@openvtc/trust-tasks 0.25.1 → 0.26.0

package/src/vta/pcs/vetter/show/0.1/payload.ts

@@ -0,0 +1,387 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/pcs/vetter/show/0.1/payload.schema.json
+ */
+
+import type { Ext, Multibase, TokenDraw, VetterSummary } from "../../../../../_shared/components.js";
+
+
+/**
+ * A vetter's client reads back its VTA's vetter engine for a community: identifier, enrolled labels, token counts and draws in flight — never its key, credentials or tokens.
+ */
+export interface VTAPCSVetterShowPayload {
+  /**
+   * The context the engine belongs to. Its key is derived from this context's base.
+   */
+  contextId: string;
+  /**
+   * The community's DID: the helper whose parameters the engine runs under.
+   */
+  community: string;
+  ext?: Ext;
+}
+export interface VTAPCSVetterShowResponsePayload {
+  vetter: VetterSummary;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Multibase, TokenDraw, VetterSummary };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vta/pcs/vetter/show/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTAPCSVetterShowPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/pcs/vetter/show/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTAPCSVetterShowResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vta/pcs/vetter/show/0.1",
+  "title": "VTA PCS — Vetter — Show — payload",
+  "description": "A vetter's client reads back its VTA's vetter engine for a community: identifier, enrolled labels, token counts and draws in flight — never its key, credentials or tokens.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "contextId",
+    "community"
+  ],
+  "properties": {
+    "contextId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The context the engine belongs to. Its key is derived from this context's base."
+    },
+    "community": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The community's DID: the helper whose parameters the engine runs under."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTA PCS — Vetter — Show — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "vetter"
+      ],
+      "properties": {
+        "vetter": {
+          "$ref": "#/$defs/VetterSummary"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "VetterSummary": {
+      "title": "VetterSummary",
+      "description": "A vetter engine as the VTA holds it, without its key, its credentials or its tokens.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "contextId",
+        "community",
+        "memberDid",
+        "suite",
+        "id",
+        "enrolledLabels",
+        "pendingLabels",
+        "tokensFree",
+        "tokensHeld",
+        "drawsInFlight",
+        "attested"
+      ],
+      "properties": {
+        "contextId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "community": {
+          "type": "string",
+          "minLength": 1
+        },
+        "memberDid": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The member DID the engine draws tokens as. Bound into every token request."
+        },
+        "suite": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64
+        },
+        "id": {
+          "$ref": "#/$defs/Multibase",
+          "description": "The vetter's PCS identifier for this community."
+        },
+        "enrolledLabels": {
+          "type": "array",
+          "description": "Class labels this vetter holds a credential under, newest first.",
+          "items": {
+            "type": "string",
+            "pattern": "^vetter/[0-9]{4}-[0-9]{2}$"
+          }
+        },
+        "pendingLabels": {
+          "type": "array",
+          "description": "Class labels requested and not yet accepted.",
+          "items": {
+            "type": "string",
+            "pattern": "^vetter/[0-9]{4}-[0-9]{2}$"
+          }
+        },
+        "tokensFree": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Tokens held and not reserved."
+        },
+        "tokensHeld": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Tokens held in all."
+        },
+        "drawsInFlight": {
+          "type": "array",
