@openvtc/trust-tasks 0.28.14 → 0.28.15

package/dist/rooms/records/list/0.6/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../src/rooms/records/list/0.6/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkEH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,oDAA6D,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAkB,IAAI,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAkB,IAAI,CAAC;AAK/C,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,6DAAsE,CAAC;AAKxG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,oDAAoD;IAC3D,OAAO,EAAE,8BAA8B;IACvC,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,QAAQ;QACR,cAAc;KACf;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,wBAAwB;SACxC;QACD,cAAc,EAAE;YACd,MAAM,EAAE,+BAA+B;YACvC,aAAa,EAAE,qDAAqD;SACrE;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,+KAA+K;SAC/L;QACD,cAAc,EAAE;YACd,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,yQAAyQ;SACzR;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,yHAAyH;SACzI;QACD,OAAO,EAAE;YACP,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;YACd,aAAa,EAAE,8EAA8E;SAC9F;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,uCAAuC;YAChD,aAAa,EAAE,2GAA2G;YAC1H,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,SAAS;aACV;YACD,YAAY,EAAE;gBACZ,SAAS,EAAE;oBACT,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,0BAA0B;qBACnC;iBACF;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,+HAA+H;iBAC/I;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,wBAAwB;oBAChC,aAAa,EAAE,mZAAmZ;iBACna;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,qBAAqB;oBAC7B,aAAa,EAAE,0dAA0d;iBAC1e;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,qBAAqB;oBAC7B,aAAa,EAAE,0ZAA0Z;iBAC1a;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,qBAAqB;oBAC7B,aAAa,EAAE,iiBAAiiB;iBACjjB;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;YACD,mBAAmB,EAAE;gBACnB,aAAa,EAAE;oBACb,gBAAgB;iBACjB;gBACD,aAAa,EAAE;oBACb,gBAAgB;iBACjB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,SAAS;gBACT,UAAU;gBACV,SAAS;aACV;YACD,aAAa,EAAE,2xCAA2xC;YAC1yC,YAAY,EAAE;gBACZ,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,kPAAkP;iBAClQ;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,6BAA6B;iBAC7C;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,kGAAkG;iBAClH;aACF;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,stGAAstG;SACtuG;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,ugDAAugD;SACvhD;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,yBAAyB;YACjC,aAAa,EAAE,w2GAAw2G;SACx3G;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,gnDAAgnD;YAC/nD,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,4CAA4C;YACvD,UAAU,EAAE;gBACV,iDAAiD;aAClD;SACF;QACD,kBAAkB,EAAE;YAClB,OAAO,EAAE,kBAAkB;YAC3B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,KAAK;gBACL,SAAS;gBACT,WAAW;aACZ;YACD,aAAa,EAAE,yXAAyX;YACxY,YAAY,EAAE;gBACZ,KAAK,EAAE;oBACL,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mRAAmR;iBACnS;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,sCAAsC;iBACtD;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,kEAAkE;iBAClF;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,QAAQ;wBACR,YAAY;wBACZ,WAAW;qBACZ;oBACD,aAAa,EAAE,0JAA0J;iBAC1K;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,ixBAAixB;iBACjyB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,suBAAsuB;iBACtvB;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,4rBAA4rB;iBAC5sB;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,iEAAiE;iBACjF;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,iEAAiE;iBACjF;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,iJAAiJ;iBACjK;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,CAAC;oBACb,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,iBAAiB;qBAC1B;oBACD,aAAa,EAAE,kTAAkT;iBAClU;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,oBAAoB;oBAC5B,aAAa,EAAE,wZAAwZ;iBACxa;aACF;SACF;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,qBAAqB;YAChC,aAAa,EAAE,2uBAA2uB;SAC3vB;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,wvBAAwvB;YACvwB,MAAM,EAAE,yBAAyB;SAClC;QACD,uBAAuB,EAAE;YACvB,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,YAAY;gBACZ,WAAW;aACZ;YACD,aAAa,EAAE,giEAAgiE;YAC/iE,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,4JAA4J;iBAC5K;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;qBACjB;oBACD,aAAa,EAAE,odAAod;iBACpe;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mYAAmY;iBACnZ;aACF;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,uCAAuC;YAChD,aAAa,EAAE,2GAA2G;YAC1H,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,SAAS;aACV;YACD,YAAY,EAAE;gBACZ,SAAS,EAAE;oBACT,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE;wBACP,MAAM,EAAE,0BAA0B;qBACnC;iBACF;gBACD,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,+HAA+H;iBAC/I;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,wBAAwB;oBAChC,aAAa,EAAE,mZAAmZ;iBACna;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,qBAAqB;oBAC7B,aAAa,EAAE,0dAA0d;iBAC1e;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,qBAAqB;oBAC7B,aAAa,EAAE,0ZAA0Z;iBAC1a;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,qBAAqB;oBAC7B,aAAa,EAAE,iiBAAiiB;iBACjjB;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;YACD,mBAAmB,EAAE;gBACnB,aAAa,EAAE;oBACb,gBAAgB;iBACjB;gBACD,aAAa,EAAE;oBACb,gBAAgB;iBACjB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,SAAS;gBACT,UAAU;gBACV,SAAS;aACV;YACD,aAAa,EAAE,2xCAA2xC;YAC1yC,YAAY,EAAE;gBACZ,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,kPAAkP;iBAClQ;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,6BAA6B;iBAC7C;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,kGAAkG;iBAClH;aACF;SACF;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,stGAAstG;SACtuG;QACD,aAAa,EAAE;YACb,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,ugDAAugD;SACvhD;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,yBAAyB;YACjC,aAAa,EAAE,w2GAAw2G;SACx3G;QACD,iBAAiB,EAAE;YACjB,OAAO,EAAE,iBAAiB;YAC1B,aAAa,EAAE,gnDAAgnD;YAC/nD,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,4CAA4C;YACvD,UAAU,EAAE;gBACV,iDAAiD;aAClD;SACF;QACD,kBAAkB,EAAE;YAClB,OAAO,EAAE,kBAAkB;YAC3B,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,KAAK;gBACL,SAAS;gBACT,WAAW;aACZ;YACD,aAAa,EAAE,yXAAyX;YACxY,YAAY,EAAE;gBACZ,KAAK,EAAE;oBACL,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mRAAmR;iBACnS;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,sCAAsC;iBACtD;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,kEAAkE;iBAClF;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE;wBACN,QAAQ;wBACR,YAAY;wBACZ,WAAW;qBACZ;oBACD,aAAa,EAAE,0JAA0J;iBAC1K;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;iBACtB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,ixBAAixB;iBACjyB;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,SAAS,EAAE,OAAO;oBAClB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,suBAAsuB;iBACtvB;gBACD,cAAc,EAAE;oBACd,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,4rBAA4rB;iBAC5sB;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,iEAAiE;iBACjF;gBACD,aAAa,EAAE;oBACb,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,IAAI;oBACjB,aAAa,EAAE,iEAAiE;iBACjF;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,iJAAiJ;iBACjK;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,CAAC;oBACb,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE;wBACP,MAAM,EAAE,iBAAiB;qBAC1B;oBACD,aAAa,EAAE,kTAAkT;iBAClU;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,oBAAoB;oBAC5B,aAAa,EAAE,wZAAwZ;iBACxa;aACF;SACF;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,qBAAqB;YAChC,aAAa,EAAE,2uBAA2uB;SAC3vB;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,wvBAAwvB;YACvwB,MAAM,EAAE,yBAAyB;SAClC;QACD,uBAAuB,EAAE;YACvB,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,YAAY;gBACZ,WAAW;aACZ;YACD,aAAa,EAAE,giEAAgiE;YAC/iE,YAAY,EAAE;gBACZ,YAAY,EAAE;oBACZ,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,4JAA4J;iBAC5K;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;qBACjB;oBACD,aAAa,EAAE,odAAod;iBACpe;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mYAAmY;iBACnZ;aACF;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/dist/rooms/records/put/0.1/payload.d.ts

