@openvtc/trust-tasks 0.26.26 → 0.26.28

package/src/_shared/components.ts

@@ -435,7 +435,8 @@ export type BoardEntry =
   | ElectionKeyEntry
   | PartialDecryptionsEntry
   | UnsealedEntry
-  | SpoiledEntry;
+  | SpoiledEntry
+  | TrusteeStepEntry;
 /**
  * `public`: anyone reads the board. `private`: the community, the auditors the manifest names and, for one cast's inclusion, the holder of its receipt (VTI-VOT-052).
  */
@@ -4900,14 +4901,23 @@ export interface EncryptedCastEntry {
   kind: "encryptedCast";
   cast: EncryptedCast;
 }
+/**
+ * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
+ */
 export interface TransportKeyEntry {
   kind: "transportKey";
   transportKey: TransportKey;
 }
+/**
+ * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
+ */
 export interface DealingEntry {
   kind: "dealing";
   dealing: Dealing;
 }
+/**
+ * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
+ */
 export interface ConfirmationEntry {
   kind: "confirmation";
   trustee: TrusteeIndex;
@@ -4916,6 +4926,9 @@ export interface ConfirmationEntry {
    */
   complaints: TrusteeIndex[];
 }
+/**
+ * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
+ */
 export interface JustificationEntry {
   kind: "justification";
   dealer: TrusteeIndex;
@@ -4947,6 +4960,13 @@ export interface SpoiledEntry {
   kind: "spoiled";
   leafIndex: number;
 }
+/**
+ * One step of the trustees' ceremony — an enrolment, a dealing, a confirmation or a justification — as the trustee's own signed request, so that anyone reading the board can tell who took it (CONVENTIONS §9.6).
+ */
+export interface TrusteeStepEntry {
+  kind: "trusteeStep";
+  request: SignedRequest;
+}
 /**
  * A board's tree head (RFC 9162 §2.1). A head is signed by being carried in a document the ballot box signs; whoever keeps a head keeps that whole document.
  */
@@ -10401,6 +10421,10 @@ export interface SigmaProof {
   c: GroupScalar;
   z: GroupScalar;
 }
+/**
+ * A whole Trust Task request document — `id`, `type`, `issuer`, `payload` and every other member, `proof` included — exactly as the ballot box received it, never re-serialised: its proof is taken over its members, and a re-serialised copy does not reliably reproduce them. Typed as an open object so every member survives; CONVENTIONS §9.6 gives the checks that make it a trustee's step.
+ */
+export interface SignedRequest {}
 /**
  * One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.
  */

package/src/index.ts

@@ -813,6 +813,7 @@ export * as VtcCommunityRequestedAttributesShow_v0_1 from "./vtc/community/reque
 export * as VtcCommunityRequestedAttributesUpdate_v0_1 from "./vtc/community/requested-attributes/update/0.1/payload.js";
 export * as VtcCommunityThemeShow_v0_1 from "./vtc/community/theme/show/0.1/payload.js";
 export * as VtcCommunityThemeUpdate_v0_1 from "./vtc/community/theme/update/0.1/payload.js";
+export * as VtcConfigDidHostingList_v0_1 from "./vtc/config/did-hosting/list/0.1/payload.js";
 export * as VtcConfigExport_v0_1 from "./vtc/config/export/0.1/payload.js";
 export * as VtcConfigImport_v0_1 from "./vtc/config/import/0.1/payload.js";
 export * as VtcCredentialsReissue_v0_1 from "./vtc/credentials/reissue/0.1/payload.js";

package/src/voting/_shared/0.1/voting.ts

@@ -14,4 +14,4 @@ export interface CommunityVotingSharedDefinitions {
  * The definitions this shared schema publishes, hoisted to one declaration each.
  * See "../../../_shared/components.js".
  */
-export type { Answer, Ballot, BoardEntry, BoardHead, BoardVisibility, Cast, Dealing, DecryptionTarget, Disclosure, DisjunctiveProof, ElectionId, ElectionKey, ElectionResult, ElectionState, ElectionSummary, ElGamalCiphertext, EncryptedBallot, EncryptedCast, EncryptedOption, EncryptedQuestion, GroupElement, GroupScalar, Key_VotingV0_1 as Key, Manifest, MerklePath, Multibase_VotingV0_1 as Multibase, PartialDecryption, Question, QuestionOption, QuestionResult, Revote, RollRule, SealedPayload, SealedShare, SecrecyLevel, SigmaProof, TransportKey, TrusteeIndex, TrusteePhase, Trustees, VotingParameters } from "../../../_shared/components.js";
+export type { Answer, Ballot, BoardEntry, BoardHead, BoardVisibility, Cast, Dealing, DecryptionTarget, Disclosure, DisjunctiveProof, ElectionId, ElectionKey, ElectionResult, ElectionState, ElectionSummary, ElGamalCiphertext, EncryptedBallot, EncryptedCast, EncryptedOption, EncryptedQuestion, GroupElement, GroupScalar, Key_VotingV0_1 as Key, Manifest, MerklePath, Multibase_VotingV0_1 as Multibase, PartialDecryption, Question, QuestionOption, QuestionResult, Revote, RollRule, SealedPayload, SealedShare, SecrecyLevel, SigmaProof, SignedRequest, TransportKey, TrusteeIndex, TrusteePhase, Trustees, VotingParameters } from "../../../_shared/components.js";

