@openvtc/trust-tasks 0.28.8 → 0.28.9

package/CHANGELOG.md

@@ -11,6 +11,115 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.28.9 — 2026-11-03
+
+
+### Added
+
+- **vtc/networks**: A community's side of Verifiable Trust Network membership (#1014)
+
+A Verifiable Trust Network (VTN) curates communities and networks
+  (dtgwg-vti-spec 11a-vtn.md, VTI-VTN-001..063). Listing is one-sided;
+  membership is the listed party's acknowledgement. These tasks are the
+  community's side of that relationship.
+
+  - vtc/networks/list, vtc/networks/show (0.1): the community's network
+    memberships, with the credentials that evidence each state.
+  - vtc/networks/join (0.1): accept a listing. The community checks the
+    network at the URL is the DID the administrator named, verifies the
+    listing, registers groups for the network's roles (required ones first),
+    signs the acknowledgement as itself and verifies the grant.
+  - vtc/networks/repudiate (0.1): reject a listing; the network publishes
+    the repudiation beside it (VTI-VTN-012).
+  - vtc/networks/leave (0.1): depart by repudiating the grant (VTI-VTN-053).
+  - vtc/networks/groups/register (0.1): nominate a community group to serve
+    a network role. The community is the registrant; the network learns
+    the group's DID, never its members.
+  - vtc/networks/notice (0.1): the community passes a network broadcast on
+    to members of the registered group, carrying the network's signed
+    envelope unchanged. Distinct from notifications/notify, which carries
+    a reference and none of the content (VTI-NTF-003).
+  - vtc/networks/evidence (0.1): a member gets the registration and
+    acceptance linking their group to a network, to present for a network
+    room pass.
+
+  The shared NetworkMembership, RegisteredGroup and RoleAssignment records
+  are in vtc/_shared/0.6/network-membership.schema.json. Rust, TypeScript,
+  Go and Dart bindings are regenerated.
+
+- **notifications**: A generic notification family — notify, relay, and the VTA's list, show and dismiss (#1012)
+
+notifications/notify/0.1 tells the party a DID names (an individual,
+  group, community or network) that a thing exists it, or those it stands
+  for, may take part in: where it is held, its identifier there, the task
+  that opens it, and the audience it concerns, with a kind from an
+  extensible registry (`election` registered) and nothing of the thing's
+  content. Signed by the originator; deduplicated by issuer +
+  notificationId, with revision for change and withdrawal; the receipt is
+  the same whatever the recipient did.
+
+  notifications/relay/0.1 lets the addressee pass it on, carrying the
+  received document whole and opaque so every signed member survives; the
+  recipient verifies every layer, to at most four relays.
+
+  vta/notifications/list, show and dismiss (0.1) are the principal's view
+  of what its VTA holds, per context; show returns the delivering document
+  as received.
+
+  Implements VTI-NTF-001 – VTI-NTF-063 (trustoverip/dtgwg-vti-spec#91).
+
+- **voting**: A member-party election's ticket claim says nothing to an unproven claimant, and a presentation outage is indeterminate whatever the election (vtc/elections/tickets/issue/0.3, vtc/elections/show/0.6, vta/pcs/voter/register/0.5, vta/pcs/voter/read/0.6) (#1011)
+
+Follows trustoverip/dtgwg-vti-spec#90 (VTI-VOT-015 - VTI-VOT-018,
+  VTI-VOT-025).
+
+- **voting**: An election put to a member party's members is shown only to a reader who proves that membership (vtc/elections/show/0.5, vtc/elections/list/0.5, vta/pcs/voter/read/0.5) (#1010)
+
+Follows trustoverip/dtgwg-vti-spec VTI-VOT-015/016. Under show/0.4 and
+  list/0.4, an election whose credential roll names a member party was shown
+  to any caller, so its title, questions and options were public.
