@openvtc/trust-tasks 0.24.1 → 0.24.2

package/CHANGELOG.md

@@ -11,6 +11,83 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.24.2 — 2026-10-11
+
+
+### Added
+
+- **keys**: Sign-jws and sign-csr — protocol signatures from a VTA-held key (#749)
+
+A custodian that hardens keys/sign frames every payload under its own
+  opaque signing domain (vti.vta.opaque-signing.v1 || 0x00 || payload), so
+  nothing signed there verifies as a protocol signature. That is the point
+  of the hardening, and it also means nobody can obtain a usable JWS or a
+  certificate request for a custodian-held key. A community server acting
+  as an OpenID4VP verifier for swiyu and EUDI wallets needs both: a signed
+  request object (typ oauth-authz-req+jwt) and proof-of-possession JWTs,
+  and a PKCS#10 request to obtain an EUDI relying-party access certificate.
+
+  Two narrow tasks where the custodian builds the protocol bytes itself, so
+  the key stays custodian-held and the custodian signs only what it built:
+
+  - keys/sign-jws/0.1: the producer sends header members and a payload
+    (a JSON object, or payloadBase64Url); the custodian sets alg from the
+    key type (EdDSA, ES256, ES256K, ML-DSA-44/65), refuses alg, crit, b64,
+    jwk, jku and x5u, checks an x5c leaf against the key, serialises both
+    halves with RFC 8785 and signs the bare JWS signing input. Audited by a
+    digest of the signing input, never the payload.
+  - keys/sign-csr/0.1: the producer names the subject as ordered typed
+    attributes from a closed set and optional subject alternative names;
+    the custodian builds the CertificationRequestInfo from those and the
+    key's own public key (P-256 with ecdsa-with-SHA256, or Ed25519) and
+    returns the PEM request with the key's multibase public key. No
+    extension but subjectAltName is ever requested.
+
+  Registers the signJws and signCsr device capabilities (sign-jws and
+  sign-csr in 0.1). A custodian must not require sign for either; one that
+  frames keys/sign under its own domain should not accept sign in their
+  place, since its sign grant cannot yield a JWS or CSR.
+
+  Bindings regenerated (Rust, TS, Go, Dart); no version bumps.
+
+  Refs OpenVTC/verifiable-trust-infrastructure#1988
+
+
+
+### Specifications
+
+- **rooms**: Define the sealed record body, signed by its author and bound to its location (#747)
+
+* spec(rooms): define the sealed record body, signed by its author and bound to its location
+
+  records/put 0.2 already relied on "the sealed body the author signed" to
+  detect a substituted blob, and blobs.schema.json defined the body's `file`
+  member, but nothing defined the body itself. Without it, two clients cannot
+  read each other's records, and nobody can check the signature.
+
+  SealedRecordBody (rooms/_shared/0.1/room.schema.json) is the JSON inside
+  SealedRecord.ciphertext on attributed and private rooms:
+
+  - the open tier's title, description, body and tags;
+  - an optional `file` (FileManifest);
+  - `author`;
+  - a Data Integrity proof by `author` (eddsa-jcs-2022, or ecdsa-jcs-2019 for
+    a hardware-backed signer).
+
+  Readers MUST verify the proof and MUST refuse a record that fails it, not show
+  it with a warning.
+
+  The body also signs its own location (roomId, key, version). The AEAD binds
+  those against the host, but any member can open and re-seal a record. Without
+  the signed location, a member could copy another member's body to a new key
+  or version, and on a private room, where the host records no author, readers
+  would attribute it to the original author. On attributed rooms, readers also
+  check `author` against the author the host recorded.
+
+  records/put 0.2 and keys/seal 0.1 point at the definition. keys/seal says a
+  key holder seals what it is given and never signs for the writer. No payload
+  or response schema changes, so no version moves and no generated type changes.
+
 ## 0.24.1 — 2026-10-11
 
 

