@openvtc/trust-tasks 0.26.17 → 0.26.19

package/src/_shared/components.ts

@@ -374,6 +374,12 @@ export type ApproverLabel = string;
  * The metadata of one attestation: what a Vetting Statement would have said, minus its issuer, as vetting/attestation/0.1 defines it.
  */
 export type AttestationMeta = StatementMeta;
+/**
+ * Who may see a directory field, ordered from narrowest to widest. `admins`: holders of `vtc.directory.admin` (and, for derived fields, `vtc.members.manage`). `groups`: members who share at least one community group with the subject (narrowed to the groups the subject names in `groupAudience`, where it names any). `connections`: members holding an attributed, in-force verified relationship with the subject at the community. `members`: every active member. `public`: anyone, and what the member's signed public card carries outside the community.
+ *
+ * `groups` and `connections` are not a chain: a viewer sees a field when they satisfy the audience the subject chose for it or any wider audience. Every audience includes the administrators, and the subject always sees their own whole card. There is no `onlyMe`: a value nobody else should see is not directory data.
+ */
+export type Audience = "admins" | "groups" | "connections" | "members" | "public";
 /**
  * The kind of privileged change recorded in the audit log.
  */
@@ -407,6 +413,8 @@ export type AuthModel =
 export type AuthorityScope = AuthorityScopeAll | AuthorityScopeNone | AuthorityScopeContexts;
 export type AwsArn = string;
 export type AwsRegion = string;
+export type BindingId = string;
+export type BindingSpec = RoomBindingSpec | GrantsBindingSpec | RoleBindingSpec;
 /**
  * The name of one blob: the digest of its BlobManifest, taken over the manifest's RFC 8785 (JCS) canonicalization. sha2-256 is RECOMMENDED and MUST be implemented. Content addressing over ciphertext, never plaintext, so a BlobRef says nothing about what the file contains, and two uploads of one file have different BlobRefs (a fresh `fileId` gives a different key, and so different ciphertext). Rooms cannot be correlated by the files they share. Compared as decoded multihash bytes, never as encoded strings. A BlobRef is defined over the manifest's JSON, as this schema states it and RFC 8785 canonicalizes it, never over any binding's generated type: two bindings that model the manifest as distinct types still compute the same BlobRef from the same JSON.
  */
@@ -453,6 +461,7 @@ export type Capability_DeviceV0_1 =
   | "sign-sshsig"
   | "sign-jws"
   | "sign-csr"
+  | "sign-document"
   | "external-accounts-manage"
   | "external-auth-use"
   | "pcs-vetter"
@@ -480,6 +489,7 @@ export type Capability_DeviceV0_2 =
   | "signSshsig"
   | "signJws"
   | "signCsr"
+  | "signDocument"
   | "externalAccountsManage"
   | "externalAuthUse"
   | "pcsVetter"
@@ -633,6 +643,10 @@ export type Did_GitNsV0_3 = string;
  * Restricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that "interoperability is not guaranteed between implementations using such values", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.
  */
 export type DigestMultibase = string;
+/**
+ * A community directory entry's identifier, exactly as that community's directory returned it. Opaque and community-scoped: the agent stores and compares it as a string, never parses it, and never treats the same value under two communities as the same entry.
+ */
+export type DirectoryEntryId = string;
 /**
  * The kinds of drift, named so that a task can select a drift item by kind. The same values, with the same meanings, as `DriftItem`'s `type`, which keeps its own inline list so that `DriftItem` stays textually identical to 0.1; the two lists change together. `roleAdded` — someone holds a forge role the projection does not give them. `roleRemoved` — a projected role is missing. `roleChanged` — a projected role is present at another level. `requiredCheckMissing` — the verify-trust check is no longer required. `protectionWeakened` — branch protection or a ruleset is weaker than the projection in another way (force-push allowed, bypass actors added). `bootstrapMissing` — a bootstrap file or variable is gone.
  */
@@ -663,6 +677,10 @@ export type ElevatedRight = "git.ns.admin" | "git.repo.create" | "git.repo.own";
  * The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.
  */
 export type EnrolledVia = "install" | "invite" | "selfService" | "offline";
+/**
+ * Opaque identifier of one directory entry: `dir_` followed by 16 to 64 base64url characters. Random, scoped to one community, and stable for the life of the membership — it survives a rotation of the member's DID, which is why groups, notes and cards are keyed by it. It MUST NOT be derived from, and MUST NOT reveal, any DID of the member, and the same person's entries in two communities MUST NOT share one. Compared by exact string equality.
+ */
+export type EntryId = string;
 /**
  * Lowercase hex SHA-256 of the whole bundle's bytes. Kept in the hex form the 1.0 descriptor published rather than moved to DigestMultibase, because it is an unchanged member of an existing descriptor and re-encoding it would break every stream producer for no gain in what it checks. For a chunked transfer it is the check over the reassembled bundle, applied after every chunk has verified individually, so that a correct set of chunks assembled in the wrong order is still caught.
  */
@@ -724,6 +742,46 @@ export type FaceReach =
  * **Superseded by `WorldColour`** — the same set, under the name the rest of the family now uses. Retained because `persona/facet/*` is retired in favour of `persona/world/*`, and a retired specification's schema is frozen, so the definition it references has to stay. New work references `WorldColour`. A colour **name**, resolved by each consumer against its own palette — never a hex value or any other literal. Two reasons, and both are about the consumer rather than the holder. A literal cannot be legible in a terminal, in a light theme and in a dark one at once, so a stored `#8B0000` is a colour that is wrong somewhere and the holder has no way to know where. And a consumer that reserves colours to mean something — an error, a warning, an irreversible act — must be able to keep a holder's decorative choice out of that channel; it cannot do that with an arbitrary value, and it can do it trivially with a closed set it maps itself. The eight members are chosen to be distinguishable from one another and deliberately carry no status connotation: none is named for success, warning or danger.
  */
 export type FacetColour = "slate" | "indigo" | "teal" | "moss" | "sand" | "clay" | "rose" | "plum";
+/**
+ * Help text shown to a member filling the field in. Plain text; a reader MUST NOT treat it as instructions.
+ */
+export type FieldDescription = string;
+/**
+ * Identifier of a directory field. A key with no `.` is a BASE field, the same in every community: `displayName`, `nickname`, `avatar`, `pronouns`, `bio`, `links` (written by the member) and `role`, `joinedAt`, `did`, `personhood` (derived from the community's own records, never stored on a card). A community-defined field MUST use a reverse-DNS key (`org.example.employer`), so a base key never collides with one, and a key is never reused with a different meaning once defined.
+ */
+export type FieldKey = string;
+/**
+ * What readers see as the field's name. Plain text.