+
+  - vtc/elections/show/0.5 (extends 0.4): optional `presentation` in the form
+    tickets/issue/0.2 carries (nonce = document id, domain/aud = community,
+    in a document the holder signs). Considered only for a member-party
+    election the caller cannot otherwise see, in a signed document within the
+    acceptance window and used once; checked as tickets/issue/0.2 item 5.2 to
+    5.4. Every failure, indeterminate included, is electionUnknown. Never a
+    refusal for carrying one. maxDocumentBytes.request 98304.
+  - vtc/elections/list/0.5 (extends 0.4): prose only. A member-party
+    election is listed only to administrators and the party itself; to
+    everyone else it is omitted, with no stub. A list never carries a
+    presentation.
+  - vta/pcs/voter/read/0.5: signs list/0.5 and show/0.5; optional
+    `membershipCredential` (only with read = show, a dependentSchemas rule),
+    which the engine presents from the vault in the show it signs. New code
+    membershipCredentialUnusable.
+  - CONVENTIONS.md: a Member-party election term, and the §4 row for
+    list/show.
+
+- **voting**: A credential roll, proven when the ticket is claimed (voting/_shared/0.4, vtc/elections/tickets/issue/0.2) (#1008)
+
+* feat(voting): a credential roll, proven when the ticket is claimed (voting/_shared/0.4, vtc/elections/tickets/issue/0.2)
+
+  Follows trustoverip/dtgwg-vti-spec#88 (VTI-VOT-021, VTI-VOT-022,
+  VTI-VOT-025 – VTI-VOT-028, VTI-VOT-090).
+
+  voting/_shared/0.4 appends `credential` to the roll rule, with `roll.memberOf`
+  naming exactly one DID: the community, one of its groups, or a community or
+  network it recognises. memberOf is required with `credential` and refused with
+  every other rule, and `listed` is refused with `credential` (dependentSchemas,
+  which the generators read as an optional member). Disclosure gains an optional
+  RollCredentialDisclosure saying whose credential counts (VTI-VOT-090).
+
+  Every task carrying the manifest takes a new version re-pinned to 0.4, and the
+  signed reads name the newer reads. vtc/elections/tickets/issue/0.2 (extends 0.1)
+  carries the membership presentation, bound to the document's id and the
+  community, checked at issuance, with five appended error codes.
+  vtc/elections/create/0.5 refuses an untrusted memberOf (rollUntrusted,
+  rollIndeterminate). vta/pcs/voter/register/0.4 presents a vault credential in
+  the ticket document it signs. vtc/elections/list/0.4 (extends 0.3) says who sees
+  an election under a credential roll.
+
 ## 0.28.8 — 2026-11-02
 
 

package/dist/_extends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_extends.d.ts","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS/D,CAAC"}
+{"version":3,"file":"_extends.d.ts","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAc/D,CAAC"}

package/dist/_extends.js

@@ -14,5 +14,10 @@ export const EXTENDS_BY_TYPE_URI = Object.freeze({
     "https://trusttasks.org/spec/vta/did-templates/list/3.2": "3.1",
     "https://trusttasks.org/spec/vta/did-templates/update/3.2": "3.1",
     "https://trusttasks.org/spec/vta/webvh/dids/update/1.1": "1.0",
+    "https://trusttasks.org/spec/vtc/elections/list/0.4": "0.3",
+    "https://trusttasks.org/spec/vtc/elections/list/0.5": "0.4",
+    "https://trusttasks.org/spec/vtc/elections/show/0.5": "0.4",
+    "https://trusttasks.org/spec/vtc/elections/show/0.6": "0.5",
+    "https://trusttasks.org/spec/vtc/elections/tickets/issue/0.2": "0.1",
 });
 //# sourceMappingURL=_extends.js.map

package/dist/_extends.js.map

@@ -1 +1 @@
