@openvtc/trust-tasks 0.28.6 → 0.28.8

package/CHANGELOG.md

@@ -11,6 +11,79 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.28.8 — 2026-11-02
+
+
+### Added
+
+- **vtc/rooms/community**: Archive, unarchive, remove and removal/cancel 0.1; get/list 0.4, members/add+list 0.2, memberships/list 0.2 (#1006)
+
+A community could create a room it owns and change its members, but never
+  close or end one. This adds an owner's lifecycle for a community-owned room,
+  distinct from the host's computed clock (live/lapsed/dormant/reclaimable):
+
+  - active
+  - archived, with an access: readOnly (members keep reading; the host refuses
+    every write, upload and curation) or noAccess (the community's VTA resets
+    the room — one `room` withdrawal — and re-issues the community's own
+    credentials; each admitted member becomes `suspended`). Open offers are
+    withdrawn either way. Reversible: vtc/rooms/community/unarchive restores
+    suspended members in the background by re-issuing their membership and
+    authority, collected as an offers/list renewal.
+  - removalScheduled: only from archived (removal is the second of two
+    deliberate acts). The room is noAccess and its content kept until purgeAt,
+    after a grace period (graceDays, or the community's configured default;
+    30 days in the reference implementation). vtc/rooms/community/removal/cancel
+    returns it to archived/noAccess.
+  - purging: graceDays 0, or the grace period ended. Deletes every record,
+    epoch link, commit, revocation list, file in every storage config, transfer
+    and the host record; drops kept credentials and owed removals; unbinds
+    groups; stops serving a serverless DID log; SHOULD have the VTA delete the
+    room's DID (a refusal there does not hold the purge). Retried with backoff,
+    progress in status.purge, never reversible.
+  - removed: a tombstone with the host record as it last stood.
+
+  A change part-way through at the VTA (a reset the host accepted before the
+  community's own credentials were re-issued) is reported as
+  status.pendingChange and finished by the community.
+
+  New shared definitions in vtc/_shared/0.5 (RoomState, ArchiveAccess,
+  RoomStatus, PendingChange, PurgeProgress, CommunityRoomV3, MemberStateV2,
+  RoomMemberV2, RoomMembershipV2). get/list 0.4 carry status (list gains a
+  `states` filter; removed rooms only when asked for); members/add 0.2 refuses
+  a room that is not active (wrongState); members/list 0.2 and
+  memberships/list 0.2 add `suspended`, and memberships/list the room's own
+  state so member surfaces can say read-only, closed or going away.
+  rooms/keys/act 0.10 adds vtc/rooms/memberships/list/0.2 to its table so a
+  member's key holder can sign it.
+
+  Rust, TS, Go and Dart bindings regenerated.
+
+## 0.28.7 — 2026-11-01
+
+
+### Added
+
+- **voting**: TextReleaseThreshold may be as low as 1, disclosed below 10 (voting/_shared/0.3) (#1002)
+
+* spec(voting): textReleaseThreshold may be as low as 1, disclosed below 10 (voting/_shared/0.3)
+
+  VTI-VOT-065 now lets an election release text answers from a threshold of
+  1: it MUST be at least 1 and SHOULD be at least 10, and below 10 the
+  disclosure a member is shown before requesting a ticket MUST say so and
+  that a written answer may identify its author (VTI-VOT-090). Small
+  communities and surveys need written answers; the risk is disclosed rather
+  than forbidden.
+
+  voting/_shared/0.3 is 0.2 with Manifest.textReleaseThreshold minimum 1.
+  Every task whose schema carries the Manifest gets a new version pinned to
+  it: voting/election/register/0.3, voting/election/show/0.3,
+  vta/pcs/trustee/{deal/0.4, enrol/0.3, justify/0.4, keys/0.4},
+  vta/pcs/vote/0.3, vta/pcs/vote-encrypted/0.4, vta/pcs/voter/register/0.3,
+  vtc/elections/create/0.4 and vtc/elections/show/0.3. The two signed reads
+  that name a show version on the wire move with it: vta/pcs/trustee/read/0.3
+  and vta/pcs/voter/read/0.3. Prose references in current specs follow.
+
 ## 0.28.6 — 2026-11-01
 