@@ -3,7 +3,7 @@
  * Source: specs/rooms/records/put/0.1/payload.schema.json
  */
 import type { AuthorityPresentation, Ext, SealedRecord } from "../../../../_shared/components.js";
-/** @deprecated superseded by rooms/records/put/0.4 */
+/** @deprecated superseded by rooms/records/put/0.5 */
 export interface RoomsRecordsPutPayload {
     /**
      * The room's identifier. A host verifies the presentation against credentials issued by this identifier, never against a member list of its own — which is what lets a room move hosts without reissuing a credential.
@@ -45,7 +45,7 @@ export interface RoomsRecordsPutPayload {
 /**
  * Success response to rooms/records/put. Type https://trusttasks.org/spec/rooms/records/put/0.1#response.
  *
- * @deprecated superseded by rooms/records/put/0.4
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export interface RoomsRecordsPutResponsePayload {
     /**
@@ -83,7 +83,7 @@ export declare const DEPRECATION: string | null;
 /**
  * Stable alias for this specification's request payload shape.
  *
- * @deprecated superseded by rooms/records/put/0.4
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export type Payload = RoomsRecordsPutPayload;
 /** Trust Task response type URI (request type URI + "#response"). */
@@ -91,7 +91,7 @@ export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/rooms/recor
 /**
  * Stable alias for this specification's success-response payload shape.
  *
- * @deprecated superseded by rooms/records/put/0.4
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export type Response = RoomsRecordsPutResponsePayload;
 /**

package/dist/rooms/records/put/0.1/payload.js

@@ -17,7 +17,7 @@ export const EXTENDS = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION = "superseded by rooms/records/put/0.4";
+export const DEPRECATION = "superseded by rooms/records/put/0.5";
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/rooms/records/put/0.1#response";
 /**

package/dist/rooms/records/put/0.2/payload.d.ts

@@ -6,7 +6,7 @@ import type { AuthorityPresentation, BlobRef, DigestMultibase, Ext, SealedRecord
 /**
  * A member writes a record to a data room, authorized by an authority chain the room itself issued. 0.2 adds `blobs`: a record can carry a file, whose ciphertext the host stores outside the record and whose description is sealed inside it.
  *
- * @deprecated superseded by rooms/records/put/0.4
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export interface RoomsRecordsPutPayload {
     /**
@@ -56,7 +56,7 @@ export interface RoomsRecordsPutPayload {
 /**
  * Success response to rooms/records/put. Type https://trusttasks.org/spec/rooms/records/put/0.2#response.
  *
- * @deprecated superseded by rooms/records/put/0.4
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export interface RoomsRecordsPutResponsePayload {
     /**
@@ -94,7 +94,7 @@ export declare const DEPRECATION: string | null;
 /**
  * Stable alias for this specification's request payload shape.
  *
- * @deprecated superseded by rooms/records/put/0.4
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export type Payload = RoomsRecordsPutPayload;
 /** Trust Task response type URI (request type URI + "#response"). */
@@ -102,7 +102,7 @@ export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/rooms/recor
 /**
  * Stable alias for this specification's success-response payload shape.
  *
- * @deprecated superseded by rooms/records/put/0.4
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export type Response = RoomsRecordsPutResponsePayload;
 /**

package/dist/rooms/records/put/0.2/payload.js

@@ -17,7 +17,7 @@ export const EXTENDS = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION = "superseded by rooms/records/put/0.4";
+export const DEPRECATION = "superseded by rooms/records/put/0.5";
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/rooms/records/put/0.2#response";
 /**

package/dist/rooms/records/put/0.3/payload.d.ts

@@ -6,7 +6,7 @@ import type { AuthorityPresentation, BlobRef, DigestMultibase, Ext, PermittedUse
 /**
  * A member writes a record to a data room, authorized by an authority chain the room itself issued. 0.2 added `blobs`: a record can carry a file, whose ciphertext the host stores outside the record and whose description is sealed inside it. 0.3 lets an `open` room's `cleartext` carry the record's provenance — `basis`, `confidence`, `evidence`, `validFor` — and its `validUntil`, which the sealed tiers carry inside the signed `SealedRecordBody`.
  *
- * @deprecated superseded by rooms/records/put/0.4
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export interface RoomsRecordsPutPayload {
     /**
@@ -67,7 +67,7 @@ export interface RoomsRecordsPutPayload {
 /**
  * Success response to rooms/records/put. Type https://trusttasks.org/spec/rooms/records/put/0.3#response.
  *
- * @deprecated superseded by rooms/records/put/0.4
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export interface RoomsRecordsPutResponsePayload {
     /**
@@ -105,7 +105,7 @@ export declare const DEPRECATION: string | null;
 /**
  * Stable alias for this specification's request payload shape.
  *
- * @deprecated superseded by rooms/records/put/0.4
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export type Payload = RoomsRecordsPutPayload;
 /** Trust Task response type URI (request type URI + "#response"). */
@@ -113,7 +113,7 @@ export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/rooms/recor
 /**
  * Stable alias for this specification's success-response payload shape.
  *
- * @deprecated superseded by rooms/records/put/0.4
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export type Response = RoomsRecordsPutResponsePayload;
 /**

package/dist/rooms/records/put/0.3/payload.js

@@ -17,7 +17,7 @@ export const EXTENDS = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION = "superseded by rooms/records/put/0.4";
+export const DEPRECATION = "superseded by rooms/records/put/0.5";
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/rooms/records/put/0.3#response";
 /**

