@openvtc/trust-tasks 0.26.20 → 0.26.21

package/CHANGELOG.md

@@ -11,6 +11,81 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.26.21 — 2026-10-19
+
+
+### Added
+
+- **voting**: Community voting — voting/* (the ballot box), vtc/elections/* (the registrar) and vta/pcs/voter/* + vta/pcs/vote (the voter's agent) (#834)
+
+* feat(voting): community voting — voting/* (the ballot box), vtc/elections/* (the registrar) and vta/pcs/voter/* + vta/pcs/vote (the voter's agent)
+
+  Twenty-one draft 0.1 tasks for VTI-VOT-001 – 100 (dtgwg-vti-spec, Community
+  Voting chapter). A member proves only that they may vote, never who they are,
+  and anyone permitted to read the board can recount it.
+
+  - voting/_shared/0.1: CONVENTIONS.md (separation of registrar and ballot box,
+    the exact cryptographic binding — deployment label, ticket class
+    voter/<electionId>, hash-to-G1 election point, framed ballot context, cast,
+    admission, RFC 9162 board hashing — authorization, VTA custody, privacy,
+    shared error local parts, retry safety) and voting.schema.json (Manifest,
+    Question, Ballot, Cast, BoardHead, BoardEntry, MerklePath, ElectionResult,
+    ElectionSummary, VotingParameters, Disclosure …).
+  - voting/*: election/{register,show,close,cancel}, ballot/cast (HTTPS binding
+    always accepted, one-time did:key issuer, signed receipt, idempotent),
+    board/{head,read,inclusion,consistency}, result/show. 0.1 serves open
+    elections only; sealed and tallied-encrypted await the trustee tasks.
+  - vtc/elections/*: create (binding elections park for a second
+    administrator), list, show (disclosure, kept checkpoints, certified result),
+    close, cancel, certify (the VTC verifies the board itself), tickets/issue
+    (blind, one per eligible party, recorded before answering).
+  - vta/pcs/voter/{register,accept,receipt} and vta/pcs/vote: a voter key per
+    election, the blinded ticket request, the signed cast document the client
+    sends itself, receipt keeping and inclusion checking. New capability
+    `pcsVoter` in device/_shared/0.2 Capability.
+
+  Bindings regenerated (Rust, TypeScript, Go, Dart); check-bindings agrees and
+  the Rust conformance suite passes. Reference implementation of the binding:
+  vti-voting in verifiable-trust-infrastructure.
+
+- **vtc/groups**: Appointing group managers — vtc/groups/managers/{add,remove}/0.1; create refuses an unserved dynamic group (#833)
+
+* feat(vtc/groups): appointing group managers — vtc/groups/managers/{add,remove}/0.1; create refuses an unserved dynamic group
+
+  The groups family made a manager an access-control resource grant,
+  `vtc.groups.manage` qualified `group:<groupId>`, "never this record". But no
+  task wrote that grant. The general `acl/grant` caps a grant by the holder's
+  role ceiling, so only an administrator could ever manage a group.
+
+  - vtc/groups/managers/add/0.1: a manager of the group, or a holder of the
+    unqualified capability, appoints an active member. The appointment is a
+    resource grant on the appointee's entry, delegated by the signer, which sits
+    beside the role and never inside its ceiling, so a member with no
+    administrative role may hold it. The signer must cover the grant. It is
+    reviewed like any delegated grant when its granter departs, and withdrawn
+    with the group or the holder's departure. The group's record never decides
+    who manages it. Codes: notFound, entryNotFound, alreadyManager.
+  - vtc/groups/managers/remove/0.1: a manager steps down, or a holder of the
+    unqualified capability removes another manager's appointment. Managers of
+    one group do not remove one another. Codes: notFound, notManager.
+  - vtc/groups/create: `kindNotServed` lets a community that serves only static
+    groups refuse a dynamic one after checking its rule. It never stores a
+    dynamic group it does not compute.
+  - group.schema.json: `managers` points at the new task.
