@openvtc/trust-tasks 0.19.3 → 0.19.5

package/src/vtc/vetting/revoke-statement/0.1/payload.ts

@@ -0,0 +1,218 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/vetting/revoke-statement/0.1/payload.schema.json
+ */
+
+import type { DigestMultibase, Ext } from "../../../../_shared/components.js";
+
+
+/**
+ * A vetter tells the community it withdraws a Vetting Statement it issued. The community records the notice against the statement's id and digest, and from then on that statement does not count. The response is the time the community recorded the notice; repeating a notice returns the original time.
+ */
+export interface VTCVettingRevokeStatementPayload {
+  /**
+   * The withdrawn statement's `id`, a URI (e.g. `urn:uuid:…`).
+   */
+  statementId: string;
+  /**
+   * Digest over the RFC 8785 canonicalization of the withdrawn statement exactly as issued, `proof` included (SHA-256 RECOMMENDED). Pins the notice to one credential, so it cannot be aimed at a different statement that reuses the id.
+   */
+  statementDigestMultibase: DigestMultibase;
+  /**
+   * OPTIONAL. `mistake` — the vetter attested in error. `newInformation` — the vetter learned something that changes its view. `keyCompromise` — the key that signed the statement may be in someone else's hands. `other` — none of these.
+   */
+  reason?: "mistake" | "newInformation" | "keyCompromise" | "other";
+  ext?: Ext;
+}
+/**
+ * The community recorded the notice.
+ */
+export interface VTCVettingRevokeStatementResponsePayload {
+  /**
+   * When the community recorded the notice. A repeated notice for the same statement returns the time the first was recorded: revocation converges, and a vetter retrying cannot move it.
+   */
+  recordedAt: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DigestMultibase, Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/vetting/revoke-statement/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCVettingRevokeStatementPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/vetting/revoke-statement/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCVettingRevokeStatementResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vtc/vetting/revoke-statement/0.1",
+  "title": "VTC Vetting — Revoke Statement — payload",
+  "description": "A vetter tells the community it withdraws a Vetting Statement it issued. The community records the notice against the statement's id and digest, and from then on that statement does not count. The response is the time the community recorded the notice; repeating a notice returns the original time.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "statementId",
+    "statementDigestMultibase"
+  ],
+  "properties": {
+    "statementId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512,
+      "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:\\S+$",
+      "description": "The withdrawn statement's `id`, a URI (e.g. `urn:uuid:…`)."
+    },
+    "statementDigestMultibase": {
+      "$ref": "#/$defs/DigestMultibase",
+      "description": "Digest over the RFC 8785 canonicalization of the withdrawn statement exactly as issued, `proof` included (SHA-256 RECOMMENDED). Pins the notice to one credential, so it cannot be aimed at a different statement that reuses the id."
+    },
+    "reason": {
+      "type": "string",
+      "enum": [
+        "mistake",
+        "newInformation",
+        "keyCompromise",
+        "other"
+      ],
+      "description": "OPTIONAL. `mistake` — the vetter attested in error. `newInformation` — the vetter learned something that changes its view. `keyCompromise` — the key that signed the statement may be in someone else's hands. `other` — none of these."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Vetting — Revoke Statement — response payload",
+      "description": "The community recorded the notice.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "recordedAt"
+      ],
+      "properties": {
+        "recordedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the community recorded the notice. A repeated notice for the same statement returns the time the first was recorded: revocation converges, and a vetter retrying cannot move it."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Vetting — Revoke Statement — response payload",
+      "description": "The community recorded the notice.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "recordedAt"
+      ],
+      "properties": {
+        "recordedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the community recorded the notice. A repeated notice for the same statement returns the time the first was recorded: revocation converges, and a vetter retrying cannot move it."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/vtc/vetting/vetters/grant/0.1/payload.ts

@@ -0,0 +1,237 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/vetting/vetters/grant/0.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../../../_shared/components.js";
+
+
+/**
+ * A community administrator makes a member a vetter. The community issues the member a revocable `CommunityRole` endorsement credential for the `vetter` role, delivers it over credential-exchange/issue, and returns the identifiers and validity of the grant. A member who already holds a live grant gets that grant back unchanged.
+ */
+export interface VTCVettingVettersGrantPayload {
+  /**
+   * The member DID to grant the vetter role to — the subject of the role credential, and the DID the vetter signs statements with.
+   */
+  memberDid: string;
+  /**
+   * OPTIONAL. How long the role credential is valid, from issuance: at least one day, at most two years. Absent: 31536000 (365 days). Ignored when the member already holds a live grant.
+   */
+  validitySeconds?: number;
+  ext?: Ext;
+}
+/**
+ * The grant — newly issued, or the member's existing live grant.
+ */
+export interface VTCVettingVettersGrantResponsePayload {
+  /**
+   * The community's endorsement record for this grant — the identifier vtc/endorsements/revoke takes.
+   */
+  endorsementId: string;
+  /**
+   * The `id` of the role credential, a URI.
+   */
+  credentialId: string;
+  /**
+   * The role credential's `validFrom`.
+   */
+  validFrom: string;
+  /**
+   * The role credential's `validUntil`.
+   */
+  validUntil: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/vetting/vetters/grant/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCVettingVettersGrantPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/vetting/vetters/grant/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCVettingVettersGrantResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vtc/vetting/vetters/grant/0.1",
+  "title": "VTC Vetting — Vetters Grant — payload",
+  "description": "A community administrator makes a member a vetter. The community issues the member a revocable `CommunityRole` endorsement credential for the `vetter` role, delivers it over credential-exchange/issue, and returns the identifiers and validity of the grant. A member who already holds a live grant gets that grant back unchanged.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "memberDid"
+  ],
+  "properties": {
+    "memberDid": {
+      "type": "string",
+      "pattern": "^did:",
+      "description": "The member DID to grant the vetter role to — the subject of the role credential, and the DID the vetter signs statements with."
+    },
+    "validitySeconds": {
+      "type": "integer",
+      "minimum": 86400,
+      "maximum": 63072000,
+      "description": "OPTIONAL. How long the role credential is valid, from issuance: at least one day, at most two years. Absent: 31536000 (365 days). Ignored when the member already holds a live grant."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Vetting — Vetters Grant — response payload",
+      "description": "The grant — newly issued, or the member's existing live grant.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "endorsementId",
+        "credentialId",
+        "validFrom",
+        "validUntil"
+      ],
+      "properties": {
+        "endorsementId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "description": "The community's endorsement record for this grant — the identifier vtc/endorsements/revoke takes."
+        },
+        "credentialId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:\\S+$",
+          "description": "The `id` of the role credential, a URI."
+        },
+        "validFrom": {
+          "type": "string",
+          "format": "date-time",
+          "description": "The role credential's `validFrom`."
+        },
+        "validUntil": {
+          "type": "string",
+          "format": "date-time",
+          "description": "The role credential's `validUntil`."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Vetting — Vetters Grant — response payload",
+      "description": "The grant — newly issued, or the member's existing live grant.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "endorsementId",
+        "credentialId",
+        "validFrom",
+        "validUntil"
+      ],
+      "properties": {
+        "endorsementId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128,
+          "description": "The community's endorsement record for this grant — the identifier vtc/endorsements/revoke takes."
+        },
+        "credentialId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:\\S+$",
+          "description": "The `id` of the role credential, a URI."
+        },
+        "validFrom": {
+          "type": "string",
+          "format": "date-time",
+          "description": "The role credential's `validFrom`."
+        },
+        "validUntil": {
+          "type": "string",
+          "format": "date-time",
+          "description": "The role credential's `validUntil`."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;