@openvtc/trust-tasks 0.25.1 → 0.26.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (143) hide show
  1. package/CHANGELOG.md +46 -0
  2. package/dist/_shared/components.d.ts +314 -3
  3. package/dist/_shared/components.d.ts.map +1 -1
  4. package/dist/device/list/0.1/payload.d.ts +4 -4
  5. package/dist/device/list/0.1/payload.d.ts.map +1 -1
  6. package/dist/device/list/0.1/payload.js +6 -2
  7. package/dist/device/list/0.1/payload.js.map +1 -1
  8. package/dist/device/list/0.2/payload.d.ts +4 -4
  9. package/dist/device/list/0.2/payload.d.ts.map +1 -1
  10. package/dist/device/list/0.2/payload.js +6 -2
  11. package/dist/device/list/0.2/payload.js.map +1 -1
  12. package/dist/device/register/0.1/payload.d.ts +4 -4
  13. package/dist/device/register/0.1/payload.d.ts.map +1 -1
  14. package/dist/device/register/0.1/payload.js +6 -2
  15. package/dist/device/register/0.1/payload.js.map +1 -1
  16. package/dist/device/register/0.2/payload.d.ts +4 -4
  17. package/dist/device/register/0.2/payload.d.ts.map +1 -1
  18. package/dist/device/register/0.2/payload.js +6 -2
  19. package/dist/device/register/0.2/payload.js.map +1 -1
  20. package/dist/index.d.ts +14 -0
  21. package/dist/index.d.ts.map +1 -1
  22. package/dist/index.js +14 -0
  23. package/dist/index.js.map +1 -1
  24. package/dist/vetting/_shared/0.1/hidden-vetting.d.ts +16 -0
  25. package/dist/vetting/_shared/0.1/hidden-vetting.d.ts.map +1 -0
  26. package/dist/vetting/_shared/0.1/hidden-vetting.js +6 -0
  27. package/dist/vetting/_shared/0.1/hidden-vetting.js.map +1 -0
  28. package/dist/vetting/attestation/0.1/payload.d.ts +94 -146
  29. package/dist/vetting/attestation/0.1/payload.d.ts.map +1 -1
  30. package/dist/vetting/attestation/0.1/payload.js +43 -43
  31. package/dist/vetting/attestation/0.1/payload.js.map +1 -1
  32. package/dist/vta/_shared/0.4/pcs-engine.d.ts +16 -0
  33. package/dist/vta/_shared/0.4/pcs-engine.d.ts.map +1 -0
  34. package/dist/vta/_shared/0.4/pcs-engine.js +6 -0
  35. package/dist/vta/_shared/0.4/pcs-engine.js.map +1 -0
  36. package/dist/vta/pcs/applications/create/0.1/payload.d.ts +1215 -0
  37. package/dist/vta/pcs/applications/create/0.1/payload.d.ts.map +1 -0
  38. package/dist/vta/pcs/applications/create/0.1/payload.js +724 -0
  39. package/dist/vta/pcs/applications/create/0.1/payload.js.map +1 -0
  40. package/dist/vta/pcs/applications/delete/0.1/payload.d.ts +253 -0
  41. package/dist/vta/pcs/applications/delete/0.1/payload.d.ts.map +1 -0
  42. package/dist/vta/pcs/applications/delete/0.1/payload.js +146 -0
  43. package/dist/vta/pcs/applications/delete/0.1/payload.js.map +1 -0
  44. package/dist/vta/pcs/applications/show/0.1/payload.d.ts +733 -0
  45. package/dist/vta/pcs/applications/show/0.1/payload.d.ts.map +1 -0
  46. package/dist/vta/pcs/applications/show/0.1/payload.js +450 -0
  47. package/dist/vta/pcs/applications/show/0.1/payload.js.map +1 -0
  48. package/dist/vta/pcs/attest/0.1/payload.d.ts +1456 -0
  49. package/dist/vta/pcs/attest/0.1/payload.d.ts.map +1 -0
  50. package/dist/vta/pcs/attest/0.1/payload.js +876 -0
  51. package/dist/vta/pcs/attest/0.1/payload.js.map +1 -0
  52. package/dist/vta/pcs/prove/0.1/payload.d.ts +1348 -0
  53. package/dist/vta/pcs/prove/0.1/payload.d.ts.map +1 -0
  54. package/dist/vta/pcs/prove/0.1/payload.js +804 -0
  55. package/dist/vta/pcs/prove/0.1/payload.js.map +1 -0
  56. package/dist/vta/pcs/root-accept/0.1/payload.d.ts +1100 -0
  57. package/dist/vta/pcs/root-accept/0.1/payload.d.ts.map +1 -0
  58. package/dist/vta/pcs/root-accept/0.1/payload.js +634 -0
