@openvtc/trust-tasks 0.21.3 → 0.21.5

package/CHANGELOG.md

@@ -11,6 +11,78 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.21.5 — 2026-09-27
+
+
+### Added
+
+- **did-management**: Trust Tasks for the DID hosting service's REST-only surface (#661)
+
+* feat(did-management): Trust Tasks for the DID hosting service's REST-only surface
+
+  Specs for every remote surface of affinidi-webvh-service that had none, so each can move onto the service's central Trust Task dispatch over TSP, DIDComm and HTTPS:
+
+  - did-management: did/log, agent-name/resolve, domain/list, registry/list|get|check|purge-domain, stats/get|timeseries, server/config|info, identity/list|retire, and _shared/0.2 service-instance.
+  - did-management/replica/domain: upsert, assign, unassign, purge (the control plane to edge hop, today sent on the admin URIs or unspecified).
+  - webvh: sync/update 0.2 and sync/delete 0.2 (proof required, a disabled member, watchers as replicas), sync/batch 0.1, witness/sign and witness/key/create|list|delete.
+  - auth: step-up/start (replaces the bespoke REST start/finish paths), and passkey/enroll/invite/list|update|revoke addressed by inviteId, never by token.
+
+  Every task requires a proof except the public did-management/server/info read. Bindings regenerated for Rust, TypeScript, Go and Dart.
+
+## 0.21.4 — 2026-09-27
+
+
+### Added
+
+- **git-ns**: Administrator reads — view 0.5, namespace/list and repo/list (#659)
+
+* feat(git-ns): administrator reads — view 0.5, namespace/list and repo/list
+
+  Three signed read tasks replace the bearer-authenticated administrator
+  views VTCs served beside git-ns/view:
+
+  - git-ns/view/0.5 adds scope: administrator (everything in the
+    namespaces the caller administers, reasons included) and
+    breakGlass: true (narrow to break-glass records). The response is
+    0.4's.
+  - git-ns/namespace/list/0.1 lists administered namespaces with admins,
+    repository count, bridge, role map and forge status.
+  - git-ns/repo/list/0.1 lists repositories in administered namespaces
+    with owners, right counts, bootstrap, sync and the bridge's report.
+
+  Proof REQUIRED on all three; no side effects. Authority is the
+  community-administrator capability (every namespace) or a live explicit
+  git.ns.admin (that namespace); each declares notAdministrator, answered
+  alike for an unknown namespace and one the caller does not administer.
+
+- **auth/passkey**: An administrator lists one member's passkeys (admin-list 0.1) (#658)
+
+auth/passkey/list lists only the signer's own credentials and refuses a
+  subject in the payload, so no task let an administrator see which step-up
+  passkeys a member holds — and so which credentialId to hand to
+  auth/passkey/revoke/start 0.2.
+
+  auth/passkey/admin-list 0.1:
+
+  - Proof REQUIRED: the administrator is the issuer. The subject and a purpose
+    (session | stepUp, no default) are named in the payload, and are a request,
+    never a grant: the consumer authorises the administrator over that subject
+    from its own state.
+  - Refusals, in order: notAdministrator (before the subject is looked at);
+    subjectUnknown, also for a subject outside the administrator's authority,
+    so the code is no oracle; purposeNotSupported; subjectNotMember.
+  - The response is { subject, purpose, credentials }, each a ListedCredential
+    of credentialId, deviceLabel, registeredAt, lastUsedAt and signCount — no
+    key material, no public key, no attestation, additionalProperties false.
+    The counter is disclosed to the administrator, as the operator who acts on
+    a cloning signal.
+  - sideEffects none: listing touches no counter and no last-used time.
+  - Privacy: only administrators with authority over the subject; the family
+    audits writes, not reads, and a consumer that audits administrative reads
+    SHOULD include this one.
+
+  Rust, TypeScript, Go and Dart bindings regenerated.
+
 ## 0.21.3 — 2026-09-26
 
 