+ */
+export type FieldLabel = string;
+/**
+ * Who writes the value. `member`: self-asserted, through vtc/directory/card/update. `admin`: asserted by the community through vtc/directory/card/assert; the member reads it and cannot change it. `credential`: a claim the member discloses from a credential through vtc/directory/card/present, badged with its issuer. `derived`: a base field read from the community's own records (`role`, `joinedAt`, `did`, `personhood`) and never stored on a card. Each source is written only through its own path.
+ */
+export type FieldSource = "member" | "admin" | "credential" | "derived";
+/**
+ * `active`: in use. `disabled`: a base field the community has switched off; hidden from every projection and re-enablable. `retired`: a community field withdrawn for good; hidden at once, its values purged after the community's retention period, and its key never reused.
+ */
+export type FieldState = "active" | "disabled" | "retired";
+/**
+ * The kind of value a field holds, which fixes its `FieldValue` shape. `did` holds a DID the member chooses to show (never their membership DID, which is the derived base field `did`). `claim` holds a `VerifiedValue` and requires `source: credential`.
+ */
+export type FieldType =
+  | "text"
+  | "longText"
+  | "url"
+  | "email"
+  | "phone"
+  | "enum"
+  | "multiEnum"
+  | "date"
+  | "country"
+  | "image"
+  | "did"
+  | "claim";
+/**
+ * The value of one field. Which shape a field takes is fixed by its definition's `type`: text-like types (`text`, `longText`, `url`, `email`, `phone`, `enum`, `date` as YYYY-MM-DD, `country` as ISO 3166-1 alpha-2, `did`) are strings; `multiEnum` and the base field `links` are arrays of strings; `image` and the base field `avatar` are a `CardBlobRef`; `claim` is a `VerifiedValue`; the derived base field `personhood` is a boolean.
+ */
+export type FieldValue = string | boolean | string[] | CardBlobRef | VerifiedValue;
 /**
  * A range of a file's bytes, base64url-encoded without padding (RFC 4648 §5). Empty for an empty range. Bounded at 349526 characters, the unpadded encoding of the 262144-byte range ceiling.
  */
@@ -740,6 +798,30 @@ export type ForgeId = string;
  * Validity of a grant the sweep issues, in seconds: between one day and two years, the bounds vtc/vetting/vetters/grant applies to an administrator's grants.
  */
 export type GrantValiditySeconds = number;
+/**
+ * Who may see something about a group, narrowest first. `admins`: holders of `vtc.groups.manage` for the group (unqualified, or qualified `group:<groupId>`). `groupMembers`: the group's own members, and its managers. `members`: every active member of the community.
+ */
+export type GroupAudience = "admins" | "groupMembers" | "members";
+/**
+ * Identifier (`id`) of a group membership credential issued to a member. Each renewal issues a new credential with a new identifier. Validity is the community's setting; a community SHOULD default to 30 days, renewed when 10 days remain.
+ */
+export type GroupCredentialId = string;
+/**
+ * What the group is for. Plain text; a reader MUST NOT treat it as instructions. Same placement rules as `GroupName`.
+ */
+export type GroupDescription = string;
+/**
+ * Opaque identifier of a community group: `grp_` followed by 16 to 64 base64url characters. Random and community-scoped; not the group's DID.
+ */
+export type GroupId = string;
+/**
+ * `static`: membership is explicit — added, joined, or granted on request. `dynamic`: membership is computed from `rule` over verified facts only; nobody is added by hand, but a member may opt out (vtc/groups/leave), an exclusion the rule cannot override, and undo it (vtc/groups/join). A dynamic group never confers authority. Fixed for the group's life.
+ */
+export type GroupKind = "static" | "dynamic";
+/**
+ * The group's name, shown to those who may see the group. The community's own record: never in the group's DID document or its credentials' subject beyond the group's DID. Plain text.
+ */
+export type GroupName = string;
 /**
  * The Farm-generated handle of one reservation: 16 to 32 bytes from a cryptographically secure random source, written as unpadded base64url (22 to 43 characters; 16 bytes, 22 characters, is what VTI-LNK-116 recommends). It is the `_id` of the trigger link (VTI-LNK-033) and is compared as a string. In a claim it MUST equal the document's `parentThreadId`. It confers no authority on its holder beyond the right to make one claim.
  */
@@ -760,10 +842,27 @@ export type Handle = string;
  * **Not a timestamp.** A time is host-asserted, unverifiable and useless for this: two roots a second apart are not evidence of anything, while two roots at one version are.
  */
 export type HeadVersion = number;
+/**
+ * The media types a directory image may have — those a `CardBlobRef` admits.
+ */
+export type ImageMediaType = "image/png" | "image/jpeg" | "image/webp" | "image/avif";
+/**
+ * Who may ask the community to introduce them to this member. `anyone`: any active member who can find the entry. `groups`: only members who share a community group with them. `connections`: only members holding an attributed, in-force verified relationship with them. `off`: nobody. A refused introduction is never reported to its sender.
+ */
+export type Introductions = "anyone" | "groups" | "connections" | "off";
 /**
  * `issued` is outstanding and revocable; `consumed` and `expired` are terminal.
  */
 export type InviteStatus = "issued" | "consumed" | "expired";
+/**
+ * How a member enters a static group by themselves. `closed`: only a manager adds them. `request`: a member asks and a manager decides. `open`: a member joins at once, subject to the community's `groups` policy. A group carrying authority is always `closed`.
+ */
+export type JoinPolicy = "closed" | "request" | "open";
+export type JoinRequestId = string;
+/**
+ * An optional note from the member to the group's managers. Plain text.
+ */
+export type JoinRequestMessage = string;
 /**
  * Application-chosen identifier for a record within a namespace. Opaque to the maintainer: it MUST NOT be parsed, normalized, or case-folded, and prefix matching in `list` is a byte-prefix comparison over the UTF-8 encoding. Applications SHOULD use `/`-delimited hierarchical keys (`community/acme`, `contact/z6Mk…`) so that `prefix` can address a record family, but the delimiter is a convention between an application and itself — the maintainer attaches no meaning to it.
  */
@@ -812,6 +911,33 @@ export type LifecycleReason = string;
  * Where an effective limit came from. `policy`: the community's rooms policy at the room's creation. `override`: an administrator's vtc/rooms/limits/set. `default`: the community's configured defaults, where neither applies. The host-wide ceiling bounds all three.
  */
 export type LimitSource = "policy" | "override" | "default";
+/**
+ * A colour the holder picked for a list, as a six-digit lowercase sRGB hex value (`#1f8a70`). A rendering hint: a consumer MAY map it to the nearest colour of its own palette that keeps contrast in light and dark themes, and MUST NOT rely on colour alone to tell lists apart.
