@openvtc/trust-tasks 0.26.3 → 0.26.5

package/CHANGELOG.md

@@ -11,6 +11,81 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.26.5 — 2026-10-15
+
+
+### Added
+
+- **rooms**: Rooms/owner/group/renew renews a sealed room; rooms/keys/act refuses a sealed room's mint (#773)
+
+A sealed room (`attributed` / `private`) had no correct way to renew, and
+  one way to brick itself that looked like a renewal.
+
+  - rooms/epoch/mint advances a host without a commit (a host MUST), and on a
+    sealed room the room epoch is the MLS group epoch + 1. rooms/keys/act/0.1
+    completes a mint for a member's client, which holds no group key and so
+    sends no commit: the host moves to N+1, every member's key holder stays at
+    N, every write is refused as sealed under a superseded epoch, and the
+    owner's next rooms/owner/group/{add,remove} fails epochConflict.
+  - Only membership changes advanced a sealed room's epoch, so a room whose
+    membership was stable lapsed after its epoch lifetime with no remedy.
+
+  rooms/owner/group/renew/0.1 (new, Owner -> KeyHolder): the sibling of
+  group/{create,add,remove}. The key holder advances the group with a commit
+  that changes no membership (self-update or empty commit), builds the epoch
+  link, retains the pending advance durably before sending (at most one per
+  room, shared with add/remove), mints at the host with the commit, the link
+  and the owner's admin presentation, applies only on acceptance, discards on
+  refusal, keeps on an unknown outcome and settles via rooms/info. Errors:
+  noGroup, noAuthority, epochConflict (details.hostEpoch), hostUnreachable,
+  hostRefused.
+
+  rooms/keys/act/0.1 (draft, edited in place): recipient item 9 refuses a
+  rooms/epoch/mint for a room it holds group state for, for any member it
+  serves, with the new rooms/keys/act:sealedRoomMint naming
+  rooms/owner/group/renew; producer item 4 says not to ask. Open rooms keep
+  renewing through act. The wire shape is unchanged; a draft MAY change
+  without a version bump (SPEC §5.2/§5.3), and a 0.2 would leave 0.1
+  permitting the defect it exists to close.
+
+## 0.26.4 — 2026-10-15
+
+
+### Added
+
+- **rooms**: Act as the member's persona — rooms/keys/act, seal 0.2, direct-to-storage blob transfer (#771)
+
+A member of a data room is the DID the room admitted — usually a persona
+  their key holder (VTA) holds for them — but the member's own client (CLI,
+  extension, phone) holds none of that DID's keys. Until now it could reach a
+  host only through rooms/keys/present, which grants the leaf to the caller,
+  and then signed with its own key: the host recorded the client's did:key as
+  the actor and, on an attributed room, as the author of every record.
+
+  - rooms/keys/act/0.1 (new): the client builds a host-bound room request
+    without presentation or proof; the key holder completes it as the member
+    (the member's own authority narrowed to the one action a closed table
+    fixes per type, granted to the member; issuer = member; the member's
+    authentication proof) and returns it for the client to send. Refused to
+    delegates, which keep using rooms/keys/present.
+  - rooms/keys/seal/0.2: optional signAsPrincipal — the key holder signs the
+    SealedRecordBody as its author (a member the caller acts as) before
+    sealing, so the record is attributed to the member.
+  - rooms/blobs/upload/{begin,chunk,commit,abort}/0.2 and rooms/blobs/get/0.2:
+    two transfer modes. Direct: the host authorizes and reserves as before,
+    then issues per-part presigned PUTs (one object, one method, exact length
+    and SHA-256 as signed headers, <= 5 min), verifies the object at storage
+    before commit records it, and serves reads with a presigned GET. Proxied:
+    bytes through the host as chunk documents signed by a single-use upload
+    key the begin names, so file bytes never pass through the key holder.
+    A host SHOULD NOT offer direct transfer on a private room unless its
+    policy allows; the response always names the mode.
+  - In place (drafts, wire unchanged): rooms/keys/{read,browse,backfill}
+    present as the principal and never let the key holder's own identifier
+    reach the host; rooms/keys/welcome and rooms/keys/open keep one group
+    state per member per room.
+  - rooms/_shared/0.1/blobs: TransferMode, PartPlan, TransferTarget (additive).
+
 ## 0.26.3 — 2026-10-14
 
