@openvtc/trust-tasks 0.28.20 → 0.28.22

package/CHANGELOG.md

@@ -11,6 +11,55 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.28.22 — 2026-11-08
+
+
+### Added
+
+- **vtc/badges**: Claim codes and the badge rule counts (VTI-BDG-015, VTI-BDG-025 – 027) (#1059)
+
+* feat(vtc/badges): claim codes and the badge rule counts (VTI-BDG-015, VTI-BDG-025 – 027)
+
+## 0.28.21 — 2026-11-08
+
+
+### Added
+
+- **vtc/badges**: Show answers the caller's own awards (myAwards), so a holder can share one (#1057)
+
+* feat(vtc/badges): show answers the caller's own awards (myAwards), so a holder can share one
+
+  vtc/badges/awards/share and unshare (#1054) name an award, but no read answered a holder their own accepted award identifiers for a community badge: mine/list carries badges, show only myCount. vtc/badges/show/0.1#response gains the optional myAwards - the caller's own accepted awards of the badge, newest first, each with its shared - and conformance item 4 says so. Additive, on a draft.
+
+- **auth/step-up**: Requests/show — the subject's wallet fetches a step-up refused to a delegated producer (auth/step-up/requests/show/0.1) (#1056)
+
+A relying party that refuses an operation until its subject steps up carries
+  the request inline in the refusal (approve-request/0.5, Inline delivery). That
+  only works when the producer of the operation can gather the evidence itself.
+  A process acting with a key the subject delegated to it — an assistant, an
+  automation — can redeem a recorded step-up but never make one. It cannot
+  forward the inline request to the subject's wallet either, because the inline
+  request carries no proof.
+
+  This adds a hand-off by reference. Beside the inline request, the relying
+  party MAY carry `details.stepUpHandoff` (`$defs.Handoff`): a single-use handle
+  of at least 128 bits, its expiry and this task's Type URI. The person's
+  approver agent sends the handle and receives two things:
+
+  - the relying party's own signed approve-request/0.5, addressed to the
+    subject, with the same challenge and binding as the inline request;
+  - the operation the step-up is bound to, exactly as received.
+
+  The agent verifies the proof and shows the operation itself. It recomputes the
+  binding where it knows the construction. It then answers with approve-response
+  0.7, signed by the subject's own DID, directly to the relying party. The
+  producer resends the identical operation, and the recorded step-up is redeemed.
+
+  A handle is answered at most once, atomically. Unknown, spent, expired and
+  settled handles all return `notFound`. Reading a handle is never part of an
+  approval, so a party that sees the handle can spend the read but cannot
+  approve.
+
 ## 0.28.20 — 2026-11-07
 
 

package/dist/_shared/components.d.ts

@@ -514,6 +514,14 @@ export type ChunkIndex = number;
  * Size in bytes of every chunk except the last, which carries the remainder and is between 1 and this value inclusive. The ceiling of 262144 (256 KiB) is normative and is derived in `vta/backup/initiate-export/1.1` under Chunked transfer: it is the largest power of two whose `get-chunk` or `put-chunk` document still fits a 1 MiB mediator message after base64url encoding of `data`, DIDComm authcrypt encoding, and two nested forward wrappers. The floor of 16384 keeps a 1 GiB bundle within `ChunkCount`'s ceiling at sizes a constrained transport can still choose.
  */
 export type ChunkSize = number;
+/**
+ * Opaque identifier of a claim code's record: `bcl_` followed by 16 to 64 base64url characters. Random; never the code itself, which the community keeps only as a digest (VTI-BDG-025).
+ */
+export type ClaimId = string;
+/**
+ * A claim code itself: at least 128 random bits the community generated, base64url (22 to 64 characters). A bearer secret: shown to its issuer once, redeemed by a member, never stored or answered again (VTI-BDG-025).
+ */
+export type ClaimSecret = string;
 /**
  * The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.
  *
@@ -6478,6 +6486,38 @@ export interface Claim {
      */
     renewable: boolean;
 }
+/**
+ * A claim code's record, as the badge's owners and administrators see it: never the code (VTI-BDG-027).
+ */
+export interface ClaimCode {
+    claimId: ClaimId;
+    badgeId: BadgeId;
+    /**
+     * What the code is for — the event, say — shown to the badge's owners. Never shown to whoever redeems it.
+     */
+    label: string;
+    /**
+     * After this the code admits no one.
+     */
+    validUntil: string;
+    /**
+     * How many claims the code admits.
+     */
+    limit: number;
+    /**
+     * How many members have redeemed it.
+     */
+    claims: number;
+    /**
+     * `withdrawn` once its issuer withdrew it or the badge was retired. A code past `validUntil` or out of claims stays `active` and admits no one.
+     */
+    state: "active" | "withdrawn";
+    createdAt: string;
+    /**
+     * The issuer's entry, where they have one; the giver of every award the code admits.
+     */
+    createdBy?: EntryId;
+}
 /**
  * Which claim a `claim` field accepts, from which credentials and issuers.
  */
@@ -13968,24 +14008,28 @@ export interface RotationRecord {
     cacheHorizonAt?: string;
 }
 /**
- * One test over a verified fact about a member. `fact: role` tests the member's community role; `fact: field` tests an `admin`- or `credential`-sourced directory field named by `field`; `fact: personhood` tests whether a personhood assertion is on file; `fact: joinedAt` tests when they joined. A rule never reads a self-asserted (`member`-sourced) field: a member must not be able to join a group by editing their card.
+ * One test over a verified fact about a member. `fact: role` tests the member's community role; `fact: field` tests an `admin`- or `credential`-sourced directory field named by `field`; `fact: personhood` tests whether a personhood assertion is on file; `fact: joinedAt` tests when they joined. A rule never reads a self-asserted (`member`-sourced) field: a member must not be able to join a group by editing their card. `kudosReceived`, `ideasSelected` and `electionTickets` are counts the community keeps of its own records (kudos the member accepted, ideas of theirs a board selected, elections it issued them a ticket in), compared with `atLeast`; only a badge's group reads them (VTI-BDG-015), and any other group refuses them with `ruleInvalid`.
  */
 export interface RuleCondition {
-    fact: "role" | "field" | "personhood" | "joinedAt";
+    fact: "role" | "field" | "personhood" | "joinedAt" | "kudosReceived" | "ideasSelected" | "electionTickets";
     /**
      * Present exactly when `fact` is `field`.
      */
     field?: FieldKey;
     /**
-     * `equals` compares with `value`; `oneOf` with any of `values`; `exists` needs neither; `before` and `after` compare a date fact with `value`.
+     * `equals` compares with `value`; `oneOf` with any of `values`; `exists` needs neither; `before` and `after` compare a date fact with `value`; `atLeast` compares a count fact with `count`.
      */
-    op: "equals" | "oneOf" | "exists" | "before" | "after";
+    op: "equals" | "oneOf" | "exists" | "before" | "after" | "atLeast";
     value?: string | boolean;
     /**
      * @minItems 1
      * @maxItems 64
      */
     values?: [string, ...string[]];
+    /**
+     * With `atLeast`: the least a count fact (`kudosReceived`, `ideasSelected`, `electionTickets`) must be. Present exactly when `op` is `atLeast`.
+     */
+    count?: number;
 }
 export interface S3Settings {
     kind: "s3";