-{"version":3,"file":"_extends.js","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACjF,iDAAiD,EAAE,KAAK;IACxD,gDAAgD,EAAE,KAAK;IACvD,mDAAmD,EAAE,KAAK;IAC1D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;IAC9D,wDAAwD,EAAE,KAAK;IAC/D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;CAC/D,CAAC,CAAC"}
+{"version":3,"file":"_extends.js","sourceRoot":"","sources":["../src/_extends.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACjF,iDAAiD,EAAE,KAAK;IACxD,gDAAgD,EAAE,KAAK;IACvD,mDAAmD,EAAE,KAAK;IAC1D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;IAC9D,wDAAwD,EAAE,KAAK;IAC/D,0DAA0D,EAAE,KAAK;IACjE,uDAAuD,EAAE,KAAK;IAC9D,oDAAoD,EAAE,KAAK;IAC3D,oDAAoD,EAAE,KAAK;IAC3D,oDAAoD,EAAE,KAAK;IAC3D,oDAAoD,EAAE,KAAK;IAC3D,6DAA6D,EAAE,KAAK;CACrE,CAAC,CAAC"}

package/dist/_shared/components.d.ts

@@ -477,6 +477,10 @@ export type ConsumerKind_DeviceV0_1 = Companion_DeviceV0_1 | Service_DeviceV0_1;
  * Discriminator: is this consumer a user-driven Companion or a headless Service?
  */
 export type ConsumerKind_DeviceV0_2 = Companion_DeviceV0_2 | Service_DeviceV0_2;
+/**
+ * The trust context the notification is held in: the one the addressed DID belongs to.
+ */
+export type ContextId = string;
 /**
  * Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.
  */
@@ -568,6 +572,10 @@ export type Did_GitNsV0_1 = string;
  * A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.
  */
 export type Did_GitNsV0_3 = string;
+/**
+ * A DID.
+ */
+export type Did_NotificationsV0_1 = string;
 /**
  * A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.
  *
@@ -900,6 +908,10 @@ export type Key_VtaV0_1 = string;
  * The interaction kind: a 1:1 direct message, a multi-party group, or a broadcast channel.
  */
 export type Kind = "dm" | "group" | "channel";
+/**
+ * What the thing is. Either a registered kind — one lowerCamelCase name in the VTI specification's notification kind registry (Appendix G), such as `election` — or an unregistered kind, written `<reverse-DNS domain>:<name>` under a domain its definer controls, such as `org.example:meetingInvite`. A recipient that does not recognise a kind holds, lists and discards it and does nothing else with it (VTI-NTF-012).
+ */
+export type Kind_NotificationsV0_1 = string;
 /**
  * A BCP 47 language tag, e.g. `en`, `de-AT`. Compared case-insensitively.
  */
@@ -1012,6 +1024,10 @@ export type NoteId = string;
  * The note, as plain text. Read only by holders of `vtc.directory.notes`. A reader MUST NOT treat it as instructions.
  */
 export type NoteText = string;
+/**
+ * The originator's identifier for one notification, unique among the notifications that originator issues and the same in every document that carries it — retries, re-issued documents and relayed copies alike. It is the notification's idempotency key (VTI-NTF-021). Compared for equality only. An originator SHOULD make it unguessable and SHOULD NOT make it descriptive: it travels as far as the notification does.
+ */
+export type NotificationId = string;
 /**
  * A key prefix inside the bucket, ending in `/`, under which the config's `rooms/` tree is placed. Restricted to the S3 safe-character set so that it can be placed in a downscoped policy without escaping.
  */
@@ -1364,6 +1380,10 @@ export type RecordEvidence = RecordEvidenceRecord | RecordEvidenceCredential;
  * @maxItems 32
  */
 export type RecordEvidenceList = [RecordEvidence, ...RecordEvidence[]];
+/**
+ * The VTA's own identifier for one held notification, stable across the revisions that replace it. Opaque and compared for equality only; unguessable, because a show of a record in a context the caller may not read is refused and an enumerable identifier would turn the refusal into an oracle.