 

package/dist/_extends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_extends.d.ts","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ/D,CAAC"}
+{"version":3,"file":"_extends.d.ts","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS/D,CAAC"}

package/dist/_extends.js

@@ -6,6 +6,7 @@
  * `extendsChain` follows them transitively.
  */
 export const EXTENDS_BY_TYPE_URI = Object.freeze({
+    "https://trusttasks.org/spec/rooms/keys/act/0.10": "0.9",
     "https://trusttasks.org/spec/rooms/keys/act/0.9": "0.8",
     "https://trusttasks.org/spec/rooms/records/put/0.4": "0.3",
     "https://trusttasks.org/spec/vta/did-templates/create/3.2": "3.1",

package/dist/_extends.js.map

@@ -1 +1 @@
-{"version":3,"file":"_extends.js","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACjF,gDAAgD,EAAE,KAAK;IACvD,mDAAmD,EAAE,KAAK;IAC1D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;IAC9D,wDAAwD,EAAE,KAAK;IAC/D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;CAC/D,CAAC,CAAC"}
+{"version":3,"file":"_extends.js","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACjF,iDAAiD,EAAE,KAAK;IACxD,gDAAgD,EAAE,KAAK;IACvD,mDAAmD,EAAE,KAAK;IAC1D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;IAC9D,wDAAwD,EAAE,KAAK;IAC/D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;CAC/D,CAAC,CAAC"}

