@openvtc/trust-tasks 0.26.5 → 0.26.7

package/dist/vta/witness/request/0.1/payload.js

@@ -0,0 +1,311 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/witness/request/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vta/witness/request/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/witness/request/0.1#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/vta/witness/request/0.1",
+    "title": "VTA Witness — Request — payload",
+    "description": "A client asks its VTA to run a witnessed session for one of its principal's relationships: open a witness/session with the named witness as the relationship DID the VTA holds, present the relationship credential (and, optionally, the membership evidence) from its credential vault, verify the Verifiable Witness Credential the witness returns, and store it in the vault with its evidence.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "witness",
+        "relationshipDid",
+        "counterpartyDid",
+        "relationshipThreadId",
+        "relationshipCredentialId"
+    ],
+    "properties": {
+        "witness": {
+            "type": "string",
+            "pattern": "^did:",
+            "description": "The witness to run the session with, as its public DID: the recipient of the witness/session and witness/session/submit documents the VTA sends, and the issuer of the VWC it must return. Chosen by the caller, because which witness observes an exchange is the parties' privacy decision (witness/session, Security & Privacy)."
+        },
+        "relationshipDid": {
+            "type": "string",
+            "pattern": "^did:",
+            "description": "The principal's relationship DID for this relationship: the participating party, and the issuer of both documents the VTA sends to the witness. The VTA signs them, and the relationship presentation, with a key of this DID it holds in a context the caller may act in; never as itself."
+        },
+        "counterpartyDid": {
+            "type": "string",
+            "pattern": "^did:",
+            "description": "The other party's relationship DID. With relationshipDid it forms the session's `parties` pair, and it is the subject of the relationship credential presented."
+        },
+        "relationshipThreadId": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "description": "The threadId of the relationship exchange the session is nested in. The VTA sets it as `parentThreadId` on every document of the session, as witness/session requires of a producer."
+        },
+        "relationshipCredentialId": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "description": "The credential-vault handle of the relationship credential (VRC) to present: one issued by relationshipDid whose subject is counterpartyDid. A handle, as vault/credentials/query returns one; the credential itself never travels in this request."
+        },
+        "membership": {
+            "$ref": "#/$defs/Membership",
+            "description": "The membership evidence to present beside the relationship credential, for a witness whose policy asks for it. Absent, none is presented."
+        },
+        "storeAs": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "description": "The credential-vault handle to store the VWC under. Absent, the VTA derives one. Supplying it lets a caller recognise its own result after an ambiguous failure."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Membership": {
+            "title": "Membership",
+            "description": "A membership credential (VMC) held in the credential vault, and the DID it names. When memberDid is absent the VMC names relationshipDid and is presented in the relationship presentation. When memberDid is present the VMC names that DID, and the VTA builds a second presentation — the member presentation — signed by memberDid and bound to the same session, which discloses memberDid to the witness.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "credentialId"
+            ],
+            "properties": {
+                "credentialId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 256,
+                    "description": "The credential-vault handle of the membership credential."
+                },
+                "memberDid": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "description": "The member DID the membership credential names, when it is not relationshipDid. The VTA must hold a key of it in a context the caller may act in. Naming it is the caller's explicit choice to disclose it to the witness."
+                }
+            }
+        },
+        "Evidence": {
+            "title": "Evidence",
+            "description": "The two documents a holder ships with the VWC so a verifier can pair it with the session that produced it (witness/session/submit, This response is the outcome evidence). Each is carried exactly as sent or received, never re-serialised.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "session",
+                "outcome"
+            ],
+            "properties": {
+                "session": {
+                    "type": "object",
+                    "minProperties": 1,
+                    "description": "The witness/session document that opened the session, as the VTA sent it. The VWC's taskContext is its id and its taskDigestMultibase is computed over it."
+                },
+                "outcome": {
+                    "type": "object",
+                    "minProperties": 1,
+                    "description": "The witness/session/submit #response, as the VTA received it, under the witness's proof. It carries the VWC and its vwcDigestMultibase."
+                }
+            }
+        },
+        "Response": {
+            "$anchor": "response",
+            "title": "VTA Witness — Request — response payload",
+            "description": "The stored VWC's vault handle, its digest, and the evidence documents that carry it. Sent only once the VWC is verified and stored.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "credentialId",
+                "witness",
+                "vwcDigestMultibase",
+                "evidence"
+            ],
+            "properties": {
+                "credentialId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 256,
+                    "description": "The credential-vault handle the VWC is now stored under, with its evidence."
+                },
+                "witness": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "description": "The witness that issued the VWC. Equal to the request's witness: a VWC issued by any other party is refused, not stored."
+                },
+                "vwcDigestMultibase": {
+                    "$ref": "#/$defs/DigestMultibase",
+                    "description": "The digest the witness returned for the VWC, which the VTA has checked against the VWC it stored: over the RFC 8785 canonicalization of the VWC, proof included."
+                },
+                "evidence": {
+                    "$ref": "#/$defs/Evidence"
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "DigestMultibase": {
+            "title": "DigestMultibase",
+            "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+            "type": "string",
+            "minLength": 16,
+            "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+            "examples": [
+                "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+            ]
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Membership": {
+            "title": "Membership",
