@openvtc/trust-tasks 0.26.14 → 0.26.15

package/CHANGELOG.md

@@ -11,6 +11,120 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.26.15 — 2026-10-17
+
+
+### Added
+
+- **rooms/keys/profile**: A room's own profile — name and description sealed inside the room, readable only by its members (#807)
+
+A member holding keys to many rooms saw a DID per room: nothing a member
+  could read said what a room was, and the community's label for a room it
+  owns reached only administrators and members it was offered to.
+
+  - rooms/_shared/0.1: RoomProfile (name required ≤128, description ≤1000,
+    tags ≤8, one emoji, ext) and RoomProfileStatement — the profile as a
+    SealedRecordBody's new `roomProfile` member, signed by its author, with
+    the author's authority chain and issuedAt. One record per epoch at
+    profile_key(E) = HKDF(storage_key(E), "openvtc/room/profile/v1" ||
+    roomId || u64be(E)) — 22 chars, indistinguishable from a random key, so
+    the host cannot tell which record names the room; fixed key
+    `room-profile` on open rooms. Readers accept only a chain conferring
+    curate or admin, valid at issuedAt, issuedAt within the host's
+    updatedAt window, not revoked at or before issuedAt; newest accepted
+    epoch wins; a retraction (curate-gated at the host) clears it.
+    Revocation is not retroactive.
+  - rooms/keys/profile/read 0.1 (new): the member's key holder derives the
+    location, walks epochs down, fetches as the member, verifies, and
+    answers found/absent/cleared with stale, searched and rejected.
+  - rooms/keys/profile/write 0.1 (new): the key holder signs as the member,
+    embeds the chain, pads, seals under the current epoch and puts; clear
+    retracts. Carries the rule that a key holder advancing an epoch
+    re-writes the profile under the new one (fromJoin members can read it).
+  - vtc/rooms/community/create 0.3, update 0.2: the community's VTA writes
+    label/description (never tags) as the room's profile; the community's
+    own authority confers admin, write and curate; response `roomProfile`.
+  - Editorial pointers in rooms/owner/group/{add 0.2, remove 0.2, renew
+    0.1}; vtc/_shared RoomLabel/RoomDescription say where they now go.
+  - Rust, TypeScript, Go and Dart bindings regenerated.
+
+- **rooms/keys/label**: A member's own private name, description, notes and tags for a room they hold (#806)
+
+A member holding several rooms could tell them apart only by names other
+  parties gave them — the room's own profile, a community's offer label — or
+  by their DIDs. Nothing let a member keep their own name for a room, and a
+  person holding one room as two personas could not even tell the two
+  rooms/keys/list entries apart (implementations carried the member in ext).
+
+  - rooms/keys/label 0.1 (new): set, change or remove the member's personal
+    label for one room — label (one line, 128), description (1000), notes
+    (4000), tags (1–16 × 32) — kept by their key holder, keyed by room AND
+    member, never sent to the room, its host, its owner or a community, never
+    logged. Patch semantics (each detail given replaces, absent unchanged,
+    removeX removes one), idempotent (changed: false on a repeat), no
+    precondition. notHeld answers both "no group state" and "not a member you
+    act as". Delegates refused. Kept and backed up with the group state for
+    that room and member, discarded with it, and not on removal from the room.
+  - rooms/keys/list 0.2: each entry names its `member` (one entry per room
+    and member, for the members the caller may act as); `includePersonal`
+    (off by default) returns each entry's `personal` label. A consumer sends
+    a label nowhere but to the member; a wallet does not hand one to a
+    website unless the member chose to.
+  - rooms/_shared/0.1/personal-label (new): PersonalLabel and its details.
+
+  Informative display precedence: personal label, then the room's own
+  profile name, then the community's offer label, then the DID.
+
+- **vtc/rooms/community**: Update — administrators name, describe and tag the rooms the community owns (#805)
+
+A community could name a room it owns only once, at create, with no
+  description, and nothing could change it afterwards — so neither its
+  administrators nor the members it offers a room to could tell what each
+  room was for.
+
+  - vtc/rooms/community/update 0.1 (new): change a community-owned room's
+    label, description (or removeDescription) and tags. vtc.rooms.manage;
+    proof and issuedAt REQUIRED; reason audited with each changed detail's
+    previous and new value; same values answer changed: false and write
+    nothing; notFound for a room the community only hosts. Designed for
+    no operation-bound step-up: it reaches no key holder and confers
+    nothing.