+ */
+export type ListColour = string;
+/**
+ * Identifier of one of the holder's contact lists: a ULID in Crockford base32, uppercase, assigned by the agent when the list is created. Meaningful only inside the context that holds the list; it is never sent to anyone but the holder's own clients.
+ */
+export type ListId = string;
+/**
+ * The lists a contact is on, as a set: order carries no meaning. A contact on no list has no `lists` member, never an empty array, so there is one way to say "none".
+ *
+ * @minItems 1
+ * @maxItems 64
+ */
+export type ListIds = [ListId, ...ListId[]];
+/**
+ * The holder's name for one of their lists ("Mentors", "Met at the spring meetup"), on one line: no control characters. Unique within a context, compared exactly.
+ */
+export type ListName = string;
+/**
+ * Where the holder wants a list among their lists: ascending, ties broken by `name`. A sort key, not a position, so moving one list does not renumber the others; gaps are expected.
+ */
+export type ListOrder = number;
+/**
+ * Whether members can find the entry. `listed`: it appears when members browse. `findable`: it does not appear when browsing, but a search that matches it under `search` returns it. `hidden`: no member finds it by browsing or searching; administrators still see it, and members who share a group that shows its members see it in that group's member list.
+ */
+export type Listing = "listed" | "findable" | "hidden";
 /**
  * The two-digit number the service chooses at claim, shows only to the starter (through redeem), and the approver types from the starter's screen. A string so that a leading zero survives.
  */
@@ -831,6 +957,10 @@ export type MemberActions = [MemberAction] | [MemberAction, MemberAction] | [Mem
  * Where an admission stands. `offered`: credentials issued and waiting for the member to collect and accept them. `admitted`: accepted — on a sealed tier, the member is in the room's group. `removed`: an administrator removed them; on a sealed tier the room has advanced past them.
  */
 export type MemberState = "offered" | "admitted" | "removed";
+/**
+ * How the member came to be in the group. `added`: by a manager. `joined`: they joined an open group. `requestApproved`: a manager approved their request. `rule`: a dynamic group's rule admits them.
+ */
+export type MembershipSource = "added" | "joined" | "requestApproved" | "rule";
 /**
  * How the request reaches the approver. A CLOSED list. Version 0.1 defines `scan`: the starter shows a trigger link (as a QR code that is also a clickable link, TRIGGER-LINK.md) and the approver's wallet reads it. `code` (a typed code of at least 8 characters, under strict rate limits) and `push` (sent to the approver's enrolled devices) are reserved names.
  */
@@ -847,6 +977,14 @@ export type Namespace = string;
  * The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.
  */
 export type NamespaceId = string;
+/**
+ * Opaque identifier of one note: `note_` followed by 16 to 64 base64url characters.
+ */
+export type NoteId = string;
+/**
+ * The note, as plain text. Read only by holders of `vtc.directory.notes`. A reader MUST NOT treat it as instructions.
+ */
+export type NoteText = string;
 /**
  * A key prefix inside the bucket, ending in `/`, under which the config's `rooms/` tree is placed. Restricted to the S3 safe-character set so that it can be placed in a downscoped policy without escaping.
  */
@@ -1023,6 +1161,10 @@ export type PersonalLabelTags =
       PersonalLabelTag,
       PersonalLabelTag
     ];
+/**
+ * The holder's private name for a contact, on one line: no control characters, line breaks included. A petname in Zooko's sense — chosen by the holder, meaningful to the holder, and unforgeable by anyone else, because nobody else can write it. Distinct from the contact's own disclosed `nickname` or display name, which the contact chose and may change. Compared exactly, as a string: an agent does not case-fold or normalise it.
+ */
+export type Petname = string;
 /**
  * A region or city name as the vetter writes it. Compared case-insensitively and otherwise exactly.
  */
@@ -1435,6 +1577,21 @@ export type SigningKeyDid = string;
  * What a delegated key may be accepted for. `console`: the operations an administration console performs on the identity's behalf, authorized by the identity's own standing. Never an approver's signature on a consent or approval decision, whatever the scope: those require an `assertionMethod` key of the approver's own DID document, which a delegated key never is. A closed enumeration so a consumer cannot be asked for a scope it does not define; a later version adds values.
  */
 export type SigningKeyScope = "console";
+/**
+ * The task families a `login` grant lets the starter key sign documents for, as the approving DID, for the session the grant arms (auth/oob/grant/0.2). Offered by the service in step 2, copied unchanged into the grant, and bounded further by the exclusions auth/oob/grant/0.2 states. Absent means the starter key signs nothing beyond the family's own tasks.
+ *
+ * @minItems 1
+ * @maxItems 8
+ */
+export type SigningScope =
+  | [TaskFamily]
+  | [TaskFamily, TaskFamily]
+  | [TaskFamily, TaskFamily, TaskFamily]
+  | [TaskFamily, TaskFamily, TaskFamily, TaskFamily]
+  | [TaskFamily, TaskFamily, TaskFamily, TaskFamily, TaskFamily]
+  | [TaskFamily, TaskFamily, TaskFamily, TaskFamily, TaskFamily, TaskFamily]
+  | [TaskFamily, TaskFamily, TaskFamily, TaskFamily, TaskFamily, TaskFamily, TaskFamily]
+  | [TaskFamily, TaskFamily, TaskFamily, TaskFamily, TaskFamily, TaskFamily, TaskFamily, TaskFamily];
 /**
  * A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.
  */
@@ -1502,6 +1659,10 @@ export type SyncEvent_SyncV0_2 =
   | VaultDeletedEvent_SyncV0_2
   | AclChangedEvent_SyncV0_2
   | PolicyChangedEvent_SyncV0_2;
+/**
+ * A family of Trust Tasks, named by a slug prefix of whole segments (SPEC §6.1 grammar): `vtc/directory` names every task whose slug is `vtc/directory` or begins `vtc/directory/`, at any version. A prefix matches on segment boundaries only, so `vtc/dir` names nothing under `vtc/directory`.
+ */
+export type TaskFamily = string;
 /**
  * The length of one tick of the drip, as an ISO 8601 duration in days and/or hours — at least `PT1H`. A label's tick `t` is the window starting `t` tick lengths after the label's start (`vtc/vetting/vetters/pcs-tokens`).
  */
@@ -1527,6 +1688,19 @@ export type Topic_VtcAdminEventsV0_2 =
   | "singleAdminMode"
   | "config"
   | "rooms";
+/**
+ * One kind of change a console can be told about. A closed set: a topic not listed here is a new MINOR version of this component, not an `ext` member, because each topic is bound to the read that authorizes it.
