@openvtc/trust-tasks 0.28.7 → 0.28.8

package/CHANGELOG.md

@@ -11,6 +11,54 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.28.8 — 2026-11-02
+
+
+### Added
+
+- **vtc/rooms/community**: Archive, unarchive, remove and removal/cancel 0.1; get/list 0.4, members/add+list 0.2, memberships/list 0.2 (#1006)
+
+A community could create a room it owns and change its members, but never
+  close or end one. This adds an owner's lifecycle for a community-owned room,
+  distinct from the host's computed clock (live/lapsed/dormant/reclaimable):
+
+  - active
+  - archived, with an access: readOnly (members keep reading; the host refuses
+    every write, upload and curation) or noAccess (the community's VTA resets
+    the room — one `room` withdrawal — and re-issues the community's own
+    credentials; each admitted member becomes `suspended`). Open offers are
+    withdrawn either way. Reversible: vtc/rooms/community/unarchive restores
+    suspended members in the background by re-issuing their membership and
+    authority, collected as an offers/list renewal.
+  - removalScheduled: only from archived (removal is the second of two
+    deliberate acts). The room is noAccess and its content kept until purgeAt,
+    after a grace period (graceDays, or the community's configured default;
+    30 days in the reference implementation). vtc/rooms/community/removal/cancel
+    returns it to archived/noAccess.
+  - purging: graceDays 0, or the grace period ended. Deletes every record,
+    epoch link, commit, revocation list, file in every storage config, transfer
+    and the host record; drops kept credentials and owed removals; unbinds
+    groups; stops serving a serverless DID log; SHOULD have the VTA delete the
+    room's DID (a refusal there does not hold the purge). Retried with backoff,
+    progress in status.purge, never reversible.
+  - removed: a tombstone with the host record as it last stood.
+
+  A change part-way through at the VTA (a reset the host accepted before the
+  community's own credentials were re-issued) is reported as
+  status.pendingChange and finished by the community.
+
+  New shared definitions in vtc/_shared/0.5 (RoomState, ArchiveAccess,
+  RoomStatus, PendingChange, PurgeProgress, CommunityRoomV3, MemberStateV2,
+  RoomMemberV2, RoomMembershipV2). get/list 0.4 carry status (list gains a
+  `states` filter; removed rooms only when asked for); members/add 0.2 refuses
+  a room that is not active (wrongState); members/list 0.2 and
+  memberships/list 0.2 add `suspended`, and memberships/list the room's own
+  state so member surfaces can say read-only, closed or going away.
+  rooms/keys/act 0.10 adds vtc/rooms/memberships/list/0.2 to its table so a
+  member's key holder can sign it.
+
+  Rust, TS, Go and Dart bindings regenerated.
+
 ## 0.28.7 — 2026-11-01
 
 

package/dist/_extends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_extends.d.ts","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ/D,CAAC"}
+{"version":3,"file":"_extends.d.ts","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS/D,CAAC"}

package/dist/_extends.js

@@ -6,6 +6,7 @@
  * `extendsChain` follows them transitively.
  */
 export const EXTENDS_BY_TYPE_URI = Object.freeze({
+    "https://trusttasks.org/spec/rooms/keys/act/0.10": "0.9",
     "https://trusttasks.org/spec/rooms/keys/act/0.9": "0.8",
     "https://trusttasks.org/spec/rooms/records/put/0.4": "0.3",
     "https://trusttasks.org/spec/vta/did-templates/create/3.2": "3.1",

package/dist/_extends.js.map

@@ -1 +1 @@
-{"version":3,"file":"_extends.js","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACjF,gDAAgD,EAAE,KAAK;IACvD,mDAAmD,EAAE,KAAK;IAC1D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;IAC9D,wDAAwD,EAAE,KAAK;IAC/D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;CAC/D,CAAC,CAAC"}
+{"version":3,"file":"_extends.js","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACjF,iDAAiD,EAAE,KAAK;IACxD,gDAAgD,EAAE,KAAK;IACvD,mDAAmD,EAAE,KAAK;IAC1D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;IAC9D,wDAAwD,EAAE,KAAK;IAC/D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;CAC/D,CAAC,CAAC"}