+  - vtc/rooms/community/create 0.2: optional description and tags.
+  - vtc/rooms/community/get 0.2, list 0.2: CommunityRoomV2 — description,
+    tags, detailsUpdatedAt/detailsUpdatedBy; list filters by tag.
+  - vtc/rooms/offers/list 0.2: OfferV2 carries the room's current
+    description (never its tags).
+  - vtc/_shared/0.1/community-room: additive $defs RoomDescription,
+    RoomTag, RoomTags, CommunityRoomV2, OfferV2 (the RecordMetadataV2
+    pattern), so every 0.1 task keeps its published shape.
+
+  Details stay the community's owner-side record: never in the host
+  record, the room, or anything sent on its host path.
+
+- **rooms**: Revocation — a removal takes effect at the host at once (#804)
+
+A room can now withdraw credentials it issued before they expire, and a
+  host refuses them from the moment it accepts the withdrawal.
+
+  - rooms/_shared/0.1: RevocationList (room-signed, cumulative, sequenced,
+    append-only), RevocationEntry (credential | subject | room, keyed on
+    validFrom vs revokedAt so a party can be re-admitted), RevocationHead.
+    AuthorityPresentation states that every credential's proof must be made
+    by a key of its own issuer, and that a host holding a list refuses any
+    chain containing a revoked link, under every task and version.
+  - rooms/revocations/put 0.1 (new): an admin delivers the list; the host
+    enforces it immediately on every path.
+  - rooms/revocations/get 0.1 (new): an admin reads the held list, to
+    confirm enforcement or recover a lost list.
+  - rooms/owner/revoke 0.1 (new): the owner's key holder signs the next
+    list as the room and pushes it to every host — outbound only.
+  - rooms/owner/group/remove 0.2: withdraws the member first, then
+    advances the group; refuses a private room.
+  - vtc/rooms/community/members/remove 0.2: open and attributed rooms
+    withdraw the member's credentials (and an open offer's) at the host.
+  - Editorial pointers in group/remove 0.1, owner/claim 0.1 and
+    vtc/rooms/community/members/remove 0.1.
+
 ## 0.26.14 — 2026-10-16
 
 

package/dist/_shared/components.d.ts

@@ -754,6 +754,154 @@ export type OobKey = string;
  * A web origin (`https://host[:port]`, no path, no trailing slash) — for `login`, the origin of the portal where the starter runs, which is the origin of the `serviceEndpoint` of the service's `SignInPortal` service in its DID document.
  */
 export type Origin = string;
+/**
+ * What the room is to the member, in a sentence or a short paragraph. Line breaks and tabs are allowed; other control characters are not.
+ */
+export type PersonalLabelDescription = string;
+/**
+ * The member's own name for the room, on one line: no control characters, line breaks included. Shown before every name a third party gave the room, because it is the only one nobody else wrote.
+ */
+export type PersonalLabelName = string;
+/**
+ * Longer free-form notes the member keeps about the room: who introduced them, what to look for in it, what they agreed there. Line breaks and tabs are allowed; other control characters are not.
+ */
+export type PersonalLabelNotes = string;
+/**
+ * A word or short phrase the member files the room under, in any script, so their own surfaces can group and filter their rooms. Compared exactly, as a string: a key holder does not case-fold or normalise it.
+ */
+export type PersonalLabelTag = string;
+/**
+ * The member's tags for the room, one to sixteen, as a set: order carries no meaning. A room with no tags has no `tags` member, never an empty list, so there is one way to say "none".
+ *
+ * @minItems 1
+ * @maxItems 16
+ */
+export type PersonalLabelTags = [PersonalLabelTag] | [PersonalLabelTag, PersonalLabelTag] | [PersonalLabelTag, PersonalLabelTag, PersonalLabelTag] | [PersonalLabelTag, PersonalLabelTag, PersonalLabelTag, PersonalLabelTag] | [PersonalLabelTag, PersonalLabelTag, PersonalLabelTag, PersonalLabelTag, PersonalLabelTag] | [PersonalLabelTag, PersonalLabelTag, PersonalLabelTag, PersonalLabelTag, PersonalLabelTag, PersonalLabelTag] | [
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag
+] | [
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag
+] | [
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag
+] | [
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag
+] | [
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag
+] | [
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag
+] | [
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag
+] | [
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag
+] | [
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag
+] | [
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag,
+    PersonalLabelTag
+];
 /**
  * A region or city name as the vetter writes it. Compared case-insensitively and otherwise exactly.
