@openvtc/trust-tasks 0.26.13 → 0.26.15

package/dist/rooms/owner/revoke/0.1/payload.d.ts

@@ -0,0 +1,1481 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/rooms/owner/revoke/0.1/payload.schema.json
+ */
+import type { CredentialRevocation, DigestMultibase, Ext, RevocationEntry, RevocationHead, RevocationList, RoomRevocation, SubjectRevocation } from "../../../../_shared/components.js";
+/**
+ * One withdrawal to add, discriminated by `kind` as a RevocationEntry is. It carries no `revokedAt`: the recipient stamps the time it signs, so that a subject or room entry withdraws exactly what the room had issued until then and nothing the caller dated.
+ */
+export type Withdrawal = WithdrawCredential | WithdrawSubject | WithdrawRoom;
+/**
+ * A room's owner asks their own agent to withdraw credentials the room issued: sign the room's next revocation list as the room, keep it, and deliver it to each host serving the room.
+ */
+export interface RoomsOwnerRevokePayload {
+    /**
+     * The room whose credentials are withdrawn. The recipient signs as this room.
+     */
+    roomId: string;
+    /**
+     * Which held key signs as the room — named explicitly, as for rooms/owner/issue-authority, because nothing maps a DID to the key it was minted with. A key that is not one the room's DID document lists for `assertionMethod` produces a list every host refuses.
+     */
+    signingKeyId: string;
+    /**
+     * Every host serving the room, as DIDs: its primary, any mirror, and a host it is moving to. A withdrawal binds only the hosts that hold it, so a host left off this list honours what the room withdrew.
+     *
+     * @minItems 1
+     * @maxItems 8
+     */
+    hosts: [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string];
+    /**
+     * What to withdraw now. Absent or empty: sign nothing new, and deliver the list the recipient holds — how a host the room has moved to, or one that missed a delivery, is brought up to date.
+     *
+     * @maxItems 64
+     */
+    withdraw?: Withdrawal[];
+    /**
+     * Why, for the owner's own record. Never put into the list, which reaches every host: it MUST NOT carry personal data or a credential.
+     */
+    reason?: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+export interface WithdrawCredential {
+    kind: "credential";
+    /**
+     * The `id` of the credential withdrawn.
+     */
+    credentialId: string;
+    /**
+     * OPTIONAL. The credential's own `validUntil`, after which the entry can be dropped.
+     */
+    until?: string;
+}
+export interface WithdrawSubject {
+    kind: "subject";
+    /**
+     * The party withdrawn: every credential naming them as subject or issuer that the room's chain gave them before now. Never the room.
+     */
+    subject: string;
+    /**
+     * OPTIONAL. When the last credential the room issued them expires, after which the entry can be dropped.
+     */
+    until?: string;
+}
+export interface WithdrawRoom {
+    kind: "room";
+    /**
+     * OPTIONAL. When the last credential the room issued before now expires.
+     */
+    until?: string;
+}
+/**
+ * Success response to rooms/owner/revoke. Type https://trusttasks.org/spec/rooms/owner/revoke/0.1#response. The list the recipient now holds for the room, and what each host did with it. A success says the list was signed and kept; only a delivery whose outcome is `accepted` says a host enforces it.
+ */
+export interface RoomsOwnerRevokeResponsePayload {
+    roomId: string;
+    /**
+     * The room's current list, as signed. Returned so the owner holds a copy that does not depend on the recipient.
+     */
+    list: RevocationList;
+    head: RevocationHead;
+    /**
+     * One per host in the request, in its order.
+     *
+     * @minItems 1
+     * @maxItems 8
+     */
+    deliveries: [Delivery] | [Delivery, Delivery] | [Delivery, Delivery, Delivery] | [Delivery, Delivery, Delivery, Delivery] | [Delivery, Delivery, Delivery, Delivery, Delivery] | [Delivery, Delivery, Delivery, Delivery, Delivery, Delivery] | [Delivery, Delivery, Delivery, Delivery, Delivery, Delivery, Delivery] | [Delivery, Delivery, Delivery, Delivery, Delivery, Delivery, Delivery, Delivery];
+    ext?: Ext;
+}
+/**
+ * What one host did with the list.
+ */
+export interface Delivery {
+    host: string;
+    /**
+     * `accepted`: the host holds this list, or answered it as a repeat, and enforces it from `inForceAt`. `refused`: it answered and declined; its code is in `code`. `unreachable`: no answer, so the outcome is unknown — repeat the request with no `withdraw` to deliver again.