+
+
+
+### Fixed
+
+- **device**: PcsVoter is appended to Capability, not inserted — no existing variant moves (#835)
+- **vtc/directory/card/present**: A Data Integrity presentation binds through its signed nonce and domain (#831)
+
+Producer conformance required a Data Integrity presentation's proof to carry `challenge` equal to the document's `id` and `domain` equal to the community's DID. Neither member is signed by the Data Integrity libraries the implementations use: a proof stating them either fails to verify or carries them unsigned, where they bind nothing. The presentations this ecosystem already produces for a verifier (`vta_sdk::vp::build_di_vp`, the OpenID4VP DI path, the personhood assertion) put `nonce` and `domain` on the presentation itself, which the holder's proof covers.
+
+  The binding is now the presentation's own `nonce` (this document's `id`) and `domain` (the community's DID), signed by the holder proof; a proof that also states `challenge` or `domain` must state the same values. The consumer's item 3 is unchanged: it verifies "the binding above".
+
+  No schema change beyond the presentation's description; the generated libraries carry the new text in their documentation.
+
 ## 0.26.20 — 2026-10-19
 
 

package/dist/_shared/components.d.ts

@@ -385,6 +385,14 @@ export type BindingSpec = RoomBindingSpec | GrantsBindingSpec | RoleBindingSpec;
  * The name of one blob: the digest of its BlobManifest, taken over the manifest's RFC 8785 (JCS) canonicalization. sha2-256 is RECOMMENDED and MUST be implemented. Content addressing over ciphertext, never plaintext, so a BlobRef says nothing about what the file contains, and two uploads of one file have different BlobRefs (a fresh `fileId` gives a different key, and so different ciphertext). Rooms cannot be correlated by the files they share. Compared as decoded multihash bytes, never as encoded strings. A BlobRef is defined over the manifest's JSON, as this schema states it and RFC 8785 canonicalizes it, never over any binding's generated type: two bindings that model the manifest as distinct types still compute the same BlobRef from the same JSON.
  */
 export type BlobRef = DigestMultibase;
+/**
+ * One leaf of a board. A leaf's hash is the RFC 9162 leaf hash of the JCS canonicalization of this object. Entries carry no time of arrival: the order is the board's, and a timestamp would hand anyone who reads the board the timing the registrar's log would need to pair a ticket with its cast.
+ */
+export type BoardEntry = CastEntry | ReplacementEntry | LifecycleEntry | ResultEntry;
+/**
+ * `public`: anyone reads the board. `private`: the community, the auditors the manifest names and, for one cast's inclusion, the holder of its receipt (VTI-VOT-052).
+ */
+export type BoardVisibility = "public" | "private";
 /**
  * The control-plane account of a bundle transfer: which algorithm, on what terms, until when. Exactly one of the two shapes — they are mutually exclusive, since StreamDescriptor requires `transportUrl` and `transportToken` and forbids `chunks`, and ChunkedDescriptor requires `chunks` and forbids both.
  */
@@ -412,7 +420,7 @@ export type Capability_DeviceV0_1 = "vault-read" | "vault-write" | "proxy-login"
 /**
  * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each. Capability values are additive: a consumer MUST ignore a value it does not recognise rather than reject the binding, and MUST NOT treat an unrecognised value as conferring anything.
  */
-export type Capability_DeviceV0_2 = "vaultRead" | "vaultWrite" | "proxyLogin" | "fillRelease" | "policyAdmin" | "deviceAdmin" | "sign" | "keyMint" | "signTrustTask" | "credentialWrite" | "memoryRead" | "memoryWrite" | "roomPresent" | "roomOpen" | "keyExport" | "signSshsig" | "signJws" | "signCsr" | "signDocument" | "externalAccountsManage" | "externalAuthUse" | "pcsVetter" | "pcsApplicant" | "witnessRequest";
+export type Capability_DeviceV0_2 = "vaultRead" | "vaultWrite" | "proxyLogin" | "fillRelease" | "policyAdmin" | "deviceAdmin" | "sign" | "keyMint" | "signTrustTask" | "credentialWrite" | "memoryRead" | "memoryWrite" | "roomPresent" | "roomOpen" | "keyExport" | "signSshsig" | "signJws" | "signCsr" | "signDocument" | "externalAccountsManage" | "externalAuthUse" | "pcsVetter" | "pcsApplicant" | "witnessRequest" | "pcsVoter";
 /**
  * Number of chunks in the bundle, equal to ceil(expectedSizeBytes / chunkSize). Bounded at 4096 so that the manifest itself — one digest per chunk — fits in the single document that carries it under the same message-size reasoning as a chunk.