package/src/voting/board/read/0.1/payload.ts

@@ -3,7 +3,7 @@
  * Source: specs/voting/board/read/0.1/payload.schema.json
  */
 
-import type { Answer, Ballot, BoardEntry, BoardHead, Cast, CastEntry, ConfirmationEntry, Dealing, DealingEntry, DecryptionTarget, DigestMultibase, ElectionId, ElectionKey, ElectionKeyEntry, ElectionResult, ElGamalCiphertext, EncryptedCast, EncryptedCastEntry, Ext, GroupElement, GroupScalar, JustificationEntry, Key_VotingV0_1 as Key, LifecycleEntry, Multibase_VotingV0_1 as Multibase, PartialDecryption, PartialDecryptionsEntry, QuestionResult, ReplacementEntry, ResultEntry, SealedPayload, SealedShare, SigmaProof, SpoiledEntry, TransportKey, TransportKeyEntry, TrusteeIndex, UnsealedEntry } from "../../../../_shared/components.js";
+import type { Answer, Ballot, BoardEntry, BoardHead, Cast, CastEntry, ConfirmationEntry, Dealing, DealingEntry, DecryptionTarget, DigestMultibase, ElectionId, ElectionKey, ElectionKeyEntry, ElectionResult, ElGamalCiphertext, EncryptedCast, EncryptedCastEntry, Ext, GroupElement, GroupScalar, JustificationEntry, Key_VotingV0_1 as Key, LifecycleEntry, Multibase_VotingV0_1 as Multibase, PartialDecryption, PartialDecryptionsEntry, QuestionResult, ReplacementEntry, ResultEntry, SealedPayload, SealedShare, SigmaProof, SignedRequest, SpoiledEntry, TransportKey, TransportKeyEntry, TrusteeIndex, TrusteeStepEntry, UnsealedEntry } from "../../../../_shared/components.js";
 
