@openvtc/trust-tasks 0.20.7 → 0.21.0

package/src/index.ts

@@ -33,6 +33,9 @@ export * as AuthChallenge_v0_1 from "./auth/challenge/0.1/payload.js";
 export * as AuthPasskeyEnrollFinish_v0_1 from "./auth/passkey/enroll/finish/0.1/payload.js";
 export * as AuthPasskeyEnrollFinish_v0_2 from "./auth/passkey/enroll/finish/0.2/payload.js";
 export * as AuthPasskeyEnrollInvite_v0_1 from "./auth/passkey/enroll/invite/0.1/payload.js";
+export * as AuthPasskeyEnrollInvite_v0_2 from "./auth/passkey/enroll/invite/0.2/payload.js";
+export * as AuthPasskeyEnrollRedeemFinish_v0_1 from "./auth/passkey/enroll/redeem/finish/0.1/payload.js";
+export * as AuthPasskeyEnrollRedeemStart_v0_1 from "./auth/passkey/enroll/redeem/start/0.1/payload.js";
 export * as AuthPasskeyEnrollStart_v0_1 from "./auth/passkey/enroll/start/0.1/payload.js";
 export * as AuthPasskeyEnrollStart_v0_2 from "./auth/passkey/enroll/start/0.2/payload.js";
 export * as AuthPasskeyList_v0_1 from "./auth/passkey/list/0.1/payload.js";
@@ -41,18 +44,30 @@ export * as AuthPasskeyLoginFinish_v0_2 from "./auth/passkey/login/finish/0.2/pa
 export * as AuthPasskeyLoginStart_v0_1 from "./auth/passkey/login/start/0.1/payload.js";
 export * as AuthPasskeyLoginStart_v0_2 from "./auth/passkey/login/start/0.2/payload.js";
 export * as AuthPasskeyRevokeFinish_v0_1 from "./auth/passkey/revoke/finish/0.1/payload.js";
+export * as AuthPasskeyRevokeFinish_v0_2 from "./auth/passkey/revoke/finish/0.2/payload.js";
 export * as AuthPasskeyRevokeStart_v0_1 from "./auth/passkey/revoke/start/0.1/payload.js";
+export * as AuthPasskeyRevokeStart_v0_2 from "./auth/passkey/revoke/start/0.2/payload.js";
 export * as AuthRefresh_v0_1 from "./auth/refresh/0.1/payload.js";
 export * as AuthRevokeSession_v0_1 from "./auth/revoke-session/0.1/payload.js";
 export * as AuthSessionsList_v0_1 from "./auth/sessions/list/0.1/payload.js";
 export * as AuthStepUpApproveRequest_v0_1 from "./auth/step-up/approve-request/0.1/payload.js";
 export * as AuthStepUpApproveRequest_v0_2 from "./auth/step-up/approve-request/0.2/payload.js";
+export * as AuthStepUpApproveRequest_v0_3 from "./auth/step-up/approve-request/0.3/payload.js";
 export * as AuthStepUpApproveResponse_v0_1 from "./auth/step-up/approve-response/0.1/payload.js";
 export * as AuthStepUpApproveResponse_v0_2 from "./auth/step-up/approve-response/0.2/payload.js";
 export * as AuthStepUpApproveResponse_v0_3 from "./auth/step-up/approve-response/0.3/payload.js";
+export * as AuthStepUpApproveResponse_v0_4 from "./auth/step-up/approve-response/0.4/payload.js";
+export * as AuthStepUpApproveResponse_v0_5 from "./auth/step-up/approve-response/0.5/payload.js";
 export * as AuthStepUpPolicy_v0_1 from "./auth/step-up/policy/0.1/payload.js";
 export * as AuthStepUpPolicy_v0_2 from "./auth/step-up/policy/0.2/payload.js";
 export * as AuthWhoami_v0_1 from "./auth/whoami/0.1/payload.js";
+export * as BackupAbort_v0_1 from "./backup/abort/0.1/payload.js";
+export * as BackupCompleteExport_v0_1 from "./backup/complete-export/0.1/payload.js";
+export * as BackupFinalizeImport_v0_1 from "./backup/finalize-import/0.1/payload.js";
+export * as BackupGetChunk_v0_1 from "./backup/get-chunk/0.1/payload.js";
+export * as BackupInitiateExport_v0_1 from "./backup/initiate-export/0.1/payload.js";
+export * as BackupInitiateImport_v0_1 from "./backup/initiate-import/0.1/payload.js";
+export * as BackupPutChunk_v0_1 from "./backup/put-chunk/0.1/payload.js";