+            "description": "A membership credential (VMC) held in the credential vault, and the DID it names. When memberDid is absent the VMC names relationshipDid and is presented in the relationship presentation. When memberDid is present the VMC names that DID, and the VTA builds a second presentation — the member presentation — signed by memberDid and bound to the same session, which discloses memberDid to the witness.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "credentialId"
+            ],
+            "properties": {
+                "credentialId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 256,
+                    "description": "The credential-vault handle of the membership credential."
+                },
+                "memberDid": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "description": "The member DID the membership credential names, when it is not relationshipDid. The VTA must hold a key of it in a context the caller may act in. Naming it is the caller's explicit choice to disclose it to the witness."
+                }
+            }
+        },
+        "Evidence": {
+            "title": "Evidence",
+            "description": "The two documents a holder ships with the VWC so a verifier can pair it with the session that produced it (witness/session/submit, This response is the outcome evidence). Each is carried exactly as sent or received, never re-serialised.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "session",
+                "outcome"
+            ],
+            "properties": {
+                "session": {
+                    "type": "object",
+                    "minProperties": 1,
+                    "description": "The witness/session document that opened the session, as the VTA sent it. The VWC's taskContext is its id and its taskDigestMultibase is computed over it."
+                },
+                "outcome": {
+                    "type": "object",
+                    "minProperties": 1,
+                    "description": "The witness/session/submit #response, as the VTA received it, under the witness's proof. It carries the VWC and its vwcDigestMultibase."
+                }
+            }
+        },
+        "Response": {
+            "$anchor": "response",
+            "title": "VTA Witness — Request — response payload",
+            "description": "The stored VWC's vault handle, its digest, and the evidence documents that carry it. Sent only once the VWC is verified and stored.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "credentialId",
+                "witness",
+                "vwcDigestMultibase",
+                "evidence"
+            ],
+            "properties": {
+                "credentialId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 256,
+                    "description": "The credential-vault handle the VWC is now stored under, with its evidence."
+                },
+                "witness": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "description": "The witness that issued the VWC. Equal to the request's witness: a VWC issued by any other party is refused, not stored."
+                },
+                "vwcDigestMultibase": {
+                    "$ref": "#/$defs/DigestMultibase",
+                    "description": "The digest the witness returned for the VWC, which the VTA has checked against the VWC it stored: over the RFC 8785 canonicalization of the VWC, proof included."
+                },
+                "evidence": {
+                    "$ref": "#/$defs/Evidence"
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "DigestMultibase": {
+            "title": "DigestMultibase",
+            "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+            "type": "string",
+            "minLength": 16,
+            "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+            "examples": [
+                "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+            ]
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/vta/witness/request/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/vta/witness/request/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAqFH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,qDAA8D,CAAC;AAKvF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,8DAAuE,CAAC;AAKzG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,qDAAqD;IAC5D,OAAO,EAAE,iCAAiC;IAC1C,aAAa,EAAE,sYAAsY;IACrZ,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,SAAS;QACT,iBAAiB;QACjB,iBAAiB;QACjB,sBAAsB;QACtB,0BAA0B;KAC3B;IACD,YAAY,EAAE;QACZ,SAAS,EAAE;YACT,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,OAAO;YAClB,aAAa,EAAE,qUAAqU;SACrV;QACD,iBAAiB,EAAE;YACjB,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,OAAO;YAClB,aAAa,EAAE,6RAA6R;SAC7S;QACD,iBAAiB,EAAE;YACjB,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,OAAO;YAClB,aAAa,EAAE,iKAAiK;SACjL;QACD,sBAAsB,EAAE;YACtB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,sLAAsL;SACtM;QACD,0BAA0B,EAAE;YAC1B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,qPAAqP;SACrQ;QACD,YAAY,EAAE;YACZ,MAAM,EAAE,oBAAoB;YAC5B,aAAa,EAAE,2IAA2I;SAC3J;QACD,SAAS,EAAE;YACT,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,kKAAkK;SAClL;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,iZAAiZ;YACha,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,cAAc;aACf;YACD,YAAY,EAAE;gBACZ,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,2DAA2D;iBAC3E;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,4NAA4N;iBAC5O;aACF;SACF;QACD,UAAU,EAAE;YACV,OAAO,EAAE,UAAU;YACnB,aAAa,EAAE,8OAA8O;YAC7P,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,SAAS;gBACT,SAAS;aACV;YACD,YAAY,EAAE;gBACZ,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,eAAe,EAAE,CAAC;oBAClB,aAAa,EAAE,4JAA4J;iBAC5K;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,eAAe,EAAE,CAAC;oBAClB,aAAa,EAAE,yIAAyI;iBACzJ;aACF;SACF;QACD,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,0CAA0C;YACnD,aAAa,EAAE,qIAAqI;YACpJ,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,cAAc;gBACd,SAAS;gBACT,oBAAoB;gBACpB,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,6EAA6E;iBAC7F;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,0HAA0H;iBAC1I;gBACD,oBAAoB,EAAE;oBACpB,MAAM,EAAE,yBAAyB;oBACjC,aAAa,EAAE,kKAAkK;iBAClL;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,gnDAAgnD;YAC/nD,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,4CAA4C;YACvD,UAAU,EAAE;gBACV,iDAAiD;aAClD;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,iZAAiZ;YACha,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,cAAc;aACf;YACD,YAAY,EAAE;gBACZ,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,2DAA2D;iBAC3E;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,4NAA4N;iBAC5O;aACF;SACF;QACD,UAAU,EAAE;YACV,OAAO,EAAE,UAAU;YACnB,aAAa,EAAE,8OAA8O;YAC7P,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,SAAS;gBACT,SAAS;aACV;YACD,YAAY,EAAE;gBACZ,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,eAAe,EAAE,CAAC;oBAClB,aAAa,EAAE,4JAA4J;iBAC5K;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,eAAe,EAAE,CAAC;oBAClB,aAAa,EAAE,yIAAyI;iBACzJ;aACF;SACF;QACD,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,0CAA0C;YACnD,aAAa,EAAE,qIAAqI;YACpJ,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,cAAc;gBACd,SAAS;gBACT,oBAAoB;gBACpB,UAAU;aACX;YACD,YAAY,EAAE;gBACZ,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,6EAA6E;iBAC7F;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,aAAa,EAAE,0HAA0H;iBAC1I;gBACD,oBAAoB,EAAE;oBACpB,MAAM,EAAE,yBAAyB;oBACjC,aAAa,EAAE,kKAAkK;iBAClL;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,gnDAAgnD;YAC/nD,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,4CAA4C;YACvD,UAAU,EAAE;gBACV,iDAAiD;aAClD;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.26.5",
+  "version": "0.26.7",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/_shared/components.ts

