the thing the holder set it to tell."
+        },
         "ext": {
           "$ref": "#/$defs/Ext"
         }

package/src/persona/binding/list/1.0/payload.ts

@@ -29,6 +29,10 @@ export interface PersonaBindingListResponsePayload {
      * The name the holder chose for this context to call the face. Absent when they chose none.
      */
     label?: string;
+    /**
+     * When this binding ends on its own. Absent when it lasts until changed.
+     */
+    until?: string;
     /**
      * The holder's OWN name for the bound face. A maintainer MUST omit it unless the caller is holder-authorized; see persona/binding/get.
      */
@@ -131,6 +135,11 @@ export const PAYLOAD_SCHEMA = {
                 "maxLength": 128,
                 "description": "The name the holder chose for this context to call the face. Absent when they chose none."
               },
+              "until": {
+                "type": "string",
+                "format": "date-time",
+                "description": "When this binding ends on its own. Absent when it lasts until changed."
+              },
               "profileName": {
                 "type": "string",
                 "maxLength": 128,
@@ -208,6 +217,11 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
                 "maxLength": 128,
                 "description": "The name the holder chose for this context to call the face. Absent when they chose none."
               },
+              "until": {
+                "type": "string",
+                "format": "date-time",
+                "description": "When this binding ends on its own. Absent when it lasts until changed."
+              },
               "profileName": {
                 "type": "string",
                 "maxLength": 128,

package/src/persona/binding/set/1.0/payload.ts

@@ -32,6 +32,10 @@ export interface PersonaBindingSetPayload {
    * What this context may call the face the persona wears here, chosen by the holder for this context. Returned by persona/binding/get and persona/binding/list in place of the holder's own name for the face, which is theirs and may say far more than they would tell a context ('the divorce'). Omit to give the context no name at all.
    */
   label?: string;
+  /**
+   * When this binding ends on its own. At `until` the maintainer clears the binding as a null persona/binding/set would; if the face is then worn nowhere, it is retired (persona/profile/retire), never deleted, so its history survives. Absent means the binding lasts until changed. For the face worn for one weekend — a conference, a listing — so that ending it is a default rather than a discipline. A maintainer MUST refuse an `until` that is not in the future, and one given with a null `profileId`.
+   */
+  until?: string;
   expectedVersion?: ExpectedVersion;
   ext?: Ext;
 }
@@ -58,6 +62,10 @@ export interface PersonaBindingSetResponsePayload {
     alsoBoundPersonaCount?: number;
   };
   boundAt: string;
+  /**
+   * When this binding ends on its own, as set.
+   */
+  until?: string;
   ext?: Ext;
 }
 
@@ -133,6 +141,11 @@ export const PAYLOAD_SCHEMA = {
       "maxLength": 128,
       "description": "What this context may call the face the persona wears here, chosen by the holder for this context. Returned by persona/binding/get and persona/binding/list in place of the holder's own name for the face, which is theirs and may say far more than they would tell a context ('the divorce'). Omit to give the context no name at all."
     },
+    "until": {
+      "type": "string",
+      "format": "date-time",
+      "description": "When this binding ends on its own. At `until` the maintainer clears the binding as a null persona/binding/set would; if the face is then worn nowhere, it is retired (persona/profile/retire), never deleted, so its history survives. Absent means the binding lasts until changed. For the face worn for one weekend — a conference, a listing — so that ending it is a default rather than a discipline. A maintainer MUST refuse an `until` that is not in the future, and one given with a null `profileId`."
+    },
     "expectedVersion": {
       "$ref": "#/$defs/ExpectedVersion"
     },
@@ -207,6 +220,11 @@ export const PAYLOAD_SCHEMA = {
           "type": "string",
           "format": "date-time"
         },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When this binding ends on its own, as set."
+        },
         "ext": {
           "$ref": "#/$defs/Ext"
         }
@@ -314,6 +332,11 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "type": "string",
           "format": "date-time"
         },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When this binding ends on its own, as set."
+        },
         "ext": {
           "$ref": "#/$defs/Ext"
         }

package/src/persona/contact/get/1.0/payload.ts

@@ -251,7 +251,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "Provenance": {
       "title": "Provenance",
-      "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
+      "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.",
       "type": "object",
       "required": [
         "kind"
@@ -322,6 +322,31 @@ export const PAYLOAD_SCHEMA = {
               "description": "When true (the default and the only useful setting), a distinct value is minted for each verifier."
             }
           }
+        },
+        {
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "source",
+            "derivedAt"
+          ],
+          "properties": {
+            "kind": {
+              "const": "derived"
+            },
+            "source": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64,
+              "pattern": "^[a-z][A-Za-z0-9.-]*$",
+              "description": "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share."
+            },
+            "derivedAt": {
+              "type": "string",
+              "format": "date-time",
+              "description": "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it."
+            }
+          }
         }
       ]
     },
@@ -518,7 +543,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
     },
     "Provenance": {
       "title": "Provenance",
-      "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
+      "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.",
       "type": "object",
       "required": [
         "kind"
@@ -589,6 +614,31 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
               "description": "When true (the default and the only useful setting), a distinct value is minted for each verifier."
             }
           }
+        },
+        {
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "source",
+            "derivedAt"
+          ],
+          "properties": {
+            "kind": {
+              "const": "derived"
+            },
+            "source": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64,
+              "pattern": "^[a-z][A-Za-z0-9.-]*$",
+              "description": "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share."
+            },
+            "derivedAt": {
+              "type": "string",
+              "format": "date-time",
+              "description": "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it."
+            }
+          }
         }
       ]
     },

