@openvtc/trust-tasks 0.25.2 → 0.26.0

package/CHANGELOG.md

@@ -11,6 +11,34 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.26.0 — 2026-10-13
+
+
+### Specifications
+
+- **vtc**: A vta-account storage config names the account's context as well as its identifier (#758)
+
+`StorageAuth`'s `vta-account` variant named only `account`, but a VTA names an
+  external account by the context that owns it and its identifier there: the
+  `external/credentials/issue` task the community sends requires both. A
+  community could only fill the gap from something outside the config, which
+  makes a config mean something only on the host that stored it, confines every
+  account a community uses to one context, and leaves each implementation to
+  fill the gap its own way.
+
+  `vta-account` now requires `context` (`ExternalAccountContextId`, the issue
+  task's `AccountContextId` form), and `CredentialState` carries it beside
+  `account`. Naming a context grants nothing: the VTA issues only to a consumer
+  bound to the account and holding `external-auth-use` in that context.
+  `vtc/storage/configs/create` item 5 addresses the account by that pair and
+  never by an identifier resolved against a context of the community's own
+  choosing; `unknownAccount` on create and update says so. A new invalid
+  example covers a missing context.
+
+  Breaking for the generated types: a new required member. No community could
+  create a `vta-account` config before this (the one implementation refused
+  every kind but `local`), so no stored config lacks it.
+
 ## 0.25.2 — 2026-10-13
 
 

package/dist/_shared/components.d.ts

@@ -586,6 +586,10 @@ export type ExpiresAt = string;
  * @minItems 1
  */
 export type ExtCritical = [string, ...string[]];
+/**
+ * The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate.
+ */
+export type ExternalAccountContextId = string;
 /**
  * The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself.
  */
@@ -1089,7 +1093,7 @@ export type Slot = string;
 /**
  * How the community authenticates to a config's backend. Absent on a `local` config, which needs none.
  *
- * `vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.
+ * `vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.
  *
  * `ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.
  *
@@ -1097,6 +1101,7 @@ export type Slot = string;
  */
 export type StorageAuth = {
     mode: "vta-account";
+    context: ExternalAccountContextId;
     account: ExternalAccountId;
 } | {
     mode: "ambient";
@@ -4640,6 +4645,10 @@ export interface CredentialScopeCeiling {
  */
 export interface CredentialState {
     status: "vta-account" | "ambient" | "sealed" | "required" | "none";
+    /**
+     * Present with `vta-account`.
+     */
+    context?: ExternalAccountContextId;
     /**
      * Present with `vta-account`.
      */