+          "description": "Draws requested and not yet accepted or abandoned.",
+          "items": {
+            "$ref": "#/$defs/TokenDraw"
+          }
+        },
+        "attested": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Attestations made through this engine."
+        }
+      }
+    },
+    "TokenDraw": {
+      "title": "TokenDraw",
+      "description": "One draw of the token drip: a label and a tick.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "label",
+        "tick"
+      ],
+      "properties": {
+        "label": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "tick": {
+          "type": "integer",
+          "minimum": 0
+        }
+      }
+    },
+    "Multibase": {
+      "title": "Multibase",
+      "description": "A binary value, multibase base58btc over the suite's canonical encoding.",
+      "type": "string",
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTA PCS — Vetter — Show — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "vetter"
+      ],
+      "properties": {
+        "vetter": {
+          "$ref": "#/$defs/VetterSummary"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "VetterSummary": {
+      "title": "VetterSummary",
+      "description": "A vetter engine as the VTA holds it, without its key, its credentials or its tokens.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "contextId",
+        "community",
+        "memberDid",
+        "suite",
+        "id",
+        "enrolledLabels",
+        "pendingLabels",
+        "tokensFree",
+        "tokensHeld",
+        "drawsInFlight",
+        "attested"
+      ],
+      "properties": {
+        "contextId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "community": {
+          "type": "string",
+          "minLength": 1
+        },
+        "memberDid": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The member DID the engine draws tokens as. Bound into every token request."
+        },
+        "suite": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64
+        },
+        "id": {
+          "$ref": "#/$defs/Multibase",
+          "description": "The vetter's PCS identifier for this community."
+        },
+        "enrolledLabels": {
+          "type": "array",
+          "description": "Class labels this vetter holds a credential under, newest first.",
+          "items": {
+            "type": "string",
+            "pattern": "^vetter/[0-9]{4}-[0-9]{2}$"
+          }
+        },
+        "pendingLabels": {
+          "type": "array",
+          "description": "Class labels requested and not yet accepted.",
+          "items": {
+            "type": "string",
+            "pattern": "^vetter/[0-9]{4}-[0-9]{2}$"
+          }
+        },
+        "tokensFree": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Tokens held and not reserved."
+        },
+        "tokensHeld": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Tokens held in all."
+        },
+        "drawsInFlight": {
+          "type": "array",
+          "description": "Draws requested and not yet accepted or abandoned.",
+          "items": {
+            "$ref": "#/$defs/TokenDraw"
+          }
+        },
+        "attested": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Attestations made through this engine."
+        }
+      }
+    },
+    "TokenDraw": {
+      "title": "TokenDraw",
+      "description": "One draw of the token drip: a label and a tick.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "label",
+        "tick"
+      ],
+      "properties": {
+        "label": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "tick": {
+          "type": "integer",
+          "minimum": 0
+        }
+      }
+    },
+    "Multibase": {
+      "title": "Multibase",
+      "description": "A binary value, multibase base58btc over the suite's canonical encoding.",
+      "type": "string",
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: false,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: false,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/vtc/_shared/0.1/room-storage.ts

