@openvtc/trust-tasks 0.23.0 → 0.23.2

package/dist/vtc/operator/offline-write/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vtc/operator/offline-write/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkCH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,4DAAqE,CAAC;AAK9F;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,4DAA4D;IACnE,OAAO,EAAE,qCAAqC;IAC9C,aAAa,EAAE,qvBAAqvB;IACpwB,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,SAAS;QACT,MAAM;QACN,MAAM;QACN,IAAI;KACL;IACD,YAAY,EAAE;QACZ,SAAS,EAAE;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,WAAW;gBACX,aAAa;gBACb,mBAAmB;gBACnB,eAAe;gBACf,oBAAoB;aACrB;YACD,aAAa,EAAE,sjBAAsjB;SACtkB;QACD,MAAM,EAAE;YACN,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,EAAE;YACd,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,CAAC;gBACd,WAAW,EAAE,IAAI;aAClB;YACD,aAAa,EAAE,4UAA4U;SAC5V;QACD,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,0QAA0Q;SAC1R;QACD,IAAI,EAAE;YACJ,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,WAAW;YACrB,aAAa,EAAE,4JAA4J;SAC5K;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,KAAK;IAC1B,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.23.0",
+  "version": "0.23.2",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/_shared/components.ts

@@ -637,6 +637,10 @@ export type Resource = string;
  * Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.
  */
 export type ResourceQualifier = string;
+/**
+ * Opaque, community-minted position in one caller's event stream. A console MUST NOT parse, construct or order it; it only hands the latest one back as `since` when it re-subscribes. A community binds it to the caller it was minted for and treats a token minted for anyone else as unknown.
+ */
+export type ResumeToken = string;
 /**
  * Whether a room keeps its history readable across a membership change, fixed at creation and immutable thereafter — like `Visibility`, and for the same reason: the rungs of an epoch key chain either exist for an epoch or they do not, and no later change of mind can seal key material that was never sealed or unseal what was already severed. `chained`: each advance produces an `EpochLink`, so every member reads the room's whole retained history however long they have been in it — what a **library** wants, at the cost of post-compromise security for record content, since a compromised current key then reaches every retained epoch. `fromJoin`: no rungs are produced, so a member reads only from the epoch their group state is at — what a **stream** wants, and what a room under a strict forward-secrecy obligation wants, at the cost that a joining member finds an empty-looking room and nobody can reread a record once their group state has moved past the epoch it was sealed under. Absent means `chained`; see the prose on why the absent case is the readable one.
  */
@@ -801,6 +805,10 @@ export type SyncEvent_SyncV0_2 =
   | VaultDeletedEvent_SyncV0_2
   | AclChangedEvent_SyncV0_2
   | PolicyChangedEvent_SyncV0_2;
+/**
+ * One kind of change a console can be told about. A closed set: a topic not listed here is a new MINOR version of this component, not an `ext` member, because each topic is bound to the read that authorizes it.
+ */
+export type Topic = "actions" | "acknowledgements" | "joinRequests" | "members" | "singleAdminMode" | "config";
 /**
  * How the traffic reached or left the mediator. `peerMediator` is mediator-to-mediator forwarding.
  */
@@ -1349,7 +1357,7 @@ export interface AclEntry_AclV0_2 {
 /**
  * One parked administrative operation, as the caller is entitled to see it. The same action reads differently to different callers only in `challenge` and `callerRole`, which are per-caller.
  */
-export interface Action {
+export interface Action_VtcAdminActionsV0_1 {
   actionId: ActionId;
   /**
    * `approval` — eligible approvers approve or decline, N-of-M; the operation executes when the threshold is met. `acknowledge` — an operation that already happened (an operator's offline or break-glass write) which every remaining administrator must acknowledge; there is nothing to approve or decline. `queue` — an existing human decision (for example a join review) surfaced in the same list, with a threshold of one.