+ */
+export type RecordId = string;
 /**
  * The path from one record's leaf to the room's `DataCommitment` — a Merkle inclusion proof, in the vocabulary this work already uses for it.
  *
@@ -1689,6 +1709,14 @@ export type SiteTarget_VaultV0_2 = WebOrigin_VaultV0_2 | Did_VaultV0_2 | IosApp_
  * Other values are the holder's or the producer's own and carry no meaning a maintainer interprets.
  */
 export type Slot = string;
+/**
+ * The principal's disposition of a held notification: `active`, or `dismissed` by vta/notifications/dismiss. Dismissal is the principal's alone and changes nothing outside the VTA (VTI-NTF-052).
+ */
+export type State = "active" | "dismissed";
+/**
+ * Whether the thing is still open to the audience: `available`, or `withdrawn` — cancelled by its holder, or no longer open to the audience — in which case the recipient keeps the record only to show that it was withdrawn (VTI-NTF-024).
+ */
+export type Status = "available" | "withdrawn";
 /**
  * How the community authenticates to a config's backend. Absent on a `local` config, which needs none.
  *
@@ -7426,6 +7454,32 @@ export interface Disclosure {
      */
     coercionResistance: false;
 }
+/**
+ * The statement a community publishes, and shows a member before they request a ticket, about how one election is run (VTI-VOT-090). Generated from the election's manifest and the community's configuration, never written by hand. Under a `credential` roll it also says whose membership credential counts (`rollCredential`).
+ */
+export interface Disclosure_VotingV0_4 {
+    /**
+     * The ballot box's DID.
+     */
+    ballotBox: string;
+    /**
+     * Who operates the ballot box, as the community names them.
+     */
+    ballotBoxOperator: string;
+    /**
+     * Whether the party operating the community's VTC also operates the ballot box.
+     */
+    sameOperator: boolean;
+    trustees?: Trustees;
+    boardVisibility: BoardVisibility;
+    auditors: string[];
+    revote: Revote;
+    rollCredential?: RollCredentialDisclosure;
+    /**
+     * Always false: a voter can prove how they voted, so the community cannot protect a member against being made to vote a certain way.
+     */
+    coercionResistance: false;
+}
 /**
  * The member's three discoverability decisions, made separately.
  */
@@ -8433,6 +8487,40 @@ export interface GroupMember {
      */
     credentialValidUntil?: string;
 }
+/**
+ * One notification the VTA holds, as a client with standing in its context sees it. `originator` and every entry of `relayedBy` were verified by the VTA when it accepted the notification (VTI-NTF-042); a client that does not take the VTA's word for them reads the document with vta/notifications/show and verifies it itself.
+ */
+export interface HeldNotification {
+    recordId: RecordId;
+    contextId: ContextId;
+    /**
+     * The principal's DID the notification, or the relay that delivered it, was addressed to.
+     */
+    addressee: Did_NotificationsV0_1;
+    /**
+     * The issuer of the notifications/notify document: who said the thing exists.
+     */
+    originator: Did_NotificationsV0_1;
+    /**
+     * The relayers the held revision passed through, in the order they relayed it: the first is the notification's own addressee, the last the relayer that delivered it to `addressee`. Empty for a notification the originator sent to `addressee` directly. The acceptance policy counted the last one (VTI-NTF-031).
+     *
+     * @maxItems 4
+     */
+    relayedBy: [] | [Did_NotificationsV0_1] | [Did_NotificationsV0_1, Did_NotificationsV0_1] | [Did_NotificationsV0_1, Did_NotificationsV0_1, Did_NotificationsV0_1] | [Did_NotificationsV0_1, Did_NotificationsV0_1, Did_NotificationsV0_1, Did_NotificationsV0_1];
+    /**
+     * The notification's members at the revision held.
+     */
+    notification: Notification;
+    state: State;
+    /**
+     * When the VTA accepted the revision held.