package/dist/_shared/components.d.ts

@@ -357,6 +357,10 @@ export type ApproverDid = string;
  * A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.
  */
 export type ApproverLabel = string;
+/**
+ * What an archived room's members may still do. `readOnly`: their credentials stand and they keep reading what the room holds; the room's host refuses every write, upload and curation from a member. `noAccess`: every credential the room issued before the archival is withdrawn at its host — a room reset — so the host refuses every member's every task; the content is kept intact, and each withdrawn admission is `suspended`, restored when the room is unarchived or made `readOnly`. Neither recalls what a member already read or saved, and on a sealed tier neither removes anyone from the room's group.
+ */
+export type ArchiveAccess = "readOnly" | "noAccess";
 /**
  * The metadata of one attestation: what a Vetting Statement would have said, minus its issuer, as vetting/attestation/0.1 defines it.
  */
@@ -954,6 +958,10 @@ export type MemberActions = [MemberAction] | [MemberAction, MemberAction] | [Mem
  * Where an admission stands. `offered`: credentials issued and waiting for the member to collect and accept them. `admitted`: accepted — on a sealed tier, the member is in the room's group. `removed`: an administrator removed them; on a sealed tier the room has advanced past them.
  */
 export type MemberState = "offered" | "admitted" | "removed";
+/**
+ * `MemberState` plus `suspended`. `offered`: credentials issued and waiting for the member to collect and accept them. `admitted`: accepted — on a sealed tier, the member is in the room's group. `suspended`: admitted, but the room was archived with `noAccess` (or scheduled for removal), so the room's host refuses the member's credentials; on a sealed tier they are still in the room's group. Restored to `admitted` with freshly issued credentials when the room leaves that state, and never restored if it is removed. `removed`: an administrator removed them, or withdrew their offer — archiving withdraws every open offer; on a sealed tier the room has advanced past an admitted member.
+ */
+export type MemberStateV2 = "offered" | "admitted" | "suspended" | "removed";
 /**
  * How the member came to be in the group. `added`: by a manager. `joined`: they joined an open group. `requestApproved`: a manager approved their request. `rule`: a dynamic group's rule admits them.
  */
@@ -1486,6 +1494,10 @@ export type RoomDescription = string;
  * A name for the room, chosen by an administrator: shown to administrators and to the members a room is offered to. Not part of the room's identity and never in anything a room's host can read. From `vtc/rooms/community/create` 0.3 and `vtc/rooms/community/update` 0.2 the community also writes it, through its own VTA, as the `name` of the room's own profile (`RoomProfile` in rooms/_shared), sealed inside the room for its members; earlier versions keep it out of the room altogether. MUST NOT carry personal data.
  */
 export type RoomLabel = string;
+/**
+ * Where a room the community owns stands in its owner's lifecycle — distinct from `HostedRoom.lifecycle`, which is the host's clock (`live`, `lapsed`, `dormant`, `reclaimable`) and is computed from the room's epoch, never set. `active`: open to change. `archived`: closed to change by an administrator — no admissions, and the room's host accepts no writes from its members; what members may still do is `ArchiveAccess`. Reversible with vtc/rooms/community/unarchive. `removalScheduled`: an administrator removed the room with a grace period; it admits nobody and its content is kept until `purgeAt`, and vtc/rooms/community/removal/cancel returns it to `archived`. `purging`: the grace period ended (or there was none) and the community is deleting the room's content from its host and storage; not reversible. `removed`: the content is gone; the community keeps only this record of the room, for its history.
+ */
+export type RoomState = "active" | "archived" | "removalScheduled" | "purging" | "removed";
 /**
  * A short identifier an administrator files a community-owned room under — `board`, `working-group`, `finance` — so the room list can be filtered. Lower-case letters, digits and hyphens, starting with a letter or digit. Owner-side tracking metadata for holders of `vtc.rooms.manage` only: never shown to members, never sent on the room's host path, and it confers nothing.
  */
@@ -6059,6 +6071,54 @@ export interface CommunityRoomV2_VtcV0_3 {
      */
     detailsUpdatedBy?: string;
 }
+/**
+ * What vtc/rooms/community/{get,list}/0.4 and vtc/rooms/community/{archive,unarchive,remove,removal/cancel}/0.1 return: `CommunityRoomV2` plus the room's `status` in its owner's lifecycle and the count of `suspended` admissions. A separate definition, not a change to `CommunityRoomV2`, so that the versions returning that keep the exact shape they published. For a room in state `purging` or `removed`, whose host record a purge deletes, `room` is the host record as it last stood before the purge began — the community keeps that snapshot with the room's record when the purge starts — and its `lifecycle` is what was computed then.
