@openvtc/trust-tasks 0.25.2 → 0.26.0

package/dist/vtc/storage/credentials/set/0.1/payload.js

@@ -108,6 +108,10 @@ export const PAYLOAD_SCHEMA = {
                         "none"
                     ]
                 },
+                "context": {
+                    "$ref": "#/$defs/ExternalAccountContextId",
+                    "description": "Present with `vta-account`."
+                },
                 "account": {
                     "$ref": "#/$defs/ExternalAccountId",
                     "description": "Present with `vta-account`."
@@ -136,6 +140,13 @@ export const PAYLOAD_SCHEMA = {
             "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
             "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
         },
+        "ExternalAccountContextId": {
+            "title": "ExternalAccountContextId",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+        },
         "DigestMultibase": {
             "title": "DigestMultibase",
             "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
@@ -215,6 +226,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
                         "none"
                     ]
                 },
+                "context": {
+                    "$ref": "#/$defs/ExternalAccountContextId",
+                    "description": "Present with `vta-account`."
+                },
                 "account": {
                     "$ref": "#/$defs/ExternalAccountId",
                     "description": "Present with `vta-account`."
@@ -243,6 +258,13 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
             "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
         },
+        "ExternalAccountContextId": {
+            "title": "ExternalAccountContextId",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+        },
         "DigestMultibase": {
             "title": "DigestMultibase",
             "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",