  */
@@ -977,6 +1125,18 @@ export type ResumeToken = string;
  * Whether a room keeps its history readable across a membership change, fixed at creation and immutable thereafter — like `Visibility`, and for the same reason: the rungs of an epoch key chain either exist for an epoch or they do not, and no later change of mind can seal key material that was never sealed or unseal what was already severed. `chained`: each advance produces an `EpochLink`, so every member reads the room's whole retained history however long they have been in it — what a **library** wants, at the cost of post-compromise security for record content, since a compromised current key then reaches every retained epoch. `fromJoin`: no rungs are produced, so a member reads only from the epoch their group state is at — what a **stream** wants, and what a room under a strict forward-secrecy obligation wants, at the cost that a joining member finds an empty-looking room and nobody can reread a record once their group state has moved past the epoch it was sealed under. Absent means `chained`; see the prose on why the absent case is the readable one.
  */
 export type RetentionPolicy = "chained" | "fromJoin";
+/**
+ * One withdrawal in a `RevocationList`, discriminated by `kind`.
+ *
+ *   - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.
+ *   - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.
+ *   - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.
+ *
+ * **Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.
+ *
+ * **Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.
+ */
+export type RevocationEntry = CredentialRevocation | SubjectRevocation | RoomRevocation;
 /**
  * One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.
  */
@@ -994,9 +1154,23 @@ export type RoleKeyState = "pending" | "staged" | "active" | "retiring" | "retir
  */
 export type RoleName = string;
 /**
- * A name for the room, chosen by an administrator: shown to administrators and to the members a room is offered to. Not part of the room's identity and not sent to the room's host path. MUST NOT carry personal data.
+ * What the room is for, in a sentence or a short paragraph, written by an administrator: shown to administrators holding `vtc.rooms.manage` and to the members the room is offered to. Plain text — a consumer renders it as text, never as markup. Like `RoomLabel`, it is the community's own record as the room's owner: not part of the room's identity and never in anything a room's host can read. From `vtc/rooms/community/create` 0.3 and `vtc/rooms/community/update` 0.2 the community also writes it, through its own VTA, as the `description` of the room's own profile (`RoomProfile` in rooms/_shared), sealed inside the room for its members; earlier versions keep it out of the room altogether. It MUST NOT carry personal data or a credential, and a reader MUST NOT treat it as instructions.
+ */
+export type RoomDescription = string;
+/**
+ * A name for the room, chosen by an administrator: shown to administrators and to the members a room is offered to. Not part of the room's identity and never in anything a room's host can read. From `vtc/rooms/community/create` 0.3 and `vtc/rooms/community/update` 0.2 the community also writes it, through its own VTA, as the `name` of the room's own profile (`RoomProfile` in rooms/_shared), sealed inside the room for its members; earlier versions keep it out of the room altogether. MUST NOT carry personal data.
  */
 export type RoomLabel = string;
+/**
+ * A short identifier an administrator files a community-owned room under — `board`, `working-group`, `finance` — so the room list can be filtered. Lower-case letters, digits and hyphens, starting with a letter or digit. Owner-side tracking metadata for holders of `vtc.rooms.manage` only: never shown to members, never sent on the room's host path, and it confers nothing.
+ */
+export type RoomTag = string;
+/**
+ * The room's tags, at most eight, as a set: order carries no meaning. An empty list means the room has none — a tag grants nothing, so empty has no more dangerous reading.