+ */
+export type Topic_VtcAdminEventsV0_3 =
+  | "actions"
+  | "acknowledgements"
+  | "joinRequests"
+  | "members"
+  | "singleAdminMode"
+  | "config"
+  | "rooms"
+  | "directory"
+  | "groups";
 /**
  * How the traffic reached or left the mediator. `peerMediator` is mediator-to-mediator forwarding.
  */
@@ -3942,6 +4116,31 @@ export interface AdminAccount {
    */
   accountType: AccountType;
 }
+export interface AdminNote {
+  noteId: NoteId;
+  entryId: EntryId;
+  /**
+   * DID of the administrator who wrote the note.
+   */
+  author: string;
+  createdAt: string;
+  /**
+   * The note. Absent from a note that has since been redacted, except in vtc/directory/notes/export, which returns every note as written.
+   */
+  text?: NoteText;
+  /**
+   * Optional date by which the note asks for a follow-up.
+   */
+  followUp?: string;
+  /**
+   * Present on a redaction: the earlier note this one withdraws.
+   */
+  redacts?: NoteId;
+  /**
+   * Present on a note that a later note redacted.
+   */
+  redactedBy?: NoteId;
+}
 /**
  * One right as the administrator's rights console shows it: a recorded `RightRecord` restated with the membership facts an administrator needs (`subjectMember`, `granterDeparted`), or a role-derived grant that carries no record. `git-ns/right/list` and `git-ns/right/issued-by-departed` are its only producers.
  */
@@ -4734,6 +4933,37 @@ export interface CapabilityScopeListed {
 export interface CapabilityScopeNone {
   scope: "none";
 }
+/**
+ * A content-addressed image held in the community's blob store — an avatar or an `image` field. At most 256 KiB, images only, re-encoded by the community on upload (vtc/directory/images/upload: metadata stripped, dimensions capped) so its digest does not link the member across communities. A viewer reads the bytes with vtc/directory/images/get, which answers only where the same projection shows the value. `url` and `urlExpiresAt` MAY appear in a projection: a short-lived URL the community checks against the same projection, so a member-only image is never a public URL. A community that does not offer one leaves both out.
+ */
+export interface CardBlobRef {
+  /**
+   * Lowercase hex SHA-256 of the stored, re-encoded bytes.
+   */
+  sha256: string;
+  /**
+   * Media type of the stored bytes.
+   */
+  mediaType: "image/png" | "image/jpeg" | "image/webp" | "image/avif";
+  /**
+   * Size in bytes of the stored bytes.
+   */
+  size?: number;
+  /**
+   * Projection only: a URL the viewer can fetch the image from until `urlExpiresAt`.
+   */
+  url?: string;
+  /**
+   * Projection only: when `url` stops working.
+   */
+  urlExpiresAt?: string;
+}
+/**
+ * A card's stored values, keyed by field. Holds `member`-, `admin`- and `credential`-sourced fields only; derived fields (`role`, `joinedAt`, `did`, `personhood`) are read from the community's own records when a projection is made, never stored here. At most 64 values, and at most 16 KiB serialized excluding the blobs a `CardBlobRef` names.
+ */
+export interface CardValues {
+  [k: string]: FieldValue | undefined;
+}
 /**
  * A whole Trust Task document — `id`, `type`, `payload` and every other member, `proof` included — carried between the VTA and the witness by the client: one the VTA built and signed for the client to send, or one the witness returned for the client to hand back. Typed as an open object so every member survives a round trip: carried exactly as built or received, never re-serialised, because its proof is over itself. Its envelope is checked by the VTA against the session record (CONVENTIONS.md §3), not by this schema.
  */
@@ -4768,6 +4998,25 @@ export interface ChunkedDescriptor {
   expectedSizeBytes: ExpectedSizeBytes;
   expiresAt: ExpiresAt;
 }
+/**
+ * Which claim a `claim` field accepts, from which credentials and issuers.
+ */
+export interface ClaimSelector {
+  /**
+   * A `type` the presented credential MUST carry.
+   */
+  credentialType: string;
+  /**
+   * JSON Pointer (RFC 6901) to the claim within `credentialSubject`.
+   */
+  claimPath: string;
+  /**
+   * Issuers the community accepts for this field. Absent: the community's trusted issuers for the credential type, as its own policy decides.
+   *
+   * @maxItems 32
+   */
+  issuers?: string[];
+}
 /**
  * OPTIONAL. How the community asks to be shown to a prospective applicant: a name, an accent colour and a logo. Presentation only, self-asserted and unverified — `communityDid` identifies the community, never `branding`. Not part of any criterion, so not covered by a `requirementsDigest`. Every member is optional.
  */
@@ -5103,6 +5352,24 @@ export interface ContactDocument {
     provenance?: Provenance;
   }[];
 }
+/**
+ * One of the holder's lists, as their agent keeps it. A list is context-scoped, like the contacts it holds: it may hold contacts known by any persona in its context, and contacts from any number of communities, but never a contact of another context.
+ */
+export interface ContactList {
+  listId: ListId;
+  name: ListName;
+  colour?: ListColour;
+  order: ListOrder;
+  /**
+   * How many of the context's contacts are on the list now.
+   */
+  contactCount: number;
+  createdAt: string;
+  /**
+   * When the list's name, colour or order last changed. Adding a contact to the list or removing one does not move it.
+   */
+  updatedAt: string;
+}
 /**
  * One received version of a contact's document. Revisions exist because an address book that silently replaces a payment address is a phishing surface, and one that says what changed and when is a defence.
  */
@@ -5848,6 +6115,138 @@ export interface DidcommAuthcryptEnvelope_VaultV0_2 {
    */
   jwe: string;
 }
+/**
+ * A member's own directory record: their values, a visibility for each field, their discoverability and who may ask to be introduced. Returned whole only to its subject. Every other reader receives a `DirectoryEntry`.
+ */
+export interface DirectoryCard {
+  entryId: EntryId;
+  values: CardValues;
+  visibility: FieldVisibility;
+  discoverability: Discoverability;
+  introductions: Introductions;
+  /**
+   * The community groups whose members count as the `groups` audience for this card. Absent: every community group the subject belongs to. A group the subject has left stops counting at once.
+   *
+   * @maxItems 64
+   */
+  groupAudience?: string[];
+  externalCard?: ExternalCard;
+  /**
+   * Incremented on every accepted change to the card, by its subject or by an administrator's assertion.
+   */
+  revision: number;
+  /**
+   * When the card last changed.
+   */
+  updatedAt: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1. An extension member MUST NOT carry directory data that bypasses the projection.