  */
@@ -564,6 +572,11 @@ export type Duration = string;
  * Whether the subject is permitted. The ABSENCE of any grant is treated as `deny` (default-deny).
  */
 export type Effect_ConsentV0_1 = "allow" | "deny";
+/**
+ * An election's identifier, unique within its community. A closed alphabet: it appears in the ticket class label `voter/<electionId>` and is framed into every hash a cast is bound to.
+ */
+export type ElectionId = string;
+export type ElectionState = "registered" | "registration" | "voting" | "closed" | "tallied" | "cancelled";
 /**
  * The three rights that carry authority over other people's rights: `git.ns.admin`, `git.repo.create` (which makes its holder the owner of every repository they create) and `git.repo.own`. Separation of duties applies to these: nobody grants one to themselves through git-ns/right/grant, or records one for themselves through any other task that grants on the actor's own authority. The explicit self-grant is git-ns/right/break-glass. `git.repo.maintain` and `git.commit.sign` are not elevated.
  */
@@ -744,10 +757,6 @@ export type JoinRequestId = string;
  * An optional note from the member to the group's managers. Plain text.
  */
 export type JoinRequestMessage = string;
-/**
- * Application-chosen identifier for a record within a namespace. Opaque to the maintainer: it MUST NOT be parsed, normalized, or case-folded, and prefix matching in `list` is a byte-prefix comparison over the UTF-8 encoding. Applications SHOULD use `/`-delimited hierarchical keys (`community/acme`, `contact/z6Mk…`) so that `prefix` can address a record family, but the delimiter is a convention between an application and itself — the maintainer attaches no meaning to it.
- */
-export type Key = string;
 /**
  * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.
  */
@@ -776,6 +785,14 @@ export type KeyStatus = "active" | "revoked";
  * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.
  */
 export type KeyType = "ed25519" | "x25519" | "p256" | "mldsa44" | "mldsa65";
+/**
+ * A question or option key, unique within its manifest or question.
+ */
+export type Key_VotingV0_1 = string;
+/**
+ * Application-chosen identifier for a record within a namespace. Opaque to the maintainer: it MUST NOT be parsed, normalized, or case-folded, and prefix matching in `list` is a byte-prefix comparison over the UTF-8 encoding. Applications SHOULD use `/`-delimited hierarchical keys (`community/acme`, `contact/z6Mk…`) so that `prefix` can address a record family, but the delimiter is a convention between an application and itself — the maintainer attaches no meaning to it.
+ */
+export type Key_VtaV0_1 = string;
 /**
  * The interaction kind: a 1:1 direct message, a multi-party group, or a broadcast channel.
  */
@@ -842,14 +859,24 @@ export type MemberState = "offered" | "admitted" | "removed";
  * How the member came to be in the group. `added`: by a manager. `joined`: they joined an open group. `requestApproved`: a manager approved their request. `rule`: a dynamic group's rule admits them.
  */
 export type MembershipSource = "added" | "joined" | "requestApproved" | "rule";
+/**
+ * An RFC 9162 audit or consistency path: the node hashes, in the order §2.1.3 / §2.1.4 define.
+ *
+ * @maxItems 64
+ */
+export type MerklePath = DigestMultibase[];
 /**
  * How the request reaches the approver. A CLOSED list. Version 0.1 defines `scan`: the starter shows a trigger link (as a QR code that is also a clickable link, TRIGGER-LINK.md) and the approver's wallet reads it. `code` (a typed code of at least 8 characters, under strict rate limits) and `push` (sent to the approver's enrolled devices) are reserved names.