  59. package/dist/vta/pcs/root-accept/0.1/payload.js.map +1 -0
  60. package/dist/vta/pcs/root-request/0.1/payload.d.ts +880 -0
  61. package/dist/vta/pcs/root-request/0.1/payload.d.ts.map +1 -0
  62. package/dist/vta/pcs/root-request/0.1/payload.js +496 -0
  63. package/dist/vta/pcs/root-request/0.1/payload.js.map +1 -0
  64. package/dist/vta/pcs/tokens/abandon/0.1/payload.d.ts +612 -0
  65. package/dist/vta/pcs/tokens/abandon/0.1/payload.d.ts.map +1 -0
  66. package/dist/vta/pcs/tokens/abandon/0.1/payload.js +355 -0
  67. package/dist/vta/pcs/tokens/abandon/0.1/payload.js.map +1 -0
  68. package/dist/vta/pcs/tokens/accept/0.1/payload.d.ts +1149 -0
  69. package/dist/vta/pcs/tokens/accept/0.1/payload.d.ts.map +1 -0
  70. package/dist/vta/pcs/tokens/accept/0.1/payload.js +657 -0
  71. package/dist/vta/pcs/tokens/accept/0.1/payload.js.map +1 -0
  72. package/dist/vta/pcs/tokens/request/0.1/payload.d.ts +908 -0
  73. package/dist/vta/pcs/tokens/request/0.1/payload.d.ts.map +1 -0
  74. package/dist/vta/pcs/tokens/request/0.1/payload.js +508 -0
  75. package/dist/vta/pcs/tokens/request/0.1/payload.js.map +1 -0
  76. package/dist/vta/pcs/verify-attestation/0.1/payload.d.ts +1423 -0
  77. package/dist/vta/pcs/verify-attestation/0.1/payload.d.ts.map +1 -0
  78. package/dist/vta/pcs/verify-attestation/0.1/payload.js +850 -0
  79. package/dist/vta/pcs/verify-attestation/0.1/payload.js.map +1 -0
  80. package/dist/vta/pcs/vetter/show/0.1/payload.d.ts +605 -0
  81. package/dist/vta/pcs/vetter/show/0.1/payload.d.ts.map +1 -0
  82. package/dist/vta/pcs/vetter/show/0.1/payload.js +351 -0
  83. package/dist/vta/pcs/vetter/show/0.1/payload.js.map +1 -0
  84. package/dist/vtc/_shared/0.1/room-storage.d.ts +1 -1
  85. package/dist/vtc/_shared/0.1/room-storage.d.ts.map +1 -1
  86. package/dist/vtc/storage/configs/create/0.1/payload.d.ts +50 -10
  87. package/dist/vtc/storage/configs/create/0.1/payload.d.ts.map +1 -1
  88. package/dist/vtc/storage/configs/create/0.1/payload.js +24 -2
  89. package/dist/vtc/storage/configs/create/0.1/payload.js.map +1 -1
  90. package/dist/vtc/storage/configs/get/0.1/payload.d.ts +66 -10
  91. package/dist/vtc/storage/configs/get/0.1/payload.d.ts.map +1 -1
  92. package/dist/vtc/storage/configs/get/0.1/payload.js +32 -2
  93. package/dist/vtc/storage/configs/get/0.1/payload.js.map +1 -1
  94. package/dist/vtc/storage/configs/list/0.1/payload.d.ts +66 -10
  95. package/dist/vtc/storage/configs/list/0.1/payload.d.ts.map +1 -1
  96. package/dist/vtc/storage/configs/list/0.1/payload.js +32 -2
  97. package/dist/vtc/storage/configs/list/0.1/payload.js.map +1 -1
  98. package/dist/vtc/storage/configs/update/0.1/payload.d.ts +50 -10
  99. package/dist/vtc/storage/configs/update/0.1/payload.d.ts.map +1 -1
  100. package/dist/vtc/storage/configs/update/0.1/payload.js +24 -2
  101. package/dist/vtc/storage/configs/update/0.1/payload.js.map +1 -1
  102. package/dist/vtc/storage/credentials/set/0.1/payload.d.ts +46 -2
  103. package/dist/vtc/storage/credentials/set/0.1/payload.d.ts.map +1 -1
  104. package/dist/vtc/storage/credentials/set/0.1/payload.js +22 -0
  105. package/dist/vtc/storage/credentials/set/0.1/payload.js.map +1 -1
  106. package/dist/vtc/vetting/hidden/publish/0.1/payload.d.ts +403 -486
  107. package/dist/vtc/vetting/hidden/publish/0.1/payload.d.ts.map +1 -1
  108. package/dist/vtc/vetting/hidden/publish/0.1/payload.js +240 -240
  109. package/dist/vtc/vetting/hidden/publish/0.1/payload.js.map +1 -1
  110. package/dist/vtc/vetting/hidden/show/0.1/payload.d.ts +482 -565