@@ -1438,6 +1446,107 @@ export interface Action {
   requesterOpenActions?: number;
   ext?: Ext;
 }
+/**
+ * One parked administrative operation, as the caller is entitled to see it. The same action reads differently to different callers only in `challenge` and `callerRole`, which are per-caller.
+ */
+export interface Action_VtcAdminActionsV0_2 {
+  actionId: ActionId;
+  /**
+   * `approval` — eligible approvers approve or decline, N-of-M; the operation executes when the threshold is met. `acknowledge` — an operation that already happened (an operator's offline or break-glass write) which every remaining administrator must acknowledge; there is nothing to approve or decline. `queue` — an existing human decision (for example a join review) surfaced in the same list, with a threshold of one. `coolingOff` — an operation with no eligible third party to consent, which lands by itself at `landsAt` unless its requester cancels it first; nobody approves, declines or acknowledges it.
+   */
+  category: "approval" | "acknowledge" | "queue" | "coolingOff";
+  /**
+   * The community's name for what kind of operation is parked, dotted and lowerCamelCase (`acl.grant.authority`, `member.join.review`). Selects the summary template. The set is OPEN: a renderer that does not recognise a kind still renders `summary` from its fields.
+   */
+  kind: string;
+  /**
+   * The Type URI of the parked operation — the Trust Task the community will execute when the action completes (for `coolingOff`, when it lands). Together with `payload` it is exactly what will run. For `acknowledge`, the Type URI of the operation that already took effect; an operator's offline write, which is a command on the community's host and has no Trust Task of its own, is named by the record type `https://trusttasks.org/spec/vtc/operator/offline-write/0.1`, and `payload` is then that record.
+   */
+  typeUri: string;
+  /**
+   * VID of the party whose operation was parked. For `acknowledge`, the operator whose offline write is being acknowledged, where the community can attribute one. For `coolingOff`, the administrator whose operation will land — the only party who may cancel it.
+   */
+  requester: string;
+  /**
+   * `open` — awaiting decisions, or for `coolingOff` awaiting `landsAt`. `completed` — the threshold was met and the operation executed, a `coolingOff` operation landed, or, for `acknowledge`, every administrator acknowledged. `declined` — an eligible approver denied it. `expired` — it lapsed at `expiresAt`. `cancelled` — the requester withdrew it, or the community invalidated it (see `closedReason`). `failed` — the threshold was met or `landsAt` reached but the re-check at execution refused it, or execution itself failed; the operation did not take effect.
+   */
+  status: "open" | "completed" | "declined" | "expired" | "cancelled" | "failed";
+  /**
+   * When the operation was parked.
+   */
+  createdAt: string;
+  /**
+   * When an open action lapses. ALWAYS present for `approval`, whose open life is bounded (72 hours by default; the community configures it between 15 minutes and 14 days). Absent for an `acknowledge` or `queue` action that does not expire, and ALWAYS absent for `coolingOff`, which does not lapse but lands — see `landsAt`.
+   */
+  expiresAt?: string;
+  /**
+   * When a `coolingOff` action lands: the instant from which the community executes the parked operation, after its execution-time re-check, unless the requester cancelled first. Present exactly when `category` is `coolingOff`. It is a deadline for the requester's cancellation, not for anyone's approval, and it is fixed when the action is parked: neither the requester nor the subject can move it.
+   */
+  landsAt?: string;
+  /**
+   * Who may withdraw the action with `vtc/admin/actions/cancel` while it is `open`. Present on every open `coolingOff` action, where it is `requester`: the operation lands unless its requester stops it, and nobody else — the subject included — can. A closed set so that a console can offer a cancel control without inferring it; future values would widen who may cancel and need a new version.
+   */
+  cancellableBy?: "requester";
+  /**