package/dist/vtc/storage/credentials/set/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/vtc/storage/credentials/set/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAqCH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,6DAAsE,CAAC;AAK/F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,sEAA+E,CAAC;AAKjH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,6DAA6D;IACpE,OAAO,EAAE,2CAA2C;IACpD,aAAa,EAAE,iMAAiM;IAChN,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,UAAU;QACV,QAAQ;QACR,iBAAiB;QACjB,QAAQ;KACT;IACD,YAAY,EAAE;QACZ,UAAU,EAAE;YACV,MAAM,EAAE,yBAAyB;SAClC;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,KAAK;YAClB,SAAS,EAAE,oCAAoC;YAC/C,aAAa,EAAE,uPAAuP;SACvQ;QACD,iBAAiB,EAAE;YACjB,MAAM,EAAE,yBAAyB;YACjC,aAAa,EAAE,mJAAmJ;SACnK;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,4QAA4Q;SAC5R;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,oDAAoD;YAC7D,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,UAAU;gBACV,iBAAiB;aAClB;YACD,YAAY,EAAE;gBACZ,UAAU,EAAE;oBACV,MAAM,EAAE,yBAAyB;iBAClC;gBACD,iBAAiB,EAAE;oBACjB,MAAM,EAAE,yBAAyB;iBAClC;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,uEAAuE;iBACvF;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;aACT;YACD,aAAa,EAAE,6TAA6T;YAC5U,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,aAAa;wBACb,SAAS;wBACT,QAAQ;wBACR,UAAU;wBACV,MAAM;qBACP;iBACF;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,2BAA2B;oBACnC,aAAa,EAAE,6BAA6B;iBAC7C;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,yBAAyB;oBACjC,aAAa,EAAE,2PAA2P;iBAC3Q;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,iEAAiE;iBACjF;gBACD,yBAAyB,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,6GAA6G;iBAC7H;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,wCAAwC;YACnD,aAAa,EAAE,gNAAgN;SAChO;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,gnDAAgnD;YAC/nD,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,4CAA4C;YACvD,UAAU,EAAE;gBACV,iDAAiD;aAClD;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,wCAAwC;YACnD,aAAa,EAAE,8TAA8T;SAC9U;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,oDAAoD;YAC7D,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,UAAU;gBACV,iBAAiB;aAClB;YACD,YAAY,EAAE;gBACZ,UAAU,EAAE;oBACV,MAAM,EAAE,yBAAyB;iBAClC;gBACD,iBAAiB,EAAE;oBACjB,MAAM,EAAE,yBAAyB;iBAClC;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,uEAAuE;iBACvF;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;aACT;YACD,aAAa,EAAE,6TAA6T;YAC5U,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,aAAa;wBACb,SAAS;wBACT,QAAQ;wBACR,UAAU;wBACV,MAAM;qBACP;iBACF;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,2BAA2B;oBACnC,aAAa,EAAE,6BAA6B;iBAC7C;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,yBAAyB;oBACjC,aAAa,EAAE,2PAA2P;iBAC3Q;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,iEAAiE;iBACjF;gBACD,yBAAyB,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,6GAA6G;iBAC7H;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,wCAAwC;YACnD,aAAa,EAAE,gNAAgN;SAChO;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,gnDAAgnD;YAC/nD,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,4CAA4C;YACvD,UAAU,EAAE;gBACV,iDAAiD;aAClD;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,wCAAwC;YACnD,aAAa,EAAE,8TAA8T;SAC9U;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/vtc/storage/credentials/set/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAqCH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,6DAAsE,CAAC;AAK/F,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,sEAA+E,CAAC;AAKjH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,6DAA6D;IACpE,OAAO,EAAE,2CAA2C;IACpD,aAAa,EAAE,iMAAiM;IAChN,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,UAAU;QACV,QAAQ;QACR,iBAAiB;QACjB,QAAQ;KACT;IACD,YAAY,EAAE;QACZ,UAAU,EAAE;YACV,MAAM,EAAE,yBAAyB;SAClC;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,KAAK;YAClB,SAAS,EAAE,oCAAoC;YAC/C,aAAa,EAAE,uPAAuP;SACvQ;QACD,iBAAiB,EAAE;YACjB,MAAM,EAAE,yBAAyB;YACjC,aAAa,EAAE,mJAAmJ;SACnK;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,4QAA4Q;SAC5R;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,oDAAoD;YAC7D,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,UAAU;gBACV,iBAAiB;aAClB;YACD,YAAY,EAAE;gBACZ,UAAU,EAAE;oBACV,MAAM,EAAE,yBAAyB;iBAClC;gBACD,iBAAiB,EAAE;oBACjB,MAAM,EAAE,yBAAyB;iBAClC;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,uEAAuE;iBACvF;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;aACT;YACD,aAAa,EAAE,6TAA6T;YAC5U,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,aAAa;wBACb,SAAS;wBACT,QAAQ;wBACR,UAAU;wBACV,MAAM;qBACP;iBACF;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,kCAAkC;oBAC1C,aAAa,EAAE,6BAA6B;iBAC7C;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,2BAA2B;oBACnC,aAAa,EAAE,6BAA6B;iBAC7C;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,yBAAyB;oBACjC,aAAa,EAAE,2PAA2P;iBAC3Q;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,iEAAiE;iBACjF;gBACD,yBAAyB,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,6GAA6G;iBAC7H;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,wCAAwC;YACnD,aAAa,EAAE,gNAAgN;SAChO;QACD,0BAA0B,EAAE;YAC1B,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,8WAA8W;SAC9X;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,gnDAAgnD;YAC/nD,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,4CAA4C;YACvD,UAAU,EAAE;gBACV,iDAAiD;aAClD;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,wCAAwC;YACnD,aAAa,EAAE,8TAA8T;SAC9U;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,oDAAoD;YAC7D,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,UAAU;gBACV,iBAAiB;aAClB;YACD,YAAY,EAAE;gBACZ,UAAU,EAAE;oBACV,MAAM,EAAE,yBAAyB;iBAClC;gBACD,iBAAiB,EAAE;oBACjB,MAAM,EAAE,yBAAyB;iBAClC;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,aAAa,EAAE,uEAAuE;iBACvF;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,QAAQ;aACT;YACD,aAAa,EAAE,6TAA6T;YAC5U,YAAY,EAAE;gBACZ,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,aAAa;wBACb,SAAS;wBACT,QAAQ;wBACR,UAAU;wBACV,MAAM;qBACP;iBACF;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,kCAAkC;oBAC1C,aAAa,EAAE,6BAA6B;iBAC7C;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,2BAA2B;oBACnC,aAAa,EAAE,6BAA6B;iBAC7C;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,yBAAyB;oBACjC,aAAa,EAAE,2PAA2P;iBAC3Q;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,iEAAiE;iBACjF;gBACD,yBAAyB,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,6GAA6G;iBAC7H;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,wCAAwC;YACnD,aAAa,EAAE,gNAAgN;SAChO;QACD,0BAA0B,EAAE;YAC1B,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,8WAA8W;SAC9X;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,gnDAAgnD;YAC/nD,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,4CAA4C;YACvD,UAAU,EAAE;gBACV,iDAAiD;aAClD;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,wCAAwC;YACnD,aAAa,EAAE,8TAA8T;SAC9U;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.25.2",
+  "version": "0.26.0",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/_shared/components.ts