  111. package/dist/vtc/vetting/hidden/show/0.1/payload.d.ts.map +1 -1
  112. package/dist/vtc/vetting/hidden/show/0.1/payload.js +294 -294
  113. package/dist/vtc/vetting/hidden/show/0.1/payload.js.map +1 -1
  114. package/package.json +1 -1
  115. package/src/_shared/components.ts +318 -3
  116. package/src/device/list/0.1/payload.ts +6 -2
  117. package/src/device/list/0.2/payload.ts +6 -2
  118. package/src/device/register/0.1/payload.ts +6 -2
  119. package/src/device/register/0.2/payload.ts +6 -2
  120. package/src/index.ts +14 -0
  121. package/src/vetting/_shared/0.1/hidden-vetting.ts +17 -0
  122. package/src/vetting/attestation/0.1/payload.ts +49 -101
  123. package/src/vta/_shared/0.4/pcs-engine.ts +17 -0
  124. package/src/vta/pcs/applications/create/0.1/payload.ts +768 -0
  125. package/src/vta/pcs/applications/delete/0.1/payload.ts +182 -0
  126. package/src/vta/pcs/applications/show/0.1/payload.ts +482 -0
  127. package/src/vta/pcs/attest/0.1/payload.ts +943 -0
  128. package/src/vta/pcs/prove/0.1/payload.ts +845 -0
  129. package/src/vta/pcs/root-accept/0.1/payload.ts +681 -0
  130. package/src/vta/pcs/root-request/0.1/payload.ts +559 -0
  131. package/src/vta/pcs/tokens/abandon/0.1/payload.ts +392 -0
  132. package/src/vta/pcs/tokens/accept/0.1/payload.ts +713 -0
  133. package/src/vta/pcs/tokens/request/0.1/payload.ts +581 -0
  134. package/src/vta/pcs/verify-attestation/0.1/payload.ts +888 -0
  135. package/src/vta/pcs/vetter/show/0.1/payload.ts +387 -0
  136. package/src/vtc/_shared/0.1/room-storage.ts +1 -1
  137. package/src/vtc/storage/configs/create/0.1/payload.ts +26 -4
  138. package/src/vtc/storage/configs/get/0.1/payload.ts +34 -4
  139. package/src/vtc/storage/configs/list/0.1/payload.ts +34 -4
  140. package/src/vtc/storage/configs/update/0.1/payload.ts +26 -4
  141. package/src/vtc/storage/credentials/set/0.1/payload.ts +24 -2
  142. package/src/vtc/vetting/hidden/publish/0.1/payload.ts +247 -331
  143. package/src/vtc/vetting/hidden/show/0.1/payload.ts +295 -379
@@ -0,0 +1,351 @@
1
+ /**
2
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
3
+ * Source: specs/vta/pcs/vetter/show/0.1/payload.schema.json
4
+ */
5
+ /** Trust Task type URI. */
6
+ export const TYPE_URI = "https://trusttasks.org/spec/vta/pcs/vetter/show/0.1";
7
+ /** Trust Task response type URI (request type URI + "#response"). */
8
+ export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/pcs/vetter/show/0.1#response";
9
+ /**
10
+ * This specification's payload schema, as a value.
11
+ *
12
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
13
+ * rather than only as a `.json` file because TypeScript types are erased
14
+ * at runtime: without a schema a consumer has nothing to validate, and
15
+ * every REQUIRED payload member is optional in practice. Cross-file
16
+ * `$ref`s are already inlined, so it needs no resolver.
17
+ */
18
+ export const PAYLOAD_SCHEMA = {
19
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
20
+ "$id": "https://trusttasks.org/spec/vta/pcs/vetter/show/0.1",
21
+ "title": "VTA PCS — Vetter — Show — payload",
22
+ "description": "A vetter's client reads back its VTA's vetter engine for a community: identifier, enrolled labels, token counts and draws in flight — never its key, credentials or tokens.",
23
+ "type": "object",
24
+ "additionalProperties": false,
25
+ "required": [
26
+ "contextId",
27
+ "community"
28
+ ],
29
+ "properties": {
30
+ "contextId": {
31
+ "type": "string",
32
+ "minLength": 1,
33
+ "description": "The context the engine belongs to. Its key is derived from this context's base."