package/dist/_shared/components.d.ts

@@ -2619,6 +2619,43 @@ export interface GitNamespace {
      */
     state: "pending" | "bound";
 }
+/**
+ * One histogram's distribution, in the Prometheus cumulative-bucket convention: each bucket's `count` includes every observation at or below its `le`.
+ */
+export interface Histogram {
+    /**
+     * The histogram's stable name (e.g. `did_hosting_resolve_seconds`).
+     */
+    name: string;
+    /**
+     * Dimensions the distribution is broken down by. Absent or empty when the histogram carries none.
+     */
+    labels?: {
+        [k: string]: string | undefined;
+    };
+    /**
+     * Total number of observations.
+     */
+    count: number;
+    /**
+     * Sum of all observed values.
+     */
+    sum: number;
+    /**
+     * Cumulative buckets, ordered by ascending `le`. Empty when the service exposes no bucket breakdown for this histogram — count and sum still apply. Always present, for the same reason as the snapshot's own arrays.
+     */
+    buckets: HistogramBucket[];
+}
+export interface HistogramBucket {
+    /**
+     * Upper bound of this bucket, inclusive. The final bucket conventionally reports the same value as the histogram's own `count` at whatever `le` the service treats as its ceiling.
+     */
+    le: number;
+    /**
+     * Number of observations at or below `le`.
+     */
+    count: number;
+}
 /**
  * OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`did-signed` / `attested` / `pinned-only`) is the integrity / authenticity anchor.
  *
@@ -2692,10 +2729,34 @@ export interface InvitationSummary {
      */
     revokedAt?: string;
 }
+export interface InviteSummary_AuthV0_1 {
+    /**
+     * Consumer-chosen opaque handle for the invite. It is NOT the invite token and MUST NOT be derivable into it; knowing it lets an administrator manage the invite, never redeem it.
+     */
+    inviteId: string;
+    /**
+     * The VID the invite binds a passkey to.
+     */
+    subject: string;
+    /**
+     * What the redeemed credential may authenticate, as in auth/passkey/enroll/invite.
+     */
+    purpose: "session" | "stepUp";
+    /**
+     * The role the invitee receives on redemption. Absent when the consumer applies its default role, and always absent for purpose stepUp.
+     */
+    role?: string;
+    createdAt: string;
+    expiresAt: string;
+    /**
+     * True when expiresAt has passed. An expired invite can no longer be redeemed; it is listed until the consumer's cleanup removes it.
+     */
+    expired: boolean;
+}
 /**
  * One outstanding or historical admin invite. Consumed rows are retained as audit history and cannot be revoked.
  */
-export interface InviteSummary {
+export interface InviteSummary_VtcV0_1 {
     /**
      * Unique invite identifier; the revoke target.
      */
@@ -3066,6 +3127,44 @@ export interface MessageMeta {
      */
     deliveredAt?: string;
 }
+/**
+ * One counter or gauge reading.
+ */
+export interface Metric {
+    /**
+     * The metric's stable name (e.g. `did_hosting_requests_total`). Implementation-defined; the framework imposes no vocabulary.
+     */
+    name: string;
+    /**
+     * The current reading.
+     */
+    value: number;
+    /**
+     * Dimensions the value is broken down by (e.g. `{"method": "resolve"}`). Absent or empty when the metric carries none.
+     */
+    labels?: {
+        [k: string]: string | undefined;
+    };
+}
+export interface MetricsSnapshot {
+    /**
+     * When the service read these values from its own instrumentation. Not the same as the envelope's issuedAt when a snapshot is cached briefly before answering.
+     */
+    takenAt: string;
+    /**
+     * Monotonically increasing totals (e.g. requests served, errors raised). Empty when the service exposes none. Always present, so a collector can tell "no counters" from "the field was dropped".
+     */
+    counters: Metric[];
+    /**
+     * Point-in-time values that can rise or fall (e.g. open connections, queue depth). Empty when the service exposes none. Always present, for the same reason as counters.
+     */
+    gauges: Metric[];
+    /**
+     * Distributions of observed values (e.g. request latency). Empty when the service exposes none. Always present, for the same reason as counters.
+     */
+    histograms: Histogram[];
+    ext?: Ext;
+}
 /**
  * One observed step in the life of one message at the mediator. Carries metadata only — never a message body.
  */
@@ -4296,7 +4395,7 @@ export interface SealedRecord {
      */
     epoch: number;
 }
-export interface ServiceInstance {
+export interface ServiceInstance_DidManagementV0_1 {
     /**
      * Stable identifier the control plane uses for this instance. SHOULD be derived from the instance's DID (e.g. `did:web:host.example` → `did_web_host_example`) so it survives restarts.
      */
@@ -4314,6 +4413,62 @@ export interface ServiceInstance {
     lastSeen?: string;
     ext?: Ext;
 }
+export interface ServiceInstance_DidManagementV0_2 {
+    /**
+     * Stable identifier the control plane uses for this instance. SHOULD be derived from the instance's DID so it survives restarts.
+     */
+    instanceId: string;
+    /**
