@openvtc/trust-tasks 0.28.1 → 0.28.3

package/src/task-consent/decision/0.2/payload.ts

@@ -38,7 +38,7 @@ export interface TaskConsentDecisionPayload {
 export interface WebAuthn {
   kind: "webauthn";
   /**
-   * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.6 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it.
+   * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.7 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it.
    */
   assertion: AuthenticatorAssertionResponseLogin;
 }
@@ -179,7 +179,7 @@ export const PAYLOAD_SCHEMA = {
             },
             "assertion": {
               "$ref": "#/$defs/AssertionResponse",
-              "description": "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.6 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it."
+              "description": "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.7 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it."
             }
           }
         },
@@ -363,7 +363,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             },
             "assertion": {
               "$ref": "#/$defs/AssertionResponse",
-              "description": "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.6 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it."
+              "description": "The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API, the same shape auth/step-up/approve-response/0.7 carries. The WebAuthn challenge the approver's client passed to the authenticator MUST be the UTF-8 bytes of this decision's `challenge` value, so `clientDataJSON.challenge` is their base64url (no padding) encoding; the executor, as relying party, verifies it per WebAuthn Level 2 §7.2 against a credential enrolled to the approver whose DID made the document's proof. The commitment to the payload is the executor's binding: it issued that challenge for exactly one pending request, whose `payloadDigest` is salted with it."
             }
           }
         },

package/src/vta/_shared/0.3/did-key-roles.ts

@@ -4,7 +4,7 @@
  */
 
 /**
- * A VTA holds the keys of the durable DIDs it serves — its own, and those of the VTCs and VTNs provisioned on it — and assigns every one of them to exactly one named key role. These definitions describe a role, a key in a role, a rotation, the preview of the DID document a change would publish, and the approval state of a change awaiting a quorum. The normative rules that give them meaning (which verification relationships each role owns, who may change which role, how a change is approved, what is audited, and what each caller may see) are in CONVENTIONS.md beside this file. Not itself a Trust Task specification: the `_shared` folder is skipped by the registry build and the codegen.
+ * Retired: superseded by vta/dids/_shared/0.1/key-roles.schema.json, the method-neutral key-role definitions. A VTA holds the keys of the durable DIDs it serves — its own, and those of the VTCs and VTNs provisioned on it — and assigns every one of them to exactly one named key role. These definitions describe a role, a key in a role, a rotation, the preview of the DID document a change would publish, and the approval state of a change awaiting a quorum. The normative rules that give them meaning (which verification relationships each role owns, who may change which role, how a change is approved, what is audited, and what each caller may see) are in CONVENTIONS.md beside this file. Not itself a Trust Task specification: the `_shared` folder is skipped by the registry build and the codegen.
  */
 export interface DIDKeyRolesSharedDefinitionsForTheVtaWebvhDidsKeyRoleTasks {
   [k: string]: unknown | undefined;

package/src/vta/_shared/0.9/did-template.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/_shared/0.9/did-template.schema.json
+ */
+
+/**
+ * A *DID template* is the JSON shape of a DID document with `{TOKEN}` placeholders plus the variable contract the VTA's renderer enforces; the VTA fills the placeholders with keys it mints and caller-supplied variables when provisioning an integration. `DidTemplate` is the authored shape a caller uploads; `DidTemplateRecord` is the persisted shape the VTA returns (the DidTemplate fields flattened at the top level alongside the resolved `Scope` and provenance metadata). Shared by every task in the vta/did-templates/* family so the record is defined once rather than duplicated per task. Version 0.9 adds `schemaVersion` 3, the key-role template (`keyRoles`), used by vta/dids/create; it is otherwise 0.7.
+ */
+export interface DidTemplateDidTemplateRecordSharedDefinitionsForTheVtaDidTemplatesSpecFamily {
+  [k: string]: unknown | undefined;
+}
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { DidTemplate_VtaV0_9 as DidTemplate, DidTemplateRecord_VtaV0_9 as DidTemplateRecord, Scope_VtaV0_1 as Scope } from "../../../_shared/components.js";

