@openvtc/trust-tasks 0.2.50 → 0.2.51

package/dist/acl/grant/0.1/payload.d.ts

@@ -26,6 +26,10 @@ export interface AclEntry {
      * Opaque scope identifiers (e.g. contexts, domains, resource prefixes).
      */
     scopes?: string[];
+    /**
+     * Key identifiers this subject may invoke the maintainer's signing oracle on. INTERSECTS WITH `scopes` — it can only narrow, never widen: a key named here that lies outside the entry's scopes remains unreachable, exactly as if it were not named. ABSENT means every key within the entry's scopes (the behaviour of entries that pre-date this member); explicit `null` is equivalent to absent, and producers SHOULD omit the member instead. PRESENT-BUT-EMPTY means authorized on NO keys — the opposite of absent, and deliberately so: emptiness is never a wildcard (CONVENTIONS.md §5). A consumer MUST preserve and enforce the absent-vs-empty distinction end to end; collapsing the two (e.g. by testing emptiness alone) re-creates the empty-means-unrestricted class of privilege-escalation defect this family's conventions exist to prevent.
+     */
+    allowedKeys?: string[] | null;
     /**
      * Optional human-readable label.
      */

package/dist/acl/grant/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/grant/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,CAAC;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR;;WAEG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2CAAoD,CAAC;AAE7E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oDAA6D,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/grant/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,CAAC;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR;;WAEG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2CAAoD,CAAC;AAE7E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oDAA6D,CAAC"}

package/dist/acl/grant/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/grant/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyFH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2CAAoD,CAAC;AAE7E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oDAA6D,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/grant/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6FH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2CAAoD,CAAC;AAE7E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oDAA6D,CAAC"}

package/dist/acl/update/0.1/payload.d.ts

@@ -3,7 +3,7 @@
  * Source: specs/acl/update/0.1/payload.schema.json
  */
 /**
- * Amend the non-role attributes of an existing ACL entry: its label, scopes, expiry, step-up requirement, or approve-authority. Role changes are NOT expressible here — they go through acl/change-role, which requires the current role as a compare-and-swap.
+ * Amend the non-role attributes of an existing ACL entry: its label, scopes, allowed keys, expiry, step-up requirement, or approve-authority. Role changes are NOT expressible here — they go through acl/change-role, which requires the current role as a compare-and-swap.
  */
 export interface ACLUpdatePayload {
     /**
@@ -18,6 +18,10 @@ export interface ACLUpdatePayload {
      * Replacement scope set, applied wholesale rather than merged — a caller that means to add one sends the full intended set. NARROWING THE SET IS A REVOCATION and a consumer MUST refuse it here, directing the caller to acl/revoke, so that every removal of authority passes through the task that is audited and reasoned as a revocation.
      */
     scopes?: string[];
+    /**
+     * Replacement key filter, applied wholesale rather than merged (the entry's allowedKeys becomes exactly this value). Omitted leaves the filter unchanged. Explicit `null` REMOVES the filter — the subject may once again reach every key within its scopes, a privilege increase a consumer SHOULD gate like clearing `expiresAt`. An EMPTY ARRAY sets the filter to no keys at all — the narrowest grant, not a wildcard. A replacement that narrows the previous filter IS a privilege reduction: unlike `scopes` (whose narrowing is refused here and routed to acl/revoke) it is accepted, because acl/revoke/0.1 cannot express a per-key reduction — but the consumer MUST audit it as a reduction and apply it to the subject's live sessions rather than letting the wider set survive until a credential expires.
+     */
+    allowedKeys?: string[] | null;
     /**
      * Replacement expiry. Explicit `null` makes the entry permanent — a privilege increase, which a consumer SHOULD gate at least as strictly as the original grant.
      */

package/dist/acl/update/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/update/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;KACvC,CAAC;IACF;;OAEG;IACH,OAAO,CAAC,EAAE;QACR;;WAEG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4CAAqD,CAAC;AAE9E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qDAA8D,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/update/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;KACvC,CAAC;IACF;;OAEG;IACH,OAAO,CAAC,EAAE;QACR;;WAEG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4CAAqD,CAAC;AAE9E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qDAA8D,CAAC"}

package/dist/acl/update/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/update/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6DH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,4CAAqD,CAAC;AAE9E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qDAA8D,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/update/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiEH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,4CAAqD,CAAC;AAE9E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qDAA8D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.2.50",
+  "version": "0.2.51",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/acl/grant/0.1/payload.ts

@@ -27,6 +27,10 @@ export interface AclEntry {
    * Opaque scope identifiers (e.g. contexts, domains, resource prefixes).
    */
   scopes?: string[];
+  /**
+   * Key identifiers this subject may invoke the maintainer's signing oracle on. INTERSECTS WITH `scopes` — it can only narrow, never widen: a key named here that lies outside the entry's scopes remains unreachable, exactly as if it were not named. ABSENT means every key within the entry's scopes (the behaviour of entries that pre-date this member); explicit `null` is equivalent to absent, and producers SHOULD omit the member instead. PRESENT-BUT-EMPTY means authorized on NO keys — the opposite of absent, and deliberately so: emptiness is never a wildcard (CONVENTIONS.md §5). A consumer MUST preserve and enforce the absent-vs-empty distinction end to end; collapsing the two (e.g. by testing emptiness alone) re-creates the empty-means-unrestricted class of privilege-escalation defect this family's conventions exist to prevent.
+   */
+  allowedKeys?: string[] | null;
   /**
    * Optional human-readable label.
    */

package/src/acl/update/0.1/payload.ts

@@ -4,7 +4,7 @@
  */
 
 /**
- * Amend the non-role attributes of an existing ACL entry: its label, scopes, expiry, step-up requirement, or approve-authority. Role changes are NOT expressible here — they go through acl/change-role, which requires the current role as a compare-and-swap.
+ * Amend the non-role attributes of an existing ACL entry: its label, scopes, allowed keys, expiry, step-up requirement, or approve-authority. Role changes are NOT expressible here — they go through acl/change-role, which requires the current role as a compare-and-swap.
  */
 export interface ACLUpdatePayload {
   /**
@@ -19,6 +19,10 @@ export interface ACLUpdatePayload {
    * Replacement scope set, applied wholesale rather than merged — a caller that means to add one sends the full intended set. NARROWING THE SET IS A REVOCATION and a consumer MUST refuse it here, directing the caller to acl/revoke, so that every removal of authority passes through the task that is audited and reasoned as a revocation.
    */
   scopes?: string[];
+  /**
+   * Replacement key filter, applied wholesale rather than merged (the entry's allowedKeys becomes exactly this value). Omitted leaves the filter unchanged. Explicit `null` REMOVES the filter — the subject may once again reach every key within its scopes, a privilege increase a consumer SHOULD gate like clearing `expiresAt`. An EMPTY ARRAY sets the filter to no keys at all — the narrowest grant, not a wildcard. A replacement that narrows the previous filter IS a privilege reduction: unlike `scopes` (whose narrowing is refused here and routed to acl/revoke) it is accepted, because acl/revoke/0.1 cannot express a per-key reduction — but the consumer MUST audit it as a reduction and apply it to the subject's live sessions rather than letting the wider set survive until a credential expires.
+   */
+  allowedKeys?: string[] | null;
   /**
    * Replacement expiry. Explicit `null` makes the entry permanent — a privilege increase, which a consumer SHOULD gate at least as strictly as the original grant.
    */