34
+ },
35
+ "community": {
36
+ "type": "string",
37
+ "minLength": 1,
38
+ "description": "The community's DID: the helper whose parameters the engine runs under."
39
+ },
40
+ "ext": {
41
+ "$ref": "#/$defs/Ext"
42
+ }
43
+ },
44
+ "$defs": {
45
+ "Response": {
46
+ "$anchor": "response",
47
+ "title": "VTA PCS — Vetter — Show — response payload",
48
+ "type": "object",
49
+ "additionalProperties": false,
50
+ "required": [
51
+ "vetter"
52
+ ],
53
+ "properties": {
54
+ "vetter": {
55
+ "$ref": "#/$defs/VetterSummary"
56
+ },
57
+ "ext": {
58
+ "$ref": "#/$defs/Ext"
59
+ }
60
+ }
61
+ },
62
+ "Ext": {
63
+ "title": "Ext",
64
+ "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
65
+ "type": "object",
66
+ "minProperties": 1,
67
+ "additionalProperties": true,
68
+ "propertyNames": {
69
+ "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
70
+ }
71
+ },
72
+ "VetterSummary": {
73
+ "title": "VetterSummary",
74
+ "description": "A vetter engine as the VTA holds it, without its key, its credentials or its tokens.",
75
+ "type": "object",
76
+ "additionalProperties": false,
77
+ "required": [
78
+ "contextId",
79
+ "community",
80
+ "memberDid",
81
+ "suite",
82
+ "id",
83
+ "enrolledLabels",
84
+ "pendingLabels",
85
+ "tokensFree",
86
+ "tokensHeld",
87
+ "drawsInFlight",
88
+ "attested"
89
+ ],
90
+ "properties": {
91
+ "contextId": {
92
+ "type": "string",
93
+ "minLength": 1
94
+ },
95
+ "community": {
96
+ "type": "string",
97
+ "minLength": 1
98
+ },
99
+ "memberDid": {
100
+ "type": "string",
101
+ "minLength": 1,
102
+ "description": "The member DID the engine draws tokens as. Bound into every token request."
103
+ },
104
+ "suite": {
105
+ "type": "string",
106
+ "minLength": 1,
107
+ "maxLength": 64
108
+ },
109
+ "id": {
110
+ "$ref": "#/$defs/Multibase",
111
+ "description": "The vetter's PCS identifier for this community."
112
+ },
113
+ "enrolledLabels": {
114
+ "type": "array",
115
+ "description": "Class labels this vetter holds a credential under, newest first.",
116
+ "items": {
117
+ "type": "string",
118
+ "pattern": "^vetter/[0-9]{4}-[0-9]{2}$"
119
+ }
120
+ },
121
+ "pendingLabels": {
122
+ "type": "array",
123
+ "description": "Class labels requested and not yet accepted.",
124
+ "items": {
125
+ "type": "string",
126
+ "pattern": "^vetter/[0-9]{4}-[0-9]{2}$"
127
+ }
128
+ },
129
+ "tokensFree": {
130
+ "type": "integer",
131
+ "minimum": 0,
132
+ "description": "Tokens held and not reserved."
133
+ },
134
+ "tokensHeld": {
135
+ "type": "integer",
136
+ "minimum": 0,
137
+ "description": "Tokens held in all."
138
+ },
139
+ "drawsInFlight": {
140
+ "type": "array",
141
+ "description": "Draws requested and not yet accepted or abandoned.",
142
+ "items": {
143
+ "$ref": "#/$defs/TokenDraw"
144
+ }
145
+ },
146
+ "attested": {
147
+ "type": "integer",
148
+ "minimum": 0,
149
+ "description": "Attestations made through this engine."