 
 /**
@@ -51,7 +51,7 @@ export interface VotingBoardReadResponsePayload {
 }
 
 /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
-export type { Answer, Ballot, BoardEntry, BoardHead, Cast, CastEntry, ConfirmationEntry, Dealing, DealingEntry, DecryptionTarget, DigestMultibase, ElectionId, ElectionKey, ElectionKeyEntry, ElectionResult, ElGamalCiphertext, EncryptedCast, EncryptedCastEntry, Ext, GroupElement, GroupScalar, JustificationEntry, Key, LifecycleEntry, Multibase, PartialDecryption, PartialDecryptionsEntry, QuestionResult, ReplacementEntry, ResultEntry, SealedPayload, SealedShare, SigmaProof, SpoiledEntry, TransportKey, TransportKeyEntry, TrusteeIndex, UnsealedEntry };
+export type { Answer, Ballot, BoardEntry, BoardHead, Cast, CastEntry, ConfirmationEntry, Dealing, DealingEntry, DecryptionTarget, DigestMultibase, ElectionId, ElectionKey, ElectionKeyEntry, ElectionResult, ElGamalCiphertext, EncryptedCast, EncryptedCastEntry, Ext, GroupElement, GroupScalar, JustificationEntry, Key, LifecycleEntry, Multibase, PartialDecryption, PartialDecryptionsEntry, QuestionResult, ReplacementEntry, ResultEntry, SealedPayload, SealedShare, SigmaProof, SignedRequest, SpoiledEntry, TransportKey, TransportKeyEntry, TrusteeIndex, TrusteeStepEntry, UnsealedEntry };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/voting/board/read/0.1" as const;
@@ -296,7 +296,8 @@ export const PAYLOAD_SCHEMA = {
             "transportKey": {
               "$ref": "#/$defs/TransportKey"
             }
-          }
+          },
+          "description": "Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind."
         },
         {
           "title": "DealingEntry",
@@ -313,7 +314,8 @@ export const PAYLOAD_SCHEMA = {
             "dealing": {
               "$ref": "#/$defs/Dealing"
             }
-          }
+          },
+          "description": "Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind."
         },
         {
           "title": "ConfirmationEntry",
@@ -338,7 +340,8 @@ export const PAYLOAD_SCHEMA = {
                 "$ref": "#/$defs/TrusteeIndex"
               }
             }
-          }
+          },
+          "description": "Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind."
         },
         {
           "title": "JustificationEntry",
@@ -363,7 +366,8 @@ export const PAYLOAD_SCHEMA = {
             "share": {
               "$ref": "#/$defs/GroupScalar"
             }
-          }
+          },
+          "description": "Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind."
         },
         {
           "title": "ElectionKeyEntry",
@@ -448,9 +452,33 @@ export const PAYLOAD_SCHEMA = {
               "minimum": 0
             }
           }
+        },
+        {
+          "title": "TrusteeStepEntry",
+          "description": "One step of the trustees' ceremony — an enrolment, a dealing, a confirmation or a justification — as the trustee's own signed request, so that anyone reading the board can tell who took it (CONVENTIONS §9.6).",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "request"
+          ],
+          "properties": {
+            "kind": {
+              "const": "trusteeStep"
+            },
+            "request": {
+              "$ref": "#/$defs/SignedRequest"
+            }
+          }
         }
       ]
     },
+    "SignedRequest": {
+      "title": "SignedRequest",
+      "description": "A whole Trust Task request document — `id`, `type`, `issuer`, `payload` and every other member, `proof` included — exactly as the ballot box received it, never re-serialised: its proof is taken over its members, and a re-serialised copy does not reliably reproduce them. Typed as an open object so every member survives; CONVENTIONS §9.6 gives the checks that make it a trustee's step.",
+      "type": "object",
+      "minProperties": 1
+    },
     "Ballot": {
       "title": "Ballot",
       "description": "An open ballot: one answer per question of the manifest, in any order. The bytes a cast's proof binds are the RFC 8785 (JCS) canonicalization of this object as received.",
@@ -1278,7 +1306,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             "transportKey": {
               "$ref": "#/$defs/TransportKey"
             }
-          }
+          },
+          "description": "Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind."
         },
         {
           "title": "DealingEntry",
@@ -1295,7 +1324,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             "dealing": {
               "$ref": "#/$defs/Dealing"
             }
-          }
+          },
+          "description": "Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind."
         },
         {
           "title": "ConfirmationEntry",
@@ -1320,7 +1350,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
                 "$ref": "#/$defs/TrusteeIndex"
               }
             }
-          }
+          },
+          "description": "Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind."
         },
         {
           "title": "JustificationEntry",
@@ -1345,7 +1376,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
             "share": {
               "$ref": "#/$defs/GroupScalar"
             }
-          }
+          },
+          "description": "Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind."
         },
         {
           "title": "ElectionKeyEntry",
@@ -1430,9 +1462,33 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
               "minimum": 0
             }
           }
+        },
+        {
+          "title": "TrusteeStepEntry",
+          "description": "One step of the trustees' ceremony — an enrolment, a dealing, a confirmation or a justification — as the trustee's own signed request, so that anyone reading the board can tell who took it (CONVENTIONS §9.6).",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "request"
+          ],
+          "properties": {
+            "kind": {
+              "const": "trusteeStep"
+            },
+            "request": {
+              "$ref": "#/$defs/SignedRequest"
+            }
+          }
         }
       ]
     },
+    "SignedRequest": {
+      "title": "SignedRequest",
+      "description": "A whole Trust Task request document — `id`, `type`, `issuer`, `payload` and every other member, `proof` included — exactly as the ballot box received it, never re-serialised: its proof is taken over its members, and a re-serialised copy does not reliably reproduce them. Typed as an open object so every member survives; CONVENTIONS §9.6 gives the checks that make it a trustee's step.",
+      "type": "object",
+      "minProperties": 1
+    },
     "Ballot": {
       "title": "Ballot",
       "description": "An open ballot: one answer per question of the manifest, in any order. The bytes a cast's proof binds are the RFC 8785 (JCS) canonicalization of this object as received.",