  */
 export type Mode = "scan";
+/**
+ * A binary value, multibase base58btc over the suite's canonical (compressed) encoding.
+ */
+export type Multibase_VotingV0_1 = string;
 /**
  * A binary value, multibase base58btc over the suite's canonical encoding.
  */
-export type Multibase = string;
+export type Multibase_VtaV0_4 = string;
 /**
  * Scopes one application's records within a context, so several tools can share a context without colliding — `openvtc`, `cnm`, an agent runtime. The maintainer MUST NOT interpret the value; it is an opaque partition name. Namespaces are first-come and unreserved, so an application SHOULD pick a stable, specific one: a future per-namespace ACL would grant on this exact string, which makes renaming a namespace a migration rather than an edit.
  */
@@ -1157,6 +1184,10 @@ export type Purpose = "login";
  * A device's platform push channel — the body the device registers with its push GATEWAY (push wake-up binding, https://trusttasks.org/binding/push/0.1; modeled on Aries RFC 0699/0734). The gateway holds this token and returns an opaque WakeHandle in exchange; the token is held by the gateway ONLY, never by the mediator or the maintainer/VTA. The gateway uses it to send a contentless wake-up when an authorized trigger asks — the push payload never carries Trust Task content. Tagged union over the discriminator `platform`.
  */
 export type PushRegistration = Apns | Fcm | WebPush;
+/**
+ * One question. Tagged union over `type`.
+ */
+export type Question = ChoiceQuestion | RankingQuestion | ScoreQuestion | TextQuestion;
 /**
  * Which of an account's two queues. `receive` holds messages addressed to the account awaiting its pickup. `send` holds messages the account sent that are still held against it until their recipient deletes them — so a stalled recipient fills its senders' send queues.
  */
@@ -1265,6 +1296,10 @@ export type RetentionPolicy = "chained" | "fromJoin";
  * **Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.
  */
 export type RevocationEntry = CredentialRevocation | SubjectRevocation | RoomRevocation;
+/**
+ * What a later, different ballot under one ticket does: `replace` the earlier one, or be refused (`refuse`) (VTI-VOT-041).
+ */
+export type Revote = "replace" | "refuse";
 /**
  * One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.
  */
@@ -1343,6 +1378,10 @@ export type SealedEnvelope_VaultV0_2 = DidcommAuthcryptEnvelope_VaultV0_2 | Hpke
  * A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload, an ExternalCredentialPayload or, from external/credentials/issue 0.2 for `s3-static-presign`, a PresignedRequestSet. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of "the response" from ever holding a usable secret, whatever transport carried the document.
  */
 export type SealedTransferBundle = string;
+/**
+ * `open`: ballots are recorded on the board as cast. `sealed`: ballots are encrypted to a jointly generated election key and decrypted after voting closes. `talliedEncrypted`: ballots are encrypted and only the totals are ever decrypted (VTI-VOT-060). Version 0.1 of the voting tasks carries open ballots only; a ballot box refuses to register any other level with `voting/election/register:unsupportedSecrecy` until the trustee tasks are specified.
+ */
+export type SecrecyLevel = "open" | "sealed" | "talliedEncrypted";
 /**
  * Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.
  */
@@ -3936,6 +3975,19 @@ export interface AgentNameEntry {
     createdAt?: number;
     ext?: Ext;
 }
+/**
+ * The answer to one question. Exactly one member besides `question` is present, matching the question's type, or `abstain` for an optional question left unanswered.
+ */
+export interface Answer {
+    question: Key_VotingV0_1;
+    choice?: Key_VotingV0_1[];
+    ranking?: Key_VotingV0_1[];
+    scores?: {
+        [k: string]: number | undefined;
+    };
+    text?: string;
+    abstain?: true;
+}
 /**
  * A record as the maintainer holds it. `value` is absent in three distinct situations and a consumer MUST NOT conflate them: the record is a tombstone (`deleted` is true); the caller asked for a metadata-only view (`list` without `includeValues`); or the value genuinely is the JSON literal `null`, in which case `value` is PRESENT and null. This is why `deleted` is required rather than defaulted — a consumer that has to infer deletion from an absent value gets the tombstone case wrong exactly when convergence depends on it.
