From 377f83fb4073b3bd8af67ec3b53c4c1933f34c3f Mon Sep 17 00:00:00 2001 From: Glenn Gore Date: Sun, 9 Aug 2026 23:00:25 +0200 Subject: [PATCH] release(core): @openvtc/pnm-core 0.3.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cuts the three changes sitting under `[Unreleased]` since 0.2.0: the `digestMultibase` decoding and byte-derived approver match code (#113), the canonical `auth/authenticate/0.1` type for VTA DIDComm auth, and the consent-gated task detection that keys on `details.reason` rather than a top-level code that never matched. Minor rather than patch: `trust-tasks/digest.ts` adds public API (`matchCodeFromDigest`, `decodeDigestMultibase`, `decodeMultibase`, `MATCH_CODE_LEN`, `DigestMultibaseError`). Nothing in the TypeScript surface was removed or narrowed, so no BREAKING section — but the release is not drop-in, and the changelog says so under Migration rather than leaving a consumer to find out from a mismatched code on an approval screen. The reason it is not drop-in is that `payloadDigest` changed encoding with no type-URI version to signal it — Trust Tasks 0.4 re-pinned the task-consent specifications errata-style, in place. So this release pairs with verifiable-trust-infrastructure#911 and the two have to move together. Unlike the 0.1.3 authcrypt change there is deliberately no dual-accept fallback to stage behind: the digest is what the approver signs, and accepting both encodings would mean accepting two different digests for one payload — the exact substitution the digest exists to prevent. Both skew directions fail closed, which is what bounds this to an upgrade inconvenience rather than a security event. A 0.3.0 wallet against a pre-0.4 VTA refuses the bare-hex digest and blocks approval with an explicit message. A 0.2.0 wallet against a 0.4 VTA displays `zQmSK9…` where the requesting screen displays `3b0c7f`, so destructive approvals become impossible while non-destructive ones still complete. Nothing is silently mis-approved either way. Installed extensions need a rebuild — there is no store auto-update path in this repository. Dependents moved to `^0.3.0` in the same commit so the workspace keeps resolving to the local package rather than the published 0.2.0. Not published here. `npm publish` remains a manual step after this merges. Signed-off-by: Glenn Gore --- package-lock.json | 6 +++--- packages/core/CHANGELOG.md | 30 ++++++++++++++++++++++++++++++ packages/core/package.json | 2 +- packages/extension/package.json | 2 +- packages/pwa/package.json | 2 +- 5 files changed, 36 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 2a2894e..79f4e38 100644 --- a/package-lock.json +++ b/package-lock.json @@ -7856,7 +7856,7 @@ }, "packages/core": { "name": "@openvtc/pnm-core", - "version": "0.2.0", + "version": "0.3.0", "license": "Apache-2.0", "dependencies": { "@hpke/chacha20poly1305": "^1.8.0", @@ -7882,7 +7882,7 @@ "name": "@openvtc/pnm-extension", "version": "0.2.0", "dependencies": { - "@openvtc/pnm-core": "^0.2.0", + "@openvtc/pnm-core": "^0.3.0", "react": "^19.0.0", "react-dom": "^19.0.0", "zustand": "^5.0.0" @@ -7903,7 +7903,7 @@ "name": "@openvtc/pnm-pwa", "version": "0.2.0", "dependencies": { - "@openvtc/pnm-core": "^0.2.0", + "@openvtc/pnm-core": "^0.3.0", "@tanstack/react-query": "^5.101.2", "lucide-react": "^1.25.0", "react": "^19.0.0", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index 4644c1c..ca0389b 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -8,6 +8,8 @@ For history before this file, see `git log` on `packages/core`. ## [Unreleased] +## [0.3.0] - 2026-08-09 + ### Added - **`digestMultibase` decoding, and the approver match code derived from the @@ -54,6 +56,34 @@ For history before this file, see `git log` on `packages/core`. of it emits the explicit reason yet. The prior tests encoded the wrong wire shape as correct and were rewritten against the real one. +### Migration + +The `payloadDigest` **wire format changed**, on both sides at once and without +a type-URI version to signal it — Trust Tasks 0.4 re-pinned +`task-consent/{request,decision,granted}` errata-style, in place. This release +pairs with `verifiable-trust-infrastructure` **#911**; a wallet and an executor +on opposite sides of that change do not interoperate on consent. + +**Upgrade the wallet and the VTA together.** Unlike the 0.1.3 authcrypt change +there is no dual-accept fallback to stage behind, because the digest is the +value the approver signs — accepting both encodings would mean accepting two +different digests for one payload, which is precisely the substitution the +digest exists to prevent. + +The failure is fail-closed in both directions, which bounds the blast radius: + +- **Wallet ≥ 0.3.0, VTA pre-0.4** (bare hex on the wire): the digest is refused + as non-conforming, no match code is rendered, and approval is blocked with an + explicit message. +- **Wallet ≤ 0.2.0, VTA on 0.4** (multibase on the wire): the old code slices + the encoded string, so the wallet displays `zQmSK9…` where the requesting + screen and the mobile approver display `3b0c7f`. Destructive approvals become + impossible — the codes cannot match — while non-destructive ones still + complete with a cosmetically wrong code shown. **Rebuild and reinstall the + extension**; there is no store auto-update path in this repository. + +Nothing is silently mis-approved in either direction. + ## [0.2.0] - 2026-06-08 ### Changed diff --git a/packages/core/package.json b/packages/core/package.json index 86f2840..eb03fa6 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@openvtc/pnm-core", - "version": "0.2.0", + "version": "0.3.0", "description": "Browser-side bridge between WebAuthn passkeys and VTA-managed DIDs. Wire types, WebAuthn ceremony helpers, COSE→Multikey conversion, DID verificationMethod builder, REST + DIDComm transports, mediator client, SIOP / RP-login / provision-integration flows.", "license": "Apache-2.0", "repository": { diff --git a/packages/extension/package.json b/packages/extension/package.json index 33b8841..2a20701 100644 --- a/packages/extension/package.json +++ b/packages/extension/package.json @@ -11,7 +11,7 @@ "render:icons": "scripts/render-icons.sh" }, "dependencies": { - "@openvtc/pnm-core": "^0.2.0", + "@openvtc/pnm-core": "^0.3.0", "react": "^19.0.0", "react-dom": "^19.0.0", "zustand": "^5.0.0" diff --git a/packages/pwa/package.json b/packages/pwa/package.json index 26767b1..cc5deae 100644 --- a/packages/pwa/package.json +++ b/packages/pwa/package.json @@ -11,7 +11,7 @@ "lint": "tsc -b" }, "dependencies": { - "@openvtc/pnm-core": "^0.2.0", + "@openvtc/pnm-core": "^0.3.0", "@tanstack/react-query": "^5.101.2", "lucide-react": "^1.25.0", "react": "^19.0.0",