@openvtc/trust-tasks 0.21.6 → 0.21.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +56 -0
  2. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -11,6 +11,62 @@ The package versions over **its own API** — what a consumer compiles against
11
11
  not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
12
12
  component.
13
13
 
14
+ ## 0.21.7 — 2026-09-27
15
+
16
+
17
+ ### Fixed
18
+
19
+ - **codegen**: Generate usable types for oneOf branches that use not (#665)
20
+
21
+ typify (0.6) merges a `oneOf` branch's own keywords into the untagged
22
+ enum variant it synthesizes for that branch. A bare `not: {"required":
23
+ ["x"]}` is a shape it handles directly — property `x` is simply absent
24
+ from that variant. Wrap the same exclusion in `anyOf` (the shape a
25
+ 3-way mutual-exclusion group needs, e.g.
26
+ auth/passkey/enroll/invite/update/0.1's role/expiresAt/extendBy) and
27
+ typify's merge instead produces an uninhabited `pub enum
28
+ PayloadVariant0 {}` for that branch, so a payload carrying only `role`
29
+ (plus `inviteId`) could never deserialize — and silently drops a
30
+ property required only by that branch from every *other* branch's
31
+ variant too, so `role` + `expiresAt` together also failed to
32
+ round-trip. auth/revoke-session/0.2 has the same three-way `not:
33
+ {anyOf: [...]}` shape and produced the same uninhabited nested type,
34
+ though there it never broke a valid document (no shared field to
35
+ drop).
36
+
37
+ Only conformance example exercised extendBy alone, which is why this
38
+ was never caught. Added role-only, expiresAt-only and role+expiresAt
39
+ examples to auth/passkey/enroll/invite/update/0.1's spec.md, one per
40
+ oneOf branch plus their combination.
41
+
42
+ Fixed with a new preprocessing pass in trust-tasks-codegen,
43
+ desugar_oneof_with_compound_not, which drops a oneOf combinator from
44
+ the copy of the schema handed to typify whenever any branch's not is
45
+ more than a single {"required": ["x"]} guard. Re-expressing the oneOf
46
+ as anyOf (at least one) plus a pairwise not (no two at once) -
47
+ oneOf's own JSON Schema definition - was tried first and does not
48
+ help: typify applies the identical broken merge to a not wrapping
49
+ anyOf/allOf regardless of which combinator carries it. The wire
50
+ schema (SCHEMA_JSON / ValidatedPayload::validate_value, and the
51
+ TypeScript/Go/Dart bindings, generated independently of typify) is
52
+ captured before this pass runs and is unaffected, so the actual
53
+ mutual-exclusion constraint is still enforced at runtime; only the
54
+ Rust type for the two affected specs becomes fully permissive, matching
55
+ what the other three languages already generate for this schema. A
56
+ plain discriminated oneOf (every branch's not, if any, a single
57
+ {"required": ["x"]}) is untouched and still renders as a clean Rust
58
+ enum.
59
+
60
+ Scanned every schema under specs/ for a oneOf/anyOf branch using not.
61
+ Only these two combine it with oneOf; the rest (auth/revoke-session/0.1,
62
+ vta/app-state/put/1.0, vta/app-state/put-many/1.0,
63
+ vtc/registry/sync-jobs/retry/0.1, credential-exchange/issue/0.1, and a
64
+ few uses of not outside any oneOf) were unaffected and are unchanged
65
+ after regenerating.
66
+
67
+ Regenerated all four bindings; only the two affected Rust modules
68
+ changed.
69
+
14
70
  ## 0.21.6 — 2026-09-27
15
71
 
16
72
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@openvtc/trust-tasks",
3
- "version": "0.21.6",
3
+ "version": "0.21.7",
4
4
  "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",