+     */
+    outcome: "accepted" | "refused" | "unreachable";
+    /**
+     * The head the host answered with. Present when `accepted`.
+     */
+    head?: RevocationHead;
+    /**
+     * When the host began enforcing the list. Present when `accepted`.
+     */
+    inForceAt?: string;
+    /**
+     * The host's error code. Present when `refused`.
+     */
+    code?: string;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { CredentialRevocation, DigestMultibase, Ext, RevocationEntry, RevocationHead, RevocationList, RoomRevocation, SubjectRevocation };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/rooms/owner/revoke/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = RoomsOwnerRevokePayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/rooms/owner/revoke/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = RoomsOwnerRevokeResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/rooms/owner/revoke/0.1";
+    readonly title: "Rooms Owner Revoke — payload";
+    readonly description: "A room's owner asks their own agent to withdraw credentials the room issued: sign the room's next revocation list as the room, keep it, and deliver it to each host serving the room.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["roomId", "signingKeyId", "hosts"];
+    readonly properties: {
+        readonly roomId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+            readonly description: "The room whose credentials are withdrawn. The recipient signs as this room.";
+        };
+        readonly signingKeyId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly description: "Which held key signs as the room — named explicitly, as for rooms/owner/issue-authority, because nothing maps a DID to the key it was minted with. A key that is not one the room's DID document lists for `assertionMethod` produces a list every host refuses.";
+        };
+        readonly hosts: {
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly maxItems: 8;
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly type: "string";
+                readonly pattern: "^did:";
+                readonly maxLength: 2048;
+            };
+            readonly description: "Every host serving the room, as DIDs: its primary, any mirror, and a host it is moving to. A withdrawal binds only the hosts that hold it, so a host left off this list honours what the room withdrew.";
+        };
+        readonly withdraw: {
+            readonly type: "array";
+            readonly maxItems: 64;
+            readonly items: {
+                readonly $ref: "#/$defs/Withdrawal";
+            };
+            readonly description: "What to withdraw now. Absent or empty: sign nothing new, and deliver the list the recipient holds — how a host the room has moved to, or one that missed a delivery, is brought up to date.";
+        };
+        readonly reason: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 500;
+            readonly description: "Why, for the owner's own record. Never put into the list, which reaches every host: it MUST NOT carry personal data or a credential.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Withdrawal: {
+            readonly title: "Withdrawal";
+            readonly description: "One withdrawal to add, discriminated by `kind` as a RevocationEntry is. It carries no `revokedAt`: the recipient stamps the time it signs, so that a subject or room entry withdraws exactly what the room had issued until then and nothing the caller dated.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/WithdrawCredential";
+            }, {
+                readonly $ref: "#/$defs/WithdrawSubject";
+            }, {
+                readonly $ref: "#/$defs/WithdrawRoom";
+            }];
+        };
+        readonly WithdrawCredential: {
+            readonly title: "WithdrawCredential";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "credentialId"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "credential";
+                };
+                readonly credentialId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "The `id` of the credential withdrawn.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. The credential's own `validUntil`, after which the entry can be dropped.";
+                };
+            };
+        };
+        readonly WithdrawSubject: {
+            readonly title: "WithdrawSubject";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "subject"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "subject";
+                };
+                readonly subject: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                    readonly description: "The party withdrawn: every credential naming them as subject or issuer that the room's chain gave them before now. Never the room.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. When the last credential the room issued them expires, after which the entry can be dropped.";
+                };
+            };
+        };
+        readonly WithdrawRoom: {
+            readonly title: "WithdrawRoom";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "room";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. When the last credential the room issued before now expires.";
+                };
+            };
+        };
+        readonly Delivery: {
+            readonly title: "Delivery";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["host", "outcome"];
+            readonly description: "What one host did with the list.";
+            readonly properties: {
+                readonly host: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                };
+                readonly outcome: {
+                    readonly type: "string";
+                    readonly enum: readonly ["accepted", "refused", "unreachable"];
+                    readonly description: "`accepted`: the host holds this list, or answered it as a repeat, and enforces it from `inForceAt`. `refused`: it answered and declined; its code is in `code`. `unreachable`: no answer, so the outcome is unknown — repeat the request with no `withdraw` to deliver again.";
+                };
+                readonly head: {
+                    readonly $ref: "#/$defs/RevocationHead";
+                    readonly description: "The head the host answered with. Present when `accepted`.";
+                };
+                readonly inForceAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the host began enforcing the list. Present when `accepted`.";
+                };
+                readonly code: {
+                    readonly type: "string";
+                    readonly maxLength: 128;
+                    readonly description: "The host's error code. Present when `refused`.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Rooms Owner Revoke — response payload";
+            readonly description: "Success response to rooms/owner/revoke. Type https://trusttasks.org/spec/rooms/owner/revoke/0.1#response. The list the recipient now holds for the room, and what each host did with it. A success says the list was signed and kept; only a delivery whose outcome is `accepted` says a host enforces it.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["roomId", "list", "head", "deliveries"];
+            readonly properties: {