150
+ }
151
+ }
152
+ },
153
+ "TokenDraw": {
154
+ "title": "TokenDraw",
155
+ "description": "One draw of the token drip: a label and a tick.",
156
+ "type": "object",
157
+ "additionalProperties": false,
158
+ "required": [
159
+ "label",
160
+ "tick"
161
+ ],
162
+ "properties": {
163
+ "label": {
164
+ "type": "string",
165
+ "minLength": 1,
166
+ "maxLength": 128
167
+ },
168
+ "tick": {
169
+ "type": "integer",
170
+ "minimum": 0
171
+ }
172
+ }
173
+ },
174
+ "Multibase": {
175
+ "title": "Multibase",
176
+ "description": "A binary value, multibase base58btc over the suite's canonical encoding.",
177
+ "type": "string",
178
+ "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
179
+ }
180
+ }
181
+ };
182
+ /** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
183
+ export const RESPONSE_PAYLOAD_SCHEMA = {
184
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
185
+ "$ref": "#/$defs/Response",
186
+ "$defs": {
187
+ "Response": {
188
+ "$anchor": "response",
189
+ "title": "VTA PCS — Vetter — Show — response payload",
190
+ "type": "object",
191
+ "additionalProperties": false,
192
+ "required": [
193
+ "vetter"
194
+ ],
195
+ "properties": {
196
+ "vetter": {
197
+ "$ref": "#/$defs/VetterSummary"
198
+ },
199
+ "ext": {
200
+ "$ref": "#/$defs/Ext"
201
+ }
202
+ }
203
+ },
204
+ "Ext": {
205
+ "title": "Ext",
206
+ "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
207
+ "type": "object",
208
+ "minProperties": 1,
209
+ "additionalProperties": true,
210
+ "propertyNames": {
211
+ "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
212
+ }
213
+ },
214
+ "VetterSummary": {
215
+ "title": "VetterSummary",
216
+ "description": "A vetter engine as the VTA holds it, without its key, its credentials or its tokens.",
217
+ "type": "object",
218
+ "additionalProperties": false,
219
+ "required": [
220
+ "contextId",
221
+ "community",
222
+ "memberDid",
223
+ "suite",
224
+ "id",
225
+ "enrolledLabels",
226
+ "pendingLabels",
227
+ "tokensFree",
228
+ "tokensHeld",
229
+ "drawsInFlight",
230
+ "attested"
231
+ ],
232
+ "properties": {
233
+ "contextId": {
234
+ "type": "string",
235
+ "minLength": 1
236
+ },
237
+ "community": {
238
+ "type": "string",
239
+ "minLength": 1
240
+ },
241
+ "memberDid": {
242
+ "type": "string",
243
+ "minLength": 1,
244
+ "description": "The member DID the engine draws tokens as. Bound into every token request."
245
+ },
246
+ "suite": {
247
+ "type": "string",
248
+ "minLength": 1,
249
+ "maxLength": 64
250
+ },
251
+ "id": {
252
+ "$ref": "#/$defs/Multibase",
253
+ "description": "The vetter's PCS identifier for this community."
254
+ },
255
+ "enrolledLabels": {
256
+ "type": "array",
257
+ "description": "Class labels this vetter holds a credential under, newest first.",
258
+ "items": {
259
+ "type": "string",
260
+ "pattern": "^vetter/[0-9]{4}-[0-9]{2}$"
261
+ }
262
+ },
263
+ "pendingLabels": {
264
+ "type": "array",
265
+ "description": "Class labels requested and not yet accepted.",
266
+ "items": {
267
+ "type": "string",
268
+ "pattern": "^vetter/[0-9]{4}-[0-9]{2}$"
269
+ }
270
+ },
271
+ "tokensFree": {
272
+ "type": "integer",
273
+ "minimum": 0,
274
+ "description": "Tokens held and not reserved."
275
+ },
276
+ "tokensHeld": {
277
+ "type": "integer",
278
+ "minimum": 0,
279
+ "description": "Tokens held in all."
280
+ },
281
+ "drawsInFlight": {
282
+ "type": "array",
283
+ "description": "Draws requested and not yet accepted or abandoned.",
284
+ "items": {
285
+ "$ref": "#/$defs/TokenDraw"
286
+ }
287
+ },
288
+ "attested": {
289
+ "type": "integer",
290
+ "minimum": 0,
291
+ "description": "Attestations made through this engine."
292
+ }
293
+ }
294
+ },
295
+ "TokenDraw": {
296
+ "title": "TokenDraw",
297
+ "description": "One draw of the token drip: a label and a tick.",
298
+ "type": "object",
299
+ "additionalProperties": false,
300
+ "required": [
301
+ "label",
302
+ "tick"
303
+ ],
304
+ "properties": {
305
+ "label": {
306
+ "type": "string",
307
+ "minLength": 1,
308
+ "maxLength": 128
309
+ },
310
+ "tick": {
311
+ "type": "integer",
312
+ "minimum": 0
313
+ }
314
+ }
315
+ },
316
+ "Multibase": {
317
+ "title": "Multibase",
318
+ "description": "A binary value, multibase base58btc over the suite's canonical encoding.",
319
+ "type": "string",
320
+ "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
321
+ }
322
+ }
323
+ };
324
+ /**
325
+ * SPEC.md §7.2 policy for the request variant, from this specification's
326
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
327
+ * per-specification and cannot be derived from the document alone, and
328
+ * item 2 needs the schema this carries.
