@openvtc/trust-tasks 0.21.10 → 0.21.12

package/CHANGELOG.md

@@ -11,6 +11,112 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.21.12 — 2026-09-28
+
+
+### Added
+
+- **vtc/website**: Website content moves as a chunked Trust Task transfer (#682)
+
+Replaces the raw-byte REST routes (GET/PUT /website/files/{path}, POST /website/deploy) with Trust Tasks, modelled on backup/* and reusing vta/_shared/0.1/backup-transfer's chunk vocabulary:
+
+  - vtc/website/upload/begin — commits the target (a file at a path, with optional ifMatch, or a whole-site bundle), total size, whole-content SHA-256 and every chunk digest before any byte moves.
+  - vtc/website/upload/chunk — one chunk of up to 256 KiB, checked against the manifest on arrival; idempotent.
+  - vtc/website/upload/commit — reassembles and verifies the SHA-256; writes a file target atomically, or stages a bundle.
+  - vtc/website/upload/abort — discards an open or staged upload.
+  - vtc/website/deploy — publishes a staged bundle (live replace, or a new managed generation with pruning).
+  - vtc/website/files/show — ranged reads of up to 256 KiB with the whole-file etag.
+
+  begin, chunk and files/show declare maxDocumentBytes (256 KiB, 352 KiB, 352 KiB response), so the community's 64 KiB default is not raised for every other task. Shared component vtc/_shared/0.1/website-transfer. Bindings regenerated for Rust, TypeScript, Go and Dart.
+
+- **vtc**: Trust Tasks for the community's REST-only admin surfaces (#680)
+
+* feat(vtc): Trust Tasks for the community's REST-only admin surfaces
+
+  Specifies, at 0.1, the VTC operations that existed only as REST routes, so each can be served as a sender-bound signed Trust Task over TSP, DIDComm or HTTPS:
+
+  - auth/signing-key/{enroll,list,revoke} — delegated signing keys (the admin console's non-extractable browser key). Enrolment is signed by the key being enrolled (proof of possession) and names the identity it acts for; control of that identity is established by separate authority evidence, which the reference implementation takes as an operation-bound passkey step-up.
+  - vtc/community/{branding,requested-attributes,join-discovery}/{show,update}
+  - vtc/schemas/{register,list,show,delete} and vtc/schemas/accepts/{register,list,show,delete} — register and show declare maxDocumentBytes, since a credential schema exceeds the 64 KiB default.
+  - vtc/vetting/vetters/grants/list, vtc/vetting/auto-grant/{show,update}, vtc/vetting/revocations/list
+  - vtc/relationships/{suspend,restore} — the edge issuer's own proof replaces the REST pop authorization.
+  - vtc/join-requests/vetting/show, and vtc/join-requests/query — its own task rather than credential-exchange/*, because an administrator instructs the verifier, which alone can author the query's challenge.
+  - vtc/rooms/list — under vtc/, not rooms/, because it is authorized by host ACL and rooms invariant I5 forbids that for any rooms/* task.
+
+  Shared components: auth/_shared/0.1/signing-key and vtc/_shared/0.1/{community-presentation,schema-registry,vetting-auto-grant,relationship-lifecycle}. Relationship persona attach/detach stays out, blocked on dtgwg-cred-spec#9. Bindings regenerated for Rust, TypeScript, Go and Dart.
+
+- **spec-meta**: A specification declares its own maximum document size (#679)
+
+Adds an optional front-matter member, maxDocumentBytes { request?, response?, rationale }, stating the largest serialized Trust Task document (proof included, transport envelope excluded) of each variant that a consumer serving the task must not refuse on grounds of size alone, and should refuse beyond with malformedRequest.
+
+  SPEC §12.4 already tells a consumer to bound what it parses at "a body-size limit appropriate to the Trust Task specification's payload", and §7.3 item 19 notes that a transport-layer limit is the wrong place to pick the number; until now no specification could say what it was. A consumer serving many tasks therefore applied one blanket cap sized for the small ones, and a task that legitimately carries a JSON Schema or a chunk of a file was refused. This lets the bound be stated, and enforced, per type.
+
+  - specs/spec.meta.schema.json: the member (at least one variant, 1 KiB to 16 MiB; larger content belongs in a chunked transfer).
+  - trust-tasks-codegen: reads it and emits Payload::MAX_DOCUMENT_BYTES on the request and response impls, plus schema_index::max_document_bytes_for(type_uri) for a dispatcher that learns the type before parsing. An absent variant never inherits the other's bound.