@@ -452,7 +452,8 @@ export type Capability_DeviceV0_1 =
   | "external-accounts-manage"
   | "external-auth-use"
   | "pcs-vetter"
-  | "pcs-applicant";
+  | "pcs-applicant"
+  | "witness-request";
 /**
  * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything.
  */
@@ -478,7 +479,8 @@ export type Capability_DeviceV0_2 =
   | "externalAccountsManage"
   | "externalAuthUse"
   | "pcsVetter"
-  | "pcsApplicant";
+  | "pcsApplicant"
+  | "witnessRequest";
 /**
  * Number of chunks in the bundle, equal to ceil(expectedSizeBytes / chunkSize). Bounded at 4096 so that the manifest itself — one digest per chunk — fits in the single document that carries it under the same message-size reasoning as a chunk.
  */
@@ -1151,7 +1153,7 @@ export type SealedEnvelope_VaultV0_2 =
   | HpkeArmoredEnvelope_VaultV0_2
   | TspMessageEnvelope_VaultV0_2;
 /**
- * A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload or an ExternalCredentialPayload. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of "the response" from ever holding a usable secret, whatever transport carried the document.
+ * A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload, an ExternalCredentialPayload or, from external/credentials/issue 0.2 for `s3-static-presign`, a PresignedRequestSet. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of "the response" from ever holding a usable secret, whatever transport carried the document.
  */
 export type SealedTransferBundle = string;
 /**