package/src/vtc/config/did-hosting/list/0.1/payload.ts

@@ -0,0 +1,233 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/config/did-hosting/list/0.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../../../_shared/components.js";
+
+
+/**
+ * List the did:webvh hosting servers the community's VTA can publish its identities through. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface VTCConfigDIDHostingListPayload {
+  ext?: Ext;
+}
+/**
+ * The success response to a vtc/config/did-hosting/list/0.1 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vtc/config/did-hosting/list/0.1#response.
+ */
+export interface VTCConfigDIDHostingListResponsePayload {
+  /**
+   * @maxItems 256
+   */
+  servers: HostingServer[];
+  ext?: Ext;
+}
+/**
+ * A did:webvh hosting server registered at the community's VTA, as that VTA reports it. Carries no credential.
+ */
+export interface HostingServer {
+  /**
+   * The server's id at the VTA: the value that names it in the community's configuration.
+   */
+  id: string;
+  /**
+   * The server's own DID.
+   */
+  did: string;
+  label?: string;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/config/did-hosting/list/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCConfigDIDHostingListPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/config/did-hosting/list/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCConfigDIDHostingListResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vtc/config/did-hosting/list/0.1",
+  "title": "VTC Config — DID Hosting — List — payload",
+  "description": "List the did:webvh hosting servers the community's VTA can publish its identities through. The outer document members are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "HostingServer": {
+      "title": "HostingServer",
+      "description": "A did:webvh hosting server registered at the community's VTA, as that VTA reports it. Carries no credential.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "did"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9._:-]{1,128}$",
+          "description": "The server's id at the VTA: the value that names it in the community's configuration."
+        },
+        "did": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "The server's own DID."
+        },
+        "label": {
+          "type": "string",
+          "maxLength": 256
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Config — DID Hosting — List — response payload",
+      "description": "The success response to a vtc/config/did-hosting/list/0.1 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vtc/config/did-hosting/list/0.1#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "servers"
+      ],
+      "properties": {
+        "servers": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/HostingServer"
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "HostingServer": {
+      "title": "HostingServer",
+      "description": "A did:webvh hosting server registered at the community's VTA, as that VTA reports it. Carries no credential.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "did"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9._:-]{1,128}$",
+          "description": "The server's id at the VTA: the value that names it in the community's configuration."
+        },
+        "did": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "The server's own DID."
+        },
+        "label": {
+          "type": "string",
+          "maxLength": 256
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Config — DID Hosting — List — response payload",
+      "description": "The success response to a vtc/config/did-hosting/list/0.1 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vtc/config/did-hosting/list/0.1#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "servers"
+      ],
+      "properties": {
+        "servers": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/HostingServer"
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/vtc/elections/show/0.1/payload.ts

@@ -3,7 +3,7 @@
  * Source: specs/vtc/elections/show/0.1/payload.schema.json
  */
 
-import type { BoardHead, BoardVisibility, ChoiceQuestion, DigestMultibase, Disclosure, ElectionId, ElectionResult, Ext, Key_VotingV0_1 as Key, Manifest, Multibase_VotingV0_1 as Multibase, Question, QuestionOption, QuestionResult, RankingQuestion, Revote, RollRule, ScoreQuestion, SecrecyLevel, TextQuestion, Trustees, VotingParameters } from "../../../../_shared/components.js";
+import type { BoardHead, BoardVisibility, ChoiceQuestion, DigestMultibase, Disclosure, ElectionId, ElectionKey, ElectionResult, Ext, GroupElement, Key_VotingV0_1 as Key, Manifest, Multibase_VotingV0_1 as Multibase, Question, QuestionOption, QuestionResult, RankingQuestion, Revote, RollRule, ScoreQuestion, SecrecyLevel, TextQuestion, TrusteeIndex, Trustees, VotingParameters } from "../../../../_shared/components.js";
 
 
 /**
@@ -54,6 +54,10 @@ export interface VTCElectionsShowResponsePayload {
    * How many tickets the community has issued for the election. Present only to a caller holding vtc.elections.manage.
    */
   ticketsIssued?: number;
+  /**
+   * The key a sealed or tallied-encrypted election's ballots are encrypted under, once its trustees have formed it (CONVENTIONS §9.6).
+   */
+  electionKey?: ElectionKey;
   certified?: Certification;
   ext?: Ext;
 }
@@ -80,7 +84,7 @@ export interface Certification {
 }
 