+   * When the action left `open`. Present exactly when `status` is not `open`.
+   */
+  closedAt?: string;
+  /**
+   * Why the action closed. Present exactly when `status` is not `open`. `invalidated` — the community closed it because something it depended on stopped holding before the threshold or `landsAt` (an approver or the requester lost standing, the target state moved); `failedRecheck` — the threshold was met or `landsAt` reached but the execution-time re-check refused; `landedAfterCoolingOff` — a `coolingOff` action reached `landsAt` uncancelled and its operation executed (`status: completed`).
+   */
+  closedReason?:
+    | "thresholdMet"
+    | "declined"
+    | "expired"
+    | "cancelledByRequester"
+    | "invalidated"
+    | "failedRecheck"
+    | "acknowledged"
+    | "landedAfterCoolingOff";
+  /**
+   * The number of distinct approvals the operation needs. Present for `approval`; absent otherwise (a `queue` decision is one decision by construction, `acknowledge` needs every remaining administrator, and `coolingOff` needs no approval at all).
+   */
+  threshold?: number;
+  /**
+   * The decisions in favour recorded so far — approvals for `approval` and `queue`, acknowledgements for `acknowledge` — one entry per distinct subject, in the order recorded. Empty while none has landed, and always empty for `coolingOff`, which takes no decisions.
+   */
+  approvals: {
+    /**
+     * VID of the approver or acknowledger, as proven by the decision's own proof.
+     */
+    subject: string;
+    /**
+     * When the decision was recorded.
+     */
+    at: string;
+  }[];
+  /**
+   * How many further distinct decisions the action needs while `open` — approvals for `approval`, acknowledgements for `acknowledge`. Lets a console say 'one more' without disclosing the eligible set. Absent for `coolingOff`, which waits on time, not on decisions.
+   */
+  approversRemaining?: number;
+  summary: Summary;
+  /**
+   * The exact payload of the parked operation — the object `payloadDigest` is computed over and the one the community will execute. Carried so an approver can recompute the digest and re-derive every summary field from it rather than trusting the rendering (VTI-APV-013). Deliberately an open object: its shape is governed by the specification `typeUri` names, and a digest is checked over members exactly as received.
+   */
+  payload: {};
+  /**
+   * Digest of `payload`, taken over its RFC 8785 (JCS) canonicalization. The community re-derives it from the payload it is about to execute and refuses on mismatch. The digest an approver signs over is the challenge-salted one of `task-consent/decision`, not this value; this one lets the approver check that `payload` is what was parked.
+   */
+  payloadDigest: DigestMultibase;
+  /**
+   * Present ONLY on an action the CALLER may decide now — an `approval` or `queue` action on which the caller is an eligible approver who has not yet decided. Never present on `acknowledge` or `coolingOff`. Per-approver: two approvers are shown different challenges for the same action. Echoed verbatim in `task-consent/decision`'s `challenge`, which binds that decision to this approver and this action. Absent for everyone else, including the requester.
+   */
+  challenge?: string;
+  /**
+   * The caller's relation to this action. `approver` — an eligible approver (whether or not already decided). `requester` — the party whose operation was parked. `acknowledger` — an administrator expected to acknowledge it. `subject` — the party a `coolingOff` operation acts on, shown it so that they learn of it before it lands; a subject can neither decide nor cancel it. `observer` — none of these; seen only through the audit-read capability on a `history` or `all` view.
+   */
+  callerRole: "approver" | "requester" | "acknowledger" | "subject" | "observer";
+  /**
+   * How many open actions the requester currently has at the community, this one included. For consent-fatigue display: an approver shown the twentieth request from one requester today should be able to see that it is the twentieth.
+   */
+  requesterOpenActions?: number;
+  ext?: Ext;
+}
 /**
  * A privileged account at the mediator (an `admin` or `rootAdmin`).
  */