+     */
+    receivedAt: string;
+    /**
+     * When the principal dismissed it. Present exactly when `state` is `dismissed`.
+     */
+    dismissedAt?: string;
+}
 /**
  * The applicant's proof that distinct eligible vetters of the community vetted it, as a join submission carries it under `extensions.hiddenVetting`. Built by vta/pcs/prove, verified by the community.
  */
@@ -9350,6 +9438,51 @@ export interface Manifest_VotingV0_3 {
      */
     textReleaseThreshold: number;
 }
+/**
+ * What an election asks and how it is decided (VTI-VOT-010). Its digest (`manifestDigest`) is the SHA-256 multihash of its RFC 8785 (JCS) canonicalization, and every cast is bound to it (VTI-VOT-011).
+ */
+export interface Manifest_VotingV0_4 {
+    electionId: ElectionId;
+    /**
+     * The community's DID.
+     */
+    community: string;
+    title?: string;
+    description?: string;
+    /**
+     * @minItems 1
+     * @maxItems 128
+     */
+    questions: [Question, ...Question[]];
+    secrecy: SecrecyLevel;
+    roll: RollRule_VotingV0_4;
+    registrationOpensAt: string;
+    votingOpensAt: string;
+    votingClosesAt: string;
+    revote: Revote;
+    board: {
+        visibility: BoardVisibility;
+        auditors: string[];
+    };
+    /**
+     * The DID of the voting service that holds the board.
+     */
+    ballotBox: string;
+    trustees?: Trustees;
+    /**
+     * Whether the community treats the result as deciding something; creating a binding election takes another administrator's consent (VTI-VOT-081).
+     */
+    binding: boolean;
+    allowEarlyClose: boolean;
+    /**
+     * Open elections only: whether running totals may be read while voting is open (VTI-VOT-061).
+     */
+    resultsBeforeClose: boolean;
+    /**
+     * Counted ballots required before any text answer is disclosed (VTI-VOT-065). At least 1, and SHOULD be at least 10: a written answer can identify its author by what it says or how it is phrased, and the fewer the ballots released together, the easier that is. Where it is below 10, the disclosure a member is shown before they request a ticket MUST say so, and MUST say that a written answer may identify its author (VTI-VOT-090).
+     */
+    textReleaseThreshold: number;
+}
 /**
  * The mediator's per-account access-control capability set, expressed as named booleans (the transport-agnostic form of the mediator's internal capability flags). On a set request, members omitted are left unchanged; a get/response carries the full realized set.
  */
@@ -9779,6 +9912,46 @@ export interface MonitorFilter {
      */
     failuresOnly?: boolean;
 }
+export interface NetworkMembership {
+    /**
+     * The network's DID.
+     */
+    network: string;
+    /**
+     * Where the network's API is reached: the base its `/.well-known/vtn` profile is served under.
+     */
+    url: string;
+    /**
+     * The network's name, as its profile gives it.
+     */
+    name?: string;
+    /**
+     * `acknowledged`: the community is a member — it signed the acknowledgement of the network's grant. `repudiated`: the community rejected the network's listing of it. `departed`: the community left, by repudiating the grant.
+     */
+    state: "acknowledged" | "repudiated" | "departed";
+    /**
+     * The network's listing credential naming the community, as the community verified it.
+     */
+    listing: {};
+    /**
+     * The network's membership grant (VMC), once the community acknowledged.
+     */
+    grant?: {};
+    /**
+     * The community's acknowledgement (VMC carrying the grant's digest).
+     */
+    acknowledgement?: {};
+    /**
+     * The community's repudiation (VSC) of the listing, or — on departure — of the grant.
+     */
+    repudiation?: {};
+    /**
+     * @maxItems 64
+     */
+    groups: RegisteredGroup[];
+    joinedAt?: string;
+    updatedAt: string;
+}
 /**
  * The discoverability a card has when the community creates it, before its member chooses. A new card is never published beyond the community (VTI-DIR-042), so there is no member for that here: `externalCards` says whether the member may turn it on.