@@ -687,6 +687,10 @@ export type ExpiresAt = string;
  * @minItems 1
  */
 export type ExtCritical = [string, ...string[]];
+/**
+ * The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate.
+ */
+export type ExternalAccountContextId = string;
 /**
  * The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself.
  */
@@ -1222,7 +1226,7 @@ export type Slot = string;
 /**
  * How the community authenticates to a config's backend. Absent on a `local` config, which needs none.
  *
- * `vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.
+ * `vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.
  *
  * `ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.
  *
@@ -1231,6 +1235,7 @@ export type Slot = string;
 export type StorageAuth =
   | {
       mode: "vta-account";
+      context: ExternalAccountContextId;
       account: ExternalAccountId;
     }
   | {
@@ -4884,6 +4889,10 @@ export interface CredentialScopeCeiling {
  */
 export interface CredentialState {
   status: "vta-account" | "ambient" | "sealed" | "required" | "none";
+  /**
+   * Present with `vta-account`.
+   */
+  context?: ExternalAccountContextId;
   /**
    * Present with `vta-account`.
    */

package/src/vtc/_shared/0.1/room-storage.ts

@@ -14,4 +14,4 @@ export interface VTCSharedRoomStorageDefinitions {
  * The definitions this shared schema publishes, hoisted to one declaration each.
  * See "../../../_shared/components.js".
  */
-export type { ConfigState, CredentialState, EffectiveLimits, ExternalAccountId, GcsSettings, HostedRoom, LimitSource, LimitTarget, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageKind, StorageSettings, WalrusSettings } from "../../../_shared/components.js";
+export type { ConfigState, CredentialState, EffectiveLimits, ExternalAccountContextId, ExternalAccountId, GcsSettings, HostedRoom, LimitSource, LimitTarget, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageKind, StorageSettings, WalrusSettings } from "../../../_shared/components.js";

package/src/vtc/storage/configs/create/0.1/payload.ts

@@ -3,7 +3,7 @@
  * Source: specs/vtc/storage/configs/create/0.1/payload.schema.json
  */
 
-import type { ConfigState, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
+import type { ConfigState, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
 
 
 /**
@@ -37,7 +37,7 @@ export interface VTCStorageConfigsCreateResponsePayload {
 }
 
 /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
-export type { ConfigState, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings };
+export type { ConfigState, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/storage/configs/create/0.1" as const;
@@ -209,19 +209,23 @@ export const PAYLOAD_SCHEMA = {
     },
     "StorageAuth": {
       "title": "StorageAuth",
-      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
+      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
       "oneOf": [
         {
           "type": "object",
           "additionalProperties": false,
           "required": [
             "mode",
+            "context",
             "account"
           ],
           "properties": {
             "mode": {
               "const": "vta-account"
             },
+            "context": {
+              "$ref": "#/$defs/ExternalAccountContextId"
+            },
             "account": {
               "$ref": "#/$defs/ExternalAccountId"
             }
@@ -261,6 +265,13 @@ export const PAYLOAD_SCHEMA = {
       "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
       "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
     },
+    "ExternalAccountContextId": {
+      "title": "ExternalAccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+    },
     "StorageSettings": {
       "title": "StorageSettings",
       "description": "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.",
@@ -534,19 +545,23 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
     },
     "StorageAuth": {
       "title": "StorageAuth",
-      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
+      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
       "oneOf": [
         {
           "type": "object",
           "additionalProperties": false,
           "required": [
             "mode",
+            "context",
             "account"
           ],
           "properties": {
             "mode": {
               "const": "vta-account"
             },
+            "context": {
+              "$ref": "#/$defs/ExternalAccountContextId"
+            },
             "account": {
               "$ref": "#/$defs/ExternalAccountId"
             }
@@ -586,6 +601,13 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
       "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
     },
+    "ExternalAccountContextId": {
+      "title": "ExternalAccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+    },
     "StorageSettings": {
       "title": "StorageSettings",
       "description": "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.",

package/src/vtc/storage/configs/get/0.1/payload.ts

@@ -3,7 +3,7 @@
  * Source: specs/vtc/storage/configs/get/0.1/payload.schema.json
  */
 