+   */
+  ext?: Ext;
+}
+/**
+ * The statement itself. Every member is generated from the community's configuration when the statement is read. `statementDigest` names this exact statement, so an applicant can record which one it was shown.
+ */
+export interface DirectoryDisclosure {
+  /**
+   * Every active field, base and community-defined, in display order. A base field the community has disabled is absent, which is how a reader learns it is not collected.
+   *
+   * @maxItems 128
+   */
+  fields: DisclosedField[];
+  newCard: NewCardDefaults;
+  /**
+   * The widest audience a member's membership identifier — the DID they joined with — can reach through the directory: the ceiling of the base field `did`, or `admins` where that field is disabled. `members` or `public` means a member may choose to show it that widely; a new card never shows it beyond `admins` (VTI-DIR-042). Administrators always see it.
+   */
+  membershipIdentifiers: Audience;
+  /**
+   * Whether administrators keep notes about members. Notes are never on a card and never reach another member; a member may ask for the notes about them.
+   */
+  adminNotes: boolean;
+  groups?: GroupDisclosure;
+  /**
+   * Whether a member may publish a card beyond the community: their `public` values, signed by them, offered through the community's trust registry. Always the member's own choice, and off on a new card. False where the community cannot publish external cards.
+   */
+  externalCards: boolean;
+  /**
+   * Digest over the RFC 8785 (JCS) canonicalization of this statement with the `statementDigest` member removed, as a multibase-encoded multihash (SHA-256 and base58btc RECOMMENDED). Changes exactly when what the statement says changes.
+   */
+  statementDigest: DigestMultibase;
+  ext?: Ext;
+}
+/**
+ * One entry as a particular viewer sees it.
+ */
+export interface DirectoryEntry {
+  entryId: EntryId;
+  fields: EntryFields;
+  /**
+   * Present, and `true`, only when the viewer is one of the two parties to an attributed, in-force verified relationship with this entry's member that the community can see. Absent otherwise — never `false`, which would disclose that the community looked and found none. Relationships known only to the viewer's own agent are badged by that agent, not here.
+   */
+  connected?: boolean;
+  /**
+   * The community groups the viewer and this member both belong to, among those whose membership the viewer may see. Absent when there are none.
+   *
+   * @maxItems 64
+   */
+  sharedGroups?: string[];
+}
+/**
+ * Links a contact to the entry in a community's member directory it corresponds to, so the holder's own client can join that community's directory with the holder's address book — showing a star or a petname beside an entry — without either side telling the other. The community never learns the link exists; the contact never learns it either. A contact has at most one.
+ */
+export interface DirectoryRef {
+  /**
+   * The DID of the community whose directory holds the entry.
+   */
+  vtcDid: string;
+  /**
+   * The entry, as that community's directory identifies it.
+   */
+  entryId: DirectoryEntryId;
+}
+/**
+ * One active field of the community's directory, as an applicant needs to see it: what it is, who writes its value, the widest audience it may ever reach and the audience a new card gives it. Disabled and retired fields are not listed: no projection shows them.
+ */
+export interface DisclosedField {
+  key: FieldKey;
+  label: FieldLabel;
+  description?: FieldDescription;
+  type: FieldType;
+  /**
+   * Who writes the value. `admin` and `credential` matter most to an applicant: an `admin` field holds what the community asserts about the member, which the member reads and cannot change.
+   */
+  source: FieldSource;
+  /**
+   * The widest audience the field may ever reach, whatever the member chooses.
+   */
+  ceiling: Audience;
+  /**
+   * The audience a new card gives the field until its member chooses. Never wider than `ceiling`.
+   */
+  defaultVisibility: Audience;
+  /**
+   * Whether a member's search may match the field, within what the searcher may see.
+   */
+  searchable: boolean;
+  /**
+   * Whether members may filter on the field and see counts by its values. Absent: false.
+   */
+  facet?: boolean;
+}
+/**
+ * The member's three discoverability decisions, made separately.
+ */
+export interface Discoverability {
+  listing: Listing;
+  /**
+   * What a member's search may match. `byName`: `displayName` or `nickname`. `exactNickname`: only an exact `nickname`. `off`: nothing. A DID is never a search key for a non-administrator, whatever this says.
+   */
+  search: "byName" | "exactNickname" | "off";
+  /**
+   * Whether the member publishes a public card — the fields whose visibility is `public`, signed by the member — through the community's trust registry. A second consent, separate from registry-publication consent (`publishConsent`), which it requires. A community that cannot yet publish external cards refuses `true` with `notAvailable`.
+   */
+  external: boolean;
+}
 export interface DomainEntry {
   /**
    * Hosting domain name (e.g. `did.example.com`). Compared case-insensitively; producers SHOULD emit lowercase canonical form.
@@ -5925,6 +6324,149 @@ export interface DriftItem {
    */
   expected?: string;
 }
+/**
+ * A dynamic group's membership rule: a member belongs when every condition holds and they have not opted out. The community evaluates it under its `groups` policy and recomputes membership whenever a fact it reads changes, always excluding opted-out entries.
+ */
+export interface DynamicRule {
+  /**
+   * @minItems 1
+   * @maxItems 16
+   */
+  all:
+    | [RuleCondition]
+    | [RuleCondition, RuleCondition]
+    | [RuleCondition, RuleCondition, RuleCondition]
+    | [RuleCondition, RuleCondition, RuleCondition, RuleCondition]
+    | [RuleCondition, RuleCondition, RuleCondition, RuleCondition, RuleCondition]
+    | [RuleCondition, RuleCondition, RuleCondition, RuleCondition, RuleCondition, RuleCondition]
+    | [RuleCondition, RuleCondition, RuleCondition, RuleCondition, RuleCondition, RuleCondition, RuleCondition]
+    | [
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition
+      ]
+    | [
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition
+      ]
+    | [
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition
+      ]
+    | [
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition
+      ]
+    | [
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition
+      ]
+    | [
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition
+      ]
+    | [
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition
+      ]
+    | [
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition
+      ]
+    | [
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition,
+        RuleCondition
+      ];
+}
 /**
  * One consequence of executing the pending task, authored by the executor that is about to run it. An effect is produced by dry-running the real handler against the executor's own prior state — never by the requester, and never by re-implementing the handler's semantics elsewhere. A consent surface renders ONLY effects it received under the executor's signature.
  */
@@ -6028,6 +6570,22 @@ export interface EndorsementType {
    */
   createdByDid?: string;
 }
+/**
+ * The fields of one entry that a particular viewer may see, keyed by field: the intersection of the member's visibility, the community's ceiling and policy, plus any derived fields that intersection admits. A withheld field is ABSENT, never null.