  */
@@ -3945,7 +3997,7 @@ export interface AppStateRecord {
      */
     contextId: string;
     namespace: Namespace;
-    key: Key;
+    key: Key_VtaV0_1;
     /**
      * The namespace counter value this record's most recent write took. Supply it as `expectedVersion` on the next write to make that write conditional on nothing having changed in between.
      */
@@ -4001,7 +4053,7 @@ export interface ApplicationSummary {
     /**
      * The applicant's PCS identifier: what a vetter attests to, carried in a vetting/request's `ext`.
      */
-    id: Multibase;
+    id: Multibase_VtaV0_4;
     /**
      * The metadata of each attestation held, in the order received. Metadata names no vetter.
      */
@@ -4125,7 +4177,7 @@ export interface Attestation {
     /**
      * The attestation: a tag, a shown class credential and a proof. It names no vetter.
      */
-    attestation: Multibase;
+    attestation: Multibase_VtaV0_4;
     meta: StatementMeta;
     token: AttestationToken;
 }
@@ -4140,11 +4192,11 @@ export interface AttestationToken {
     /**
      * The serial revealed by the spend.
      */
-    serial: Multibase;
+    serial: Multibase_VtaV0_4;
     /**
      * The re-randomised token signature, verifiable under the published token key.
      */
-    shown: Multibase;
+    shown: Multibase_VtaV0_4;
 }
 /**
  * One atomic fact a holder keeps about themselves. Several attributes MAY share a `type` — three phone numbers, a legal name and a preferred name — which is why `attributeId` is the identity of a fact and `type` is not. The pool is flat and unordered; ordering is a profile's concern.
@@ -4432,6 +4484,18 @@ export interface BackupEnvelope {
      */
     ciphertext: string;
 }
+/**
+ * An open ballot: one answer per question of the manifest, in any order. The bytes a cast's proof binds are the RFC 8785 (JCS) canonicalization of this object as received.
+ */
+export interface Ballot {
+    electionId: ElectionId;
+    manifestDigest: DigestMultibase;
+    /**
+     * @minItems 1
+     * @maxItems 128
+     */
+    answers: [Answer, ...Answer[]];
+}
 /**
  * The ciphertext manifest of one blob, committed by the uploader before any byte moves. Its digest is the BlobRef. Every chunk is checked against `chunks.chunkDigests` on arrival and the reassembled blob against `digest`, so a host can neither accept nor serve bytes the uploader did not commit to. The manifest also appears, by its BlobRef, inside the sealed FileManifest the author signs; a reader who opens the record therefore knows which ciphertext its author meant, and a host cannot substitute a different blob under the same record.
  *
@@ -4450,6 +4514,39 @@ export interface BlobManifest {
      */
     digest: DigestMultibase;
 }
+export interface CastEntry {
+    kind: "cast";
+    cast: Cast;
+}
+/**
+ * The cast at `replaces` is no longer counted: a later cast under the same tag is.
+ */
+export interface ReplacementEntry {
+    kind: "replaced";
+    tag: Multibase_VotingV0_1;
+    replaces: number;
+    by: number;
+}
+export interface LifecycleEntry {
+    kind: "opened" | "closed" | "closedEarly" | "cancelled";
+    at: string;
+}
+export interface ResultEntry {
+    kind: "result";
+    result: ElectionResult;
+}
+/**
+ * A board's tree head (RFC 9162 §2.1). A head is signed by being carried in a document the ballot box signs; whoever keeps a head keeps that whole document.
+ */
+export interface BoardHead {
+    electionId: ElectionId;
+    treeSize: number;
+    /**
+     * The RFC 9162 Merkle tree hash (SHA-256) of the first `treeSize` entries, as a multihash.
+     */
+    rootHash: DigestMultibase;
+    issuedAt: string;
+}
 /**
  * Whether each step that turns commit trust on for a repository is in place, as last reported. A step that this forge's plan does not need reads `true`.
