@openvtc/trust-tasks 0.27.6 → 0.27.7

package/CHANGELOG.md

@@ -11,6 +11,8 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.27.7 — 2026-10-26
+
 ## 0.27.6 — 2026-10-26
 
 

package/README.md

@@ -31,16 +31,19 @@ npm install @openvtc/trust-tasks
 ## Usage
 
 ```ts
-import { AclGrant_v0_1, DidManagementDidRegister_v0_1 } from "@openvtc/trust-tasks";
+import { AclGrant_v0_2, DidManagementDidRegister_v0_1 } from "@openvtc/trust-tasks";
 
 // Compose a request payload, type-checked against the spec's
 // payload.schema.json. `Payload` is a stable alias every module
 // exports, so you never have to look up the title-derived interface
-// name (here, `ACLGrantPayload`).
-const grant: AclGrant_v0_1.Payload = {
+// name (here, `ACLGrant02Payload`).
+const grant: AclGrant_v0_2.Payload = {
   entry: {
     subject: "did:key:z6MkAlice",
     role: "admin",
+    act: { scope: "contexts", contexts: ["ctx/payments"] },
+    keys: { scope: "all" },
+    capabilities: { scope: "ceiling" },
   },
   reason: "onboarding",
 };
@@ -50,7 +53,7 @@ const grant: AclGrant_v0_1.Payload = {
 // Fire-and-forget specs export neither `Response` nor
 // `RESPONSE_TYPE_URI`, because SPEC.md §4.4.1 forbids emitting a
 // `#response` document for them.
-const reply: AclGrant_v0_1.Response = {
+const reply: AclGrant_v0_2.Response = {
   entry: { /* … */ },
 };
 
@@ -71,11 +74,11 @@ Each spec lands at a stable path:
 
 ```
 src/
-├── acl/grant/0.1/payload.ts           // AclGrant_v0_1
-├── auth/authenticate/0.1/payload.ts   // AuthAuthenticate_v0_1
+├── acl/grant/0.2/payload.ts           // AclGrant_v0_2
+├── auth/authenticate/0.3/payload.ts   // AuthAuthenticate_v0_3
 ├── did-management/did/register/0.1/
 │   └── payload.ts                     // DidManagementDidRegister_v0_1
-├── vault/proxy-login/0.1/payload.ts   // VaultProxyLogin_v0_1
+├── vault/proxy-login/0.2/payload.ts   // VaultProxyLogin_v0_2
 └── …
 ```
 
@@ -90,11 +93,11 @@ distinct names — there is no "latest" alias by design.
 A definition several specs `$ref` — `Ext` (the SPEC §4.5.1 extension object),
 `AclEntry`, `VaultEntry`, `DigestMultibase` — is declared **once**, in
 `src/_shared/components.ts`, and re-exported from every spec module that uses
-it under the name that module has always used. So `AclGrant_v0_1.AclEntry` and
-`AclShow_v0_1.AclEntry` are the same type, not two copies of one shape:
+it under the name that module has always used. So `AclGrant_v0_2.AclEntry` and
+`AclShow_v0_2.AclEntry` are the same type, not two copies of one shape:
 
 ```ts
-import { SharedComponents, type AclGrant_v0_1 } from "@openvtc/trust-tasks";
+import { SharedComponents, type AclGrant_v0_2 } from "@openvtc/trust-tasks";
 
 // Write a helper once, over the shared definition, and it takes any spec's.
 const namespaces = (ext: SharedComponents.Ext) => Object.keys(ext);
@@ -132,16 +135,16 @@ import {
   InMemoryReplayGuard,
   respondWith,
   StaticTransport,
-  AclGrant_v0_1,
+  AclGrant_v0_2,
 } from "@openvtc/trust-tasks";
 
 // The guard *is* the duplicate-execution record — one per consumer, held for
 // the process's lifetime. Back it with a shared store if you run replicas.
 const guard = new InMemoryReplayGuard();
 
-const outcome = await consumeInbound<AclGrant_v0_1.Payload, AclGrant_v0_1.Response>({
+const outcome = await consumeInbound<AclGrant_v0_2.Payload, AclGrant_v0_2.Response>({
   transport: new StaticTransport({ issuer: peerVid }), // what the transport authenticated
-  spec: AclGrant_v0_1.SPEC,
+  spec: AclGrant_v0_2.SPEC,
   proofPolicy: { kind: "verify", verify: myVerifier },
   payloadPolicy: { kind: "validate", validate: myValidator }, // or acceptUnvalidated
   // acl/grant is consequential: a replayed envelope must not grant twice.

package/dist/_runtime/consume.d.ts

@@ -10,7 +10,7 @@
  * ```ts
  * import {
  *   consequentialChecks, consumeInbound, InMemoryReplayGuard,
- *   StaticTransport, AclGrant_v0_1,
+ *   StaticTransport, AclGrant_v0_2,
  * } from "@openvtc/trust-tasks";
  *
  * // One guard per consumer, not one per document: it *is* the record.
@@ -18,7 +18,7 @@
  *
  * const outcome = await consumeInbound({
  *   transport,
- *   spec: AclGrant_v0_1.SPEC,
+ *   spec: AclGrant_v0_2.SPEC,
  *   proofPolicy: { kind: "verify", verify: myVerifier },
  *   // ajv, or whatever validator you already run — see PayloadPolicy.
  *   payloadPolicy: { kind: "validate", validate: myValidator },

package/dist/_runtime/consume.js

@@ -10,7 +10,7 @@
  * ```ts
  * import {
  *   consequentialChecks, consumeInbound, InMemoryReplayGuard,
- *   StaticTransport, AclGrant_v0_1,
+ *   StaticTransport, AclGrant_v0_2,
  * } from "@openvtc/trust-tasks";
  *
  * // One guard per consumer, not one per document: it *is* the record.
@@ -18,7 +18,7 @@
  *
  * const outcome = await consumeInbound({
  *   transport,
- *   spec: AclGrant_v0_1.SPEC,
+ *   spec: AclGrant_v0_2.SPEC,
  *   proofPolicy: { kind: "verify", verify: myVerifier },
  *   // ajv, or whatever validator you already run — see PayloadPolicy.
  *   payloadPolicy: { kind: "validate", validate: myValidator },

package/dist/_shared/components.d.ts

@@ -12282,6 +12282,35 @@ export interface TrustRecord {
     };
     record_type: RecordType;
 }
+export interface TrustRecord_RegistryV0_2 {
+    entityId: string;
+    authorityId: string;
+    action: string;
+    resource: string;
+    /**
+     * Present on recognition records: whether the action+resource is recognised.
+     */
+    recognized?: boolean;
+    /**
+     * Present on authorization records: whether the action+resource authorization is confirmed.
+     */
+    authorized?: boolean;
+    /**
+     * Opaque governance context attached to the record.
+     */
+    context?: {
+        [k: string]: unknown | undefined;
+    };
+    recordType: RecordType;
+    /**
+     * The first instant at which the authority statement holds (inclusive). Absent: no lower bound.
+     */
+    validFrom?: string;
+    /**
+     * The instant at which the authority statement stops holding (exclusive). Absent: no upper bound. When both bounds are present, `validFrom` MUST be earlier than `validUntil`.
+     */
+    validUntil?: string;
+}
 /**
  * The trustees of a sealed or tallied-encrypted election and the number of them decryption needs (VTI-VOT-062). Neither the community nor the ballot box may be one.
  */