+ */
+export interface CommunityRoomV3 {
+    room: HostedRoom_VtcV0_3;
+    label: RoomLabel;
+    status: RoomStatus;
+    /**
+     * Absent when the room has none.
+     */
+    description?: RoomDescription;
+    /**
+     * Absent or empty when the room has none.
+     */
+    tags?: RoomTags;
+    /**
+     * The storage config receiving the room's new uploads.
+     */
+    storageConfig?: StorageConfigId;
+    /**
+     * Members in state `admitted`.
+     */
+    admitted: number;
+    /**
+     * Offers not yet accepted or withdrawn.
+     */
+    offered: number;
+    /**
+     * Admissions in state `suspended`: withdrawn while the room was archived with `noAccess`, and restored when it leaves that state. Absent when zero.
+     */
+    suspended?: number;
+    /**
+     * When the community's own `admin` authority over the room expires. A room whose owner's authority lapses can no longer advance its epoch, admit or remove; a community SHOULD renew it well before.
+     */
+    ownerAuthorityValidUntil?: string;
+    /**
+     * The administrator who created it.
+     */
+    createdBy?: string;
+    /**
+     * When `label`, `description` or `tags` last changed. Absent until the first change after creation. Distinct from `room.updatedAt`, which is the host record's and moves with the room's epoch and lifecycle.
+     */
+    detailsUpdatedAt?: string;
+    /**
+     * The administrator who made that change. Present exactly when `detailsUpdatedAt` is. The earlier values and who set them are in the community's audit trail, not here.
+     */
+    detailsUpdatedBy?: string;
+}
 /**
  * A community's portable configuration: its profile plus the configuration overrides a maintainer stores for itself. Deliberately excludes per-host layers (environment variables, on-disk config files) — those describe where a maintainer runs, not what the community is, and carrying them would make an import overwrite the target host's own deployment settings.
  *
@@ -9879,6 +9939,24 @@ export interface PeerDepth {
     bytes: number;
     oldestAgeSeconds?: number;
 }
+/**
+ * A change of state the community began and has not finished, because a step at its VTA did not complete — most often a room reset the host accepted, after which the community's own credentials must be re-issued before it can act on the room again. `RoomStatus.state` stays what it was until the change finishes, but what the room's host enforces may already be the new state's: a pending move to `noAccess` means members' credentials may already be refused. The community finishes it by itself, retrying with backoff, and repeating the request that began it finishes it too; nothing else changes the room until it is finished.
+ */
+export interface PendingChange {
+    /**
+     * The state the change leads to.
+     */
+    state: RoomState;
+    /**
+     * The access it leads to, where `state` has one.
+     */
+    access?: ArchiveAccess;
+    beganAt: string;
+    /**
+     * What stopped the last attempt, for an administrator. Plain text; it names no member and carries no credential.
+     */
+    lastError?: string;
+}
 /**
  * What the author permits the record to be used for — for example, that a learner's record is for instructional personalisation only. OPTIONAL; absent means the author stated no limit beyond the room's own terms.
  *
@@ -10380,6 +10458,24 @@ export interface PublishedEvent {
     groupFloor: number;
     tiers: Tier[];
 }
+/**
+ * How a purge is going. A purge deletes at the room's host and at each storage config holding its files, and some of those are remote; a step that fails is retried with backoff until it succeeds, and nothing is reported removed until every step has.
+ */
+export interface PurgeProgress {
+    /**
+     * Passes made so far; 0 until the first.
+     */
+    attempts: number;
+    lastAttemptAt?: string;
+    /**
+     * When the next pass is due. Absent while one runs.
+     */
+    nextAttemptAt?: string;
+    /**
+     * What stopped the last pass, for an administrator. Present only after a pass failed. Plain text, written by the community; it names no member and carries no credential.
+     */
+    lastError?: string;
+}
 export interface Apns {
     platform: "apns";
     /**
@@ -11599,6 +11695,25 @@ export interface RoomMember {
     admittedAt?: string;
     removedAt?: string;
 }
+/**
+ * `RoomMember` with `MemberStateV2`, and `suspendedAt`.
+ */
+export interface RoomMemberV2 {
+    member: string;
+    actions: MemberActions;
+    /**
+     * When the member's authority credential expires.
+     */
+    validUntil: string;
+    state: MemberStateV2;
+    offeredAt: string;
+    admittedAt?: string;
+    removedAt?: string;
+    /**