  */
@@ -4660,6 +4757,14 @@ export interface CardValues {
  */
 export interface CarriedDocument {
 }
+/**
+ * A ballot and the PCS attestation that admits it (VTI-VOT-030). `attestation` is the suite's canonical encoding of the attestation made for the election point with the ballot context bound in (CONVENTIONS §3); `tag` repeats its tag so a ballot box can refuse a duplicate before the pairing check.
+ */
+export interface Cast {
+    ballot: Ballot;
+    tag: Multibase_VotingV0_1;
+    attestation: Multibase_VotingV0_1;
+}
 /**
  * The terms of a `chunkedTrustTask` transfer, committed before any chunk moves. On export the recipient states them in the descriptor; on import the producer pre-commits them in the request and the recipient echoes them. Either way the manifest arrives in a document whose proof is REQUIRED, so the per-chunk digests are authenticated by the party that computed them and each chunk can be verified — and a single bad chunk re-fetched or refused — on arrival rather than only after reassembly.
  *
@@ -5908,6 +6013,31 @@ export interface DisclosedField {
      */
     facet?: boolean;
 }
+/**
+ * The statement a community publishes, and shows a member before they request a ticket, about how one election is run (VTI-VOT-090). Generated from the election's manifest and the community's configuration, never written by hand.
+ */
+export interface Disclosure {
+    /**
+     * The ballot box's DID.
+     */
+    ballotBox: string;
+    /**
+     * Who operates the ballot box, as the community names them.
+     */
+    ballotBoxOperator: string;
+    /**
+     * Whether the party operating the community's VTC also operates the ballot box.
+     */
+    sameOperator: boolean;
+    trustees?: Trustees;
+    boardVisibility: BoardVisibility;
+    auditors: string[];
+    revote: Revote;
+    /**
+     * Always false: a voter can prove how they voted, so the community cannot protect a member against being made to vote a certain way.
+     */
+    coercionResistance: false;
+}
 /**
  * The member's three discoverability decisions, made separately.
  */
@@ -6167,6 +6297,33 @@ export interface EffectiveLimits {
      */
     hostCeilingBytes?: number;
 }
+/**
+ * An election's result, computable by anyone who can read its board from the board and the registration alone (VTI-VOT-070).
+ */
+export interface ElectionResult {
+    electionId: ElectionId;
+    manifestDigest: DigestMultibase;
+    ballotsCounted: number;
+    questions: QuestionResult[];
+    /**
+     * The head of the board as it stood at close: the result counts exactly its entries.
+     */
+    head: BoardHead;
+}
+/**
+ * A ballot box's view of one election.
+ */
+export interface ElectionSummary {
+    electionId: ElectionId;
+    community: string;
+    manifestDigest: DigestMultibase;
+    state: ElectionState;
+    /**
+     * Distinct tags with a counted ballot.
+     */
+    ballotsAdmitted: number;
+    head: BoardHead;
+}
 export interface EncryptionParams {
     /**
      * AEAD identifier, e.g. `aes-256-gcm`.
@@ -6631,7 +6788,7 @@ export interface Group {
      */
     memberCount?: number;
     /**
-     * Entries holding `vtc.groups.manage` qualified to this group, read from the access-control list. Informational: managers are appointed by an access-control grant, never by this record.
+     * Entries holding `vtc.groups.manage` qualified to this group, read from the access-control list. Informational: managers are appointed by an access-control grant (vtc/groups/managers/add), never by this record.
      *
      * @maxItems 256
      */
@@ -6715,7 +6872,7 @@ export interface HiddenVettingSubmission {
     /**
      * The applicant's PCS identifier for this application.
      */
-    id: Multibase;
+    id: Multibase_VtaV0_4;
     /**
      * The DID the applicant joins as. Bound to `id` by `idBinding`.
      */
@@ -6737,7 +6894,7 @@ export interface HiddenVettingSubmission {
     /**
      * The issuance proof, which carries the attestations.