 export * as ChatMessage_v0_1 from "./chat/message/0.1/payload.js";
 export * as ConfigShared_v0_1 from "./config/_shared/0.1/config.js";
 export * as ConfigPatch_v0_1 from "./config/patch/0.1/payload.js";
@@ -134,19 +149,25 @@ export * as DidManagementServerStatsSync_v0_1 from "./did-management/server/stat
 export * as GitNsShared_v0_1 from "./git-ns/_shared/0.1/git-ns.js";
 export * as GitNsShared_v0_2 from "./git-ns/_shared/0.2/git-ns.js";
 export * as GitNsShared_v0_3 from "./git-ns/_shared/0.3/git-ns.js";
+export * as GitNsShared_v0_4 from "./git-ns/_shared/0.4/git-ns.js";
 export * as GitNsAccountLinkStatus_v0_1 from "./git-ns/account/link-status/0.1/payload.js";
 export * as GitNsAccountLink_v0_1 from "./git-ns/account/link/0.1/payload.js";
+export * as GitNsAccountUnlink_v0_1 from "./git-ns/account/unlink/0.1/payload.js";
 export * as GitNsBridgeEvent_v0_1 from "./git-ns/bridge/event/0.1/payload.js";
 export * as GitNsBridgeEvent_v0_2 from "./git-ns/bridge/event/0.2/payload.js";
+export * as GitNsBridgeEvent_v0_3 from "./git-ns/bridge/event/0.3/payload.js";
 export * as GitNsBridgeJob_v0_1 from "./git-ns/bridge/job/0.1/payload.js";
 export * as GitNsBridgeJob_v0_2 from "./git-ns/bridge/job/0.2/payload.js";
 export * as GitNsBridgeJob_v0_3 from "./git-ns/bridge/job/0.3/payload.js";
+export * as GitNsBridgeJob_v0_4 from "./git-ns/bridge/job/0.4/payload.js";
 export * as GitNsBridgeResult_v0_1 from "./git-ns/bridge/result/0.1/payload.js";
 export * as GitNsDriftResolve_v0_1 from "./git-ns/drift/resolve/0.1/payload.js";
 export * as GitNsDriftResolve_v0_2 from "./git-ns/drift/resolve/0.2/payload.js";
+export * as GitNsDriftResolve_v0_3 from "./git-ns/drift/resolve/0.3/payload.js";
 export * as GitNsNamespaceBind_v0_1 from "./git-ns/namespace/bind/0.1/payload.js";
 export * as GitNsNamespaceReseat_v0_1 from "./git-ns/namespace/reseat/0.1/payload.js";
 export * as GitNsNamespaceReseat_v0_2 from "./git-ns/namespace/reseat/0.2/payload.js";
+export * as GitNsNamespaceReseat_v0_3 from "./git-ns/namespace/reseat/0.3/payload.js";
 export * as GitNsNamespaceUnbind_v0_1 from "./git-ns/namespace/unbind/0.1/payload.js";
 export * as GitNsRepoAdopt_v0_1 from "./git-ns/repo/adopt/0.1/payload.js";
 export * as GitNsRepoAdopt_v0_2 from "./git-ns/repo/adopt/0.2/payload.js";
@@ -154,15 +175,23 @@ export * as GitNsRepoArchive_v0_1 from "./git-ns/repo/archive/0.1/payload.js";
 export * as GitNsRepoArchive_v0_2 from "./git-ns/repo/archive/0.2/payload.js";
 export * as GitNsRepoCreate_v0_1 from "./git-ns/repo/create/0.1/payload.js";
 export * as GitNsRepoCreate_v0_2 from "./git-ns/repo/create/0.2/payload.js";
+export * as GitNsRepoCreate_v0_3 from "./git-ns/repo/create/0.3/payload.js";
 export * as GitNsRepoTransfer_v0_1 from "./git-ns/repo/transfer/0.1/payload.js";
 export * as GitNsRepoTransfer_v0_2 from "./git-ns/repo/transfer/0.2/payload.js";
+export * as GitNsRightBreakGlassNotice_v0_1 from "./git-ns/right/break-glass-notice/0.1/payload.js";
+export * as GitNsRightBreakGlass_v0_1 from "./git-ns/right/break-glass/0.1/payload.js";
 export * as GitNsRightGrant_v0_1 from "./git-ns/right/grant/0.1/payload.js";
 export * as GitNsRightGrant_v0_2 from "./git-ns/right/grant/0.2/payload.js";
+export * as GitNsRightGrant_v0_3 from "./git-ns/right/grant/0.3/payload.js";
+export * as GitNsRightRatify_v0_1 from "./git-ns/right/ratify/0.1/payload.js";