+     * The instance's own DID — the identity its signed documents are verified against and the one the control plane addresses.
+     */
+    did: string;
+    /**
+     * `server` — a hosting server (edge) that resolves DIDs the control plane syncs to it. `witness` — a did:webvh witness. `watcher` — a did:webvh watcher that mirrors logs.
+     */
+    serviceType: "server" | "witness" | "watcher";
+    /**
+     * Operator-chosen display label. Untrusted free text.
+     */
+    label?: string;
+    /**
+     * The instance's public base URL, where it serves DID resolution. Absent when the instance registered without one.
+     */
+    publicUrl?: string;
+    /**
+     * The control plane's current verdict, from the instance's last answered health probe. `degraded` — answered late; `unreachable` — has not answered within the control plane's configured window.
+     */
+    status: "active" | "degraded" | "unreachable";
+    /**
+     * Hosting domains the instance has acknowledged serving. Always present — empty for an instance that serves none, which includes every `witness` and `watcher`.
+     */
+    servedDomains: string[];
+    /**
+     * DID methods the instance can host (e.g. `webvh`, `web`, `webs`), as it declared at registration.
+     */
+    enabledMethods?: string[];
+    /**
+     * `service[].type` values of the instance's DID document when the control plane last resolved it. Display only: nothing is routed on it. Absent when the document has not been resolved.
+     */
+    advertisedServices?: string[];
+    /**
+     * When `advertisedServices` was last resolved. Absent with it.
+     */
+    servicesCheckedAt?: string;
+    /**
+     * The last document the control plane received from this instance. Absent when it has received none.
+     */
+    lastInbound?: TransportObservation;
+    /**
+     * The last document the control plane delivered to this instance. Absent when it has delivered none.
+     */
+    lastOutbound?: TransportObservation;
+    /**
+     * When the instance last answered a health probe. Absent when it never has.
+     */
+    lastHealthCheck?: string;
+    registeredAt: string;
+    ext?: Ext;
+}
 /**
  * The outcome of a change to an advertised service. Every member describes the **log entry the change produced**, because that is what the change actually is: the agent's DID document is the record, and a consumer that treats the response as a mere acknowledgement will miss that a redeploy may be required.
  */
@@ -4551,6 +4706,33 @@ export interface Sync {
      */
     drift: DriftItem[];
 }
+export interface SyncUpdate {
+    /**
+     * The slot path on its hosting domain (e.g. `alice`, `people/alice`, or `.well-known` for a root DID).
+     */
+    mnemonic: string;
+    /**
+     * The DID the log establishes. A replica MUST refuse a log that does not establish exactly this DID.
+     */
+    didId: string;
+    /**
+     * The slot's complete did.jsonl — one log entry per line — not a delta.
+     */
+    logContent: string;
+    /**
+     * The slot's did-witness.json. ABSENT means the slot holds no witness proofs: the replica MUST drop any witness proofs it holds for the slot. Absence never means "unchanged".
+     */
+    witnessContent?: string;
+    /**
+     * Number of entries in `logContent`, as the source counts them. A replica MUST refuse an update whose `logContent` does not contain exactly this many entries.
+     */
+    versionCount: number;
+    /**
+     * Whether the source has disabled the slot. A replica MUST stop serving a disabled slot and MUST resume only on an update carrying `false`.
+     */
+    disabled: boolean;
+    ext?: Ext;
+}
 /**
  * An access token (typically short-lived JWT) paired with an optional refresh token (typically long-lived opaque string). The shapes follow OAuth 2.0 (RFC 6749 §5.1) conventions but are not coupled to any particular OAuth profile.
  */
@@ -4597,6 +4779,13 @@ export interface TrafficOutcome {
      */
     detail?: string;
 }
+export interface TransportObservation {
+    /**
+     * The binding the document actually travelled on.
+     */
+    transport: "tsp" | "didcomm" | "https";
+    at: string;
+}
 export interface TrustRecord {
     entity_id: string;
     authority_id: string;
@@ -5165,6 +5354,25 @@ export interface WebvhServerRecord {
     updatedAt: string;
     ext?: Ext;
 }
+export interface WitnessKey {
+    /**
+     * The witness service's identifier for this identity. Opaque to the requester.
+     */
+    witnessId: string;
+    /**
+     * The witness identity's DID (for example a `did:key`) — the value a did:webvh log names in its `witness` parameter, and the controller of the key that signs its proofs.
+     */
+    did: string;
+    /**
+     * Operator-chosen display label. Untrusted free text. Absent when none was given.
+     */
+    label?: string;
+    createdAt: string;
+    /**
+     * How many witness proofs this identity has signed.
+     */
+    proofsSigned: number;
+}
 /**
  * The outcome of one write within a `vta/app-state/put-many` batch. Per-record rather than per-batch, because the default batch mode applies each write on its own merits: a caller flushing ten unrelated edits needs to know which one conflicted, not merely that something did.
  */