@registrystack/client 0.45.0 → 0.46.0

package/README.md

@@ -189,7 +189,7 @@ Coordinator joins the seven-product roster at v0.44.0. The source facade also
 contains held `render` and `@registrystack/client/render` namespaces. Default
 assembly omits Render; `--include-render` adds it to an explicit local candidate
 and does not authorize publication. Render takes a token or a resource-bound provider with
-`bearerToken()` and performs one bounded render exchange. A correlation key is
+`bearerToken()` and performs one bounded render or seal exchange. A correlation key is
 not a durable idempotency promise. `outcomeUnknown` and `transportKind` preserve
 whether an exchange may have completed; provider errors keep their own class.
 Coordinator is optional.

package/compatibility.json

@@ -2,12 +2,12 @@
   "schemaVersion": "registry-stack.sdk-compatibility.v1",
   "sdkPackage": {
     "name": "registry-stack-client",
-    "version": "0.45.0"
+    "version": "0.46.0"
   },
   "namespaces": {
     "discovery": {
-      "testedServerBaseline": "0.45.0",
-      "compatibleServerPatchLine": "0.45.x",
+      "testedServerBaseline": "0.46.0",
+      "compatibleServerPatchLine": "0.46.x",
       "responseCompatibility": {
         "additiveObjectMembers": "ignored-after-duplicate-key-rejection",
         "unknownProblemCodes": "http-status-only",

package/coordinator/client.d.ts

@@ -227,12 +227,15 @@ export class CoordinatorClient {
   reconcile(token: string, runId: RunId, reason: string): Promise<CoordinatorOutcome<RunInspection>>
   /**
    * Read one stable page of caller-visible runs. Pass `nextCursor` unchanged
-   * with the same caller, `state`, `attention`, `proposal`, and `turn`
-   * values. `attention: true` selects the effective states `attention` and
-   * `failed`. `proposal` selects runs waiting on that BReg Proposal; `turn`
-   * selects runs whose Proposal wait last showed that turn.
+   * with the same caller, `state`, `attention`, `proposal`, `turn`, and
+   * `outcome` values. `attention: true` selects the effective states
+   * `attention` and `failed`. `proposal` selects runs waiting on that BReg
+   * Proposal; `turn` selects runs whose Proposal wait last showed that turn.
+   * `outcome` selects runs that finished with that workflow outcome, matched
+   * exactly; it is 1 to 64 letters, digits, hyphens or underscores, checked
+   * before sending.
    */
-  list(token: string, limit: SafeInteger, cursor?: string | null, state?: RunListState | null, attention?: boolean | null, proposal?: string | null, turn?: ProposalTurn | null): Promise<CoordinatorOutcome<RunList>>
+  list(token: string, limit: SafeInteger, cursor?: string | null, state?: RunListState | null, attention?: boolean | null, proposal?: string | null, turn?: ProposalTurn | null, outcome?: string | null): Promise<CoordinatorOutcome<RunList>>
   /**
    * Schedule the run's saved command again, unchanged, when its inspection
    * allows a retry. Takes no idempotency key, so it is sent exactly once. `reason` is

package/coordinator/index.d.ts

@@ -8,7 +8,7 @@ export declare class CoordinatorClient {
   status(token: string, runId: import('./client').RunId): Promise<import('./client').CoordinatorOutcome<import('./client').RunStatus>>
   inspect(token: string, runId: import('./client').RunId): Promise<import('./client').CoordinatorOutcome<import('./client').RunInspection>>
   reconcile(token: string, runId: import('./client').RunId, reason: string): Promise<import('./client').CoordinatorOutcome<import('./client').RunInspection>>
-  list(token: string, limit: number, cursor?: string | null, state?: import('./client').RunListState | null, attention?: boolean | null, proposal?: string | null, turn?: import('./client').ProposalTurn | null): Promise<import('./client').CoordinatorOutcome<import('./client').RunList>>
+  list(token: string, limit: number, cursor?: string | null, state?: import('./client').RunListState | null, attention?: boolean | null, proposal?: string | null, turn?: import('./client').ProposalTurn | null, outcome?: string | null): Promise<import('./client').CoordinatorOutcome<import('./client').RunList>>
   retrySame(token: string, runId: import('./client').RunId, reason: string): Promise<import('./client').CoordinatorOutcome<import('./client').RetryScheduled>>
   cancel(token: string, runId: import('./client').RunId, reason: string): Promise<import('./client').CoordinatorOutcome<import('./client').RunStatus>>
 }

package/evidence/client.d.ts

@@ -30,6 +30,39 @@ import {
 /** The signed response encoding closed before one request is sent. */
 export type EvidenceResponseFormat = 'signed-jws' | 'sd-jwt-vc'
 