+ */
+export interface EntryFields {
+  [k: string]: FieldValue | undefined;
+}
+export interface EnumOption {
+  /**
+   * The stored value.
+   */
+  value: string;
+  /**
+   * What a reader is shown for it.
+   */
+  label: string;
+}
 /**
  * What a room writes into its own witnessed log, so that a host serving a stale, forked or partial view of it becomes **evident rather than merely possible**.
  *
@@ -6146,6 +6704,20 @@ export interface ExternalAccount {
   createdAt: string;
   updatedAt: string;
 }
+/**
+ * Where the member's external card stands. Present on a card exactly when `discoverability.external` is true. `published`: the community is serving the card the member signed, and its trust registry points to it. `awaitingSignature`: the member's `public` values have changed since they signed, so the community has withdrawn the card it was serving and serves none until the member signs the current values (vtc/directory/card/publish). The community never serves a card the member did not sign, and never one that differs from their current `public` values.
+ */
+export interface ExternalCard {
+  state: "published" | "awaitingSignature";
+  /**
+   * Present while `published`: digest of the card served, as vtc/directory/card/publish defines it.
+   */
+  cardDigest?: DigestMultibase;
+  /**
+   * Present while `published`: when the card now served was published.
+   */
+  publishedAt?: string;
+}
 /**
  * One displayed value, with where it comes from and how to render it.
  */
@@ -6165,6 +6737,108 @@ export interface Field {
     [k: string]: unknown | undefined;
   };
 }
+/**
+ * Per-type constraints. A member that does not apply to the field's type is refused by the community with `valueInvalid` when the definition is written.
+ */
+export interface FieldConstraints {
+  maxLength?: number;
+  minLength?: number;
+  /**
+   * ECMA-262 regular expression a text value MUST match.
+   */
+  pattern?: string;
+  /**
+   * The permitted values of an `enum` or `multiEnum` field.
+   *
+   * @minItems 1
+   * @maxItems 128
+   */
+  options?: [EnumOption, ...EnumOption[]];
+  maxItems?: number;
+  minDate?: string;
+  maxDate?: string;
+  claim?: ClaimSelector;
+}
+/**
+ * One field of the community's directory schema, as the community holds it. The audience order `admins` < `groups`/`connections` < `members` < `public` applies to `ceiling` and `defaultVisibility`; `defaultVisibility` is never wider than `ceiling`.
+ */
+export interface FieldDefinition {
+  key: FieldKey;
+  label: FieldLabel;
+  description?: FieldDescription;
+  type: FieldType;
+  constraints?: FieldConstraints;
+  source: FieldSource;
+  /**
+   * `true` for a base field, present in every community; `false` for a field this community defined.
+   */
+  base: boolean;
+  /**
+   * Where the field lands when an entry is exported as a JSContact Card (RFC 9553), e.g. `name.full`, `nicknames`, `speakToAs.pronouns`. Absent: a vendor-specific property named by the key.
+   */
+  jsContactPath?: string;
+  required: boolean;
+  ceiling: Audience;
+  defaultVisibility: Audience;
+  searchable: boolean;
+  facet: boolean;
+  order: number;
+  state: FieldState;
+  /**
+   * When the field was retired. Present only on a retired field.
+   */
+  retiredAt?: string;
+  /**
+   * When the values of a retired field are purged. Present only on a retired field.
+   */
+  purgeAfter?: string;
+  updatedAt?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1. An extension member MUST NOT widen a ceiling.
+   */
+  ext?: Ext;
+}
+/**
+ * What an administrator supplies to define a community field. `key`, `type` and `source` are fixed for the field's life.
+ */
+export interface FieldInput {
+  key: FieldKey;
+  label: FieldLabel;
+  description?: FieldDescription;
+  type: FieldType;
+  constraints?: FieldConstraints;
+  /**
+   * As `FieldSource`, less `derived`, which only base fields carry.
+   */
+  source: "member" | "admin" | "credential";
+  /**
+   * Whether a card must hold a value for its entry to be listed. Never a condition of membership. Absent: false.
+   */
+  required?: boolean;
+  ceiling: Audience;
+  /**
+   * The audience a card gives the field until its member chooses. MUST NOT be wider than `ceiling`.
+   */
+  defaultVisibility: Audience;
+  /**
+   * Whether a member's search may match the field, within what the searcher may see. Absent: false.
+   */
+  searchable?: boolean;
+  /**
+   * Whether the field may be filtered on and counted. Only `enum`, `multiEnum` and `country` fields may be facets. Absent: false.
+   */
+  facet?: boolean;
+  /**
+   * Display order, ascending.
+   */
+  order?: number;
+}
+/**
+ * The audience the member chose for each field. A field with no entry here takes its definition's `defaultVisibility`. The community MUST NOT widen a member's choice: widening a field's ceiling or default changes no visibility already recorded.
+ */
+export interface FieldVisibility {
+  [k: string]: Audience | undefined;
+}
 /**
  * The `file` member of a sealed record body: everything that describes a file, sealed with the record, signed by the record's author, and never seen by the host. Defined here so that clients interoperate; no host task carries it, because the host receives only ciphertext.
  *
@@ -6260,6 +6934,131 @@ export interface GitNamespace {
    */
   state: "pending" | "bound";
 }
+/**
+ * A grant set the group confers: each capability is written onto every member's access-control entry as a resource grant whose source is the group, bounded by the member's role ceiling and by the binder's own holdings.
+ */
+export interface GrantsBindingSpec {
+  kind: "grants";
+  /**
+   * @minItems 1
+   * @maxItems 32
+   */
+  grants: [CapabilityRef, ...CapabilityRef[]];
+}
+/**
+ * A community group, as a caller who may see it sees it. Members a caller may not see are absent: `memberCount` only to those who may see the group's members, `managers` and `credentialAuthorityValidUntil` only to its managers.
+ */
+export interface Group {
+  groupId: GroupId;
+  /**
+   * The group's own DID, minted by the community's VTA for this group alone. It issues the group's membership credentials. Its DID document carries no name or description.
+   */
+  groupDid: string;
+  name: GroupName;
+  description?: GroupDescription;
+  kind: GroupKind;
+  /**
+   * Present exactly when `kind` is `dynamic`.
+   */
+  rule?: DynamicRule;
+  /**
+   * Present exactly when `kind` is `static`.
+   */
+  joinPolicy?: JoinPolicy;
+  /**
+   * Who may see that the group exists, and its name and description.
+   */
+  visibility: GroupAudience;
+  /**
+   * Who may see the group's member list. Separate from `visibility`: a group everyone sees may show its members only to administrators. Never wider than `visibility`.