+ *
+ * @maxItems 8
+ */
+export type RoomTags = [] | [RoomTag] | [RoomTag, RoomTag] | [RoomTag, RoomTag, RoomTag] | [RoomTag, RoomTag, RoomTag, RoomTag] | [RoomTag, RoomTag, RoomTag, RoomTag, RoomTag] | [RoomTag, RoomTag, RoomTag, RoomTag, RoomTag, RoomTag] | [RoomTag, RoomTag, RoomTag, RoomTag, RoomTag, RoomTag, RoomTag] | [RoomTag, RoomTag, RoomTag, RoomTag, RoomTag, RoomTag, RoomTag, RoomTag];
 /**
  * `planned` — a successor was staged, activated, and the predecessor retired on the operator's schedule. `compromise` — a key was revoked and, where the role would otherwise be empty, replaced in the same log entry. `addition` — a key was added to a role without anything leaving it (for example a post-quantum key alongside a classical one).
  */
@@ -3976,6 +4150,10 @@ export interface AuthenticatorAttestationResponseRegistration {
 }
 /**
  * What a party presents to act on a room. Carries the whole authority chain: a host MUST NOT dereference an authority credential's `parent` to fetch a link it was not given. Resolving over the network would make verification depend on availability, turn every identifier into a request the host can be induced to make against an address the holder chooses, and signal credential use to whoever hosts the identifier. A host MUST bind the presenter to the chain's leaf. A chain that verifies is evidence that authority was conferred on somebody; it is not evidence that the party presenting it is that somebody. The leaf's subject MUST equal the party the host authenticated for this request — an identity the transport established or a document `proof` proved, never one named in a payload. A host that omits this check authorizes every captured presentation, and the omission is silent, because the chain still verifies.
+ *
+ * **Every credential is its issuer's attestation, and only its issuer's.** For the membership credential and for every link of `authority`, a host MUST verify the credential's `proof` with a key that the credential's own `issuer` lists for `assertionMethod` in its DID document, and MUST refuse a credential whose proof names a verification method that is not its issuer's. A proof that verifies under some other party's key is that party's statement, not the issuer's, and confers nothing. The same binding holds for every other document a room signs, such as a `RevocationList`.
+ *
+ * **A chain that verifies may still be revoked.** A host that has accepted a `RevocationList` for the room (`rooms/revocations/put`) MUST, from the moment it accepted it, refuse every presentation in which the membership credential or any link of `authority` is revoked by that list, under every task and every version of every task it serves for the room. A chain from which any link is revoked is refused whole: a credential delegated from a revoked one confers nothing, however it was attenuated. The refusal is the same `permissionDenied` as any other failed presentation.
  */
 export interface AuthorityPresentation {
     /**
@@ -4433,6 +4611,49 @@ export interface CommunityRoom {
      */
     createdBy?: string;
 }
+/**
+ * What vtc/rooms/community/{create,get,list}/0.2 and vtc/rooms/community/update/0.1 return: `CommunityRoom` plus the details an administrator keeps track of a room by — `description`, `tags`, and who last changed them and when. A separate definition, not a change to `CommunityRoom`, so that the 0.1 versions of those tasks keep the exact shape they published. The room's creation is `room.createdAt` and `createdBy`.
+ */
+export interface CommunityRoomV2 {
+    room: HostedRoom;
+    label: RoomLabel;
+    /**
+     * Absent when the room has none.
+     */
+    description?: RoomDescription;
+    /**
+     * Absent or empty when the room has none.
+     */
+    tags?: RoomTags;
+    /**
+     * The storage config receiving the room's new uploads.
+     */
+    storageConfig?: StorageConfigId;
+    /**
+     * Members in state `admitted`.
+     */
+    admitted: number;
+    /**
+     * Offers not yet accepted or withdrawn.
+     */
+    offered: number;
+    /**
+     * When the community's own `admin` authority over the room expires. A room whose owner's authority lapses can no longer advance its epoch, admit or remove; a community SHOULD renew it well before.
+     */
+    ownerAuthorityValidUntil?: string;
+    /**
+     * The administrator who created it.
+     */
+    createdBy?: string;
+    /**
+     * When `label`, `description` or `tags` last changed. Absent until the first change after creation. Distinct from `room.updatedAt`, which is the host record's and moves with the room's epoch and lifecycle.
+     */
+    detailsUpdatedAt?: string;
+    /**
+     * The administrator who made that change. Present exactly when `detailsUpdatedAt` is. The earlier values and who set them are in the community's audit trail, not here.