package/src/persona/contact/put/1.0/payload.ts

@@ -236,7 +236,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "Provenance": {
       "title": "Provenance",
-      "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
+      "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.",
       "type": "object",
       "required": [
         "kind"
@@ -307,6 +307,31 @@ export const PAYLOAD_SCHEMA = {
               "description": "When true (the default and the only useful setting), a distinct value is minted for each verifier."
             }
           }
+        },
+        {
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "source",
+            "derivedAt"
+          ],
+          "properties": {
+            "kind": {
+              "const": "derived"
+            },
+            "source": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64,
+              "pattern": "^[a-z][A-Za-z0-9.-]*$",
+              "description": "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share."
+            },
+            "derivedAt": {
+              "type": "string",
+              "format": "date-time",
+              "description": "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it."
+            }
+          }
         }
       ]
     },
@@ -450,7 +475,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
     },
     "Provenance": {
       "title": "Provenance",
-      "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.",
+      "description": "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.",
       "type": "object",
       "required": [
         "kind"
@@ -521,6 +546,31 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
               "description": "When true (the default and the only useful setting), a distinct value is minted for each verifier."
             }
           }
+        },
+        {
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "source",
+            "derivedAt"
+          ],
+          "properties": {
+            "kind": {
+              "const": "derived"
+            },
+            "source": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64,
+              "pattern": "^[a-z][A-Za-z0-9.-]*$",
+              "description": "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share."
+            },
+            "derivedAt": {
+              "type": "string",
+              "format": "date-time",
+              "description": "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it."
+            }
+          }
         }
       ]
     },

package/src/persona/disclosure/preview/1.0/payload.ts

@@ -66,7 +66,7 @@ export interface PersonaDisclosurePreviewResponsePayload {
       arg: unknown;
       over?: ClaimType;
     };
-    provenance: "selfAsserted" | "credentialBacked" | "generated";
+    provenance: "selfAsserted" | "credentialBacked" | "generated" | "derived";
     rung: ProofRung;
     /**
      * True when this verifier has not previously received this claim type from this persona. What makes a preview rankable rather than a flat list — a holder needs the unusual ask to stand out from the routine one.
@@ -254,7 +254,8 @@ export const PAYLOAD_SCHEMA = {
                 "enum": [
                   "selfAsserted",
                   "credentialBacked",
-                  "generated"
+                  "generated",
+                  "derived"
                 ]
               },
               "rung": {
@@ -449,7 +450,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
                 "enum": [
                   "selfAsserted",
                   "credentialBacked",
-                  "generated"
+                  "generated",
+                  "derived"
                 ]
               },
               "rung": {

package/src/persona/local/binding/set/1.0/payload.ts

@@ -20,6 +20,10 @@ export interface PersonaLocalBindingSetPayload {
    * What this context may call the face the persona wears here, chosen by the holder for this context. Returned by persona/binding/get and persona/binding/list in place of the holder's own name for the face, which is theirs and may say far more than they would tell a context ('the divorce'). Omit to give the context no name at all.
    */
   label?: string;
+  /**
+   * When this binding ends on its own. At `until` the maintainer clears the binding as a null persona/binding/set would; if the face is then worn nowhere, it is retired as persona/profile/retire would a pool face, never deleted, so its history survives. Absent means the binding lasts until changed. For the face worn for one weekend — a conference, a listing — so that ending it is a default rather than a discipline. A maintainer MUST refuse an `until` that is not in the future, and one given with a null `profileId`.
+   */
+  until?: string;
   expectedVersion?: ExpectedVersion;
   ext?: Ext;
 }
@@ -96,6 +100,11 @@ export const PAYLOAD_SCHEMA = {
       "maxLength": 128,
       "description": "What this context may call the face the persona wears here, chosen by the holder for this context. Returned by persona/binding/get and persona/binding/list in place of the holder's own name for the face, which is theirs and may say far more than they would tell a context ('the divorce'). Omit to give the context no name at all."
     },
+    "until": {
+      "type": "string",
+      "format": "date-time",
+      "description": "When this binding ends on its own. At `until` the maintainer clears the binding as a null persona/binding/set would; if the face is then worn nowhere, it is retired as persona/profile/retire would a pool face, never deleted, so its history survives. Absent means the binding lasts until changed. For the face worn for one weekend — a conference, a listing — so that ending it is a default rather than a discipline. A maintainer MUST refuse an `until` that is not in the future, and one given with a null `profileId`."
+    },
     "expectedVersion": {
       "$ref": "#/$defs/ExpectedVersion"
     },