package/dist/_shared/components.d.ts

@@ -357,6 +357,10 @@ export type ApproverDid = string;
  * A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.
  */
 export type ApproverLabel = string;
+/**
+ * What an archived room's members may still do. `readOnly`: their credentials stand and they keep reading what the room holds; the room's host refuses every write, upload and curation from a member. `noAccess`: every credential the room issued before the archival is withdrawn at its host — a room reset — so the host refuses every member's every task; the content is kept intact, and each withdrawn admission is `suspended`, restored when the room is unarchived or made `readOnly`. Neither recalls what a member already read or saved, and on a sealed tier neither removes anyone from the room's group.
+ */
+export type ArchiveAccess = "readOnly" | "noAccess";
 /**
  * The metadata of one attestation: what a Vetting Statement would have said, minus its issuer, as vetting/attestation/0.1 defines it.
  */
@@ -954,6 +958,10 @@ export type MemberActions = [MemberAction] | [MemberAction, MemberAction] | [Mem
  * Where an admission stands. `offered`: credentials issued and waiting for the member to collect and accept them. `admitted`: accepted — on a sealed tier, the member is in the room's group. `removed`: an administrator removed them; on a sealed tier the room has advanced past them.
  */
 export type MemberState = "offered" | "admitted" | "removed";
+/**
+ * `MemberState` plus `suspended`. `offered`: credentials issued and waiting for the member to collect and accept them. `admitted`: accepted — on a sealed tier, the member is in the room's group. `suspended`: admitted, but the room was archived with `noAccess` (or scheduled for removal), so the room's host refuses the member's credentials; on a sealed tier they are still in the room's group. Restored to `admitted` with freshly issued credentials when the room leaves that state, and never restored if it is removed. `removed`: an administrator removed them, or withdrew their offer — archiving withdraws every open offer; on a sealed tier the room has advanced past an admitted member.
+ */
+export type MemberStateV2 = "offered" | "admitted" | "suspended" | "removed";
 /**
  * How the member came to be in the group. `added`: by a manager. `joined`: they joined an open group. `requestApproved`: a manager approved their request. `rule`: a dynamic group's rule admits them.
  */
@@ -1486,6 +1494,10 @@ export type RoomDescription = string;
  * A name for the room, chosen by an administrator: shown to administrators and to the members a room is offered to. Not part of the room's identity and never in anything a room's host can read. From `vtc/rooms/community/create` 0.3 and `vtc/rooms/community/update` 0.2 the community also writes it, through its own VTA, as the `name` of the room's own profile (`RoomProfile` in rooms/_shared), sealed inside the room for its members; earlier versions keep it out of the room altogether. MUST NOT carry personal data.
  */
 export type RoomLabel = string;
+/**
+ * Where a room the community owns stands in its owner's lifecycle — distinct from `HostedRoom.lifecycle`, which is the host's clock (`live`, `lapsed`, `dormant`, `reclaimable`) and is computed from the room's epoch, never set. `active`: open to change. `archived`: closed to change by an administrator — no admissions, and the room's host accepts no writes from its members; what members may still do is `ArchiveAccess`. Reversible with vtc/rooms/community/unarchive. `removalScheduled`: an administrator removed the room with a grace period; it admits nobody and its content is kept until `purgeAt`, and vtc/rooms/community/removal/cancel returns it to `archived`. `purging`: the grace period ended (or there was none) and the community is deleting the room's content from its host and storage; not reversible. `removed`: the content is gone; the community keeps only this record of the room, for its history.
+ */
+export type RoomState = "active" | "archived" | "removalScheduled" | "purging" | "removed";
 /**
  * A short identifier an administrator files a community-owned room under — `board`, `working-group`, `finance` — so the room list can be filtered. Lower-case letters, digits and hyphens, starting with a letter or digit. Owner-side tracking metadata for holders of `vtc.rooms.manage` only: never shown to members, never sent on the room's host path, and it confers nothing.
  */
@@ -6059,6 +6071,54 @@ export interface CommunityRoomV2_VtcV0_3 {
      */
     detailsUpdatedBy?: string;
 }
+/**
+ * What vtc/rooms/community/{get,list}/0.4 and vtc/rooms/community/{archive,unarchive,remove,removal/cancel}/0.1 return: `CommunityRoomV2` plus the room's `status` in its owner's lifecycle and the count of `suspended` admissions. A separate definition, not a change to `CommunityRoomV2`, so that the versions returning that keep the exact shape they published. For a room in state `purging` or `removed`, whose host record a purge deletes, `room` is the host record as it last stood before the purge began — the community keeps that snapshot with the room's record when the purge starts — and its `lifecycle` is what was computed then.
+ */
+export interface CommunityRoomV3 {
+    room: HostedRoom_VtcV0_3;
+    label: RoomLabel;
+    status: RoomStatus;
+    /**
+     * Absent when the room has none.
+     */
+    description?: RoomDescription;
+    /**
+     * Absent or empty when the room has none.
+     */
+    tags?: RoomTags;
+    /**
+     * The storage config receiving the room's new uploads.
+     */
+    storageConfig?: StorageConfigId;
+    /**
+     * Members in state `admitted`.
+     */