+/**
+ * How an assertion's facts were obtained. `source` means Evidence acquired
+ * them itself from an authoritative source; `holder-presented` means a holder
+ * presented another issuer's credential and Evidence verified it. A request
+ * accepts `source` only unless it names more in `acceptedChannels`.
+ */
+export type EvidenceChannel = 'source' | 'holder-presented'
+
+/**
+ * The channel policy a request or request batch may state. Both members are
+ * optional: absent `acceptedChannels` means `['source']` only, so a request
+ * that never names a channel refuses an assertion a holder presented, and
+ * absent `maximumCredentialAgeSeconds` means no credential age bound, which
+ * applies to `holder-presented` assertions only.
+ */
+export interface EvidenceChannelPolicy {
+  acceptedChannels?: ReadonlyArray<EvidenceChannel>
+  maximumCredentialAgeSeconds?: number
+}
+
+/**
+ * What a `holder-presented` assertion states about the credential the holder
+ * presented: the `presentedCredential` member of a verified `evidence`, present
+ * if and only if its `channel` is `holder-presented`.
+ */
+export interface PresentedCredential {
+  readonly trustEntry: string
+  readonly issuer: string
+  readonly type: string
+  readonly issuedAt: string
+  readonly subjectLink: 'possession' | 'attribute-match'
+}
+
 /** An opaque, versioned subject-continuity receipt owned by the application. */
 export interface SubjectBindingReceipt {
   readonly schema: 'registry.evidence-subject-binding-receipt/v1'
@@ -81,6 +114,10 @@ export type AudienceScopedRequest = {
   subjects?: Readonly<Record<string, Readonly<Record<string, string | number | boolean>>>>
   /** A prior receipt the application chose to retain. Nothing is persisted by this package. */
   bindingReceipt?: SubjectBindingReceipt
+  /** See `EvidenceChannelPolicy`. Absent means `source` only. */
+  acceptedChannels?: ReadonlyArray<EvidenceChannel>
+  /** See `EvidenceChannelPolicy`. Absent means no credential age bound. */
+  maximumCredentialAgeSeconds?: number
 }
 
 /**
@@ -296,6 +333,10 @@ export interface EvidenceRequestSpec {
   expectedOutputs: ReadonlyArray<Readonly<Record<string, unknown>>>
   maximumAssertionLifetimeSeconds: number
   clockSkewSeconds: number
+  /** See `EvidenceChannelPolicy`. Absent means `source` only. */
+  acceptedChannels?: ReadonlyArray<EvidenceChannel>
+  /** See `EvidenceChannelPolicy`. Absent means no credential age bound. */
+  maximumCredentialAgeSeconds?: number
   subjectExpectations:
     | 'acceptFirstUse'
     | { pinned: ReadonlyArray<{ role: string; binding: string }> }
@@ -329,6 +370,10 @@ export interface EvidenceRequestBatchSpec {
   expectedOutputs: ReadonlyArray<Readonly<Record<string, unknown>>>
   maximumAssertionLifetimeSeconds: number
   clockSkewSeconds: number
+  /** See `EvidenceChannelPolicy`. Absent means `source` only. */
+  acceptedChannels?: ReadonlyArray<EvidenceChannel>
+  /** See `EvidenceChannelPolicy`. Absent means no credential age bound. */
+  maximumCredentialAgeSeconds?: number
   items: ReadonlyArray<EvidenceRequestBatchItemSpec>
 }
 

package/evidence/index.d.ts

@@ -56,7 +56,7 @@ export declare class EvidenceClient {
    * a multi-subject request batch. No I/O happens here, and the returned
    * opaque batch is good for exactly one exchange.
    */
-  prepareBatch(spec: { requirement: string; purpose: string; audience: string; evidenceType: string; issuedBy: string; providedBy: string; configurationRevision: string; expectedAssuranceProfile: any; expectedOutputs: ReadonlyArray<Readonly<Record<string, any>>>; maximumAssertionLifetimeSeconds: number; clockSkewSeconds: number; items: ReadonlyArray<{ subjects: ReadonlyArray<{ role: string; selectorProfile: string; selectorValues?: Readonly<Record<string, string | number | boolean>> | null }>; subjectExpectations: 'acceptFirstUse' | { pinned: ReadonlyArray<{ role: string; binding: string }> } }> }): PreparedEvidenceRequestBatch
+  prepareBatch(spec: { requirement: string; purpose: string; audience: string; evidenceType: string; issuedBy: string; providedBy: string; configurationRevision: string; expectedAssuranceProfile: any; expectedOutputs: ReadonlyArray<Readonly<Record<string, any>>>; maximumAssertionLifetimeSeconds: number; clockSkewSeconds: number; acceptedChannels?: ReadonlyArray<'source' | 'holder-presented'>; maximumCredentialAgeSeconds?: number; items: ReadonlyArray<{ subjects: ReadonlyArray<{ role: string; selectorProfile: string; selectorValues?: Readonly<Record<string, string | number | boolean>> | null }>; subjectExpectations: 'acceptFirstUse' | { pinned: ReadonlyArray<{ role: string; binding: string }> } }> }): PreparedEvidenceRequestBatch
   /**
    * Read the request shapes this requester is entitled to send. Discovery
    * is authoring input, not a trust anchor: it never supplies verification
@@ -275,7 +275,11 @@ export type SubjectContinuity =
  * opaque.
  */
 export interface VerifiedEvidence {
-  /** The verified payload, serialized field for field with no hand mapping. */
+  /**
+   * The verified payload, serialized field for field with no hand mapping.
+   * Its `channel` is `source` or `holder-presented`, and a
+   * `holder-presented` payload also carries `presentedCredential`.
+   */
   evidence: any
   /**
    * The validated W3C trace identifier for the exchange that produced this

package/native.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const PACKAGE_VERSION = '0.45.0';
+const PACKAGE_VERSION = '0.46.0';
 const PRODUCTS = new Set(["breg", "casework", "coordinator", "discovery", "evidence", "messaging", "scheduling"]);
 
 function target() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@registrystack/client",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "description": "Unified Node.js client for Registry Stack products.",
   "license": "Apache-2.0",
   "homepage": "https://docs.registrystack.org/reference/client-api/",
@@ -68,8 +68,8 @@
     "typescript": "6.0.3"
   },
   "optionalDependencies": {
-    "@registrystack/client-darwin-arm64": "0.45.0",
-    "@registrystack/client-linux-arm64-gnu": "0.45.0",
-    "@registrystack/client-linux-x64-gnu": "0.45.0"
+    "@registrystack/client-darwin-arm64": "0.46.0",
+    "@registrystack/client-linux-arm64-gnu": "0.46.0",
+    "@registrystack/client-linux-x64-gnu": "0.46.0"
   }
 }