+     * Present exactly when `state` is `suspended`.
+     */
+    suspendedAt?: string;
+}
 /**
  * What vtc/rooms/memberships/list/0.1 returns: one room the community owns, and where the caller's admission to it stands in the community's own record. Unlike `OfferV2` it carries no credentials — those are collected with vtc/rooms/offers/list while an offer is open — and it is listed in every state, for as long as the community keeps the record, not only while an accept can be repeated. `label` and `description` are the room's as they stand when the record is read.
  */
@@ -11634,6 +11749,57 @@ export interface RoomMembership {
      */
     repeatAcceptUntil?: string;
 }
+/**
+ * What vtc/rooms/memberships/list/0.2 returns: `RoomMembership` with `MemberStateV2`, `suspendedAt`, and the room's own state, so that a member can tell a room that is read-only, closed or going away from one they were removed from.
+ */
+export interface RoomMembershipV2 {
+    roomId: string;
+    /**
+     * The room's host: this community.
+     */
+    host: string;
+    label: RoomLabel;
+    /**
+     * Absent when the room has none.
+     */
+    description?: RoomDescription;
+    visibility: Visibility;
+    actions: MemberActions;
+    /**
+     * When the member's authority credential expires.
+     */
+    validUntil: string;
+    state: MemberStateV2;
+    offeredAt: string;
+    /**
+     * When the community recorded the admission. Present when `state` is `admitted`, and kept when it becomes `removed`.
+     */
+    admittedAt?: string;
+    /**
+     * Present exactly when `state` is `removed`.
+     */
+    removedAt?: string;
+    /**
+     * On an `attributed` or `private` room in state `admitted`: until when the community keeps the Welcome, so that a repeated vtc/rooms/offers/accept carrying the same KeyPackage is answered with it. Absent on an `open` room, in any other state, and once the community no longer keeps it. A surface finding the member admitted but the room absent from its key holder's rooms/keys/list finishes the acceptance before this time, and asks an administrator to re-admit the member after it.
+     */
+    repeatAcceptUntil?: string;
+    /**
+     * Present exactly when `state` is `suspended`.
+     */
+    suspendedAt?: string;
+    /**
+     * The room's state in its owner's lifecycle. `purging` is shown to members as `removalScheduled`: to them, the room is going away either way.
+     */
+    roomState: RoomState;
+    /**
+     * Present exactly when `roomState` is `archived` or `removalScheduled`.
+     */
+    roomAccess?: ArchiveAccess;
+    /**
+     * Present when `roomState` is `removalScheduled`: when the room's content is to be deleted.
+     */
+    purgeAt?: string;
+}
 /**
  * What a room says about itself to its own members: a name and, optionally, a description, short tags and an emoji, so that a member's wallet, portal or CLI can show what each room is rather than a DID.
  *
@@ -11681,6 +11847,44 @@ export interface RoomRevocation {
      */
     until?: string;
 }
+/**
+ * A room's state in its owner's lifecycle, and what that state needs to be understood.
+ */
+export interface RoomStatus {
+    state: RoomState;
+    /**
+     * Present exactly when `state` is `archived` or `removalScheduled`; always `noAccess` for `removalScheduled`.
+     */
+    access?: ArchiveAccess;
+    /**
+     * When the room entered `state`. Absent for a room that has been `active` since it was created.
+     */
+    changedAt?: string;
+    /**
+     * The administrator whose act put the room in `state`. Present exactly when `changedAt` is, except for `purging` and `removed` reached when a grace period ended, which no one did at that moment: then the administrator who scheduled the removal. The reason each gave is in the community's audit trail, not here.
+     */
+    changedBy?: string;
+    /**
+     * Present when `state` is `removalScheduled`: when the grace period ends and the purge begins. Kept when `state` is `purging` or `removed`, as when it became due.
+     */
+    purgeAt?: string;
+    /**
+     * Present exactly when `state` is `purging`.
+     */
+    purge?: PurgeProgress;
+    /**
+     * Present exactly when `state` is `removed`: when the last of the room's content was deleted.
+     */
+    removedAt?: string;
+    /**
+     * Admissions still `suspended` that the community is restoring, after the room left `noAccess` — the room re-issues each member's credentials and the member collects them as a renewal. Absent when there are none.
+     */
+    restoring?: number;
+    /**
+     * Present while a change of state is begun and not finished.
+     */
+    pendingChange?: PendingChange;
+}
 /**
  * One change to a role's key set, from preview to completion. The rotation history of a DID is the list of these; the log is the authority for what was published, and this record adds what the log cannot say — which change was which, and (custody projection only) who asked, who approved, and why.
  */