package/dist/rooms/records/put/0.4/payload.d.ts

@@ -5,6 +5,8 @@
 import type { AuthorityPresentation, BlobRef, DigestMultibase, Ext, FileManifest, PermittedUse, RecordBasis, RecordConfidence, RecordEvidence, RecordEvidenceCredential, RecordEvidenceList, RecordEvidenceRecord, RecordValidUntil, SealedRecord } from "../../../../_shared/components.js";
 /**
  * A member writes a record to a data room, authorized by an authority chain the room itself issued. 0.2 added `blobs`: a record can carry a file, whose ciphertext the host stores outside the record and whose description is sealed inside it. 0.3 lets an `open` room's `cleartext` carry the record's provenance — `basis`, `confidence`, `evidence`, `validFor` — and its `validUntil`, which the sealed tiers carry inside the signed `SealedRecordBody`. 0.4 lets an `open` room's record carry a file: its `FileManifest`, with the file key it was sealed under, in `cleartext.file`.
+ *
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export interface RoomsRecordsPutPayload {
     /**
@@ -68,6 +70,8 @@ export interface RoomsRecordsPutPayload {
 }
 /**
  * Success response to rooms/records/put. Type https://trusttasks.org/spec/rooms/records/put/0.3#response.
+ *
+ * @deprecated superseded by rooms/records/put/0.5
  */
 export interface RoomsRecordsPutResponsePayload {
     /**
@@ -102,11 +106,19 @@ export declare const EXTENDS: string | null;
  * Versions").
  */
 export declare const DEPRECATION: string | null;
-/** Stable alias for this specification's request payload shape. */
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated superseded by rooms/records/put/0.5
+ */
 export type Payload = RoomsRecordsPutPayload;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/rooms/records/put/0.4#response";
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated superseded by rooms/records/put/0.5
+ */
 export type Response = RoomsRecordsPutResponsePayload;
 /**
  * This specification's payload schema, as a value.
@@ -269,7 +281,7 @@ export declare const PAYLOAD_SCHEMA: {
             readonly type: "object";
             readonly additionalProperties: false;
             readonly required: readonly ["fileId", "name", "size", "digest", "epoch", "segmentSize", "blobRef"];
-            readonly description: "Everything that describes a file. On an `attributed` or `private` room it is the `file` member of the sealed record body: sealed with the record, signed by the record's author, and never seen by the host. On an `open` room it is the `file` member of the record's `cleartext` (rooms/records/put/0.4), carrying its own `fileKey`, and the host reads it like the rest of the record. Defined here so that clients interoperate.\n\n**Byte encodings.** In every derivation below, `fileId` is its **32 decoded bytes**, never its base64url text; `roomId` is the **UTF-8 bytes** of the room identifier exactly as it appears on the wire; string constants are their ASCII bytes; `u8`, `u32be` and `u64be` are unsigned integers of that width, big-endian. Epochs are unsigned 64-bit on the wire. An implementation that holds epochs in a narrower type **MUST** refuse a value it cannot represent with `malformedRequest` (or, reading a manifest, refuse the file), and **MUST NOT** truncate it.\n\n**The file key.** `file_key = HKDF-SHA256(ikm = storage_key(epoch), salt = fileId, info = \"openvtc/room/file/v1\" || roomId || u64be(epoch))`, where `storage_key(epoch)` is the room's per-epoch storage key, the one records are sealed under. It is derived per file and never stored. It is bound to the room and the epoch, so a key released for one room cannot open a blob relocated from another, and releasing it exposes one file and nothing else.\n\n**The file key on an `open` room.** An open room has no group and so no storage key to derive from. There the uploader mints the file key itself — 32 bytes from a cryptographically secure random source, for this file only — and carries it in `fileKey`; a reader uses that key and derives nothing. Everything else below (padding, STREAM, the associated data, reading) is the same on every tier, with `epoch` the room's epoch when the file was written. `fileKey` **MUST** be present in an open room's manifest and **MUST** be absent from a sealed record body's, where the key is derived; a reader **MUST** refuse a file whose manifest breaks either rule. The key in the clear withholds nothing from the host or from anyone it serves the record to — the open tier withholds nothing from them — but it keeps the stored blob opaque to whoever holds only the storage, and keeps one blob format, and one reader, for every tier.\n\n**Padding.** With `padding: \"padme\"`, the plaintext of length `L = size` is extended with zero bytes to `padme(L)`: for `L < 2`, `padme(L) = L`; otherwise `E = floor(log2 L)`, `S = floor(log2 E) + 1`, `z = E − S`, `mask = 2^z − 1`, and `padme(L) = (L + mask) & ~mask`. The padded length is `padme(size)`; without padding it is `size`. Padding bytes **MUST** be zero.\n\n**The STREAM construction.** The padded plaintext is cut into `segmentSize`-byte segments, the last holding the remainder; an empty plaintext is one empty final segment. Segment `i` is sealed with ChaCha20-Poly1305 under `file_key`, with nonce `u32be(0) || u64be(i)` and associated data `\"openvtc/room/file/v1\" || roomId || fileId || u64be(epoch) || u64be(i) || u8(final)`, where `final` is 1 on the last segment and 0 on every other. A host that truncates, reorders or splices ciphertext produces an authentication failure, never a shorter or rearranged file. The nonces are counters, so a `file_key` MUST NOT seal two different files; a fresh random `fileId` is what guarantees it. Each sealed segment is one transfer chunk of the blob (BlobManifest), so `segmentSize + 16` is the blob's `chunks.chunkSize`, and an empty file is one 16-byte chunk.\n\n**Reading.** A reader opens the record, derives or obtains the file key, and **MUST**, before trusting a byte:\n- check that the blob's `chunks.chunkSize` equals `segmentSize + 16` and that `chunks.chunkCount` equals `max(1, ceil(paddedLength / segmentSize))`, and refuse the file otherwise;\n- decrypt every segment in order, refusing the file on any authentication failure or on a final flag anywhere but the last segment;\n- check that the decrypted length equals the padded length, that every padding byte is zero, and, after removing the padding, that the plaintext matches `digest`.\n\nA reader **MUST** refuse a file that fails any check, and **MUST NOT** present it with a warning instead. A reader that streams **MUST NOT** treat the plaintext as received — save it under its final name, render it, or hand it to another component — until the digest has verified; it writes to a temporary destination and discards that destination on a mismatch.";
+            readonly description: "Everything that describes a file. On an `attributed` or `private` room it is the `file` member of the sealed record body: sealed with the record, signed by the record's author, and never seen by the host. On an `open` room it is the `file` member of the record's `cleartext` (rooms/records/put/0.4), carrying its own `fileKey`, and the host reads it like the rest of the record. Defined here so that clients interoperate.\n\n**Byte encodings.** In every derivation below, `fileId` is its **32 decoded bytes**, never its base64url text; `roomId` is the **UTF-8 bytes** of the room identifier exactly as it appears on the wire; string constants are their ASCII bytes; `u8`, `u32be` and `u64be` are unsigned integers of that width, big-endian. Epochs are unsigned 64-bit on the wire. An implementation that holds epochs in a narrower type **MUST** refuse a value it cannot represent with `malformedRequest` (or, reading a manifest, refuse the file), and **MUST NOT** truncate it.\n\n**The file key.** `file_key = HKDF-SHA256(ikm = storage_key(epoch), salt = fileId, info = \"openvtc/room/file/v1\" || roomId || u64be(epoch))`, where `storage_key(epoch)` is the room's per-epoch storage key, the one records are sealed under. It is derived per file and never stored. It is bound to the room and the epoch, so a key released for one room cannot open a blob relocated from another, and releasing it exposes one file and nothing else.\n\n**The file key on an `open` room.** An open room has no group and so no storage key to derive from. There the uploader mints the file key itself — 32 bytes from a cryptographically secure random source, for this file only — and carries it in `fileKey`; a reader uses that key and derives nothing. Everything else below (padding, STREAM, the associated data, reading) is the same on every tier, with `epoch` the room's epoch when the file was written. `fileKey` **MUST** be present in an open room's manifest and **MUST** be absent from a sealed record body's, where the key is derived; a reader **MUST** refuse a file whose manifest breaks either rule. The key in the clear withholds nothing from the host or from anyone it serves the record to — the open tier withholds nothing from them — but it keeps the stored blob opaque to whoever holds only the storage, and keeps one blob format, and one reader, for every tier.\n\n**Padding.** With `padding: \"padme\"`, the plaintext of length `L = size` is extended with zero bytes to `padme(L)`: for `L < 2`, `padme(L) = L`; otherwise `E = floor(log2 L)`, `S = floor(log2 E) + 1`, `z = E − S`, `mask = 2^z − 1`, and `padme(L) = (L + mask) & ~mask`. The padded length is `padme(size)`; without padding it is `size`. Padding bytes **MUST** be zero.\n\n**The STREAM construction.** The padded plaintext is cut into `segmentSize`-byte segments, the last holding the remainder; an empty plaintext is one empty final segment. Segment `i` is sealed with ChaCha20-Poly1305 under `file_key`, with nonce `u32be(0) || u64be(i)` and associated data `\"openvtc/room/file/v1\" || roomId || fileId || u64be(epoch) || u64be(i) || u8(final)`, where `final` is 1 on the last segment and 0 on every other. A host that truncates, reorders or splices ciphertext produces an authentication failure, never a shorter or rearranged file. The nonces are counters, so a `file_key` MUST NOT seal two different files; a fresh random `fileId` is what guarantees it. Each sealed segment is one transfer chunk of the blob (BlobManifest), so `segmentSize + 16` is the blob's `chunks.chunkSize`, and an empty file is one 16-byte chunk.\n\n**Reading.** A reader opens the record, derives or obtains the file key, and **MUST**, before trusting a byte:\n- check that the blob's `chunks.chunkSize` equals `segmentSize + 16` and that `chunks.chunkCount` equals `max(1, ceil(paddedLength / segmentSize))`, and refuse the file otherwise;\n- decrypt every segment in order, refusing the file on any authentication failure or on a final flag anywhere but the last segment;\n- check that the decrypted length equals the padded length, that every padding byte is zero, and, after removing the padding, that the plaintext matches `digest`.\n\nA reader **MUST** refuse a file that fails any check, and **MUST NOT** present it with a warning instead. A reader that streams **MUST NOT** treat the plaintext as received — save it under its final name, render it, or hand it to another component — until the digest has verified; it writes to a temporary destination and discards that destination on a mismatch.\n\n**An image's size and preview.** `width`, `height` and `preview` are OPTIONAL and advisory: they let a reader lay out an image, and show something, before it fetches and decrypts the blob. A reader that fetches the file checks them against the bytes — the decoded image's dimensions, and that the file is an image at all — and on a mismatch uses the bytes and discards them; it MUST NOT treat any of them as evidence about the file. On `attributed` and `private` rooms they are inside the sealed, signed body like the rest of the manifest, so the host learns nothing from them; on an `open` room they are in the clear, as everything there is, and a writer carries them only with `rooms/records/put/0.5` or later. A writer uses them only once the room's profile lists them in `recordMembers` (`RoomProfile`), as with the other members a reader that predates them refuses.";