 export * as GitNsRightRevoke_v0_1 from "./git-ns/right/revoke/0.1/payload.js";
 export * as GitNsRightRevoke_v0_2 from "./git-ns/right/revoke/0.2/payload.js";
+export * as GitNsRightRevoke_v0_3 from "./git-ns/right/revoke/0.3/payload.js";
+export * as GitNsRolesReproject_v0_1 from "./git-ns/roles/reproject/0.1/payload.js";
 export * as GitNsView_v0_1 from "./git-ns/view/0.1/payload.js";
 export * as GitNsView_v0_2 from "./git-ns/view/0.2/payload.js";
 export * as GitNsView_v0_3 from "./git-ns/view/0.3/payload.js";
+export * as GitNsView_v0_4 from "./git-ns/view/0.4/payload.js";
 export * as GitTrustGrant_v0_1 from "./git-trust/grant/0.1/payload.js";
 export * as GitTrustRevoke_v0_1 from "./git-trust/revoke/0.1/payload.js";
 export * as GovernanceShared_v0_1 from "./governance/_shared/0.1/governance.js";
@@ -207,6 +236,7 @@ export * as MessagingAdminStrip_v0_1 from "./messaging/admin/strip/0.1/payload.j
 export * as MessagingMessageDelete_v0_1 from "./messaging/message/delete/0.1/payload.js";
 export * as MessagingMessageGet_v0_1 from "./messaging/message/get/0.1/payload.js";
 export * as MessagingMessageList_v0_1 from "./messaging/message/list/0.1/payload.js";
+export * as MessagingMessageStatus_v0_1 from "./messaging/message/status/0.1/payload.js";
 export * as MessagingMonitorEvent_v0_1 from "./messaging/monitor/event/0.1/payload.js";
 export * as MessagingMonitorSubscribe_v0_1 from "./messaging/monitor/subscribe/0.1/payload.js";
 export * as MessagingMonitorUnsubscribe_v0_1 from "./messaging/monitor/unsubscribe/0.1/payload.js";
@@ -400,12 +430,14 @@ export * as PasskeyVmShared_v0_1 from "./vta/_shared/0.1/passkey-vm.js";
 export * as ServiceShared_v0_1 from "./vta/_shared/0.1/service.js";
 export * as WebvhRecordsShared_v0_1 from "./vta/_shared/0.1/webvh-records.js";
 export * as DidTemplateShared_v0_2 from "./vta/_shared/0.2/did-template.js";
+export * as DidKeyRolesShared_v0_3 from "./vta/_shared/0.3/did-key-roles.js";
 export * as VtaAppStateDelete_v1_0 from "./vta/app-state/delete/1.0/payload.js";
 export * as VtaAppStateGetMany_v1_0 from "./vta/app-state/get-many/1.0/payload.js";
 export * as VtaAppStateGet_v1_0 from "./vta/app-state/get/1.0/payload.js";
 export * as VtaAppStateList_v1_0 from "./vta/app-state/list/1.0/payload.js";
 export * as VtaAppStatePutMany_v1_0 from "./vta/app-state/put-many/1.0/payload.js";
 export * as VtaAppStatePut_v1_0 from "./vta/app-state/put/1.0/payload.js";
+export * as VtaAttestationMnemonicExport_v1_0 from "./vta/attestation/mnemonic-export/1.0/payload.js";
 export * as VtaBackupAbort_v1_0 from "./vta/backup/abort/1.0/payload.js";
 export * as VtaBackupCompleteExport_v1_0 from "./vta/backup/complete-export/1.0/payload.js";
 export * as VtaBackupFinalizeImport_v1_0 from "./vta/backup/finalize-import/1.0/payload.js";
@@ -475,11 +507,17 @@ export * as VtaWebvhAgentNameSet_v1_0 from "./vta/webvh/agent-name/set/1.0/paylo
 export * as VtaWebvhDidsCreate_v1_0 from "./vta/webvh/dids/create/1.0/payload.js";
 export * as VtaWebvhDidsDelete_v1_0 from "./vta/webvh/dids/delete/1.0/payload.js";
 export * as VtaWebvhDidsGet_v1_0 from "./vta/webvh/dids/get/1.0/payload.js";
+export * as VtaWebvhDidsKeysAdd_v1_0 from "./vta/webvh/dids/keys/add/1.0/payload.js";
+export * as VtaWebvhDidsKeysList_v1_0 from "./vta/webvh/dids/keys/list/1.0/payload.js";
+export * as VtaWebvhDidsKeysRetire_v1_0 from "./vta/webvh/dids/keys/retire/1.0/payload.js";