package/src/device/list/0.1/payload.ts

@@ -255,7 +255,8 @@ export const PAYLOAD_SCHEMA = {
         "external-accounts-manage",
         "external-auth-use",
         "pcs-vetter",
-        "pcs-applicant"
+        "pcs-applicant",
+        "witness-request"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -601,7 +602,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "external-accounts-manage",
         "external-auth-use",
         "pcs-vetter",
-        "pcs-applicant"
+        "pcs-applicant",
+        "witness-request"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },

package/src/device/list/0.2/payload.ts

@@ -255,7 +255,8 @@ export const PAYLOAD_SCHEMA = {
         "externalAccountsManage",
         "externalAuthUse",
         "pcsVetter",
-        "pcsApplicant"
+        "pcsApplicant",
+        "witnessRequest"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -601,7 +602,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "externalAccountsManage",
         "externalAuthUse",
         "pcsVetter",
-        "pcsApplicant"
+        "pcsApplicant",
+        "witnessRequest"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },

package/src/device/register/0.1/payload.ts

@@ -223,7 +223,8 @@ export const PAYLOAD_SCHEMA = {
         "external-accounts-manage",
         "external-auth-use",
         "pcs-vetter",
-        "pcs-applicant"
+        "pcs-applicant",
+        "witness-request"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -559,7 +560,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "external-accounts-manage",
         "external-auth-use",
         "pcs-vetter",
-        "pcs-applicant"
+        "pcs-applicant",
+        "witness-request"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },

package/src/device/register/0.2/payload.ts

@@ -223,7 +223,8 @@ export const PAYLOAD_SCHEMA = {
         "externalAccountsManage",
         "externalAuthUse",
         "pcsVetter",
-        "pcsApplicant"
+        "pcsApplicant",
+        "witnessRequest"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },
@@ -559,7 +560,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "externalAccountsManage",
         "externalAuthUse",
         "pcsVetter",
-        "pcsApplicant"
+        "pcsApplicant",
+        "witnessRequest"
       ],
       "description": "Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything."
     },

package/src/external/accounts/secret/set/0.1/payload.ts

@@ -128,7 +128,7 @@ export const PAYLOAD_SCHEMA = {
       "minLength": 64,
       "maxLength": 65536,
       "pattern": "^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$",
-      "description": "A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload or an ExternalCredentialPayload. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \"the response\" from ever holding a usable secret, whatever transport carried the document."
+      "description": "A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload, an ExternalCredentialPayload or, from external/credentials/issue 0.2 for `s3-static-presign`, a PresignedRequestSet. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \"the response\" from ever holding a usable secret, whatever transport carried the document."
     },
     "AccountId": {
       "title": "AccountId",
@@ -198,7 +198,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "minLength": 64,
       "maxLength": 65536,
       "pattern": "^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$",
-      "description": "A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload or an ExternalCredentialPayload. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \"the response\" from ever holding a usable secret, whatever transport carried the document."
+      "description": "A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload, an ExternalCredentialPayload or, from external/credentials/issue 0.2 for `s3-static-presign`, a PresignedRequestSet. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \"the response\" from ever holding a usable secret, whatever transport carried the document."
     },
     "AccountId": {
       "title": "AccountId",

package/src/external/credentials/issue/0.1/payload.ts

@@ -190,7 +190,7 @@ export const PAYLOAD_SCHEMA = {
       "minLength": 64,
       "maxLength": 65536,
       "pattern": "^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$",
-      "description": "A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload or an ExternalCredentialPayload. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \"the response\" from ever holding a usable secret, whatever transport carried the document."
+      "description": "A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload, an ExternalCredentialPayload or, from external/credentials/issue 0.2 for `s3-static-presign`, a PresignedRequestSet. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \"the response\" from ever holding a usable secret, whatever transport carried the document."
     },
     "AccountId": {
       "title": "AccountId",
@@ -315,7 +315,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
       "minLength": 64,
       "maxLength": 65536,
       "pattern": "^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$",
-      "description": "A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload or an ExternalCredentialPayload. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \"the response\" from ever holding a usable secret, whatever transport carried the document."
+      "description": "A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload, an ExternalCredentialPayload or, from external/credentials/issue 0.2 for `s3-static-presign`, a PresignedRequestSet. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \"the response\" from ever holding a usable secret, whatever transport carried the document."
     },
     "AccountId": {
       "title": "AccountId",