@@ -14,4 +14,4 @@ export interface VTCSharedRoomStorageDefinitions {
  * The definitions this shared schema publishes, hoisted to one declaration each.
  * See "../../../_shared/components.js".
  */
-export type { ConfigState, CredentialState, EffectiveLimits, ExternalAccountId, GcsSettings, HostedRoom, LimitSource, LimitTarget, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageKind, StorageSettings, WalrusSettings } from "../../../_shared/components.js";
+export type { ConfigState, CredentialState, EffectiveLimits, ExternalAccountContextId, ExternalAccountId, GcsSettings, HostedRoom, LimitSource, LimitTarget, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageKind, StorageSettings, WalrusSettings } from "../../../_shared/components.js";

package/src/vtc/storage/configs/create/0.1/payload.ts

@@ -3,7 +3,7 @@
  * Source: specs/vtc/storage/configs/create/0.1/payload.schema.json
  */
 
-import type { ConfigState, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
+import type { ConfigState, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
 
 
 /**
@@ -37,7 +37,7 @@ export interface VTCStorageConfigsCreateResponsePayload {
 }
 
 /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
-export type { ConfigState, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings };
+export type { ConfigState, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/storage/configs/create/0.1" as const;
@@ -209,19 +209,23 @@ export const PAYLOAD_SCHEMA = {
     },
     "StorageAuth": {
       "title": "StorageAuth",
-      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
+      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
       "oneOf": [
         {
           "type": "object",
           "additionalProperties": false,
           "required": [
             "mode",
+            "context",
             "account"
           ],
           "properties": {
             "mode": {
               "const": "vta-account"
             },
+            "context": {
+              "$ref": "#/$defs/ExternalAccountContextId"
+            },
             "account": {
               "$ref": "#/$defs/ExternalAccountId"
             }
@@ -261,6 +265,13 @@ export const PAYLOAD_SCHEMA = {
       "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
       "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
     },
+    "ExternalAccountContextId": {
+      "title": "ExternalAccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+    },
     "StorageSettings": {
       "title": "StorageSettings",
       "description": "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.",
@@ -534,19 +545,23 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
     },
     "StorageAuth": {
       "title": "StorageAuth",
-      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
+      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
       "oneOf": [
         {
           "type": "object",
           "additionalProperties": false,
           "required": [
             "mode",
+            "context",
             "account"
           ],
           "properties": {
             "mode": {
               "const": "vta-account"
             },
+            "context": {
+              "$ref": "#/$defs/ExternalAccountContextId"
+            },
             "account": {
               "$ref": "#/$defs/ExternalAccountId"
             }
@@ -586,6 +601,13 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
       "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
     },
+    "ExternalAccountContextId": {
+      "title": "ExternalAccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+    },
     "StorageSettings": {
       "title": "StorageSettings",
       "description": "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.",

package/src/vtc/storage/configs/get/0.1/payload.ts

@@ -3,7 +3,7 @@
  * Source: specs/vtc/storage/configs/get/0.1/payload.schema.json
  */
 
-import type { ConfigState, CredentialState, DigestMultibase, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
+import type { ConfigState, CredentialState, DigestMultibase, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
 
 
 /**
@@ -25,7 +25,7 @@ export interface VTCStorageConfigsGetResponsePayload {
 }
 
 /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
-export type { ConfigState, CredentialState, DigestMultibase, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageSettings, WalrusSettings };
+export type { ConfigState, CredentialState, DigestMultibase, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageSettings, WalrusSettings };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/storage/configs/get/0.1" as const;
@@ -220,6 +220,10 @@ export const PAYLOAD_SCHEMA = {
             "none"
           ]
         },
+        "context": {
+          "$ref": "#/$defs/ExternalAccountContextId",
+          "description": "Present with `vta-account`."
+        },
         "account": {
           "$ref": "#/$defs/ExternalAccountId",
           "description": "Present with `vta-account`."
@@ -248,6 +252,13 @@ export const PAYLOAD_SCHEMA = {
       "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
       "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
     },
+    "ExternalAccountContextId": {
+      "title": "ExternalAccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+    },
     "DigestMultibase": {
       "title": "DigestMultibase",
       "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
@@ -331,19 +342,23 @@ export const PAYLOAD_SCHEMA = {
     },
     "StorageAuth": {
       "title": "StorageAuth",
-      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
+      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
       "oneOf": [
         {
           "type": "object",
           "additionalProperties": false,
           "required": [
             "mode",
+            "context",
             "account"
           ],
           "properties": {
             "mode": {
               "const": "vta-account"
             },
+            "context": {
+              "$ref": "#/$defs/ExternalAccountContextId"
+            },
             "account": {
               "$ref": "#/$defs/ExternalAccountId"
             }
@@ -701,6 +716,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             "none"
           ]
         },
+        "context": {
+          "$ref": "#/$defs/ExternalAccountContextId",
+          "description": "Present with `vta-account`."
+        },
         "account": {
           "$ref": "#/$defs/ExternalAccountId",
           "description": "Present with `vta-account`."
@@ -729,6 +748,13 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
       "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
     },
+    "ExternalAccountContextId": {
+      "title": "ExternalAccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+    },
     "DigestMultibase": {
       "title": "DigestMultibase",
       "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
@@ -812,19 +838,23 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
     },
     "StorageAuth": {
       "title": "StorageAuth",
-      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
+      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
       "oneOf": [
         {
           "type": "object",
           "additionalProperties": false,
           "required": [
             "mode",
+            "context",
             "account"
           ],
           "properties": {
             "mode": {
               "const": "vta-account"
             },
+            "context": {
+              "$ref": "#/$defs/ExternalAccountContextId"
+            },
             "account": {
               "$ref": "#/$defs/ExternalAccountId"
             }