+export * as VtaWebvhDidsKeysRevoke_v1_0 from "./vta/webvh/dids/keys/revoke/1.0/payload.js";
 export * as VtaWebvhDidsList_v1_0 from "./vta/webvh/dids/list/1.0/payload.js";
 export * as VtaWebvhDidsRealignKeys_v1_0 from "./vta/webvh/dids/realign-keys/1.0/payload.js";
 export * as VtaWebvhDidsRegisterWithServer_v1_0 from "./vta/webvh/dids/register-with-server/1.0/payload.js";
 export * as VtaWebvhDidsRotateKeys_v1_0 from "./vta/webvh/dids/rotate-keys/1.0/payload.js";
+export * as VtaWebvhDidsRotateKeys_v2_0 from "./vta/webvh/dids/rotate-keys/2.0/payload.js";
 export * as VtaWebvhDidsUpdate_v1_0 from "./vta/webvh/dids/update/1.0/payload.js";
+export * as VtaWebvhDidsUpdate_v2_0 from "./vta/webvh/dids/update/2.0/payload.js";
 export * as VtaWebvhServersDomains_v0_1 from "./vta/webvh/servers/domains/0.1/payload.js";
 export * as VtaWebvhServersList_v1_0 from "./vta/webvh/servers/list/1.0/payload.js";
 export * as VtaWebvhServersReconcile_v0_1 from "./vta/webvh/servers/reconcile/0.1/payload.js";
@@ -512,6 +550,7 @@ export * as VtcCommunityProfileShow_v0_1 from "./vtc/community/profile/show/0.1/
 export * as VtcCommunityProfileUpdate_v0_1 from "./vtc/community/profile/update/0.1/payload.js";
 export * as VtcConfigExport_v0_1 from "./vtc/config/export/0.1/payload.js";
 export * as VtcConfigImport_v0_1 from "./vtc/config/import/0.1/payload.js";
+export * as VtcCredentialsReissue_v0_1 from "./vtc/credentials/reissue/0.1/payload.js";
 export * as VtcDirectoryQuery_v0_1 from "./vtc/directory/query/0.1/payload.js";
 export * as VtcEndorsementTypesDelete_v0_1 from "./vtc/endorsement-types/delete/0.1/payload.js";
 export * as VtcEndorsementTypesList_v0_1 from "./vtc/endorsement-types/list/0.1/payload.js";

package/src/messaging/message/status/0.1/payload.ts

@@ -0,0 +1,270 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/messaging/message/status/0.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../../_shared/components.js";
+
+
+/**
+ * Where a sent message stands. `queued`: held for the recipient and not yet handed over. `delivered`: handed to the recipient (pickup or live stream) and not yet removed by it. `collected`: removed by the recipient — acknowledged after pickup, fetched with delete, or deleted or purged by it. `withdrawn`: removed by the sender. `discarded`: removed by the mediator before the recipient took it — expired, or its account was removed. `unknown`: the mediator holds neither the message nor a receipt for it under the requester.
+ */
+export type MessageState = "queued" | "delivered" | "collected" | "withdrawn" | "discarded" | "unknown";
+
+export interface MessagingMessageStatusPayload {
+  /**
+   * The messages the requester sent and wants the status of, by the mediator's message identifier.
+   *
+   * @minItems 1
+   * @maxItems 100
+   */
+  msgIds: [string, ...string[]];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * The success response to a messaging/message/status request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/message/status/0.1#response.
+ */
+export interface MessagingMessageStatusResponsePayload {
+  /**
+   * One entry per requested msgId, in request order.
+   */
+  statuses: {
+    msgId: string;
+    state: MessageState;
+    /**
+     * When the message reached this state: first handed over for `delivered`, removed for `collected`, `withdrawn` and `discarded`. Absent for `queued` and `unknown`, and wherever the mediator does not disclose it.