329
+ */
330
+ export const SPEC = {
331
+ typeUri: TYPE_URI,
332
+ isBearer: false,
333
+ isProofRequired: false,
334
+ isRecipientRequired: true,
335
+ isIssuedAtRequired: false,
336
+ payloadSchema: PAYLOAD_SCHEMA,
337
+ };
338
+ /**
339
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
340
+ * tracks the *issuer* party's requirement because a response swaps the
341
+ * parties (§7.3 item 5).
342
+ */
343
+ export const RESPONSE_SPEC = {
344
+ typeUri: RESPONSE_TYPE_URI,
345
+ isBearer: false,
346
+ isProofRequired: false,
347
+ isRecipientRequired: true,
348
+ isIssuedAtRequired: false,
349
+ payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
350
+ };
351
+ //# sourceMappingURL=payload.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/vta/pcs/vetter/show/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2BH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,qDAA8D,CAAC;AAKvF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,8DAAuE,CAAC;AAKzG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,qDAAqD;IAC5D,OAAO,EAAE,mCAAmC;IAC5C,aAAa,EAAE,6KAA6K;IAC5L,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,WAAW;QACX,WAAW;KACZ;IACD,YAAY,EAAE;QACZ,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,iFAAiF;SACjG;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,yEAAyE;SACzF;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,4CAA4C;YACrD,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;aACT;YACD,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,uBAAuB;iBAChC;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,eAAe,EAAE;YACf,OAAO,EAAE,eAAe;YACxB,aAAa,EAAE,sFAAsF;YACrG,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,WAAW;gBACX,WAAW;gBACX,OAAO;gBACP,IAAI;gBACJ,gBAAgB;gBAChB,eAAe;gBACf,YAAY;gBACZ,YAAY;gBACZ,eAAe;gBACf,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;iBACf;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;iBACf;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,4EAA4E;iBAC5F;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,EAAE;iBAChB;gBACD,IAAI,EAAE;oBACJ,MAAM,EAAE,mBAAmB;oBAC3B,aAAa,EAAE,iDAAiD;iBACjE;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,OAAO;oBACf,aAAa,EAAE,kEAAkE;oBACjF,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,SAAS,EAAE,4BAA4B;qBACxC;iBACF;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,OAAO;oBACf,aAAa,EAAE,8CAA8C;oBAC7D,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,SAAS,EAAE,4BAA4B;qBACxC;iBACF;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,+BAA+B;iBAC/C;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,qBAAqB;iBACrC;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,OAAO;oBACf,aAAa,EAAE,oDAAoD;oBACnE,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;iBACF;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,wCAAwC;iBACxD;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,iDAAiD;YAChE,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,MAAM;aACP;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;iBACjB;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;iBACb;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,0EAA0E;YACzF,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,4CAA4C;YACrD,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;aACT;YACD,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,uBAAuB;iBAChC;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,eAAe,EAAE;YACf,OAAO,EAAE,eAAe;YACxB,aAAa,EAAE,sFAAsF;YACrG,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,WAAW;gBACX,WAAW;gBACX,WAAW;gBACX,OAAO;gBACP,IAAI;gBACJ,gBAAgB;gBAChB,eAAe;gBACf,YAAY;gBACZ,YAAY;gBACZ,eAAe;gBACf,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;iBACf;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;iBACf;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,4EAA4E;iBAC5F;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,EAAE;iBAChB;gBACD,IAAI,EAAE;oBACJ,MAAM,EAAE,mBAAmB;oBAC3B,aAAa,EAAE,iDAAiD;iBACjE;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,OAAO;oBACf,aAAa,EAAE,kEAAkE;oBACjF,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,SAAS,EAAE,4BAA4B;qBACxC;iBACF;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,OAAO;oBACf,aAAa,EAAE,8CAA8C;oBAC7D,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,SAAS,EAAE,4BAA4B;qBACxC;iBACF;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,+BAA+B;iBAC/C;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,qBAAqB;iBACrC;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,OAAO;oBACf,aAAa,EAAE,oDAAoD;oBACnE,OAAO,EAAE;wBACP,MAAM,EAAE,mBAAmB;qBAC5B;iBACF;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,wCAAwC;iBACxD;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,iDAAiD;YAChE,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,MAAM;aACP;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;iBACjB;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;iBACb;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,0EAA0E;YACzF,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,0BAA0B;SACtC;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,KAAK;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}
@@ -12,5 +12,5 @@ export interface VTCSharedRoomStorageDefinitions {
12
12
  * The definitions this shared schema publishes, hoisted to one declaration each.