+   */
+  showMembers: GroupAudience;
+  /**
+   * Whether the group's DID issues its members a membership credential. Default true.
+   */
+  issuesCredentials: boolean;
+  /**
+   * `true` while the group has a `grants` or `role` binding. Such a group is `static` and `closed` for as long as it does.
+   */
+  carriesAuthority: boolean;
+  /**
+   * Active members. Only to callers who may see the member list.
+   */
+  memberCount?: number;
+  /**
+   * Entries holding `vtc.groups.manage` qualified to this group, read from the access-control list. Informational: managers are appointed by an access-control grant, never by this record.
+   *
+   * @maxItems 256
+   */
+  managers?: EntryId[];
+  /**
+   * When the community's authorization credential to the group expires. The community renews it well before.
+   */
+  credentialAuthorityValidUntil?: string;
+  createdAt: string;
+  /**
+   * The creating administrator's directory entry, where they have one.
+   */
+  createdBy?: EntryId;
+  updatedAt?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1. An extension member MUST NOT carry authority.
+   */
+  ext?: Ext;
+}
+export interface GroupBinding {
+  bindingId: BindingId;
+  binding: BindingSpec;
+  /**
+   * `pending`: waiting for the consent the community requires. `active`: in force; the community's reconciler keeps members' admissions and grants in line with it. `removing`: being withdrawn; the reconciler is removing what only this binding provided.
+   */
+  state: "pending" | "active" | "removing";
+  createdAt: string;
+  createdBy?: string;
+}
+/**
+ * Present when the community has groups. A member of a group holds a credential, issued by the group's own identifier, that evidences their membership, and can present it outside the community — which is why an applicant is told.
+ */
+export interface GroupDisclosure {
+  /**
+   * How long each group membership credential is valid for, as an ISO 8601 duration in weeks, days, hours, minutes and seconds (`P30D`). It is renewed while the member stays in the group, and a credential already issued stays valid until it expires even after its holder leaves.
+   */
+  credentialValidity: string;
+}
+export interface GroupJoinRequest {
+  requestId: JoinRequestId;
+  groupId: GroupId;
+  entryId: EntryId;
+  message?: JoinRequestMessage;
+  createdAt: string;
+  state: "pending" | "approved" | "declined" | "withdrawn";
+  decidedAt?: string;
+  /**
+   * The manager who decided. Shown to managers only.
+   */
+  decidedBy?: string;
+}
+export interface GroupMember {
+  entryId: EntryId;
+  source: MembershipSource;
+  since: string;
+  /**
+   * `active`: a member. `pending`: an addition to a group carrying authority that is waiting for the consent the community requires for a grant.
+   */
+  state: "active" | "pending";
+  /**
+   * The member's directory fields that the caller may see, projected exactly as vtc/directory/entries/show would project them. Absent when the caller may see none.
+   */
+  fields?: EntryFields;
+  /**
+   * The member's current group membership credential, or null when the group issues none.
+   */
+  credentialId?: GroupCredentialId | null;
+  /**
+   * When the member's current group credential expires. Shown to the member themselves and to managers only.
+   */
+  credentialValidUntil?: string;
+}
 /**
  * The applicant's proof that distinct eligible vetters of the community vetted it, as a join submission carries it under `extensions.hiddenVetting`. Built by vta/pcs/prove, verified by the community.
  */
@@ -6520,6 +7319,12 @@ export interface IssuedCredentialBase {
    */
   expiresAt: string;
 }
+/**
+ * One entry exported as a JSContact `Card` (RFC 9553). Member names inside are JSContact's own and are carried verbatim. `uid` is `urn:vtc-directory:<EntryId>`. Base fields map as their definitions' `jsContactPath` says (`displayName` → `name.full`, `nickname` → `nicknames`, `avatar` → `media` of kind `photo`, `pronouns` → `speakToAs.pronouns`, `bio` → `notes`, `links` → `links`); community fields and derived fields are exported as vendor-specific properties named by their field key. Additional members are permitted because JSContact defines them. Carried as an open object so that no JSContact member is lost in transit: a consumer MUST check that `@type` is `Card`, `version` is `1.0` and `uid` is `urn:vtc-directory:<EntryId>`, which this schema does not constrain.
+ */
+export interface JSContactCard {
+  [k: string]: unknown | undefined;
+}
 /**
  * Whether this community answers vtc/join-requests/manifest to a caller it cannot identify.
  */
@@ -6737,6 +7542,12 @@ export interface LimitTarget {
    */
   member?: string;
 }
+/**
+ * The community's listing settings. `defaultListing`: the listing a new card starts with (default `listed`). There is no floor: every member may always choose `hidden`, and a community cannot hold an entry above its member's choice. Raising `defaultListing` affects new cards only.
+ */
+export interface ListingDefaults {
+  defaultListing: Listing;
+}
 export interface LocalSettings {
   kind: "local";
   /**
@@ -7152,6 +7963,23 @@ export interface MonitorFilter {
    */
   failuresOnly?: boolean;
 }
+/**
+ * The discoverability a card has when the community creates it, before its member chooses. A new card is never published beyond the community (VTI-DIR-042), so there is no member for that here: `externalCards` says whether the member may turn it on.
+ */
+export interface NewCardDefaults {
+  /**
+   * The listing a new card starts with: the community's `defaultListing` (vtc/directory/fields/list). Every member may always choose `hidden`.
+   */
+  listing: Listing;
+  /**
+   * What a member's search may match, as the card's `discoverability.search`.
+   */
+  search: "byName" | "exactNickname" | "off";
+  /**
+   * From whom a new card accepts introductions. Absent where the community does not deliver introductions.
+   */
+  introductions?: Introductions;
+}
 /**
  * A community's offer of admission to a room it owns, as the member it is addressed to sees it.
  */
@@ -7663,6 +8491,14 @@ export interface PublicKeyCredentialRequestOptions {
   allowCredentials?: PublicKeyCredentialDescriptor[];
   userVerification?: "discouraged" | "preferred" | "required";
 }
+/**
+ * A member's external card: a JSContact `Card` (RFC 9553) holding exactly their values whose visibility is `public`, mapped as `JSContactCard` maps them, with the member's W3C Data Integrity `proof`. The community serves it as received and never signs, composes or edits it (VTI-REG-004 item 4).
+ *
+ * Carried as an open object, and deliberately so: the proof covers every member of the card, and a typed binding that kept only the members named here would drop the rest and break the signature. So this schema constrains none of its members, and a consumer MUST check them itself: `@type`, `version`, `uid` and `proof` are present; `@type` is `Card`; `version` is `1.0`; `uid` is `urn:vtc-directory:<EntryId>`; `proof` is a `DataIntegrityProof` with `cryptosuite` `eddsa-jcs-2022` or `ecdsa-jcs-2019`, `proofPurpose` `assertionMethod`, and a `verificationMethod` of the member's membership DID authorized for `assertionMethod`; and the proof verifies over the card without it, before any member is relied on.