             readonly properties: {
                 readonly fileId: {
                     readonly type: "string";
@@ -321,6 +333,38 @@ export declare const PAYLOAD_SCHEMA: {
                     readonly pattern: "^[A-Za-z0-9_-]{43}$";
                     readonly description: "The file key itself, 32 bytes base64url without padding: present on an `open` room only, where there is no storage key to derive it from. Minted by the uploader from a cryptographically secure random source for this one file and never reused. MUST be absent on `attributed` and `private` rooms, where the key is derived and never stored.";
                 };
+                readonly width: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 1048576;
+                    readonly description: "The image's width in pixels, as the uploader read it. Advisory. A writer sets `width` and `height` together or neither; a reader ignores one without the other. A reader checks it against the decoded image.";
+                };
+                readonly height: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 1048576;
+                    readonly description: "The image's height in pixels, as the uploader read it. Advisory. A writer sets `width` and `height` together or neither; a reader ignores one without the other. A reader checks it against the decoded image.";
+                };
+                readonly preview: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["mediaType", "data"];
+                    readonly description: "A small image standing in for the file until it is fetched: at most 8192 bytes before encoding, enough for a blurred thumbnail and small enough not to swell the record every listing reader opens. A reader renders it only as a raster image it decodes itself — never as SVG or any other type that can carry active content, never as a link, never fetching anything — and replaces it with the file once fetched. It is the uploader's rendering of the file, not a digest of it: a reader MUST NOT present it as the file's contents.";
+                    readonly properties: {
+                        readonly mediaType: {
+                            readonly type: "string";
+                            readonly enum: readonly ["image/jpeg", "image/png", "image/webp"];
+                            readonly description: "The preview's own media type. Raster types only.";
+                        };
+                        readonly data: {
+                            readonly type: "string";
+                            readonly pattern: "^[A-Za-z0-9_-]+$";
+                            readonly minLength: 1;
+                            readonly maxLength: 10923;
+                            readonly description: "The preview's bytes, base64url without padding: at most 8192 bytes decoded.";
+                        };
+                    };
+                };
             };
         };
         readonly RecordValidUntil: {
@@ -556,7 +600,7 @@ export declare const RESPONSE_PAYLOAD_SCHEMA: {
             readonly type: "object";
             readonly additionalProperties: false;
             readonly required: readonly ["fileId", "name", "size", "digest", "epoch", "segmentSize", "blobRef"];
-            readonly description: "Everything that describes a file. On an `attributed` or `private` room it is the `file` member of the sealed record body: sealed with the record, signed by the record's author, and never seen by the host. On an `open` room it is the `file` member of the record's `cleartext` (rooms/records/put/0.4), carrying its own `fileKey`, and the host reads it like the rest of the record. Defined here so that clients interoperate.\n\n**Byte encodings.** In every derivation below, `fileId` is its **32 decoded bytes**, never its base64url text; `roomId` is the **UTF-8 bytes** of the room identifier exactly as it appears on the wire; string constants are their ASCII bytes; `u8`, `u32be` and `u64be` are unsigned integers of that width, big-endian. Epochs are unsigned 64-bit on the wire. An implementation that holds epochs in a narrower type **MUST** refuse a value it cannot represent with `malformedRequest` (or, reading a manifest, refuse the file), and **MUST NOT** truncate it.\n\n**The file key.** `file_key = HKDF-SHA256(ikm = storage_key(epoch), salt = fileId, info = \"openvtc/room/file/v1\" || roomId || u64be(epoch))`, where `storage_key(epoch)` is the room's per-epoch storage key, the one records are sealed under. It is derived per file and never stored. It is bound to the room and the epoch, so a key released for one room cannot open a blob relocated from another, and releasing it exposes one file and nothing else.\n\n**The file key on an `open` room.** An open room has no group and so no storage key to derive from. There the uploader mints the file key itself — 32 bytes from a cryptographically secure random source, for this file only — and carries it in `fileKey`; a reader uses that key and derives nothing. Everything else below (padding, STREAM, the associated data, reading) is the same on every tier, with `epoch` the room's epoch when the file was written. `fileKey` **MUST** be present in an open room's manifest and **MUST** be absent from a sealed record body's, where the key is derived; a reader **MUST** refuse a file whose manifest breaks either rule. The key in the clear withholds nothing from the host or from anyone it serves the record to — the open tier withholds nothing from them — but it keeps the stored blob opaque to whoever holds only the storage, and keeps one blob format, and one reader, for every tier.\n\n**Padding.** With `padding: \"padme\"`, the plaintext of length `L = size` is extended with zero bytes to `padme(L)`: for `L < 2`, `padme(L) = L`; otherwise `E = floor(log2 L)`, `S = floor(log2 E) + 1`, `z = E − S`, `mask = 2^z − 1`, and `padme(L) = (L + mask) & ~mask`. The padded length is `padme(size)`; without padding it is `size`. Padding bytes **MUST** be zero.\n\n**The STREAM construction.** The padded plaintext is cut into `segmentSize`-byte segments, the last holding the remainder; an empty plaintext is one empty final segment. Segment `i` is sealed with ChaCha20-Poly1305 under `file_key`, with nonce `u32be(0) || u64be(i)` and associated data `\"openvtc/room/file/v1\" || roomId || fileId || u64be(epoch) || u64be(i) || u8(final)`, where `final` is 1 on the last segment and 0 on every other. A host that truncates, reorders or splices ciphertext produces an authentication failure, never a shorter or rearranged file. The nonces are counters, so a `file_key` MUST NOT seal two different files; a fresh random `fileId` is what guarantees it. Each sealed segment is one transfer chunk of the blob (BlobManifest), so `segmentSize + 16` is the blob's `chunks.chunkSize`, and an empty file is one 16-byte chunk.\n\n**Reading.** A reader opens the record, derives or obtains the file key, and **MUST**, before trusting a byte:\n- check that the blob's `chunks.chunkSize` equals `segmentSize + 16` and that `chunks.chunkCount` equals `max(1, ceil(paddedLength / segmentSize))`, and refuse the file otherwise;\n- decrypt every segment in order, refusing the file on any authentication failure or on a final flag anywhere but the last segment;\n- check that the decrypted length equals the padded length, that every padding byte is zero, and, after removing the padding, that the plaintext matches `digest`.\n\nA reader **MUST** refuse a file that fails any check, and **MUST NOT** present it with a warning instead. A reader that streams **MUST NOT** treat the plaintext as received — save it under its final name, render it, or hand it to another component — until the digest has verified; it writes to a temporary destination and discards that destination on a mismatch.";
+            readonly description: "Everything that describes a file. On an `attributed` or `private` room it is the `file` member of the sealed record body: sealed with the record, signed by the record's author, and never seen by the host. On an `open` room it is the `file` member of the record's `cleartext` (rooms/records/put/0.4), carrying its own `fileKey`, and the host reads it like the rest of the record. Defined here so that clients interoperate.\n\n**Byte encodings.** In every derivation below, `fileId` is its **32 decoded bytes**, never its base64url text; `roomId` is the **UTF-8 bytes** of the room identifier exactly as it appears on the wire; string constants are their ASCII bytes; `u8`, `u32be` and `u64be` are unsigned integers of that width, big-endian. Epochs are unsigned 64-bit on the wire. An implementation that holds epochs in a narrower type **MUST** refuse a value it cannot represent with `malformedRequest` (or, reading a manifest, refuse the file), and **MUST NOT** truncate it.\n\n**The file key.** `file_key = HKDF-SHA256(ikm = storage_key(epoch), salt = fileId, info = \"openvtc/room/file/v1\" || roomId || u64be(epoch))`, where `storage_key(epoch)` is the room's per-epoch storage key, the one records are sealed under. It is derived per file and never stored. It is bound to the room and the epoch, so a key released for one room cannot open a blob relocated from another, and releasing it exposes one file and nothing else.\n\n**The file key on an `open` room.** An open room has no group and so no storage key to derive from. There the uploader mints the file key itself — 32 bytes from a cryptographically secure random source, for this file only — and carries it in `fileKey`; a reader uses that key and derives nothing. Everything else below (padding, STREAM, the associated data, reading) is the same on every tier, with `epoch` the room's epoch when the file was written. `fileKey` **MUST** be present in an open room's manifest and **MUST** be absent from a sealed record body's, where the key is derived; a reader **MUST** refuse a file whose manifest breaks either rule. The key in the clear withholds nothing from the host or from anyone it serves the record to — the open tier withholds nothing from them — but it keeps the stored blob opaque to whoever holds only the storage, and keeps one blob format, and one reader, for every tier.