 

package/dist/_shared/components.d.ts

@@ -1177,6 +1177,10 @@ export type TrafficStage = "received" | "stored" | "delivered" | "forwarded" | "
  * Handle for one upload (begin → chunk → commit or abort) or one download (get → chunk). Host-generated and unguessable, which is what lets a reference to another party's transfer be answered as not-found without confirming that it exists. Bound at creation to the party that opened it: the subject the host authenticated for the opening request. Opaque: a producer quotes what it was given.
  */
 export type TransferId = string;
+/**
+ * How a blob's bytes move. `proxied`: through the host, as chunk documents (rooms/blobs/upload/chunk, rooms/blobs/chunk). `direct`: straight between the member and the storage the room is assigned to, over time-limited URLs the host issues for one object and one method each; the host authorizes every object and verifies every upload, and never carries a byte. Which mode applies is the host's answer, from what the producer accepts, what the room's storage can do, and the room's tier.
+ */
+export type TransferMode = "direct" | "proxied";
 /**
  * A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.
  */
@@ -6561,6 +6565,25 @@ export interface OfferCredentials {
      */
     authority: string;
 }
+/**
+ * How the uploader will cut a blob for direct transfer, committed before any byte moves: one storage object, written in `partCount` parts of `partSize` bytes (the last may be shorter), each with its digest. Independent of the chunk manifest, because storage imposes part sizes a chunk document cannot carry; the chunk manifest still describes the blob and readers still check it.
+ *
+ * Consistency rules JSON Schema cannot state: `partCount` MUST equal ceil(size / partSize) for the manifest's `size`, and `partDigests` MUST have exactly `partCount` items. Every digest MUST be sha2-256, because it is what the storage itself checks the part against.
+ */
+export interface PartPlan {
+    /**
+     * Bytes per part. One part of the whole blob's size is a single-object write.
+     */
+    partSize: number;
+    partCount: number;
+    /**
+     * The sha2-256 digest of each part's ciphertext, in order.
+     *
+     * @minItems 1
+     * @maxItems 1024
+     */
+    partDigests: [DigestMultibase, ...DigestMultibase[]];
+}
 export interface PasskeyVerificationMethod {
     /**
      * The verificationMethod id as it appears in the DID document: `<did>#passkey-<base64url(sha256(credentialId))>`. The fragment is content-derived so a verifier can locate this VM by recomputing `sha256(credential.id)`.
@@ -8607,6 +8630,30 @@ export interface TrafficOutcome {
      */
     detail?: string;
 }
+/**
+ * One time-limited URL at the room's storage, issued by the host for one object and one method. A bearer credential for its lifetime: whoever holds it may perform exactly that request. A host MUST bind it to one object, one method and — for a write — the part's exact length and checksum, so that storage itself refuses any other bytes, and MUST give it the shortest practical lifetime, never more than 5 minutes. No party logs it.
+ */
+export interface TransferTarget {
+    /**
+     * The part this target writes, or 0 for a read of the whole object.
+     */
+    index: number;
+    method: "PUT" | "GET";
+    /**
+     * Where to send the request. HTTPS only.
+     */
+    url: string;
+    /**
+     * Headers the request MUST carry exactly as given — for a write, the part's length and checksum, which the URL's signature covers. A client adds nothing the storage would treat as signed.
+     */
+    headers?: {
+        [k: string]: string | undefined;
+    };
+    /**
+     * When the storage stops honouring the URL. A request begun after it is refused by the storage.
+     */
+    expiresAt: string;
+}
 export interface TransportObservation {
     /**
      * The binding the document actually travelled on.