package/src/index.ts

@@ -622,11 +622,19 @@ export * as VettingAutoGrantShared_v0_1 from "./vtc/_shared/0.1/vetting-auto-gra
 export * as WebsiteTransferShared_v0_1 from "./vtc/_shared/0.1/website-transfer.js";
 export * as SchemaRegistryShared_v0_2 from "./vtc/_shared/0.2/schema-registry.js";
 export * as ActionShared_v0_1 from "./vtc/admin/actions/_shared/0.1/action.js";
+export * as ActionShared_v0_2 from "./vtc/admin/actions/_shared/0.2/action.js";
 export * as VtcAdminActionsAcknowledge_v0_1 from "./vtc/admin/actions/acknowledge/0.1/payload.js";
+export * as VtcAdminActionsAcknowledge_v0_2 from "./vtc/admin/actions/acknowledge/0.2/payload.js";
 export * as VtcAdminActionsCancel_v0_1 from "./vtc/admin/actions/cancel/0.1/payload.js";
+export * as VtcAdminActionsCancel_v0_2 from "./vtc/admin/actions/cancel/0.2/payload.js";
 export * as VtcAdminActionsList_v0_1 from "./vtc/admin/actions/list/0.1/payload.js";
+export * as VtcAdminActionsList_v0_2 from "./vtc/admin/actions/list/0.2/payload.js";
 export * as VtcAdminActionsShow_v0_1 from "./vtc/admin/actions/show/0.1/payload.js";
+export * as VtcAdminActionsShow_v0_2 from "./vtc/admin/actions/show/0.2/payload.js";
 export * as VtcAdminBootstrap_v0_1 from "./vtc/admin/bootstrap/0.1/payload.js";
+export * as TopicShared_v0_1 from "./vtc/admin/events/_shared/0.1/topic.js";
+export * as VtcAdminEventsEvent_v0_1 from "./vtc/admin/events/event/0.1/payload.js";
+export * as VtcAdminEventsSubscribe_v0_1 from "./vtc/admin/events/subscribe/0.1/payload.js";
 export * as VtcAdminInvitesCreate_v0_1 from "./vtc/admin/invites/create/0.1/payload.js";
 export * as VtcAdminInvitesList_v0_1 from "./vtc/admin/invites/list/0.1/payload.js";
 export * as VtcAdminInvitesRevoke_v0_1 from "./vtc/admin/invites/revoke/0.1/payload.js";
@@ -686,6 +694,7 @@ export * as VtcJoinRequestsVettingShow_v0_1 from "./vtc/join-requests/vetting/sh
 export * as VtcJoinRequestsWithdraw_v0_1 from "./vtc/join-requests/withdraw/0.1/payload.js";
 export * as VtcMembersAdminRemove_v0_1 from "./vtc/members/admin-remove/0.1/payload.js";
 export * as VtcMembersAuthorityReducedNotice_v0_1 from "./vtc/members/authority-reduced-notice/0.1/payload.js";
+export * as VtcMembersAuthorityReductionPendingNotice_v0_1 from "./vtc/members/authority-reduction-pending-notice/0.1/payload.js";
 export * as VtcMembersCredentials_v0_1 from "./vtc/members/credentials/0.1/payload.js";
 export * as VtcMembersList_v0_1 from "./vtc/members/list/0.1/payload.js";
 export * as VtcMembersPersonhoodAssert_v0_1 from "./vtc/members/personhood/assert/0.1/payload.js";
@@ -705,6 +714,7 @@ export * as VtcMembersSolicitVmc_v0_1 from "./vtc/members/solicit-vmc/0.1/payloa
 export * as VtcMembersStepUpPasskeyNotice_v0_1 from "./vtc/members/step-up-passkey-notice/0.1/payload.js";
 export * as VtcMembersUpdate_v0_1 from "./vtc/members/update/0.1/payload.js";
 export * as VtcMembersVmc_v0_1 from "./vtc/members/vmc/0.1/payload.js";
+export * as VtcOperatorOfflineWrite_v0_1 from "./vtc/operator/offline-write/0.1/payload.js";
 export * as VtcPoliciesTest_v0_1 from "./vtc/policies/test/0.1/payload.js";
 export * as VtcRecognitionCheck_v0_1 from "./vtc/recognition/check/0.1/payload.js";
 export * as VtcRegistryDiagnostics_v0_1 from "./vtc/registry/diagnostics/0.1/payload.js";

package/src/vtc/admin/actions/_shared/0.1/action.ts

@@ -22,4 +22,4 @@ export interface VTCAdminActionsSharedDefinitions {
  * The definitions this shared schema publishes, hoisted to one declaration each.
  * See "../../../../../_shared/components.js".
  */
-export type { Action, ActionId, Field, Summary } from "../../../../../_shared/components.js";
+export type { Action_VtcAdminActionsV0_1 as Action, ActionId, Field, Summary } from "../../../../../_shared/components.js";