 /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
-export type { BoardHead, BoardVisibility, ChoiceQuestion, DigestMultibase, Disclosure, ElectionId, ElectionResult, Ext, Key, Manifest, Multibase, Question, QuestionOption, QuestionResult, RankingQuestion, Revote, RollRule, ScoreQuestion, SecrecyLevel, TextQuestion, Trustees, VotingParameters };
+export type { BoardHead, BoardVisibility, ChoiceQuestion, DigestMultibase, Disclosure, ElectionId, ElectionKey, ElectionResult, Ext, GroupElement, Key, Manifest, Multibase, Question, QuestionOption, QuestionResult, RankingQuestion, Revote, RollRule, ScoreQuestion, SecrecyLevel, TextQuestion, TrusteeIndex, Trustees, VotingParameters };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vtc/elections/show/0.1" as const;
@@ -231,6 +235,10 @@ export const PAYLOAD_SCHEMA = {
           "minimum": 0,
           "description": "How many tickets the community has issued for the election. Present only to a caller holding vtc.elections.manage."
         },
+        "electionKey": {
+          "$ref": "#/$defs/ElectionKey",
+          "description": "The key a sealed or tallied-encrypted election's ballots are encrypted under, once its trustees have formed it (CONVENTIONS §9.6)."
+        },
         "certified": {
           "$ref": "#/$defs/Certification",
           "description": "Present once the community has certified the result."
@@ -250,6 +258,67 @@ export const PAYLOAD_SCHEMA = {
         "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
       }
     },
+    "ElectionKey": {
+      "title": "ElectionKey",
+      "description": "The election key and each trustee's public verification key, computed from the qualified dealings (CONVENTIONS §9.6). Anyone can recompute it from the board.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "key",
+        "qualified",
+        "verification"
+      ],
+      "properties": {
+        "key": {
+          "$ref": "#/$defs/GroupElement"
+        },
+        "qualified": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/TrusteeIndex"
+          },
+          "description": "The dealers whose dealings the key is formed from."
+        },
+        "verification": {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 64,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "trustee",
+              "key"
+            ],
+            "properties": {
+              "trustee": {
+                "$ref": "#/$defs/TrusteeIndex"
+              },
+              "key": {
+                "$ref": "#/$defs/GroupElement"
+              }
+            }
+          }
+        }
+      }
+    },
+    "GroupElement": {
+      "title": "GroupElement",
+      "description": "A Ristretto group element: its 32-byte compression, multibase base58btc. Never the identity (CONVENTIONS §9.1).",
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 64,
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    },
+    "TrusteeIndex": {
+      "title": "TrusteeIndex",
+      "description": "A trustee's index: its position in the manifest's `trustees.dids`, counting from 1.",
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 64
+    },
     "Disclosure": {
       "title": "Disclosure",
       "description": "The statement a community publishes, and shows a member before they request a ticket, about how one election is run (VTI-VOT-090). Generated from the election's manifest and the community's configuration, never written by hand.",
@@ -993,6 +1062,10 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "minimum": 0,
           "description": "How many tickets the community has issued for the election. Present only to a caller holding vtc.elections.manage."
         },
+        "electionKey": {
+          "$ref": "#/$defs/ElectionKey",
+          "description": "The key a sealed or tallied-encrypted election's ballots are encrypted under, once its trustees have formed it (CONVENTIONS §9.6)."
+        },
         "certified": {
           "$ref": "#/$defs/Certification",
           "description": "Present once the community has certified the result."
@@ -1012,6 +1085,67 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
       }
     },
+    "ElectionKey": {
+      "title": "ElectionKey",
+      "description": "The election key and each trustee's public verification key, computed from the qualified dealings (CONVENTIONS §9.6). Anyone can recompute it from the board.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "key",
+        "qualified",
+        "verification"
+      ],
+      "properties": {
+        "key": {
+          "$ref": "#/$defs/GroupElement"
+        },
+        "qualified": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/TrusteeIndex"
+          },
+          "description": "The dealers whose dealings the key is formed from."
+        },
+        "verification": {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 64,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "trustee",
+              "key"
+            ],
+            "properties": {
+              "trustee": {
+                "$ref": "#/$defs/TrusteeIndex"
+              },
+              "key": {
+                "$ref": "#/$defs/GroupElement"
+              }
+            }
+          }
+        }
+      }
+    },
+    "GroupElement": {
+      "title": "GroupElement",
+      "description": "A Ristretto group element: its 32-byte compression, multibase base58btc. Never the identity (CONVENTIONS §9.1).",
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 64,
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    },
+    "TrusteeIndex": {
+      "title": "TrusteeIndex",
+      "description": "A trustee's index: its position in the manifest's `trustees.dids`, counting from 1.",
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 64
+    },
     "Disclosure": {
       "title": "Disclosure",
       "description": "The statement a community publishes, and shows a member before they request a ticket, about how one election is run (VTI-VOT-090). Generated from the election's manifest and the community's configuration, never written by hand.",