      */
-    proof: Multibase;
+    proof: Multibase_VtaV0_4;
 }
 /**
  * One histogram's distribution, in the Prometheus cumulative-bucket convention: each bucket's `count` includes every observation at or below its `le`.
@@ -7200,6 +7357,51 @@ export interface LocalSettings {
      */
     root: string;
 }
+/**
+ * What an election asks and how it is decided (VTI-VOT-010). Its digest (`manifestDigest`) is the SHA-256 multihash of its RFC 8785 (JCS) canonicalization, and every cast is bound to it (VTI-VOT-011).
+ */
+export interface Manifest {
+    electionId: ElectionId;
+    /**
+     * The community's DID.
+     */
+    community: string;
+    title?: string;
+    description?: string;
+    /**
+     * @minItems 1
+     * @maxItems 128
+     */
+    questions: [Question, ...Question[]];
+    secrecy: SecrecyLevel;
+    roll: RollRule;
+    registrationOpens: string;
+    votingOpens: string;
+    votingCloses: string;
+    revote: Revote;
+    board: {
+        visibility: BoardVisibility;
+        auditors: string[];
+    };
+    /**
+     * The DID of the voting service that holds the board.
+     */
+    ballotBox: string;
+    trustees?: Trustees;
+    /**
+     * Whether the community treats the result as deciding something; creating a binding election takes another administrator's consent (VTI-VOT-081).
+     */
+    binding: boolean;
+    allowEarlyClose: boolean;
+    /**
+     * Open elections only: whether running totals may be read while voting is open (VTI-VOT-061).
+     */
+    resultsBeforeClose: boolean;
+    /**
+     * Counted ballots required before any text answer is disclosed (VTI-VOT-065).
+     */
+    textReleaseThreshold: number;
+}
 /**
  * The mediator's per-account access-control capability set, expressed as named booleans (the transport-agnostic form of the mediator's internal capability flags). On a set request, members omitted are left unchanged; a get/response carries the full realized set.
  */
@@ -8212,6 +8414,91 @@ export interface QueryContext {
     locator?: string;
     [k: string]: string | undefined;
 }
+/**
+ * Select between `minSelections` and `maxSelections` of `options`. A yes/no/abstain motion is a choice of exactly one of three.
+ */
+export interface ChoiceQuestion {
+    key: Key_VotingV0_1;
+    type: "choice";
+    text?: string;
+    /**
+     * @minItems 2
+     * @maxItems 256
+     */
+    options: [QuestionOption, QuestionOption, ...QuestionOption[]];
+    minSelections: number;
+    maxSelections: number;
+    optional: boolean;
+}
+/**
+ * Order `options`; a ballot ranks every option or, when `partial` is true, a prefix of them.
+ */
+export interface RankingQuestion {
+    key: Key_VotingV0_1;
+    type: "ranking";
+    text?: string;
+    /**
+     * @minItems 2
+     * @maxItems 64
+     */
+    options: [QuestionOption, QuestionOption, ...QuestionOption[]];
+    partial: boolean;
+    optional: boolean;
+}
+/**
+ * Give each option an integer score within [min, max].
+ */
+export interface ScoreQuestion {
+    key: Key_VotingV0_1;
+    type: "score";
+    text?: string;
+    /**
+     * @minItems 1
+     * @maxItems 256
+     */
+    options: [QuestionOption, ...QuestionOption[]];
+    min: number;
+    max: number;
+    optional: boolean;
+}
+/**
+ * Free text of at most `maxLength` characters.
+ */
+export interface TextQuestion {
+    key: Key_VotingV0_1;
+    type: "text";
+    text?: string;
+    maxLength: number;
+    optional: boolean;
+}
+export interface QuestionOption {
+    key: Key_VotingV0_1;
+    /**
+     * Display text. Absent from a manifest registered with a ballot box that holds no question text (VTI-VOT-014).
+     */
+    label?: string;
+}
+/**
+ * One question's totals. `choice`: selections per option. `ranking`: per option, how many ballots placed it at each position (index 0 = first). `score`: per option, the sum and the number of ballots that scored it. `text`: the answers, in board order, withheld (`withheld: true`) below the manifest's `textReleaseThreshold`. `abstained` counts ballots that left the question unanswered.