+     */
+    at?: string;
+  }[];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/messaging/message/status/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = MessagingMessageStatusPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/messaging/message/status/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = MessagingMessageStatusResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/messaging/message/status/0.1",
+  "title": "Messaging — Message Status — payload",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "msgIds"
+  ],
+  "properties": {
+    "msgIds": {
+      "type": "array",
+      "description": "The messages the requester sent and wants the status of, by the mediator's message identifier.",
+      "minItems": 1,
+      "maxItems": 100,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 256
+      }
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "MessageState": {
+      "title": "MessageState",
+      "type": "string",
+      "enum": [
+        "queued",
+        "delivered",
+        "collected",
+        "withdrawn",
+        "discarded",
+        "unknown"
+      ],
+      "description": "Where a sent message stands. `queued`: held for the recipient and not yet handed over. `delivered`: handed to the recipient (pickup or live stream) and not yet removed by it. `collected`: removed by the recipient — acknowledged after pickup, fetched with delete, or deleted or purged by it. `withdrawn`: removed by the sender. `discarded`: removed by the mediator before the recipient took it — expired, or its account was removed. `unknown`: the mediator holds neither the message nor a receipt for it under the requester."
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "Messaging — Message Status — response payload",
+      "description": "The success response to a messaging/message/status request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/message/status/0.1#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "statuses": {
+          "type": "array",
+          "description": "One entry per requested msgId, in request order.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "msgId",
+              "state"
+            ],
+            "properties": {
+              "msgId": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 256
+              },
+              "state": {
+                "$ref": "#/$defs/MessageState"
+              },
+              "at": {
+                "type": "string",
+                "format": "date-time",
+                "description": "When the message reached this state: first handed over for `delivered`, removed for `collected`, `withdrawn` and `discarded`. Absent for `queued` and `unknown`, and wherever the mediator does not disclose it."
+              }
+            }
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      },
+      "required": [
+        "statuses"
+      ]
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "MessageState": {
+      "title": "MessageState",
+      "type": "string",
+      "enum": [
+        "queued",
+        "delivered",
+        "collected",
+        "withdrawn",
+        "discarded",
+        "unknown"
+      ],
+      "description": "Where a sent message stands. `queued`: held for the recipient and not yet handed over. `delivered`: handed to the recipient (pickup or live stream) and not yet removed by it. `collected`: removed by the recipient — acknowledged after pickup, fetched with delete, or deleted or purged by it. `withdrawn`: removed by the sender. `discarded`: removed by the mediator before the recipient took it — expired, or its account was removed. `unknown`: the mediator holds neither the message nor a receipt for it under the requester."
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "Messaging — Message Status — response payload",
+      "description": "The success response to a messaging/message/status request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/message/status/0.1#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "statuses": {
+          "type": "array",
+          "description": "One entry per requested msgId, in request order.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "msgId",
+              "state"
+            ],
+            "properties": {
+              "msgId": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 256
+              },
+              "state": {
+                "$ref": "#/$defs/MessageState"
+              },
+              "at": {
+                "type": "string",
+                "format": "date-time",
+                "description": "When the message reached this state: first handed over for `delivered`, removed for `collected`, `withdrawn` and `discarded`. Absent for `queued` and `unknown`, and wherever the mediator does not disclose it."
+              }
+            }
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      },
+      "required": [
+        "statuses"
+      ]
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/vta/_shared/0.3/did-key-roles.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/_shared/0.3/did-key-roles.schema.json
+ */
+
+/**
+ * A VTA holds the keys of the durable DIDs it serves — its own, and those of the VTCs and VTNs provisioned on it — and assigns every one of them to exactly one named key role. These definitions describe a role, a key in a role, a rotation, the preview of the DID document a change would publish, and the approval state of a change awaiting a quorum. The normative rules that give them meaning (which verification relationships each role owns, who may change which role, how a change is approved, what is audited, and what each caller may see) are in CONVENTIONS.md beside this file. Not itself a Trust Task specification: the `_shared` folder is skipped by the registry build and the codegen.