+     */
+    detailsUpdatedBy?: string;
+}
 /**
  * A community's portable configuration: its profile plus the configuration overrides a maintainer stores for itself. Deliberately excludes per-host layers (environment variables, on-disk config files) — those describe where a maintainer runs, not what the community is, and carrying them would make an import overwrite the target host's own deployment settings.
  *
@@ -4704,6 +4925,24 @@ export interface CredentialReference {
      */
     expiresAt?: string | null;
 }
+/**
+ * Withdraws one credential — a membership credential or any authority link — by its `id`.
+ */
+export interface CredentialRevocation {
+    kind: "credential";
+    /**
+     * The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it.
+     */
+    credentialId: string;
+    /**
+     * When the room made this withdrawal.
+     */
+    revokedAt: string;
+    /**
+     * OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.
+     */
+    until?: string;
+}
 /**
  * A JSON Schema (the W3C `credentialSchema` a credential of this type must conform to), carried as data. Any JSON Schema the community's validator compiles; this specification does not constrain its members. Absent means the type is registered with no schema constraint.
  */
@@ -6622,6 +6861,30 @@ export interface OfferCredentials {
      */
     authority: string;
 }
+/**
+ * What vtc/rooms/offers/list/0.2 returns: `Offer` plus `description`. A separate definition, not a change to `Offer`, so that vtc/rooms/offers/list/0.1 keeps the exact shape it published. `label` and `description` are the room's as they stand when the offer is read, not as they stood when it was made.
+ */
+export interface OfferV2 {
+    roomId: string;
+    /**
+     * The room's host: this community.
+     */
+    host: string;
+    label: RoomLabel;
+    /**
+     * Absent when the room has none.
+     */
+    description?: RoomDescription;
+    visibility: Visibility;
+    actions: MemberActions;
+    validUntil: string;
+    offeredAt: string;
+    /**
+     * `open`: not yet accepted. `accepted`: accepted, kept listed while a repeated accept can still be answered.
+     */
+    state: "open" | "accepted";
+    credentials: OfferCredentials;
+}
 /**
  * One witnessing session's outcome evidence. `session` is the initiating witness/session document; `outcome` is the terminal witness/session/submit #response that the initiating document's own specification declares as its outcome evidence, under the witness's proof, delivering the VWC and its vwcDigestMultibase. A consumer pairs them with a presented VWC by SPEC §4.9.4's four checks and the witnessing checks of witness/session/submit (This response is the outcome evidence).
  */
@@ -6696,6 +6959,19 @@ export interface PeerDepth {
     bytes: number;
     oldestAgeSeconds?: number;
 }
+/**
+ * A member's personal label for one room, as their key holder keeps it: at least one detail (`minProperties` counts `updatedAt`), and when it last changed. A key holder that holds no detail for the room holds no label, and returns none — there is no empty label.
+ */
+export interface PersonalLabel {
+    label?: PersonalLabelName;
+    description?: PersonalLabelDescription;
+    notes?: PersonalLabelNotes;
+    tags?: PersonalLabelTags;
+    /**
+     * When the label last changed, as the key holder recorded it. A request that changed nothing does not move it.
+     */
+    updatedAt: string;
+}
 /**
  * A community's published position on personhood.
  *
@@ -7508,6 +7784,56 @@ export interface ResolvedClaim {
      */
     updatedAt?: string;
 }
+/**
+ * Which `RevocationList` a party holds, without its entries: comparable between the room's key holder and a host, and between two hosts, without disclosing whom the room withdrew.
+ */
+export interface RevocationHead {
+    /**
+     * The list's `sequence`.
+     */
+    sequence: number;
+    /**
+     * SHA-256 multihash of the list's RFC 8785 (JCS) canonicalization, `proof` included. Two parties holding one sequence with different digests have been given two lists the room signed at one sequence.
+     */
+    digest: DigestMultibase;
+}
+/**
+ * The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.
+ *
+ * **Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.
+ *
+ * **Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.
+ *
+ * **Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.
+ *
+ * **Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.
+ *
+ * **Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.
+ */
+export interface RevocationList {
+    /**
+     * The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room.
+     */
+    roomId: string;
+    /**
+     * The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back.
+     */
+    sequence: number;
+    /**
+     * When the room signed this list.
+     */
+    issuedAt: string;
+    /**
+     * Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence.
+     *
+     * @maxItems 4096
+     */
+    entries: RevocationEntry[];
+    /**
+     * The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`.