  */
@@ -9796,6 +9969,35 @@ export interface NewCardDefaults {
      */
     introductions?: Introductions;
 }
+/**
+ * The members of one notification, as notifications/notify carries them and as a recipient's agent records them. The originator is the `issuer` of the notifications/notify document and the addressee its `recipient`; neither is repeated here, because the originator's proof covers both.
+ */
+export interface Notification {
+    notificationId: NotificationId;
+    /**
+     * The revision of this notification. A recipient replaces the record it holds with a higher revision and leaves it unchanged for an equal or lower one (VTI-NTF-022). The first revision is 1.
+     */
+    revision: number;
+    kind: Kind_NotificationsV0_1;
+    subject: Subject;
+    /**
+     * The DID whose holders or members the thing concerns — for an election under a credential roll, the DID the roll names (`roll.memberOf`); otherwise the community's own. It says whom the thing is for, not that the recipient is one of them: a recipient may be the audience itself, or a party the audience relayed the notification to.
+     */
+    audience: Did_NotificationsV0_1;
+    status: Status;
+    /**
+     * Whether the addressee may relay this notification to the parties it stands for (notifications/relay). The originator states it explicitly; an addressee MUST NOT relay a notification whose `relayable` is false, or whose kind may not be relayed (VTI-NTF-041).
+     */
+    relayable: boolean;
+    /**
+     * When the thing can first be acted on — for an election, when voting opens. Absent: it can be acted on now.
+     */
+    validFrom?: string;
+    /**
+     * When the thing can no longer be acted on, and the notification lapses — for an election, when voting closes. A recipient discards a notification received after it (VTI-NTF-032). Absent: the kind's definition says when it lapses.
+     */
+    validUntil?: string;
+}
 /**
  * A community's offer of admission to a room it owns, as the member it is addressed to sees it.
  */
@@ -10969,6 +11171,33 @@ export interface RegisteredCredential {
      */
     lastUsedAt?: string;
 }
+export interface RegisteredGroup {
+    /**
+     * A role the network defines, e.g. `admins`: lowercase letters, digits, `-` and `_`.
+     */
+    role: string;
+    /**
+     * The community's identifier for the group.
+     */
+    groupId: string;
+    /**
+     * The group's own DID, which the registration names as its subject.
+     */
+    groupDid: string;
+    /**
+     * Where the network delivers broadcasts for the group: the community's relay endpoint for it.
+     */
+    endpoint: string;
+    /**
+     * The community's `servesRole` statement (VSC): the group serves `role` in the network.
+     */
+    registration: {};
+    /**
+     * The network's `groupRegistered` statement (VSC), bound to the registration's digest.
+     */
+    acceptance: {};
+    registeredAt: string;
+}
 /**
  * The `ServiceInstance` shape of `did-management/_shared/0.1`, with `lastSeen` renamed `lastSeenAt`; named apart from `service-instance.schema.json`'s `ServiceInstance`, a different shape, so the two do not collide in generated code.
  */
@@ -11408,6 +11637,16 @@ export interface RightRecord_GitNsV0_6 {
      */
     breakGlass?: BreakGlass_GitNsV0_6;
 }
+export interface RoleAssignment {
+    /**
+     * A role the network defines, e.g. `admins`: lowercase letters, digits, `-` and `_`.
+     */
+    role: string;
+    /**
+     * The community group to serve the role.
+     */
+    groupId: string;
+}
 /**
  * A grant set by reference: the capability ceiling of a defined role, conferred as resource grants exactly as a `grants` binding confers its list. It never assigns the role itself — an entry's administrative role and its community role stay direct assignments.
  */
@@ -11573,6 +11812,27 @@ export interface RoleSummary {
      */
     preRotationCommitments?: number;
 }
+/**
+ * Under a `credential` roll, whose membership credential admits a party to a ticket, as a member is shown it before they claim one (VTI-VOT-090): the DID the roll names, what kind of party it is to this community, and its name as the community knows it. Present in a disclosure exactly when the election's roll rule is `credential`.