-import type { ConfigState, CredentialState, DigestMultibase, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
+import type { ConfigState, CredentialState, DigestMultibase, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
 
 
 /**
@@ -25,7 +25,7 @@ export interface VTCStorageConfigsGetResponsePayload {
 }
 
 /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
-export type { ConfigState, CredentialState, DigestMultibase, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageSettings, WalrusSettings };
+export type { ConfigState, CredentialState, DigestMultibase, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageSettings, WalrusSettings };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/storage/configs/get/0.1" as const;
@@ -220,6 +220,10 @@ export const PAYLOAD_SCHEMA = {
             "none"
           ]
         },
+        "context": {
+          "$ref": "#/$defs/ExternalAccountContextId",
+          "description": "Present with `vta-account`."
+        },
         "account": {
           "$ref": "#/$defs/ExternalAccountId",
           "description": "Present with `vta-account`."
@@ -248,6 +252,13 @@ export const PAYLOAD_SCHEMA = {
       "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
       "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
     },
+    "ExternalAccountContextId": {
+      "title": "ExternalAccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+    },
     "DigestMultibase": {
       "title": "DigestMultibase",
       "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
@@ -331,19 +342,23 @@ export const PAYLOAD_SCHEMA = {
     },
     "StorageAuth": {
       "title": "StorageAuth",
-      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
+      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
       "oneOf": [
         {
           "type": "object",
           "additionalProperties": false,
           "required": [
             "mode",
+            "context",
             "account"
           ],
           "properties": {
             "mode": {
               "const": "vta-account"
             },
+            "context": {
+              "$ref": "#/$defs/ExternalAccountContextId"
+            },
             "account": {
               "$ref": "#/$defs/ExternalAccountId"
             }
@@ -701,6 +716,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             "none"
           ]
         },
+        "context": {
+          "$ref": "#/$defs/ExternalAccountContextId",
+          "description": "Present with `vta-account`."
+        },
         "account": {
           "$ref": "#/$defs/ExternalAccountId",
           "description": "Present with `vta-account`."
@@ -729,6 +748,13 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
       "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
     },
+    "ExternalAccountContextId": {
+      "title": "ExternalAccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+    },
     "DigestMultibase": {
       "title": "DigestMultibase",
       "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
@@ -812,19 +838,23 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
     },
     "StorageAuth": {
       "title": "StorageAuth",
-      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
+      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
       "oneOf": [
         {
           "type": "object",
           "additionalProperties": false,
           "required": [
             "mode",
+            "context",
             "account"
           ],
           "properties": {
             "mode": {
               "const": "vta-account"
             },
+            "context": {
+              "$ref": "#/$defs/ExternalAccountContextId"
+            },
             "account": {
               "$ref": "#/$defs/ExternalAccountId"
             }

package/src/vtc/storage/configs/list/0.1/payload.ts

@@ -3,7 +3,7 @@
  * Source: specs/vtc/storage/configs/list/0.1/payload.schema.json
  */
 
-import type { ConfigState, CredentialState, DigestMultibase, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageKind, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
+import type { ConfigState, CredentialState, DigestMultibase, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageKind, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
 