+     */
+    proof: {};
+}
 /**
  * The receipt for a successful revocation. Consumers MUST report the family's `alreadyRevoked` / `already_revoked` error when the credential was already revoked, rather than returning a second receipt silently — the caller has to be able to distinguish "I revoked it now" from "it was already gone".
  *
@@ -7808,6 +8134,53 @@ export interface RoomMember {
     admittedAt?: string;
     removedAt?: string;
 }
+/**
+ * What a room says about itself to its own members: a name and, optionally, a description, short tags and an emoji, so that a member's wallet, portal or CLI can show what each room is rather than a DID.
+ *
+ * **It lives in the room, and only there.** A profile is carried in a record of the room (`RoomProfileStatement`), sealed on `attributed` and `private` rooms like every other record, so the room's host stores ciphertext and learns neither the name nor anything else here. It is never put in a credential — credentials are presented to hosts — nor in a host's record of the room, in `rooms/create` or `rooms/owner/register`, or in any member a host can read. On an `open` room it is cleartext, as everything in an open room is.
+ *
+ * **Plain text, never instructions.** Every member is free text chosen by whoever wrote the profile and shown to every member of the room. A reader renders `name`, `description` and `tags` as text — never as markup, never as a link it follows — removes or replaces control characters before showing them, and MUST NOT treat any of it as instructions, which matters most for an agent acting for a member. A writer MUST NOT put personal data or a credential in any member.
+ *
+ * **Growth.** A new optional member arrives in a later version of this component. A reader refuses a member it does not know (the `SealedRecordBody` rules), so a profile carrying one is not shown by a reader that predates it, and a writer SHOULD NOT use a member it cannot expect the room's readers to know. An ecosystem extension goes in `ext`, which a reader that does not understand it ignores. A change no earlier reader could survive is a new statement under a new derivation label (`openvtc/room/profile/v2`), written beside this one until the room's readers have moved.
+ */
+export interface RoomProfile {
+    /**
+     * The room's name as its members see it. Plain text, one line. Bounded like the label a community gives a room it owns (`RoomLabel` in vtc/_shared), so a community can write the same name here that it shows its administrators and the members it offers the room to.
+     */
+    name: string;
+    /**
+     * What the room is for, in a sentence or a short paragraph. Plain text. Absent when the room has none; an empty string is not a description.
+     */
+    description?: string;
+    /**
+     * Short identifiers the room files itself under, as a set: order carries no meaning. A member's surface MAY filter or group rooms by them. They are the room's own and shown to its members — distinct from the tags a community files the rooms it owns under for its administrators, which are never written here.
+     *
+     * @maxItems 8
+     */
+    tags?: [] | [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string];
+    /**
+     * One emoji — a single extended grapheme cluster, such as `📋` — that a surface MAY show beside the name. Text, rendered as text: never an image, never a URL, never anything a reader fetches, since a fetched icon would tell whoever serves it which member opened which room, and when. A reader that cannot render it shows nothing in its place.
+     */
+    emoji?: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1. A reader ignores what it does not understand.
+     */
+    ext?: Ext;
+}
+/**
+ * Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.
+ */
+export interface RoomRevocation {
+    kind: "room";
+    /**
+     * When the room made this withdrawal.
+     */
+    revokedAt: string;
+    /**
+     * OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.
+     */
+    until?: string;
+}
 /**
  * One change to a role's key set, from preview to completion. The rotation history of a DID is the list of these; the log is the authority for what was published, and this record adds what the log cannot say — which change was which, and (custody projection only) who asked, who approved, and why.
  */
@@ -8555,6 +8928,24 @@ export interface StreamDescriptor {
     expectedSizeBytes: ExpectedSizeBytes;
     expiresAt: ExpiresAt;
 }
+/**
+ * Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.
+ */
+export interface SubjectRevocation {
+    kind: "subject";
+    /**
+     * The party withdrawn. Never the room itself.
+     */
+    subject: string;
+    /**
+     * When the room made this withdrawal.
+     */
+    revokedAt: string;
+    /**
+     * OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.
+     */
+    until?: string;
+}
 /**
  * One attestation as a submission carries it: its metadata and its token. The attestation itself is inside the submission's `proof`, in the same order.
  */