\n\n**Padding.** With `padding: \"padme\"`, the plaintext of length `L = size` is extended with zero bytes to `padme(L)`: for `L < 2`, `padme(L) = L`; otherwise `E = floor(log2 L)`, `S = floor(log2 E) + 1`, `z = E − S`, `mask = 2^z − 1`, and `padme(L) = (L + mask) & ~mask`. The padded length is `padme(size)`; without padding it is `size`. Padding bytes **MUST** be zero.\n\n**The STREAM construction.** The padded plaintext is cut into `segmentSize`-byte segments, the last holding the remainder; an empty plaintext is one empty final segment. Segment `i` is sealed with ChaCha20-Poly1305 under `file_key`, with nonce `u32be(0) || u64be(i)` and associated data `\"openvtc/room/file/v1\" || roomId || fileId || u64be(epoch) || u64be(i) || u8(final)`, where `final` is 1 on the last segment and 0 on every other. A host that truncates, reorders or splices ciphertext produces an authentication failure, never a shorter or rearranged file. The nonces are counters, so a `file_key` MUST NOT seal two different files; a fresh random `fileId` is what guarantees it. Each sealed segment is one transfer chunk of the blob (BlobManifest), so `segmentSize + 16` is the blob's `chunks.chunkSize`, and an empty file is one 16-byte chunk.\n\n**Reading.** A reader opens the record, derives or obtains the file key, and **MUST**, before trusting a byte:\n- check that the blob's `chunks.chunkSize` equals `segmentSize + 16` and that `chunks.chunkCount` equals `max(1, ceil(paddedLength / segmentSize))`, and refuse the file otherwise;\n- decrypt every segment in order, refusing the file on any authentication failure or on a final flag anywhere but the last segment;\n- check that the decrypted length equals the padded length, that every padding byte is zero, and, after removing the padding, that the plaintext matches `digest`.\n\nA reader **MUST** refuse a file that fails any check, and **MUST NOT** present it with a warning instead. A reader that streams **MUST NOT** treat the plaintext as received — save it under its final name, render it, or hand it to another component — until the digest has verified; it writes to a temporary destination and discards that destination on a mismatch.\n\n**An image's size and preview.** `width`, `height` and `preview` are OPTIONAL and advisory: they let a reader lay out an image, and show something, before it fetches and decrypts the blob. A reader that fetches the file checks them against the bytes — the decoded image's dimensions, and that the file is an image at all — and on a mismatch uses the bytes and discards them; it MUST NOT treat any of them as evidence about the file. On `attributed` and `private` rooms they are inside the sealed, signed body like the rest of the manifest, so the host learns nothing from them; on an `open` room they are in the clear, as everything there is, and a writer carries them only with `rooms/records/put/0.5` or later. A writer uses them only once the room's profile lists them in `recordMembers` (`RoomProfile`), as with the other members a reader that predates them refuses.";
             readonly properties: {
                 readonly fileId: {
                     readonly type: "string";
@@ -608,6 +652,38 @@ export declare const RESPONSE_PAYLOAD_SCHEMA: {
                     readonly pattern: "^[A-Za-z0-9_-]{43}$";
                     readonly description: "The file key itself, 32 bytes base64url without padding: present on an `open` room only, where there is no storage key to derive it from. Minted by the uploader from a cryptographically secure random source for this one file and never reused. MUST be absent on `attributed` and `private` rooms, where the key is derived and never stored.";
                 };
+                readonly width: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 1048576;
+                    readonly description: "The image's width in pixels, as the uploader read it. Advisory. A writer sets `width` and `height` together or neither; a reader ignores one without the other. A reader checks it against the decoded image.";
+                };
+                readonly height: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 1048576;
+                    readonly description: "The image's height in pixels, as the uploader read it. Advisory. A writer sets `width` and `height` together or neither; a reader ignores one without the other. A reader checks it against the decoded image.";
+                };
+                readonly preview: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["mediaType", "data"];
+                    readonly description: "A small image standing in for the file until it is fetched: at most 8192 bytes before encoding, enough for a blurred thumbnail and small enough not to swell the record every listing reader opens. A reader renders it only as a raster image it decodes itself — never as SVG or any other type that can carry active content, never as a link, never fetching anything — and replaces it with the file once fetched. It is the uploader's rendering of the file, not a digest of it: a reader MUST NOT present it as the file's contents.";
+                    readonly properties: {
+                        readonly mediaType: {
+                            readonly type: "string";
+                            readonly enum: readonly ["image/jpeg", "image/png", "image/webp"];
+                            readonly description: "The preview's own media type. Raster types only.";
+                        };
+                        readonly data: {
+                            readonly type: "string";
+                            readonly pattern: "^[A-Za-z0-9_-]+$";
+                            readonly minLength: 1;
+                            readonly maxLength: 10923;
+                            readonly description: "The preview's bytes, base64url without padding: at most 8192 bytes decoded.";
+                        };
+                    };
+                };
             };
         };
         readonly RecordValidUntil: {
@@ -946,7 +1022,7 @@ export declare const SPEC: {
                 readonly type: "object";
                 readonly additionalProperties: false;
                 readonly required: readonly ["fileId", "name", "size", "digest", "epoch", "segmentSize", "blobRef"];
-                readonly description: "Everything that describes a file. On an `attributed` or `private` room it is the `file` member of the sealed record body: sealed with the record, signed by the record's author, and never seen by the host. On an `open` room it is the `file` member of the record's `cleartext` (rooms/records/put/0.4), carrying its own `fileKey`, and the host reads it like the rest of the record. Defined here so that clients interoperate.\n\n**Byte encodings.** In every derivation below, `fileId` is its **32 decoded bytes**, never its base64url text; `roomId` is the **UTF-8 bytes** of the room identifier exactly as it appears on the wire; string constants are their ASCII bytes; `u8`, `u32be` and `u64be` are unsigned integers of that width, big-endian. Epochs are unsigned 64-bit on the wire. An implementation that holds epochs in a narrower type **MUST** refuse a value it cannot represent with `malformedRequest` (or, reading a manifest, refuse the file), and **MUST NOT** truncate it.\n\n**The file key.** `file_key = HKDF-SHA256(ikm = storage_key(epoch), salt = fileId, info = \"openvtc/room/file/v1\" || roomId || u64be(epoch))`, where `storage_key(epoch)` is the room's per-epoch storage key, the one records are sealed under. It is derived per file and never stored. It is bound to the room and the epoch, so a key released for one room cannot open a blob relocated from another, and releasing it exposes one file and nothing else.\n\n**The file key on an `open` room.** An open room has no group and so no storage key to derive from. There the uploader mints the file key itself — 32 bytes from a cryptographically secure random source, for this file only — and carries it in `fileKey`; a reader uses that key and derives nothing. Everything else below (padding, STREAM, the associated data, reading) is the same on every tier, with `epoch` the room's epoch when the file was written. `fileKey` **MUST** be present in an open room's manifest and **MUST** be absent from a sealed record body's, where the key is derived; a reader **MUST** refuse a file whose manifest breaks either rule. The key in the clear withholds nothing from the host or from anyone it serves the record to — the open tier withholds nothing from them — but it keeps the stored blob opaque to whoever holds only the storage, and keeps one blob format, and one reader, for every tier.\n\n**Padding.** With `padding: \"padme\"`, the plaintext of length `L = size` is extended with zero bytes to `padme(L)`: for `L < 2`, `padme(L) = L`; otherwise `E = floor(log2 L)`, `S = floor(log2 E) + 1`, `z = E − S`, `mask = 2^z − 1`, and `padme(L) = (L + mask) & ~mask`. The padded length is `padme(size)`; without padding it is `size`. Padding bytes **MUST** be zero.\n\n**The STREAM construction.** The padded plaintext is cut into `segmentSize`-byte segments, the last holding the remainder; an empty plaintext is one empty final segment. Segment `i` is sealed with ChaCha20-Poly1305 under `file_key`, with nonce `u32be(0) || u64be(i)` and associated data `\"openvtc/room/file/v1\" || roomId || fileId || u64be(epoch) || u64be(i) || u8(final)`, where `final` is 1 on the last segment and 0 on every other. A host that truncates, reorders or splices ciphertext produces an authentication failure, never a shorter or rearranged file. The nonces are counters, so a `file_key` MUST NOT seal two different files; a fresh random `fileId` is what guarantees it. Each sealed segment is one transfer chunk of the blob (BlobManifest), so `segmentSize + 16` is the blob's `chunks.chunkSize`, and an empty file is one 16-byte chunk.\n\n**Reading.** A reader opens the record, derives or obtains the file key, and **MUST**, before trusting a byte:\n- check that the blob's `chunks.chunkSize` equals `segmentSize + 16` and that `chunks.chunkCount` equals `max(1, ceil(paddedLength / segmentSize))`, and refuse the file otherwise;\n- decrypt every segment in order, refusing the file on any authentication failure or on a final flag anywhere but the last segment;\n- check that the decrypted length equals the padded length, that every padding byte is zero, and, after removing the padding, that the plaintext matches `digest`.\n\nA reader **MUST** refuse a file that fails any check, and **MUST NOT** present it with a warning instead. A reader that streams **MUST NOT** treat the plaintext as received — save it under its final name, render it, or hand it to another component — until the digest has verified; it writes to a temporary destination and discards that destination on a mismatch.";