package/src/vtc/admin/actions/_shared/0.2/action.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/admin/actions/_shared/0.2/action.schema.json
+ */
+
+/**
+ * Shared shapes for a Verifiable Trust Community's administrative ACTIONS: operations parked for other administrators' decision instead of being refused.
+ *
+ * THE MODEL. When an administrative operation needs more than its requester's own authority — a grant of administrative authority that needs N-of-M approval, an operator's offline (break-glass) write every administrator must see, a human decision such as a join review — the community does not refuse it. It parks the operation as an Action. An Action names its eligible approvers (or acknowledgers) and, for `approval`, a threshold N. When the N-th approval lands, the community re-checks everything it checked at submission — the requester's standing, each approver's standing, the community's policy, the state the operation acts on — and executes the parked operation EXACTLY ONCE; the action then leaves every administrator's list. One deny closes it for everyone. An open action lapses at `expiresAt`: 72 hours by default, community-configurable between 15 minutes and 14 days.
+ *
+ * COOLING OFF (new in 0.2). Some operations need a third party's agreement that does not exist — the removal of an administrator in a community where nobody other than the requester and the subject holds the authority to consent. The community neither refuses such an operation nor lets it take effect at once: it parks it as a `coolingOff` action, which has no threshold, no approvers and no expiry. It LANDS at `landsAt` — the community executes the parked payload then, exactly once and after the same execution-time re-check as any other action — unless the requester withdraws it with `vtc/admin/actions/cancel` first. The cooling-off period is 24 hours by default and community-configurable. The subject is shown the action (`callerRole: subject`) and told of it by `vtc/members/authority-reduction-pending-notice`, so a reduction nobody else reviewed is never a surprise; the subject cannot block it, because a veto held by the subject would protect a compromised subject from its own removal.
+ *
+ * THE REPLY TO THE REQUESTER. The gated operation is not answered with an error or with its own `#response`. The community answers it with the framework-reserved `trust-task-next-step/0.1`, carrying `continuation: proceed` and one `expects` entry whose `typeUri` is `https://trusttasks.org/spec/vtc/admin/actions/show/0.2` with `hint: {"actionId": "…"}`. `proceed` is deliberate: the requester does NOT re-submit the original operation — the community executes the parked payload itself once the threshold is met — so the requester's next step is to follow the action, not to retry. No separate response specification exists for this reply.
+ *
+ * THE DECISION. A `coolingOff` action takes no decision: nobody approves it and nobody acknowledges it. An approver decides through `task-consent/decision` (0.2 or later), echoing the `challenge` it was shown on the action and quoting `actionId`. An acknowledger answers `acknowledge` actions with `vtc/admin/actions/acknowledge`. The requester may withdraw an open action with `vtc/admin/actions/cancel`.
+ *
+ * WHAT APPROVERS ARE SHOWN. The `summary` is rendered from a SUMMARY TEMPLATE delivered as data — a title, an effect sentence, and named fields each locating a value in the digested payload by JSON Pointer — and the template is pinned per kind by `templateDigest`. A renderer MUST derive every field it shows from `payload` via that field's `pointer`, and MUST refuse to render an action whose carried `value` differs from the value at the pointer, or whose `payloadDigest` does not match `payload`. It MUST NOT present an action from `title` or `effect` text alone: those are prose the community authored, and a decision taken on prose is a decision about whatever the prose claimed rather than about the payload that will execute (VTI-APV-013).
+ */
+export interface VTCAdminActionsSharedDefinitions {
+  [k: string]: unknown | undefined;
+}
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../../../_shared/components.js".
+ */
+export type { Action_VtcAdminActionsV0_2 as Action, ActionId, Field, Summary } from "../../../../../_shared/components.js";

package/src/vtc/admin/actions/acknowledge/0.1/payload.ts

@@ -3,7 +3,7 @@
  * Source: specs/vtc/admin/actions/acknowledge/0.1/payload.schema.json
  */
 
-import type { Action, ActionId, DigestMultibase, Ext, Field, Summary } from "../../../../../_shared/components.js";
+import type { Action_VtcAdminActionsV0_1 as Action, ActionId, DigestMultibase, Ext, Field, Summary } from "../../../../../_shared/components.js";
 
 
 /**