+ */
+export interface DIDKeyRolesSharedDefinitionsForTheVtaWebvhDidsKeyRoleTasks {
+  [k: string]: unknown | undefined;
+}
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { DidDocumentChange, DidDocumentPreview, DidVerificationRelationship, KeyRole, KeyRoleApprovalState, KeyRoleChangeOutcome, KeyRoleProjection, RoleKey, RoleKeyCustody, RoleKeyState, RoleSummary, RotationKind, RotationRecord, RotationState } from "../../../_shared/components.js";

package/src/vta/attestation/mnemonic-export/1.0/payload.ts

@@ -0,0 +1,232 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/attestation/mnemonic-export/1.0/payload.schema.json
+ */
+
+import type { Ext } from "../../../../_shared/components.js";
+
+
+/**
+ * Asks an agent running in a trusted execution environment to release its seed mnemonic, once, sealed to a key only the producer holds. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface VTAAttestationMnemonicExportPayload {
+  /**
+   * The Ed25519 did:key the mnemonic is sealed to, by its X25519 counterpart, so only the holder of this key's private half can open the answer. Over an end-to-end channel, a key generated for this one export on the machine that will hold the backup, and discarded after. On the signed first-boot path over a hop-by-hop channel, exactly the document's issuer: the key that signed the request.
+   */
+  clientDid: string;
+  /**
+   * Sixteen random bytes, base64url without padding. It becomes the sealed bundle's identifier, and the recipient binds it into its attestation quote, so an answer cannot be replayed to a different request.
+   */
+  nonce: string;
+  /**
+   * Operator-visible label for the request. Never sealed into the answer and never treated as an instruction.
+   */
+  label?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+export interface VTAAttestationMnemonicExportResponsePayload {
+  /**
+   * The ASCII-armored sealed bundle. It carries the mnemonic sealed to clientDid under a producer assertion whose attestation quote binds the client key, the nonce and the recipient's own sealing key.
+   */
+  bundle: string;
+  /**
+   * SHA-256 of the bundle, lowercase hex. The producer confirms it out of band before opening, so a substituted bundle is caught before any key is applied to it.
+   */
+  digest: string;
+  /**
+   * Seconds that were left in the export window when the mnemonic was released. Informational: the window is spent either way.
+   */
+  windowRemainingSecs: number;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vta/attestation/mnemonic-export/1.0" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTAAttestationMnemonicExportPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/attestation/mnemonic-export/1.0#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTAAttestationMnemonicExportResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vta/attestation/mnemonic-export/1.0",
+  "title": "VTA Attestation — Mnemonic Export — payload",
+  "description": "Asks an agent running in a trusted execution environment to release its seed mnemonic, once, sealed to a key only the producer holds. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "clientDid",
+    "nonce"
+  ],
+  "properties": {
+    "clientDid": {
+      "type": "string",
+      "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$",
+      "maxLength": 128,
+      "description": "The Ed25519 did:key the mnemonic is sealed to, by its X25519 counterpart, so only the holder of this key's private half can open the answer. Over an end-to-end channel, a key generated for this one export on the machine that will hold the backup, and discarded after. On the signed first-boot path over a hop-by-hop channel, exactly the document's issuer: the key that signed the request."
+    },
+    "nonce": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]{22}$",
+      "description": "Sixteen random bytes, base64url without padding. It becomes the sealed bundle's identifier, and the recipient binds it into its attestation quote, so an answer cannot be replayed to a different request."
+    },
+    "label": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "Operator-visible label for the request. Never sealed into the answer and never treated as an instruction."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTA Attestation Mnemonic Export — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "bundle",
+        "digest",
+        "windowRemainingSecs"
+      ],
+      "properties": {
+        "bundle": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 65536,
+          "description": "The ASCII-armored sealed bundle. It carries the mnemonic sealed to clientDid under a producer assertion whose attestation quote binds the client key, the nonce and the recipient's own sealing key."
+        },
+        "digest": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$",
+          "description": "SHA-256 of the bundle, lowercase hex. The producer confirms it out of band before opening, so a substituted bundle is caught before any key is applied to it."
+        },
+        "windowRemainingSecs": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Seconds that were left in the export window when the mnemonic was released. Informational: the window is spent either way."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTA Attestation Mnemonic Export — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "bundle",
+        "digest",
+        "windowRemainingSecs"
+      ],
+      "properties": {
+        "bundle": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 65536,
+          "description": "The ASCII-armored sealed bundle. It carries the mnemonic sealed to clientDid under a producer assertion whose attestation quote binds the client key, the nonce and the recipient's own sealing key."
+        },
+        "digest": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$",
+          "description": "SHA-256 of the bundle, lowercase hex. The producer confirms it out of band before opening, so a substituted bundle is caught before any key is applied to it."
+        },
+        "windowRemainingSecs": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Seconds that were left in the export window when the mnemonic was released. Informational: the window is spent either way."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;