 
 /**
@@ -42,7 +42,7 @@ export interface ConfigItem {
 }
 
 /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
-export type { ConfigState, CredentialState, DigestMultibase, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageKind, StorageSettings, WalrusSettings };
+export type { ConfigState, CredentialState, DigestMultibase, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigFacts, StorageConfigId, StorageHealth, StorageKind, StorageSettings, WalrusSettings };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/storage/configs/list/0.1" as const;
@@ -257,6 +257,10 @@ export const PAYLOAD_SCHEMA = {
             "none"
           ]
         },
+        "context": {
+          "$ref": "#/$defs/ExternalAccountContextId",
+          "description": "Present with `vta-account`."
+        },
         "account": {
           "$ref": "#/$defs/ExternalAccountId",
           "description": "Present with `vta-account`."
@@ -285,6 +289,13 @@ export const PAYLOAD_SCHEMA = {
       "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
       "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
     },
+    "ExternalAccountContextId": {
+      "title": "ExternalAccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+    },
     "DigestMultibase": {
       "title": "DigestMultibase",
       "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
@@ -368,19 +379,23 @@ export const PAYLOAD_SCHEMA = {
     },
     "StorageAuth": {
       "title": "StorageAuth",
-      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
+      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
       "oneOf": [
         {
           "type": "object",
           "additionalProperties": false,
           "required": [
             "mode",
+            "context",
             "account"
           ],
           "properties": {
             "mode": {
               "const": "vta-account"
             },
+            "context": {
+              "$ref": "#/$defs/ExternalAccountContextId"
+            },
             "account": {
               "$ref": "#/$defs/ExternalAccountId"
             }
@@ -757,6 +772,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             "none"
           ]
         },
+        "context": {
+          "$ref": "#/$defs/ExternalAccountContextId",
+          "description": "Present with `vta-account`."
+        },
         "account": {
           "$ref": "#/$defs/ExternalAccountId",
           "description": "Present with `vta-account`."
@@ -785,6 +804,13 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
       "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
     },
+    "ExternalAccountContextId": {
+      "title": "ExternalAccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+    },
     "DigestMultibase": {
       "title": "DigestMultibase",
       "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
@@ -868,19 +894,23 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
     },
     "StorageAuth": {
       "title": "StorageAuth",
-      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
+      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
       "oneOf": [
         {
           "type": "object",
           "additionalProperties": false,
           "required": [
             "mode",
+            "context",
             "account"
           ],
           "properties": {
             "mode": {
               "const": "vta-account"
             },
+            "context": {
+              "$ref": "#/$defs/ExternalAccountContextId"
+            },
             "account": {
               "$ref": "#/$defs/ExternalAccountId"
             }

package/src/vtc/storage/configs/update/0.1/payload.ts

@@ -3,7 +3,7 @@
  * Source: specs/vtc/storage/configs/update/0.1/payload.schema.json
  */
 
-import type { ConfigState, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
+import type { ConfigState, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
 
 
 /**
@@ -37,7 +37,7 @@ export interface VTCStorageConfigsUpdateResponsePayload {
 }
 
 /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
-export type { ConfigState, Ext, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings };
+export type { ConfigState, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/storage/configs/update/0.1" as const;
@@ -208,19 +208,23 @@ export const PAYLOAD_SCHEMA = {
     },
     "StorageAuth": {
       "title": "StorageAuth",
-      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
+      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
       "oneOf": [
         {
           "type": "object",
           "additionalProperties": false,
           "required": [
             "mode",
+            "context",
             "account"
           ],
           "properties": {
             "mode": {
               "const": "vta-account"
             },
+            "context": {
+              "$ref": "#/$defs/ExternalAccountContextId"
+            },
             "account": {
               "$ref": "#/$defs/ExternalAccountId"
             }
@@ -260,6 +264,13 @@ export const PAYLOAD_SCHEMA = {
       "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
       "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
     },
+    "ExternalAccountContextId": {
+      "title": "ExternalAccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+    },
     "StorageSettings": {
       "title": "StorageSettings",
       "description": "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.",
@@ -533,19 +544,23 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
     },
     "StorageAuth": {
       "title": "StorageAuth",
-      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
+      "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set. Protects against every administrator through every surface the community offers; does not protect against whoever operates the machine.",
       "oneOf": [
         {
           "type": "object",
           "additionalProperties": false,
           "required": [
             "mode",
+            "context",
             "account"
           ],
           "properties": {
             "mode": {
               "const": "vta-account"
             },
+            "context": {
+              "$ref": "#/$defs/ExternalAccountContextId"
+            },
             "account": {
               "$ref": "#/$defs/ExternalAccountId"
             }
@@ -585,6 +600,13 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
       "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
     },
+    "ExternalAccountContextId": {
+      "title": "ExternalAccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+    },
     "StorageSettings": {
       "title": "StorageSettings",
       "description": "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.",