+    admitted: number;
+    /**
+     * Offers not yet accepted or withdrawn.
+     */
+    offered: number;
+    /**
+     * Admissions in state `suspended`: withdrawn while the room was archived with `noAccess`, and restored when it leaves that state. Absent when zero.
+     */
+    suspended?: number;
+    /**
+     * When the community's own `admin` authority over the room expires. A room whose owner's authority lapses can no longer advance its epoch, admit or remove; a community SHOULD renew it well before.
+     */
+    ownerAuthorityValidUntil?: string;
+    /**
+     * The administrator who created it.
+     */
+    createdBy?: string;
+    /**
+     * When `label`, `description` or `tags` last changed. Absent until the first change after creation. Distinct from `room.updatedAt`, which is the host record's and moves with the room's epoch and lifecycle.
+     */
+    detailsUpdatedAt?: string;
+    /**
+     * The administrator who made that change. Present exactly when `detailsUpdatedAt` is. The earlier values and who set them are in the community's audit trail, not here.
+     */
+    detailsUpdatedBy?: string;
+}
 /**
  * A community's portable configuration: its profile plus the configuration overrides a maintainer stores for itself. Deliberately excludes per-host layers (environment variables, on-disk config files) — those describe where a maintainer runs, not what the community is, and carrying them would make an import overwrite the target host's own deployment settings.
  *
@@ -9245,6 +9305,51 @@ export interface Manifest_VotingV0_2 {
      */
     textReleaseThreshold: number;
 }
+/**
+ * What an election asks and how it is decided (VTI-VOT-010). Its digest (`manifestDigest`) is the SHA-256 multihash of its RFC 8785 (JCS) canonicalization, and every cast is bound to it (VTI-VOT-011).
+ */
+export interface Manifest_VotingV0_3 {
+    electionId: ElectionId;
+    /**
+     * The community's DID.
+     */
+    community: string;
+    title?: string;
+    description?: string;
+    /**
+     * @minItems 1
+     * @maxItems 128
+     */
+    questions: [Question, ...Question[]];
+    secrecy: SecrecyLevel;
+    roll: RollRule;
+    registrationOpensAt: string;
+    votingOpensAt: string;
+    votingClosesAt: string;
+    revote: Revote;
+    board: {
+        visibility: BoardVisibility;
+        auditors: string[];
+    };
+    /**
+     * The DID of the voting service that holds the board.
+     */
+    ballotBox: string;
+    trustees?: Trustees;
+    /**
+     * Whether the community treats the result as deciding something; creating a binding election takes another administrator's consent (VTI-VOT-081).
+     */
+    binding: boolean;
+    allowEarlyClose: boolean;
+    /**
+     * Open elections only: whether running totals may be read while voting is open (VTI-VOT-061).
+     */
+    resultsBeforeClose: boolean;
+    /**
+     * Counted ballots required before any text answer is disclosed (VTI-VOT-065). At least 1, and SHOULD be at least 10: a written answer can identify its author by what it says or how it is phrased, and the fewer the ballots released together, the easier that is. Where it is below 10, the disclosure a member is shown before they request a ticket MUST say so, and MUST say that a written answer may identify its author (VTI-VOT-090).
+     */
+    textReleaseThreshold: number;
+}
 /**
  * The mediator's per-account access-control capability set, expressed as named booleans (the transport-agnostic form of the mediator's internal capability flags). On a set request, members omitted are left unchanged; a get/response carries the full realized set.
  */
@@ -9834,6 +9939,24 @@ export interface PeerDepth {
     bytes: number;
     oldestAgeSeconds?: number;
 }
+/**
+ * A change of state the community began and has not finished, because a step at its VTA did not complete — most often a room reset the host accepted, after which the community's own credentials must be re-issued before it can act on the room again. `RoomStatus.state` stays what it was until the change finishes, but what the room's host enforces may already be the new state's: a pending move to `noAccess` means members' credentials may already be refused. The community finishes it by itself, retrying with backoff, and repeating the request that began it finishes it too; nothing else changes the room until it is finished.
+ */
+export interface PendingChange {
+    /**
+     * The state the change leads to.
+     */
+    state: RoomState;
+    /**
+     * The access it leads to, where `state` has one.
+     */
+    access?: ArchiveAccess;
+    beganAt: string;
+    /**
+     * What stopped the last attempt, for an administrator. Plain text; it names no member and carries no credential.
+     */
+    lastError?: string;
+}
 /**
  * What the author permits the record to be used for — for example, that a learner's record is for instructional personalisation only. OPTIONAL; absent means the author stated no limit beyond the room's own terms.
  *
@@ -10335,6 +10458,24 @@ export interface PublishedEvent {
     groupFloor: number;
     tiers: Tier[];
 }
+/**
+ * How a purge is going. A purge deletes at the room's host and at each storage config holding its files, and some of those are remote; a step that fails is retried with backoff until it succeeds, and nothing is reported removed until every step has.
+ */
+export interface PurgeProgress {
+    /**
+     * Passes made so far; 0 until the first.
+     */
+    attempts: number;
+    lastAttemptAt?: string;
+    /**
+     * When the next pass is due. Absent while one runs.
+     */
+    nextAttemptAt?: string;
+    /**