13
13
  * See "../../../_shared/components.js".
14
14
  */
15
- export type { ConfigState, CredentialState, EffectiveLimits, ExternalAccountId, GcsSettings, HostedRoom, LimitSource, LimitTarget, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageKind, StorageSettings, WalrusSettings } from "../../../_shared/components.js";
15
+ export type { ConfigState, CredentialState, EffectiveLimits, ExternalAccountContextId, ExternalAccountId, GcsSettings, HostedRoom, LimitSource, LimitTarget, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageKind, StorageSettings, WalrusSettings } from "../../../_shared/components.js";
16
16
  //# sourceMappingURL=room-storage.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"room-storage.d.ts","sourceRoot":"","sources":["../../../../src/vtc/_shared/0.1/room-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC"}
1
+ {"version":3,"file":"room-storage.d.ts","sourceRoot":"","sources":["../../../../src/vtc/_shared/0.1/room-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC"}
@@ -2,7 +2,7 @@
2
2
  * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
3
3
  * Source: specs/vtc/storage/configs/create/0.1/payload.schema.json
4
4
  */
5
- import type { ConfigState, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
5
+ import type { ConfigState, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
6
6
  /**
7
7
  * Add a storage config: a named backend and how the community authenticates to it. Never a secret. The outer document members are owned by the framework — SPEC §6.3.
8
8
  */
@@ -33,7 +33,7 @@ export interface VTCStorageConfigsCreateResponsePayload {
33
33
  ext?: Ext;
34
34
  }
35
35
  /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
36
- export type { ConfigState, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings };
36
+ export type { ConfigState, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings };
37
37
  /** Trust Task type URI. */
38
38
  export declare const TYPE_URI: "https://trusttasks.org/spec/vtc/storage/configs/create/0.1";
39
39
  /** Stable alias for this specification's request payload shape. */
@@ -182,15 +182,18 @@ export declare const PAYLOAD_SCHEMA: {
182
182
  };
183
183
  readonly StorageAuth: {
184
184
  readonly title: "StorageAuth";
185
- readonly description: "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.";
185
+ readonly description: "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.";
186
186
  readonly oneOf: readonly [{
187
187
  readonly type: "object";
188
188
  readonly additionalProperties: false;
189
- readonly required: readonly ["mode", "account"];
189
+ readonly required: readonly ["mode", "context", "account"];
190
190
  readonly properties: {
191
191
  readonly mode: {
192
192
  readonly const: "vta-account";
193
193
  };
194
+ readonly context: {
195
+ readonly $ref: "#/$defs/ExternalAccountContextId";
196
+ };
194
197
  readonly account: {
195
198
  readonly $ref: "#/$defs/ExternalAccountId";
196
199
  };
@@ -223,6 +226,13 @@ export declare const PAYLOAD_SCHEMA: {
223
226
  readonly pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$";
224
227
  readonly description: "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself.";
225
228
  };
229
+ readonly ExternalAccountContextId: {
230
+ readonly title: "ExternalAccountContextId";
231
+ readonly type: "string";
232
+ readonly minLength: 1;
233
+ readonly maxLength: 256;
234
+ readonly description: "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate.";
235
+ };
226
236
  readonly StorageSettings: {
227
237
  readonly title: "StorageSettings";
228
238
  readonly description: "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.";
@@ -461,15 +471,18 @@ export declare const RESPONSE_PAYLOAD_SCHEMA: {
461
471
  };
462
472
  readonly StorageAuth: {
463
473
  readonly title: "StorageAuth";
464
- readonly description: "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.";
474
+ readonly description: "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.";
465
475
  readonly oneOf: readonly [{
466
476
  readonly type: "object";
467
477
  readonly additionalProperties: false;
468
- readonly required: readonly ["mode", "account"];
478
+ readonly required: readonly ["mode", "context", "account"];
469
479
  readonly properties: {
470
480
  readonly mode: {
471
481
  readonly const: "vta-account";
472
482
  };
483
+ readonly context: {
484
+ readonly $ref: "#/$defs/ExternalAccountContextId";
485
+ };
473
486
  readonly account: {
474
487
  readonly $ref: "#/$defs/ExternalAccountId";
475
488
  };
@@ -502,6 +515,13 @@ export declare const RESPONSE_PAYLOAD_SCHEMA: {
502
515
  readonly pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$";
503
516
  readonly description: "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself.";
504
517
  };
518
+ readonly ExternalAccountContextId: {
519
+ readonly title: "ExternalAccountContextId";
520
+ readonly type: "string";
521
+ readonly minLength: 1;
522
+ readonly maxLength: 256;
523