+ */
+export interface PublishedCard {
+  [k: string]: unknown | undefined;
+}
 /**
  * The parameters exactly as they now appear in this community's join manifest, under vetting.ext. What an applicant and a vetter read.
  */
@@ -8250,6 +9086,13 @@ export interface RightRecord_GitNsV0_4 {
    */
   breakGlass?: BreakGlass;
 }
+/**
+ * A grant set by reference: the capability ceiling of a defined role, conferred as resource grants exactly as a `grants` binding confers its list. It never assigns the role itself — an entry's administrative role and its community role stay direct assignments.
+ */
+export interface RoleBindingSpec {
+  kind: "role";
+  role: RoleName;
+}
 /**
  * One administrative role of a VTC: a name, the CEILING of capabilities an entry holding the role may hold, and the approve ceiling of capabilities it may approve.
  *
@@ -8430,6 +9273,21 @@ export interface RollbackResult {
   serverless?: boolean;
   ext?: Ext;
 }
+/**
+ * Links a room the community owns to the group: joining the group offers the member admission to the room with `actions`, valid for `validFor`; leaving removes them unless another source still covers them.
+ */
+export interface RoomBindingSpec {
+  kind: "room";
+  /**
+   * The community-owned room's DID.
+   */
+  roomId: string;
+  actions: MemberActions;
+  /**
+   * How long each admission's authority runs, as an ISO 8601 duration in whole days (`P365D`). The community renews it while the member stays in the group.
+   */
+  validFor: string;
+}
 /**
  * How much a host is willing to store for one room, at the room and per member. A hosting decision, set by the host and never by anything in the room's credentials. An upload must fit every scope at once: the object against the smallest `maxFileBytes` that applies, and the member and the room with the file added.
  */
@@ -8603,6 +9461,26 @@ export interface RotationRecord {
    */
   cacheHorizonAt?: string;
 }
+/**
+ * One test over a verified fact about a member. `fact: role` tests the member's community role; `fact: field` tests an `admin`- or `credential`-sourced directory field named by `field`; `fact: personhood` tests whether a personhood assertion is on file; `fact: joinedAt` tests when they joined. A rule never reads a self-asserted (`member`-sourced) field: a member must not be able to join a group by editing their card.
+ */
+export interface RuleCondition {
+  fact: "role" | "field" | "personhood" | "joinedAt";
+  /**
+   * Present exactly when `fact` is `field`.
+   */
+  field?: FieldKey;
+  /**
+   * `equals` compares with `value`; `oneOf` with any of `values`; `exists` needs neither; `before` and `after` compare a date fact with `value`.
+   */
+  op: "equals" | "oneOf" | "exists" | "before" | "after";
+  value?: string | boolean;
+  /**
+   * @minItems 1
+   * @maxItems 64
+   */
+  values?: [string, ...string[]];
+}
 export interface S3Settings {
   kind: "s3";
   /**
@@ -8694,7 +9572,7 @@ export interface Context_VtaV0_1 {
  */
 export interface SealedRecord {
   /**
-   * The sealed record, base64url. Bound by AEAD associated data to `roomId`, `key`, `version` and `epoch`, so a host that relocates it to another key, version, epoch or room produces a mismatch and the open fails. The record cannot be moved undetected even though the host holds every byte of it.
+   * The sealed record, base64url. Bound by AEAD associated data to `roomId`, `key`, the version it was sealed at, and `epoch`, so a host that relocates it to another key, version, epoch or room produces a mismatch and the open fails. The record cannot be moved undetected even though the host holds every byte of it. The version it was sealed at is `version` below where present, and the record's own `version` otherwise.
    */
   ciphertext: string;
   /**
@@ -8705,6 +9583,14 @@ export interface SealedRecord {
    * The key epoch this record was sealed under. Cleartext because the host must serve the right ciphertext, and bound into the associated data so that relabelling it fails authentication rather than causing a reader to try the wrong key.
    */
   epoch: number;
+  /**
+   * The version this ciphertext was sealed at, where that is no longer the record's own `version`. A record's version moves when it is curated (`rooms/records/curate`, which MUST assign a new one so that every `sinceVersion` watermark sees the change), but a curation other than a retraction keeps the body — and the body is bound, by the AEAD and by its author's signature (`SealedRecordBody`), to the version it was written at. Without this member a curated record would be opened at a version it was never sealed for, and would not open for anyone.
+   *
+   * A host MUST record the version a body was sealed at when it stores it, MUST NOT change it while that body is kept — a curation alters a record's standing, never its sealed content — and MUST include it whenever it differs from the record's `version`. It is absent where the two are equal, which is every record that has not been curated since it was written, so the members a record carries are unchanged until a curation needs this one. It is part of `sealed`, and so of the record the data commitment covers (`CommittedRecord`): a host cannot change it without changing the root.
+   *
+   * A reader opens and verifies the body at this version, and MUST refuse a record whose `sealed.version` is greater than its own `version` — a body cannot have been sealed for a version the room had not reached. A host that pairs a newer version with an older body of the same key is rolling the record back; that is a change to the committed record like any other, visible to the comparisons `CommittedRecord` exists for.
+   */
+  version?: number;
 }
 /**
  * Who the service says it is.
@@ -9912,6 +10798,31 @@ export interface VerdictWith {
    */
   presentationDefinition?: {};
 }
+/**
+ * The value of a `credential`-sourced field: a claim the member disclosed from a credential they presented, with the issuer that attests it. A verified value always names its issuer, and a self-asserted value is never shaped as one. The community keeps only the disclosed claim and these facts about it — never the presentation.
+ */
+export interface VerifiedValue {
+  /**
+   * The disclosed claim value.
+   */
+  value: string | boolean | number;
+  /**
+   * DID of the credential's issuer, shown as the field's verification badge.
+   */
+  issuer: string;
+  /**
+   * The most specific `type` of the credential the claim came from.
+   */
+  credentialType?: string;
+  /**
+   * When the community verified the presentation.
+   */
+  verifiedAt: string;
+  /**
+   * When the credential expires, where it does. The community withdraws the value once it passes.
+   */
+  validUntil?: string;
+}
 /**
  * An event the vetter will attend and vet at. `endDate` is on or after `startDate` and no more than 31 days after it; JSON Schema cannot compare two members, so the community checks both and refuses a violation with `malformedRequest`.
  */