+                readonly description: "Everything that describes a file. On an `attributed` or `private` room it is the `file` member of the sealed record body: sealed with the record, signed by the record's author, and never seen by the host. On an `open` room it is the `file` member of the record's `cleartext` (rooms/records/put/0.4), carrying its own `fileKey`, and the host reads it like the rest of the record. Defined here so that clients interoperate.\n\n**Byte encodings.** In every derivation below, `fileId` is its **32 decoded bytes**, never its base64url text; `roomId` is the **UTF-8 bytes** of the room identifier exactly as it appears on the wire; string constants are their ASCII bytes; `u8`, `u32be` and `u64be` are unsigned integers of that width, big-endian. Epochs are unsigned 64-bit on the wire. An implementation that holds epochs in a narrower type **MUST** refuse a value it cannot represent with `malformedRequest` (or, reading a manifest, refuse the file), and **MUST NOT** truncate it.\n\n**The file key.** `file_key = HKDF-SHA256(ikm = storage_key(epoch), salt = fileId, info = \"openvtc/room/file/v1\" || roomId || u64be(epoch))`, where `storage_key(epoch)` is the room's per-epoch storage key, the one records are sealed under. It is derived per file and never stored. It is bound to the room and the epoch, so a key released for one room cannot open a blob relocated from another, and releasing it exposes one file and nothing else.\n\n**The file key on an `open` room.** An open room has no group and so no storage key to derive from. There the uploader mints the file key itself — 32 bytes from a cryptographically secure random source, for this file only — and carries it in `fileKey`; a reader uses that key and derives nothing. Everything else below (padding, STREAM, the associated data, reading) is the same on every tier, with `epoch` the room's epoch when the file was written. `fileKey` **MUST** be present in an open room's manifest and **MUST** be absent from a sealed record body's, where the key is derived; a reader **MUST** refuse a file whose manifest breaks either rule. The key in the clear withholds nothing from the host or from anyone it serves the record to — the open tier withholds nothing from them — but it keeps the stored blob opaque to whoever holds only the storage, and keeps one blob format, and one reader, for every tier.\n\n**Padding.** With `padding: \"padme\"`, the plaintext of length `L = size` is extended with zero bytes to `padme(L)`: for `L < 2`, `padme(L) = L`; otherwise `E = floor(log2 L)`, `S = floor(log2 E) + 1`, `z = E − S`, `mask = 2^z − 1`, and `padme(L) = (L + mask) & ~mask`. The padded length is `padme(size)`; without padding it is `size`. Padding bytes **MUST** be zero.\n\n**The STREAM construction.** The padded plaintext is cut into `segmentSize`-byte segments, the last holding the remainder; an empty plaintext is one empty final segment. Segment `i` is sealed with ChaCha20-Poly1305 under `file_key`, with nonce `u32be(0) || u64be(i)` and associated data `\"openvtc/room/file/v1\" || roomId || fileId || u64be(epoch) || u64be(i) || u8(final)`, where `final` is 1 on the last segment and 0 on every other. A host that truncates, reorders or splices ciphertext produces an authentication failure, never a shorter or rearranged file. The nonces are counters, so a `file_key` MUST NOT seal two different files; a fresh random `fileId` is what guarantees it. Each sealed segment is one transfer chunk of the blob (BlobManifest), so `segmentSize + 16` is the blob's `chunks.chunkSize`, and an empty file is one 16-byte chunk.\n\n**Reading.** A reader opens the record, derives or obtains the file key, and **MUST**, before trusting a byte:\n- check that the blob's `chunks.chunkSize` equals `segmentSize + 16` and that `chunks.chunkCount` equals `max(1, ceil(paddedLength / segmentSize))`, and refuse the file otherwise;\n- decrypt every segment in order, refusing the file on any authentication failure or on a final flag anywhere but the last segment;\n- check that the decrypted length equals the padded length, that every padding byte is zero, and, after removing the padding, that the plaintext matches `digest`.\n\nA reader **MUST** refuse a file that fails any check, and **MUST NOT** present it with a warning instead. A reader that streams **MUST NOT** treat the plaintext as received — save it under its final name, render it, or hand it to another component — until the digest has verified; it writes to a temporary destination and discards that destination on a mismatch.\n\n**An image's size and preview.** `width`, `height` and `preview` are OPTIONAL and advisory: they let a reader lay out an image, and show something, before it fetches and decrypts the blob. A reader that fetches the file checks them against the bytes — the decoded image's dimensions, and that the file is an image at all — and on a mismatch uses the bytes and discards them; it MUST NOT treat any of them as evidence about the file. On `attributed` and `private` rooms they are inside the sealed, signed body like the rest of the manifest, so the host learns nothing from them; on an `open` room they are in the clear, as everything there is, and a writer carries them only with `rooms/records/put/0.5` or later. A writer uses them only once the room's profile lists them in `recordMembers` (`RoomProfile`), as with the other members a reader that predates them refuses.";
                 readonly properties: {
                     readonly fileId: {
                         readonly type: "string";
@@ -998,6 +1074,38 @@ export declare const SPEC: {
                         readonly pattern: "^[A-Za-z0-9_-]{43}$";
                         readonly description: "The file key itself, 32 bytes base64url without padding: present on an `open` room only, where there is no storage key to derive it from. Minted by the uploader from a cryptographically secure random source for this one file and never reused. MUST be absent on `attributed` and `private` rooms, where the key is derived and never stored.";
                     };
+                    readonly width: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 1048576;
+                        readonly description: "The image's width in pixels, as the uploader read it. Advisory. A writer sets `width` and `height` together or neither; a reader ignores one without the other. A reader checks it against the decoded image.";
+                    };
+                    readonly height: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 1048576;
+                        readonly description: "The image's height in pixels, as the uploader read it. Advisory. A writer sets `width` and `height` together or neither; a reader ignores one without the other. A reader checks it against the decoded image.";
+                    };
+                    readonly preview: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["mediaType", "data"];
+                        readonly description: "A small image standing in for the file until it is fetched: at most 8192 bytes before encoding, enough for a blurred thumbnail and small enough not to swell the record every listing reader opens. A reader renders it only as a raster image it decodes itself — never as SVG or any other type that can carry active content, never as a link, never fetching anything — and replaces it with the file once fetched. It is the uploader's rendering of the file, not a digest of it: a reader MUST NOT present it as the file's contents.";
+                        readonly properties: {
+                            readonly mediaType: {
+                                readonly type: "string";
+                                readonly enum: readonly ["image/jpeg", "image/png", "image/webp"];
+                                readonly description: "The preview's own media type. Raster types only.";
+                            };
+                            readonly data: {
+                                readonly type: "string";
+                                readonly pattern: "^[A-Za-z0-9_-]+$";
+                                readonly minLength: 1;
+                                readonly maxLength: 10923;
+                                readonly description: "The preview's bytes, base64url without padding: at most 8192 bytes decoded.";
+                            };
+                        };
+                    };
                 };
             };
             readonly RecordValidUntil: {
@@ -1244,7 +1352,7 @@ export declare const RESPONSE_SPEC: {
                 readonly type: "object";
                 readonly additionalProperties: false;
                 readonly required: readonly ["fileId", "name", "size", "digest", "epoch", "segmentSize", "blobRef"];
-                readonly description: "Everything that describes a file. On an `attributed` or `private` room it is the `file` member of the sealed record body: sealed with the record, signed by the record's author, and never seen by the host. On an `open` room it is the `file` member of the record's `cleartext` (rooms/records/put/0.4), carrying its own `fileKey`, and the host reads it like the rest of the record. Defined here so that clients interoperate.\n\n**Byte encodings.** In every derivation below, `fileId` is its **32 decoded bytes**, never its base64url text; `roomId` is the **UTF-8 bytes** of the room identifier exactly as it appears on the wire; string constants are their ASCII bytes; `u8`, `u32be` and `u64be` are unsigned integers of that width, big-endian. Epochs are unsigned 64-bit on the wire. An implementation that holds epochs in a narrower type **MUST** refuse a value it cannot represent with `malformedRequest` (or, reading a manifest, refuse the file), and **MUST NOT** truncate it.\n\n**The file key.** `file_key = HKDF-SHA256(ikm = storage_key(epoch), salt = fileId, info = \"openvtc/room/file/v1\" || roomId || u64be(epoch))`, where `storage_key(epoch)` is the room's per-epoch storage key, the one records are sealed under. It is derived per file and never stored. It is bound to the room and the epoch, so a key released for one room cannot open a blob relocated from another, and releasing it exposes one file and nothing else.\n\n**The file key on an `open` room.** An open room has no group and so no storage key to derive from. There the uploader mints the file key itself — 32 bytes from a cryptographically secure random source, for this file only — and carries it in `fileKey`; a reader uses that key and derives nothing. Everything else below (padding, STREAM, the associated data, reading) is the same on every tier, with `epoch` the room's epoch when the file was written. `fileKey` **MUST** be present in an open room's manifest and **MUST** be absent from a sealed record body's, where the key is derived; a reader **MUST** refuse a file whose manifest breaks either rule. The key in the clear withholds nothing from the host or from anyone it serves the record to — the open tier withholds nothing from them — but it keeps the stored blob opaque to whoever holds only the storage, and keeps one blob format, and one reader, for every tier.