package/dist/_shared/components.d.ts

@@ -392,11 +392,11 @@ export type Capability_AclV0_2 = string;
 /**
  * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything.
  */
-export type Capability_DeviceV0_1 = "vault-read" | "vault-write" | "proxy-login" | "fill-release" | "policy-admin" | "device-admin" | "sign" | "key-mint" | "sign-trust-task" | "credential-write" | "memory-read" | "memory-write" | "room-present" | "room-open" | "key-export" | "sign-sshsig" | "external-accounts-manage" | "external-auth-use";
+export type Capability_DeviceV0_1 = "vault-read" | "vault-write" | "proxy-login" | "fill-release" | "policy-admin" | "device-admin" | "sign" | "key-mint" | "sign-trust-task" | "credential-write" | "memory-read" | "memory-write" | "room-present" | "room-open" | "key-export" | "sign-sshsig" | "sign-jws" | "sign-csr" | "external-accounts-manage" | "external-auth-use";
 /**
  * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything.
  */
-export type Capability_DeviceV0_2 = "vaultRead" | "vaultWrite" | "proxyLogin" | "fillRelease" | "policyAdmin" | "deviceAdmin" | "sign" | "keyMint" | "signTrustTask" | "credentialWrite" | "memoryRead" | "memoryWrite" | "roomPresent" | "roomOpen" | "keyExport" | "signSshsig" | "externalAccountsManage" | "externalAuthUse";
+export type Capability_DeviceV0_2 = "vaultRead" | "vaultWrite" | "proxyLogin" | "fillRelease" | "policyAdmin" | "deviceAdmin" | "sign" | "keyMint" | "signTrustTask" | "credentialWrite" | "memoryRead" | "memoryWrite" | "roomPresent" | "roomOpen" | "keyExport" | "signSshsig" | "signJws" | "signCsr" | "externalAccountsManage" | "externalAuthUse";
 /**
  * Number of chunks in the bundle, equal to ceil(expectedSizeBytes / chunkSize). Bounded at 4096 so that the manifest itself — one digest per chunk — fits in the single document that carries it under the same message-size reasoning as a chunk.
  */
@@ -5411,6 +5411,59 @@ export interface Field {
         [k: string]: unknown | undefined;
     };
 }
+/**
+ * The `file` member of a sealed record body: everything that describes a file, sealed with the record, signed by the record's author, and never seen by the host. Defined here so that clients interoperate; no host task carries it, because the host receives only ciphertext.
+ *
+ * **Byte encodings.** In every derivation below, `fileId` is its **32 decoded bytes**, never its base64url text; `roomId` is the **UTF-8 bytes** of the room identifier exactly as it appears on the wire; string constants are their ASCII bytes; `u8`, `u32be` and `u64be` are unsigned integers of that width, big-endian. Epochs are unsigned 64-bit on the wire. An implementation that holds epochs in a narrower type **MUST** refuse a value it cannot represent with `malformedRequest` (or, reading a manifest, refuse the file), and **MUST NOT** truncate it.
+ *
+ * **The file key.** `file_key = HKDF-SHA256(ikm = storage_key(epoch), salt = fileId, info = "openvtc/room/file/v1" || roomId || u64be(epoch))`, where `storage_key(epoch)` is the room's per-epoch storage key, the one records are sealed under. It is derived per file and never stored. It is bound to the room and the epoch, so a key released for one room cannot open a blob relocated from another, and releasing it exposes one file and nothing else.
+ *
+ * **Padding.** With `padding: "padme"`, the plaintext of length `L = size` is extended with zero bytes to `padme(L)`: for `L < 2`, `padme(L) = L`; otherwise `E = floor(log2 L)`, `S = floor(log2 E) + 1`, `z = E − S`, `mask = 2^z − 1`, and `padme(L) = (L + mask) & ~mask`. The padded length is `padme(size)`; without padding it is `size`. Padding bytes **MUST** be zero.
+ *
+ * **The STREAM construction.** The padded plaintext is cut into `segmentSize`-byte segments, the last holding the remainder; an empty plaintext is one empty final segment. Segment `i` is sealed with ChaCha20-Poly1305 under `file_key`, with nonce `u32be(0) || u64be(i)` and associated data `"openvtc/room/file/v1" || roomId || fileId || u64be(epoch) || u64be(i) || u8(final)`, where `final` is 1 on the last segment and 0 on every other. A host that truncates, reorders or splices ciphertext produces an authentication failure, never a shorter or rearranged file. The nonces are counters, so a `file_key` MUST NOT seal two different files; a fresh random `fileId` is what guarantees it. Each sealed segment is one transfer chunk of the blob (BlobManifest), so `segmentSize + 16` is the blob's `chunks.chunkSize`, and an empty file is one 16-byte chunk.
+ *
+ * **Reading.** A reader opens the record, derives or obtains the file key, and **MUST**, before trusting a byte:
+ * - check that the blob's `chunks.chunkSize` equals `segmentSize + 16` and that `chunks.chunkCount` equals `max(1, ceil(paddedLength / segmentSize))`, and refuse the file otherwise;
+ * - decrypt every segment in order, refusing the file on any authentication failure or on a final flag anywhere but the last segment;
+ * - check that the decrypted length equals the padded length, that every padding byte is zero, and, after removing the padding, that the plaintext matches `digest`.
+ *
+ * A reader **MUST** refuse a file that fails any check, and **MUST NOT** present it with a warning instead. A reader that streams **MUST NOT** treat the plaintext as received — save it under its final name, render it, or hand it to another component — until the digest has verified; it writes to a temporary destination and discards that destination on a mismatch.
+ */
+export interface FileManifest {
+    /**
+     * 32 random bytes, base64url without padding, minted by the uploader for this file and never reused. The salt of the file key.
+     */
+    fileId: string;
+    /**
+     * The file's name as the uploader gave it. Sealed: the host never sees it. Readers MUST treat it as untrusted text: strip path separators before using it as a local file name, and never interpret it as markup.
+     */
+    name: string;
+    /**
+     * IANA media type, without parameters. Advisory: a reader decides how to render from the bytes and its own policy, never from this alone.
+     */
+    mediaType?: string;
+    /**
+     * Plaintext bytes, before padding. The decrypted length is `padme(size)` with `padme` padding and `size` without.
+     */
+    size: number;
+    /**
+     * Digest of the plaintext bytes. Signed, with the rest of the record body, by the record's author, so a reader that verifies it knows which member put exactly these bytes there.
+     */
+    digest: DigestMultibase;
+    /**
+     * The epoch whose storage key the file key derives from. Usually the record's own epoch; a record rewritten under a later epoch that keeps the same blob keeps the file's original epoch here. Unsigned 64-bit; see Byte encodings.
+     */
+    epoch: number;
+    /**
+     * Plaintext bytes per STREAM segment: the transfer chunk size less the 16-byte tag, so that one sealed segment is one chunk.
+     */
+    segmentSize: number;
+    /**
+     * Whether the plaintext was padded before sealing, so that ciphertext sizes do not fingerprint known documents. `padme`: zero bytes appended to reach `padme(size)`, the formula above. Absent means `none`. The padding is inside the final segments, and a reader checks it is zero and removes it by truncating to `size`.
+     */
+    padding?: "none" | "padme";
+    blobRef: BlobRef;
+}
 /**
  * A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.
  */