diff --git a/Cargo.lock b/Cargo.lock index d7b2f08..75f4592 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -307,9 +307,9 @@ dependencies = [ [[package]] name = "affinidi-messaging-sdk" -version = "0.21.0" +version = "0.22.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "72f32712a19146d4a5353a98a60b676b572976a85abf318a412863389cc8f064" +checksum = "b579af2fee18048f092391f3c73e1b6a7be44fed38ed2bf79e03b58b9cafc84b" dependencies = [ "affinidi-crypto", "affinidi-did-authentication", @@ -335,7 +335,7 @@ dependencies = [ "tokio", "tokio-tungstenite", "tracing", - "trust-tasks-rs", + "trust-tasks-rs 0.18.6", "uuid", ] @@ -453,9 +453,9 @@ dependencies = [ [[package]] name = "affinidi-tdk" -version = "0.10.0" +version = "0.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "715c365fa19276fb50332e10b922822b25d52d6119721f28abb6cac02029a365" +checksum = "796229a5640d2c8e1ae81242ff86a1147994210542e3d1cdd59ec1df12bce3ea" dependencies = [ "affinidi-crypto", "affinidi-data-integrity", @@ -5304,7 +5304,7 @@ dependencies = [ "serde_json", "thiserror", "tracing", - "trust-tasks-rs", + "trust-tasks-rs 0.17.3", ] [[package]] @@ -5312,6 +5312,21 @@ name = "trust-tasks-rs" version = "0.17.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "41d841bf16638473fed22f94ce446cadcc932afc60ca3f623eef184d546d945b" +dependencies = [ + "async-trait", + "chrono", + "regress", + "serde", + "serde_json", + "serde_with", + "thiserror", +] + +[[package]] +name = "trust-tasks-rs" +version = "0.18.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fe43bd5d03b468c49ffa6c75d53afca9fe27cb70b35384941db3a8c42c1da4b8" dependencies = [ "async-trait", "chrono", @@ -5538,9 +5553,9 @@ checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64" [[package]] name = "vta-sdk" -version = "0.32.0" +version = "0.34.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f3ea9dbdad04080277acd9a57224003a73bf1300980837228792620e2d46bb5" +checksum = "e8afb6ae8320688356666abaafbcead756e5de6b728e5658a5337b9d013547f2" dependencies = [ "affinidi-crypto", "affinidi-data-integrity", @@ -5555,7 +5570,7 @@ dependencies = [ "affinidi-tdk", "affinidi-vc", "agent-names", - "base64 0.22.1", + "base64 0.23.1", "chrono", "ciborium", "curve25519-dalek 5.0.0", @@ -5573,7 +5588,7 @@ dependencies = [ "thiserror", "tokio", "tracing", - "trust-tasks-rs", + "trust-tasks-rs 0.18.6", "url", "uuid", "x25519-dalek 3.0.0", diff --git a/Cargo.toml b/Cargo.toml index 362d7dc..43c432d 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -49,9 +49,24 @@ vgi-core = { version = "0.4.7", path = "crates/vgi-core" } # on the PR path is affected (CI runs fmt/clippy/check/test only) — but do not # cut a release until the registry publishes and this goes back to a version. # -# The check is the one this comment has always carried, and it now passes -# unnarrowed again: `cargo tree -d -e normal,build` lists no trust-tasks-rs and -# no vta-sdk, and `cargo tree -i vta-sdk` resolves a single node. +# The check is the one this comment has always carried, and with the stack on +# trust-tasks 0.18 it is back to the *narrowed* form rather than the unnarrowed +# one: `cargo tree -i vta-sdk` still resolves a single node, but +# `cargo tree -i trust-tasks-rs@0.17.3` now lists one parent chain and it must +# be exactly this — +# +# trust-tasks-rs v0.17.3 +# └── trql-client v0.15.0 (git ...) +# └── verify-trust +# +# The residue is tolerable only because of where it lands: `verify-trust` sends +# TRQP queries through trql-client's HTTPS transport and passes no trust-tasks +# type across that boundary, and `did-git-sign` — the crate OpenVTC actually +# consumes — has no trql-client edge at all, so the duplicate does not reach a +# graph where a type has to unify. The test is not "is there a duplicate" but +# "does it reach somewhere that has to unify", and the way to keep that honest +# is to assert the single expected parent rather than to drop the check. +# It goes away when the registry moves to 0.18 and publishes. trql-client = { git = "https://github.com/affinidi/affinidi-trust-registry-rs", rev = "22bb9a33da6379e09027948e6c8118aeb1533754" } # VTA client for signing with DID-held keys, and the `display_name` module # (NameBook / shorten_did / verified agent names) shared with the PNM, CNM @@ -94,6 +109,16 @@ trql-client = { git = "https://github.com/affinidi/affinidi-trust-registry-rs", # (`ClientIdentity` grew a `verification_method` member in 0.32 — VTI #1193 — # and nothing here names that type). The bump exists so the ceiling moves. # +# 0.32 -> 0.34 is the sixth, and the same shape again: OpenVTC is moving to the +# line VTI main deploys (vta-sdk 0.34, vta-service 0.24, trust-tasks 0.18, TDK +# 0.12), and this requirement is the edge that decides whether its graph holds +# one sdk or two. What 0.33/0.34 change is the shape of the wire bodies — VTI +# #1270/#1271 made `AclEntry` and `AppStateWrite` `#[non_exhaustive]`, and +# #1280 replaced `create_acl`'s positional arguments with `CreateAclParams` — +# and this workspace names none of those types, so again the bump exists only so +# the ceiling moves. `affinidi-tdk` goes to 0.12 in the same step because that +# is what vta-sdk 0.34 declares. +# # Same discipline as the trust-tasks pin below: the requirement follows what the # rest of the stack resolves, and `cargo tree -i vta-sdk` in a consumer is the # check that it worked — one row, not two. @@ -101,8 +126,8 @@ trql-client = { git = "https://github.com/affinidi/affinidi-trust-registry-rs", # Old floor notes (0.21.10 for trust-tasks-rs 0.4; the 0.23 move in #26) are # below this line by construction and kept in git history rather than as a wall # of satisfied constraints. -vta-sdk = { version = "0.32", default-features = false } -affinidi-tdk = "0.10" +vta-sdk = { version = "0.34", default-features = false } +affinidi-tdk = "0.12" multibase = "0.9" pgp = "0.20" clap = { version = "4.6", features = ["derive"] }