+ */
+export interface QuestionResult {
+    question: Key_VotingV0_1;
+    abstained: number;
+    choice?: {
+        [k: string]: number | undefined;
+    };
+    ranking?: {
+        [k: string]: number[] | undefined;
+    };
+    score?: {
+        [k: string]: {
+            sum: number;
+            count: number;
+        } | undefined;
+    };
+    text?: string[];
+    withheld?: boolean;
+}
 /**
  * The depth of one queue and its effective limit.
  */
@@ -8864,6 +9151,13 @@ export interface RoleSummary {
      */
     preRotationCommitments?: number;
 }
+/**
+ * Who may be issued a ticket (VTI-VOT-021): the community's active members, its active members and the parties `listed` names, or only the parties `listed` names.
+ */
+export interface RollRule {
+    rule: "members" | "membersAndListed" | "listed";
+    listed?: string[];
+}
 /**
  * The outcome of a rollback. Distinct from ServiceMutationResult because a rollback can legitimately publish nothing: if the previous state already equals the current one there is no change to write, and `kind: "noOp"` says so with `logEntryVersionId` absent. Treating that as a failure would be wrong — the requested state holds — and treating it as an ordinary success would report a log entry that does not exist.
  */
@@ -10017,6 +10311,16 @@ export interface TrustRecord {
     };
     record_type: RecordType;
 }
+/**
+ * The trustees of a sealed or tallied-encrypted election and the number of them decryption needs (VTI-VOT-062). Neither the community nor the ballot box may be one.
+ */
+export interface Trustees {
+    /**
+     * @minItems 2
+     */
+    dids: [string, string, ...string[]];
+    threshold: number;
+}
 /**
  * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
  */
@@ -10477,7 +10781,7 @@ export interface VetterSummary {
     /**
      * The vetter's PCS identifier for this community.
      */
-    id: Multibase;
+    id: Multibase_VtaV0_4;
     /**
      * Class labels this vetter holds a credential under, newest first.
      */
@@ -10656,6 +10960,13 @@ export interface VettingRequirements {
     extCritical?: ExtCritical;
     [k: string]: unknown | undefined;
 }
+/**
+ * The community's published voting parameters: the PCS suite and the voting verification key tickets are issued under (VTI-VOT-020). Distinct from its hidden-vetting helper key.
+ */
+export interface VotingParameters {
+    suite: "ps-ddh-bls12381";
+    votingKey: Multibase_VotingV0_1;
+}
 /**
  * An opaque, gateway-issued reference to a device's push channel (push wake-up binding, https://trusttasks.org/binding/push/0.1). The push gateway returns it to the device at registration; the device conveys it to its VTA (device/set-wake), and the VTA provisions it to authorized triggers (its mediator and/or itself). The raw platform push token (APNs/FCM/WebPush) is held ONLY by the gateway and is never represented here — the handle abstracts the platform, so adding new push methods (e.g. PWA Web Push) needs no change to triggers or VTA config. A handle is a bearer capability to *request* a wake (subject to the gateway's allowlist), never to read the channel.
  */
@@ -10781,7 +11092,7 @@ export interface WitnessKey {
  * The outcome of one write within a `vta/app-state/put-many` batch. Per-record rather than per-batch, because the default batch mode applies each write on its own merits: a caller flushing ten unrelated edits needs to know which one conflicted, not merely that something did.
  */
 export interface WriteResult {
-    key: Key;
+    key: Key_VtaV0_1;
     /**
      * `written`: applied, and `version` carries the new value. `conflict`: `expectedVersion` did not match; `currentVersion`, `currentValue` and `currentDeleted` carry the maintainer's view so the caller can resolve without a re-read. `tooLarge`: the value exceeded the per-record cap; `limitBytes` and `actualBytes` say by how much. `notFound`: a `mergePatch` write named an address with no live record. `skipped`: atomic mode only — this write was not attempted because another in the batch failed.
      */