+ */
+export interface RollCredentialDisclosure {
+    /**
+     * The manifest's `roll.memberOf`.
+     */
+    memberOf: string;
+    /**
+     * `thisCommunity`: the community itself. `communityGroup`: one of the community's own groups, whose membership credentials it authorizes the group to issue (VTI-DIR-083). `memberParty`: a party outside the community that is itself an active member of it — another community, a group of another community, or a network — whose own membership credentials admit their holders (VTI-VOT-026).
+     */
+    memberOfKind: "thisCommunity" | "communityGroup" | "memberParty";
+    /**
+     * The name the community shows for the party `memberOf` names: the group's name, or the member party's name as the community's records hold it. Absent where showing it would disclose more than the group's visibility admits (VTI-DIR-070).
+     */
+    memberOfName?: string;
+    /**
+     * Always true: claiming a ticket shows the community the presenter's membership credential for `memberOf`, so the community learns that the presenter is a member of that party.
+     */
+    presenterDisclosed?: true;
+}
 /**
  * Who may be issued a ticket (VTI-VOT-021): the community's active members, its active members and the parties `listed` names, or only the parties `listed` names.
  */
@@ -11580,6 +11840,17 @@ export interface RollRule {
     rule: "members" | "membersAndListed" | "listed";
     listed?: string[];
 }
+/**
+ * Who may be issued a ticket (VTI-VOT-021): the community's active members (`members`), its active members and the parties `listed` names (`membersAndListed`), only the parties `listed` names (`listed`), or the holders of a membership credential for the one DID `memberOf` names (`credential`), proven by presentation when the holder claims their ticket and never resolved when the election is created (VTI-VOT-025). `memberOf` is present exactly when `rule` is `credential`, and `listed` is never present with it.
+ */
+export interface RollRule_VotingV0_4 {
+    rule: "members" | "membersAndListed" | "listed" | "credential";
+    listed?: string[];
+    /**
+     * The DID whose membership credential admits its holder, under the `credential` rule: this community, one of its groups, or a party that is itself an active member of this community — holding a membership credential this community issued it — such as another community, a group of another community, or a network (VTI-VOT-026). Always a DID, never a group's local identifier or name. A community refuses to create an election naming any other DID (vtc/elections/create:rollUntrusted).
+     */
+    memberOf?: string;
+}
 /**
  * The outcome of a rollback. Distinct from ServiceMutationResult because a rollback can legitimately publish nothing: if the previous state already equals the current one there is no change to write, and `kind: "noOp"` says so with `logEntryVersionId` absent. Treating that as a failure would be wrong — the requested state holds — and treating it as an ordinary success would report a log entry that does not exist.
  */
@@ -12850,6 +13121,23 @@ export interface StreamDescriptor {
     expectedSizeBytes: ExpectedSizeBytes;
     expiresAt: ExpiresAt;
 }
+/**
+ * Where the thing is and how to open it. Only these three members: what the thing contains is shown by its holder, to a reader it admits, when the thing is opened with `openWith`.
+ */
+export interface Subject {
+    /**
+     * The DID of the party holding the thing — for an election, the community. The party a recipient sends `openWith` to.
+     */
+    heldBy: Did_NotificationsV0_1;
+    /**
+     * The thing's identifier at `heldBy`, in the form the `openWith` task takes it — for an election, its `electionId`.
+     */
+    id: string;
+    /**
+     * The Type URI of the Trust Task by which a recipient opens the thing at `heldBy` — for an election, `https://trusttasks.org/spec/vtc/elections/show/0.6`. A recipient opens it only at its principal's choice (VTI-NTF-053), and only by a version of that task it and `heldBy` both serve.
+     */
+    openWith: string;
+}
 /**
  * Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.
  */