+ readonly description: "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate.";
524
+ };
505
525
  readonly StorageSettings: {
506
526
  readonly title: "StorageSettings";
507
527
  readonly description: "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.";
@@ -791,15 +811,18 @@ export declare const SPEC: {
791
811
  };
792
812
  readonly StorageAuth: {
793
813
  readonly title: "StorageAuth";
794
- readonly description: "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.";
814
+ readonly description: "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.";
795
815
  readonly oneOf: readonly [{
796
816
  readonly type: "object";
797
817
  readonly additionalProperties: false;
798
- readonly required: readonly ["mode", "account"];
818
+ readonly required: readonly ["mode", "context", "account"];
799
819
  readonly properties: {
800
820
  readonly mode: {
801
821
  readonly const: "vta-account";
802
822
  };
823
+ readonly context: {
824
+ readonly $ref: "#/$defs/ExternalAccountContextId";
825
+ };
803
826
  readonly account: {
804
827
  readonly $ref: "#/$defs/ExternalAccountId";
805
828
  };
@@ -832,6 +855,13 @@ export declare const SPEC: {
832
855
  readonly pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$";
833
856
  readonly description: "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself.";
834
857
  };
858
+ readonly ExternalAccountContextId: {
859
+ readonly title: "ExternalAccountContextId";
860
+ readonly type: "string";
861
+ readonly minLength: 1;
862
+ readonly maxLength: 256;
863
+ readonly description: "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate.";
864
+ };
835
865
  readonly StorageSettings: {
836
866
  readonly title: "StorageSettings";
837
867
  readonly description: "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.";
@@ -1081,15 +1111,18 @@ export declare const RESPONSE_SPEC: {
1081
1111
  };
1082
1112
  readonly StorageAuth: {
1083
1113
  readonly title: "StorageAuth";
1084
- readonly description: "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.";
1114
+ readonly description: "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.";
1085
1115
  readonly oneOf: readonly [{
1086
1116
  readonly type: "object";
1087
1117
  readonly additionalProperties: false;
1088
- readonly required: readonly ["mode", "account"];
1118
+ readonly required: readonly ["mode", "context", "account"];
1089
1119
  readonly properties: {
1090
1120
  readonly mode: {
1091
1121
  readonly const: "vta-account";
1092
1122
  };
1123
+ readonly context: {
1124
+ readonly $ref: "#/$defs/ExternalAccountContextId";
1125
+ };
1093
1126
  readonly account: {
1094
1127
  readonly $ref: "#/$defs/ExternalAccountId";
1095
1128
  };
@@ -1122,6 +1155,13 @@ export declare const RESPONSE_SPEC: {
1122
1155
  readonly pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$";
1123
1156
  readonly description: "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself.";
1124
1157
  };
1158
+ readonly ExternalAccountContextId: {
1159
+ readonly title: "ExternalAccountContextId";
1160
+ readonly type: "string";
1161
+ readonly minLength: 1;
1162
+ readonly maxLength: 256;
1163
+ readonly description: "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate.";
1164
+ };
1125
1165
  readonly StorageSettings: {
1126
1166
  readonly title: "StorageSettings";
1127
1167
  readonly description: "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.";
@@ -1 +1 @@
1
- {"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/vtc/storage/configs/create/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAGpO;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,eAAe,CAAC;IACpB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD,MAAM,WAAW,sCAAsC;IACrD,MAAM,EAAE,aAAa,CAAC;IACtB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,WAAW,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAExL,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4DAAqE,CAAC;AAE9F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAErD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qEAA8E,CAAC;AAEhH,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+WjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkU1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}
1
+ {"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../../src/vtc/storage/configs/create/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAG9P;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,eAAe,CAAC;IACpB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD,MAAM,WAAW,sCAAsC;IACrD,MAAM,EAAE,aAAa,CAAC;IACtB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,WAAW,EAAE,GAAG,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAElN,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4DAAqE,CAAC;AAE9F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAErD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qEAA8E,CAAC;AAEhH,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0XjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6U1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}