\n\n**Padding.** With `padding: \"padme\"`, the plaintext of length `L = size` is extended with zero bytes to `padme(L)`: for `L < 2`, `padme(L) = L`; otherwise `E = floor(log2 L)`, `S = floor(log2 E) + 1`, `z = E − S`, `mask = 2^z − 1`, and `padme(L) = (L + mask) & ~mask`. The padded length is `padme(size)`; without padding it is `size`. Padding bytes **MUST** be zero.\n\n**The STREAM construction.** The padded plaintext is cut into `segmentSize`-byte segments, the last holding the remainder; an empty plaintext is one empty final segment. Segment `i` is sealed with ChaCha20-Poly1305 under `file_key`, with nonce `u32be(0) || u64be(i)` and associated data `\"openvtc/room/file/v1\" || roomId || fileId || u64be(epoch) || u64be(i) || u8(final)`, where `final` is 1 on the last segment and 0 on every other. A host that truncates, reorders or splices ciphertext produces an authentication failure, never a shorter or rearranged file. The nonces are counters, so a `file_key` MUST NOT seal two different files; a fresh random `fileId` is what guarantees it. Each sealed segment is one transfer chunk of the blob (BlobManifest), so `segmentSize + 16` is the blob's `chunks.chunkSize`, and an empty file is one 16-byte chunk.\n\n**Reading.** A reader opens the record, derives or obtains the file key, and **MUST**, before trusting a byte:\n- check that the blob's `chunks.chunkSize` equals `segmentSize + 16` and that `chunks.chunkCount` equals `max(1, ceil(paddedLength / segmentSize))`, and refuse the file otherwise;\n- decrypt every segment in order, refusing the file on any authentication failure or on a final flag anywhere but the last segment;\n- check that the decrypted length equals the padded length, that every padding byte is zero, and, after removing the padding, that the plaintext matches `digest`.\n\nA reader **MUST** refuse a file that fails any check, and **MUST NOT** present it with a warning instead. A reader that streams **MUST NOT** treat the plaintext as received — save it under its final name, render it, or hand it to another component — until the digest has verified; it writes to a temporary destination and discards that destination on a mismatch.";
+                readonly description: "Everything that describes a file. On an `attributed` or `private` room it is the `file` member of the sealed record body: sealed with the record, signed by the record's author, and never seen by the host. On an `open` room it is the `file` member of the record's `cleartext` (rooms/records/put/0.4), carrying its own `fileKey`, and the host reads it like the rest of the record. Defined here so that clients interoperate.\n\n**Byte encodings.** In every derivation below, `fileId` is its **32 decoded bytes**, never its base64url text; `roomId` is the **UTF-8 bytes** of the room identifier exactly as it appears on the wire; string constants are their ASCII bytes; `u8`, `u32be` and `u64be` are unsigned integers of that width, big-endian. Epochs are unsigned 64-bit on the wire. An implementation that holds epochs in a narrower type **MUST** refuse a value it cannot represent with `malformedRequest` (or, reading a manifest, refuse the file), and **MUST NOT** truncate it.\n\n**The file key.** `file_key = HKDF-SHA256(ikm = storage_key(epoch), salt = fileId, info = \"openvtc/room/file/v1\" || roomId || u64be(epoch))`, where `storage_key(epoch)` is the room's per-epoch storage key, the one records are sealed under. It is derived per file and never stored. It is bound to the room and the epoch, so a key released for one room cannot open a blob relocated from another, and releasing it exposes one file and nothing else.\n\n**The file key on an `open` room.** An open room has no group and so no storage key to derive from. There the uploader mints the file key itself — 32 bytes from a cryptographically secure random source, for this file only — and carries it in `fileKey`; a reader uses that key and derives nothing. Everything else below (padding, STREAM, the associated data, reading) is the same on every tier, with `epoch` the room's epoch when the file was written. `fileKey` **MUST** be present in an open room's manifest and **MUST** be absent from a sealed record body's, where the key is derived; a reader **MUST** refuse a file whose manifest breaks either rule. The key in the clear withholds nothing from the host or from anyone it serves the record to — the open tier withholds nothing from them — but it keeps the stored blob opaque to whoever holds only the storage, and keeps one blob format, and one reader, for every tier.\n\n**Padding.** With `padding: \"padme\"`, the plaintext of length `L = size` is extended with zero bytes to `padme(L)`: for `L < 2`, `padme(L) = L`; otherwise `E = floor(log2 L)`, `S = floor(log2 E) + 1`, `z = E − S`, `mask = 2^z − 1`, and `padme(L) = (L + mask) & ~mask`. The padded length is `padme(size)`; without padding it is `size`. Padding bytes **MUST** be zero.\n\n**The STREAM construction.** The padded plaintext is cut into `segmentSize`-byte segments, the last holding the remainder; an empty plaintext is one empty final segment. Segment `i` is sealed with ChaCha20-Poly1305 under `file_key`, with nonce `u32be(0) || u64be(i)` and associated data `\"openvtc/room/file/v1\" || roomId || fileId || u64be(epoch) || u64be(i) || u8(final)`, where `final` is 1 on the last segment and 0 on every other. A host that truncates, reorders or splices ciphertext produces an authentication failure, never a shorter or rearranged file. The nonces are counters, so a `file_key` MUST NOT seal two different files; a fresh random `fileId` is what guarantees it. Each sealed segment is one transfer chunk of the blob (BlobManifest), so `segmentSize + 16` is the blob's `chunks.chunkSize`, and an empty file is one 16-byte chunk.\n\n**Reading.** A reader opens the record, derives or obtains the file key, and **MUST**, before trusting a byte:\n- check that the blob's `chunks.chunkSize` equals `segmentSize + 16` and that `chunks.chunkCount` equals `max(1, ceil(paddedLength / segmentSize))`, and refuse the file otherwise;\n- decrypt every segment in order, refusing the file on any authentication failure or on a final flag anywhere but the last segment;\n- check that the decrypted length equals the padded length, that every padding byte is zero, and, after removing the padding, that the plaintext matches `digest`.\n\nA reader **MUST** refuse a file that fails any check, and **MUST NOT** present it with a warning instead. A reader that streams **MUST NOT** treat the plaintext as received — save it under its final name, render it, or hand it to another component — until the digest has verified; it writes to a temporary destination and discards that destination on a mismatch.\n\n**An image's size and preview.** `width`, `height` and `preview` are OPTIONAL and advisory: they let a reader lay out an image, and show something, before it fetches and decrypts the blob. A reader that fetches the file checks them against the bytes — the decoded image's dimensions, and that the file is an image at all — and on a mismatch uses the bytes and discards them; it MUST NOT treat any of them as evidence about the file. On `attributed` and `private` rooms they are inside the sealed, signed body like the rest of the manifest, so the host learns nothing from them; on an `open` room they are in the clear, as everything there is, and a writer carries them only with `rooms/records/put/0.5` or later. A writer uses them only once the room's profile lists them in `recordMembers` (`RoomProfile`), as with the other members a reader that predates them refuses.";
                 readonly properties: {
                     readonly fileId: {
                         readonly type: "string";
@@ -1296,6 +1404,38 @@ export declare const RESPONSE_SPEC: {
                         readonly pattern: "^[A-Za-z0-9_-]{43}$";
                         readonly description: "The file key itself, 32 bytes base64url without padding: present on an `open` room only, where there is no storage key to derive it from. Minted by the uploader from a cryptographically secure random source for this one file and never reused. MUST be absent on `attributed` and `private` rooms, where the key is derived and never stored.";
                     };
+                    readonly width: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 1048576;
+                        readonly description: "The image's width in pixels, as the uploader read it. Advisory. A writer sets `width` and `height` together or neither; a reader ignores one without the other. A reader checks it against the decoded image.";
+                    };
+                    readonly height: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 1048576;
+                        readonly description: "The image's height in pixels, as the uploader read it. Advisory. A writer sets `width` and `height` together or neither; a reader ignores one without the other. A reader checks it against the decoded image.";
+                    };
+                    readonly preview: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["mediaType", "data"];
+                        readonly description: "A small image standing in for the file until it is fetched: at most 8192 bytes before encoding, enough for a blurred thumbnail and small enough not to swell the record every listing reader opens. A reader renders it only as a raster image it decodes itself — never as SVG or any other type that can carry active content, never as a link, never fetching anything — and replaces it with the file once fetched. It is the uploader's rendering of the file, not a digest of it: a reader MUST NOT present it as the file's contents.";
+                        readonly properties: {
+                            readonly mediaType: {
+                                readonly type: "string";
+                                readonly enum: readonly ["image/jpeg", "image/png", "image/webp"];
+                                readonly description: "The preview's own media type. Raster types only.";
+                            };
+                            readonly data: {
+                                readonly type: "string";
+                                readonly pattern: "^[A-Za-z0-9_-]+$";
+                                readonly minLength: 1;
+                                readonly maxLength: 10923;
+                                readonly description: "The preview's bytes, base64url without padding: at most 8192 bytes decoded.";
+                            };
+                        };
+                    };
                 };
             };
             readonly RecordValidUntil: {