+     * What stopped the last pass, for an administrator. Present only after a pass failed. Plain text, written by the community; it names no member and carries no credential.
+     */
+    lastError?: string;
+}
 export interface Apns {
     platform: "apns";
     /**
@@ -11554,6 +11695,25 @@ export interface RoomMember {
     admittedAt?: string;
     removedAt?: string;
 }
+/**
+ * `RoomMember` with `MemberStateV2`, and `suspendedAt`.
+ */
+export interface RoomMemberV2 {
+    member: string;
+    actions: MemberActions;
+    /**
+     * When the member's authority credential expires.
+     */
+    validUntil: string;
+    state: MemberStateV2;
+    offeredAt: string;
+    admittedAt?: string;
+    removedAt?: string;
+    /**
+     * Present exactly when `state` is `suspended`.
+     */
+    suspendedAt?: string;
+}
 /**
  * What vtc/rooms/memberships/list/0.1 returns: one room the community owns, and where the caller's admission to it stands in the community's own record. Unlike `OfferV2` it carries no credentials — those are collected with vtc/rooms/offers/list while an offer is open — and it is listed in every state, for as long as the community keeps the record, not only while an accept can be repeated. `label` and `description` are the room's as they stand when the record is read.
  */
@@ -11589,6 +11749,57 @@ export interface RoomMembership {
      */
     repeatAcceptUntil?: string;
 }
+/**
+ * What vtc/rooms/memberships/list/0.2 returns: `RoomMembership` with `MemberStateV2`, `suspendedAt`, and the room's own state, so that a member can tell a room that is read-only, closed or going away from one they were removed from.
+ */
+export interface RoomMembershipV2 {
+    roomId: string;
+    /**
+     * The room's host: this community.
+     */
+    host: string;
+    label: RoomLabel;
+    /**
+     * Absent when the room has none.
+     */
+    description?: RoomDescription;
+    visibility: Visibility;
+    actions: MemberActions;
+    /**
+     * When the member's authority credential expires.
+     */
+    validUntil: string;
+    state: MemberStateV2;
+    offeredAt: string;
+    /**
+     * When the community recorded the admission. Present when `state` is `admitted`, and kept when it becomes `removed`.
+     */
+    admittedAt?: string;
+    /**
+     * Present exactly when `state` is `removed`.
+     */
+    removedAt?: string;
+    /**
+     * On an `attributed` or `private` room in state `admitted`: until when the community keeps the Welcome, so that a repeated vtc/rooms/offers/accept carrying the same KeyPackage is answered with it. Absent on an `open` room, in any other state, and once the community no longer keeps it. A surface finding the member admitted but the room absent from its key holder's rooms/keys/list finishes the acceptance before this time, and asks an administrator to re-admit the member after it.
+     */
+    repeatAcceptUntil?: string;
+    /**
+     * Present exactly when `state` is `suspended`.
+     */
+    suspendedAt?: string;
+    /**
+     * The room's state in its owner's lifecycle. `purging` is shown to members as `removalScheduled`: to them, the room is going away either way.
+     */
+    roomState: RoomState;
+    /**
+     * Present exactly when `roomState` is `archived` or `removalScheduled`.
+     */
+    roomAccess?: ArchiveAccess;
+    /**
+     * Present when `roomState` is `removalScheduled`: when the room's content is to be deleted.
+     */
+    purgeAt?: string;
+}
 /**
  * What a room says about itself to its own members: a name and, optionally, a description, short tags and an emoji, so that a member's wallet, portal or CLI can show what each room is rather than a DID.
  *
@@ -11636,6 +11847,44 @@ export interface RoomRevocation {
      */
     until?: string;
 }
+/**
+ * A room's state in its owner's lifecycle, and what that state needs to be understood.
+ */
+export interface RoomStatus {
+    state: RoomState;
+    /**
+     * Present exactly when `state` is `archived` or `removalScheduled`; always `noAccess` for `removalScheduled`.
+     */
+    access?: ArchiveAccess;
+    /**
+     * When the room entered `state`. Absent for a room that has been `active` since it was created.
+     */
+    changedAt?: string;
+    /**
+     * The administrator whose act put the room in `state`. Present exactly when `changedAt` is, except for `purging` and `removed` reached when a grace period ended, which no one did at that moment: then the administrator who scheduled the removal. The reason each gave is in the community's audit trail, not here.
+     */
+    changedBy?: string;
+    /**
+     * Present when `state` is `removalScheduled`: when the grace period ends and the purge begins. Kept when `state` is `purging` or `removed`, as when it became due.
+     */
+    purgeAt?: string;
+    /**
+     * Present exactly when `state` is `purging`.
+     */
+    purge?: PurgeProgress;
+    /**
+     * Present exactly when `state` is `removed`: when the last of the room's content was deleted.
+     */
+    removedAt?: string;
+    /**
+     * Admissions still `suspended` that the community is restoring, after the room left `noAccess` — the room re-issues each member's credentials and the member collects them as a renewal. Absent when there are none.
+     */
+    restoring?: number;
+    /**
+     * Present while a change of state is begun and not finished.
+     */
+    pendingChange?: PendingChange;
+}
 /**
  * One change to a role's key set, from preview to completion. The rotation history of a DID is the list of these; the log is the authority for what was published, and this record adds what the log cannot say — which change was which, and (custody projection only) who asked, who approved, and why.
  */