+  - trust-tasks-rs: the trait constant, defaulting to None.
+  - check-bindings: holds Rust's constants to the front matter, re-derived independently.
+  - CONTRIBUTING-SPECS: when and how to declare it.
+
+  Rust only for now, like ERROR_CODES; the TypeScript, Go and Dart generators do not emit it yet. The framework text (a §7.3 item) is proposed in the canonical specification repository; this is the registry's half.
+
+
+
+### Specifications
+
+- **webvh/witness/sign**: Let a witness sign the entry that deactivates a DID (#681)
+
+## 0.21.11 — 2026-09-28
+
+
+### Added
+
+- **trust-task-discovery**: Publish 0.3, a responder advertises its acceptance window (#677)
+
+A consumer refuses a document whose issuedAt lies outside its acceptance
+  window (SPEC §7.2 item 13), and the framework leaves that window to the
+  consumer's policy. A producer that holds a document before delivering it
+  (store-and-forward, retry, escalation, a queue replayed after a restart)
+  cannot tell a document the consumer will still accept from one it will
+  refuse as expired. So it cannot tell when to issue a new attempt (SPEC
+  §8.4) instead. The only alternative is a constant both ends share.
+
+  - specs/trust-task-discovery/0.3: the response gains an optional
+    acceptanceWindow { maxAgeSeconds, clockSkewSeconds }, in whole seconds.
+    It appears at the response level, and on an expanded supportedTypes
+    entry, where the entry's value takes precedence.
+    - Responder: MUST NOT state a window wider than it applies, and is not
+      bound by what it advertised.
+    - Discoverer: authenticated responses only. SHOULD NOT send after
+      issuedAt + maxAge, and MUST NOT after issuedAt + maxAge + skew. It
+      issues a new attempt instead (fresh id and issuedAt, same thread,
+      new proof), and never re-stamps under the original id (idConflict).
+      It does not issue a new attempt of a consequential task unless a
+      repeat is harmless or recognizable. It never backdates to fit a
+      window, bounds its new attempts, and treats a refusal as the answer.
+    - Absent: the discoverer has learnt nothing. It falls back to the
+      window the task's specification states (item 17) or its own, with
+      the typical skew tolerance of at most 60 s. Absence is never read as
+      "no window".
+    - The response is closed, so a 0.2 discoverer that validates would
+      reject the member. §5.2 makes an added optional member a MINOR
+      increment, hence 0.3 rather than an edit to 0.2.
+    - Response-side invalid examples: a missing member, a zero max age,
+      negative skew, fractional or string values, an unknown member, and
+      a malformed entry-level window.
+  - trust-tasks-codegen: a payload.invalid-examples.json fixture may carry
+    "variant": "response". It is checked against Response and its
+    sub-schema by a separate rejects_invalid_response_examples test. It is
+    refused in a spec with no response. Existing fixtures, and every other
+    generated module, are unchanged.
+  - CONTRIBUTING-SPECS.md documents the variant.
+  - Bindings regenerated (Rust, TS, Go, Dart).
+
+  The framework text (SPEC §10) still names 0.2 as the current version.
+  That is a change to the canonical repository and follows separately.
+
+  Proposed from OpenVTC/verifiable-trust-infrastructure#1799, where both
+  ends currently share a constant window.
+
 ## 0.21.10 — 2026-09-28
 
 

package/dist/_framework/0.4/framework.d.ts

@@ -14,5 +14,5 @@ export interface TrustTasksFrameworkReusableJSONSchemaDefinitions {
  * The definitions this shared schema publishes, hoisted to one declaration each.
  * See "../../_shared/components.js".
  */
-export type { Ext, ExtCritical } from "../../_shared/components.js";
+export type { DigestMultibase, Ext, ExtCritical } from "../../_shared/components.js";
 //# sourceMappingURL=framework.d.ts.map

package/dist/_framework/0.4/framework.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../../src/_framework/0.4/framework.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,WAAW,gDAAgD;IAC/D,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../../src/_framework/0.4/framework.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,WAAW,gDAAgD;IAC/D,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,YAAY,EAAE,eAAe,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC"}