package/dist/rooms/records/put/0.4/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/rooms/records/put/0.4/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAG7R;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,YAAY,EAAE,qBAAqB,CAAC;IACpC;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb;;WAEG;QACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB;;WAEG;QACH,KAAK,CAAC,EAAE,WAAW,CAAC;QACpB,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;QAC9B,QAAQ,CAAC,EAAE,YAAY,CAAC;QACxB;;WAEG;QACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B;;WAEG;QACH,IAAI,CAAC,EAAE,YAAY,CAAC;KACrB,CAAC;IACF;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IAClB;;OAEG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,qBAAqB,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;AAEpP,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,mDAA4D,CAAC;AAErF;;;;;GAKG;AACH,eAAO,MAAM,OAAO,EAAE,MAAM,GAAG,IAAY,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,GAAG,IAAW,CAAC;AAE/C,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAE7C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,4DAAqE,CAAC;AAEvG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,8BAA8B,CAAC;AAEtD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoajB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkU1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/rooms/records/put/0.4/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAG7R;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,YAAY,EAAE,qBAAqB,CAAC;IACpC;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb;;WAEG;QACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB;;WAEG;QACH,KAAK,CAAC,EAAE,WAAW,CAAC;QACpB,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;QAC9B,QAAQ,CAAC,EAAE,YAAY,CAAC;QACxB;;WAEG;QACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B;;WAEG;QACH,IAAI,CAAC,EAAE,YAAY,CAAC;KACrB,CAAC;IACF;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IAClB;;OAEG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,qBAAqB,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;AAEpP,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,mDAA4D,CAAC;AAErF;;;;;GAKG;AACH,eAAO,MAAM,OAAO,EAAE,MAAM,GAAG,IAAY,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,GAAG,IAA4C,CAAC;AAEhF;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAE7C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,4DAAqE,CAAC;AAEvG;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,8BAA8B,CAAC;AAEtD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2cjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyW1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}