package/src/vta/did-templates/create/2.0/payload.ts

@@ -9,7 +9,7 @@ import type { Builtin_VtaV0_1 as Builtin, Context_VtaV0_1 as Context, DidTemplat
 /**
  * Create a new DID template on a VTA. Omit `contextId` to create in the global scope (super-admin gated); set it to create a template scoped to that context (gated on the context's admin, or a super-admin). The template's own `name` is the resource id within the selected scope; the VTA refuses duplicates (use update to replace). The success response is the persisted DidTemplateRecord.
  *
- * @deprecated superseded by vta/did-templates/create/3.1
+ * @deprecated superseded by vta/did-templates/create/3.2
  */
 export interface VTADIDTemplateCreatePayload {
   /**
@@ -46,12 +46,12 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = "superseded by vta/did-templates/create/3.1";
+export const DEPRECATION: string | null = "superseded by vta/did-templates/create/3.2";
 
 /**
  * Stable alias for this specification's request payload shape.
  *
- * @deprecated superseded by vta/did-templates/create/3.1
+ * @deprecated superseded by vta/did-templates/create/3.2
  */
 export type Payload = VTADIDTemplateCreatePayload;
 
@@ -61,7 +61,7 @@ export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/did-templates/
 /**
  * Stable alias for this specification's success-response payload shape.
  *
- * @deprecated superseded by vta/did-templates/create/3.1
+ * @deprecated superseded by vta/did-templates/create/3.2
  */
 export type Response = DidTemplateRecord;
 

package/src/vta/did-templates/create/3.0/payload.ts

@@ -9,7 +9,7 @@ import type { Builtin_VtaV0_1 as Builtin, Context_VtaV0_1 as Context, DidTemplat
 /**
  * Create a new DID template on a VTA. Omit `contextId` to create in the global scope (super-admin gated); set it to create a template scoped to that context (gated on the context's admin, or a super-admin). The template's own `name` is the resource id within the selected scope; the VTA refuses duplicates (use update to replace). The success response is the persisted DidTemplateRecord.
  *
- * @deprecated superseded by vta/did-templates/create/3.1
+ * @deprecated superseded by vta/did-templates/create/3.2
  */
 export interface VTADIDTemplateCreatePayload {
   /**
@@ -46,12 +46,12 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = "superseded by vta/did-templates/create/3.1";
+export const DEPRECATION: string | null = "superseded by vta/did-templates/create/3.2";
 
 /**
  * Stable alias for this specification's request payload shape.
  *
- * @deprecated superseded by vta/did-templates/create/3.1
+ * @deprecated superseded by vta/did-templates/create/3.2
  */
 export type Payload = VTADIDTemplateCreatePayload;
 
@@ -61,7 +61,7 @@ export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/did-templates/
 /**
  * Stable alias for this specification's success-response payload shape.
  *
- * @deprecated superseded by vta/did-templates/create/3.1
+ * @deprecated superseded by vta/did-templates/create/3.2
  */
 export type Response = DidTemplateRecord;
 

package/src/vta/did-templates/create/3.1/payload.ts

@@ -8,6 +8,8 @@ import type { Builtin_VtaV0_1 as Builtin, Context_VtaV0_1 as Context, DidTemplat
 
 /**
  * Create a new DID template on a VTA. Omit `contextId` to create in the global scope (super-admin gated); set it to create a template scoped to that context (gated on the context's admin, or a super-admin). The template's own `name` is the resource id within the selected scope; the VTA refuses duplicates (use update to replace). The success response is the persisted DidTemplateRecord.
+ *
+ * @deprecated superseded by vta/did-templates/create/3.2
  */
 export interface VTADIDTemplateCreatePayload {
   /**
@@ -44,15 +46,23 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = null;
+export const DEPRECATION: string | null = "superseded by vta/did-templates/create/3.2";
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated superseded by vta/did-templates/create/3.2
+ */
 export type Payload = VTADIDTemplateCreatePayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/did-templates/create/3.1#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated superseded by vta/did-templates/create/3.2
+ */
 export type Response = DidTemplateRecord;
 
 /**