@openvtc/trust-tasks 0.23.7 → 0.23.9

package/CHANGELOG.md

@@ -11,6 +11,71 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.23.9 — 2026-10-10
+
+
+### Added
+
+- **external**: VTA external accounts — management, credential issuance and Sui signing (#740)
+
+* feat(external): VTA external accounts — management, credential issuance and Sui signing
+
+  Adds the external/* family: external/accounts/{list,get,create,update,secret/set,bindings/grant,bindings/revoke,setup,probe,keys/rotate,suspend,resume,archive,restore,delete}/0.1, external/credentials/issue/0.1 and external/sign/0.1, with shared shapes and family conventions in external/_shared/0.1.
+
+  A key custodian holds an identity at a third party and never releases its key or secret. Integrations bound to the account get short-lived credentials the custodian obtained and downscoped itself, sealed to the caller, or signatures over Sui transactions the custodian decoded and checked against an allow-list. Every model pins the custodian's verification material at the provider, so none needs the custodian to be reachable from the internet; plain OIDC discovery federation is excluded for that reason.
+
+- **rooms**: Files in data rooms, and VTC room storage administration (#739)
+
+* spec(rooms): shared file and blob types
+
+- **auth/oob**: Add the auth/oob out-of-band sign-in Trust Task family (#738)
+
+* feat(auth/oob): add the auth/oob out-of-band sign-in family
+
+  Eight Trust Task specifications for out-of-band sign-in started by a
+  trigger link: request, claim, prove, identify, respond, grant, redeem
+  and cancel, with a shared auth/oob/_shared/0.1 component (closed
+  purpose and mode lists, handle, key, number, origin, requester), the
+  family conventions, and the binding note defining the sign-in trigger
+  link (VTI-LNK) in place of the trusttasks://oob scheme.
+
+## 0.23.8 — 2026-10-05
+
+
+### Specifications
+
+- **vtc/vetting**: A drip tick is a time window, and publish refuses a changed signer or a second criterion (#734)
+
+* spec(vtc/vetting): a drip tick is a time window, and publish refuses a changed signer or a second criterion
+
+  Three holes in hidden vetting's community half, all draft edits in place
+  (SPEC §5.2):
+
+  - pcs-tokens/0.1: `tick` was the vetter's own schedule counter, so "once per
+    tick" bounded nothing — a vetter could draw tick 1, 2, 3 … in the same
+    minute, and the drip, whose purpose is the velocity cap, was unbounded.
+    A tick is now a window: tick `t` (t ≥ 0) of a label is
+    [start + t·tickLength, start + (t+1)·tickLength), where a label starts at
+    00:00:00Z on the first day of its month (`token/<YYYY-MM>`) or on the
+    event's `startDate` (`token/event/<id>`). A tick that has not begun is
+    refused with the new `pcs-tokens:tickNotYet` (retryable); a begun, unserved
+    tick stays drawable once (catch-up), so a member draws at most dripPerTick
+    × ticks begun. Zero-based because the schema's `minimum` is 0, which keeps
+    the generated `tick: u64` unchanged.
+  - hidden/publish/0.1:
+    - `tickLength` (ISO 8601 days/hours, at least PT1H, default P3D) in the
+      payload, and required in `stored` and `published`; a configuration stored
+      before it existed reads as P3D.
+    - `signerChanged`: stored keys that differ from what the current signer
+      derives are refused rather than silently replaced (every enrolled vetter's
+      credential would stop verifying). Re-keying is the explicit
+      withdraw-then-publish, under a new period.
+    - `otherCriterion`: hidden vetting runs on at most one criterion, because
+      enrolment, the drip and the challenge are served from one configuration.
+  - hidden/show/0.1: `stored` and `published` carry `tickLength`.
+
+  Bindings regenerated (Rust, TS, Go, Dart).
+
 ## 0.23.7 — 2026-10-05