+                readonly roomId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                };
+                readonly list: {
+                    readonly $ref: "#/$defs/RevocationList";
+                    readonly description: "The room's current list, as signed. Returned so the owner holds a copy that does not depend on the recipient.";
+                };
+                readonly head: {
+                    readonly $ref: "#/$defs/RevocationHead";
+                };
+                readonly deliveries: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 8;
+                    readonly items: {
+                        readonly $ref: "#/$defs/Delivery";
+                    };
+                    readonly description: "One per host in the request, in its order.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RevocationHead: {
+            readonly title: "RevocationHead";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["sequence", "digest"];
+            readonly description: "Which `RevocationList` a party holds, without its entries: comparable between the room's key holder and a host, and between two hosts, without disclosing whom the room withdrew.";
+            readonly properties: {
+                readonly sequence: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "The list's `sequence`.";
+                };
+                readonly digest: {
+                    readonly $ref: "#/$defs/DigestMultibase";
+                    readonly description: "SHA-256 multihash of the list's RFC 8785 (JCS) canonicalization, `proof` included. Two parties holding one sequence with different digests have been given two lists the room signed at one sequence.";
+                };
+            };
+        };
+        readonly DigestMultibase: {
+            readonly title: "DigestMultibase";
+            readonly description: "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.";
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly pattern: "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$";
+            readonly examples: readonly ["zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"];
+        };
+        readonly RevocationList: {
+            readonly title: "RevocationList";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["roomId", "sequence", "issuedAt", "entries", "proof"];
+            readonly description: "The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.\n\n**Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.\n\n**Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.\n\n**Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.\n\n**Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.\n\n**Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.";
+            readonly properties: {
+                readonly roomId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                    readonly description: "The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room.";
+                };
+                readonly sequence: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back.";
+                };
+                readonly issuedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room signed this list.";
+                };
+                readonly entries: {
+                    readonly type: "array";
+                    readonly maxItems: 4096;
+                    readonly items: {
+                        readonly $ref: "#/$defs/RevocationEntry";
+                    };
+                    readonly description: "Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence.";
+                };
+                readonly proof: {
+                    readonly type: "object";
+                    readonly description: "The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`.";
+                };
+            };
+        };
+        readonly RevocationEntry: {
+            readonly title: "RevocationEntry";
+            readonly description: "One withdrawal in a `RevocationList`, discriminated by `kind`.\n\n  - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.\n  - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.\n  - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.\n\n**Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.\n\n**Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CredentialRevocation";
+            }, {
+                readonly $ref: "#/$defs/SubjectRevocation";
+            }, {
+                readonly $ref: "#/$defs/RoomRevocation";
+            }];
+        };
+        readonly RoomRevocation: {
+            readonly title: "RoomRevocation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "revokedAt"];
+            readonly description: "Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.";
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "room";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room made this withdrawal.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                };
+            };
+        };
+        readonly SubjectRevocation: {
+            readonly title: "SubjectRevocation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "subject", "revokedAt"];
+            readonly description: "Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.";
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "subject";
+                };
+                readonly subject: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                    readonly description: "The party withdrawn. Never the room itself.";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room made this withdrawal.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                };
+            };
+        };
+        readonly CredentialRevocation: {
+            readonly title: "CredentialRevocation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "credentialId", "revokedAt"];
+            readonly description: "Withdraws one credential — a membership credential or any authority link — by its `id`.";
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "credential";
+                };
+                readonly credentialId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it.";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room made this withdrawal.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Withdrawal: {
+            readonly title: "Withdrawal";
+            readonly description: "One withdrawal to add, discriminated by `kind` as a RevocationEntry is. It carries no `revokedAt`: the recipient stamps the time it signs, so that a subject or room entry withdraws exactly what the room had issued until then and nothing the caller dated.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/WithdrawCredential";
+            }, {
+                readonly $ref: "#/$defs/WithdrawSubject";
+            }, {
+                readonly $ref: "#/$defs/WithdrawRoom";
+            }];
+        };
+        readonly WithdrawCredential: {
+            readonly title: "WithdrawCredential";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "credentialId"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "credential";
+                };
+                readonly credentialId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "The `id` of the credential withdrawn.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. The credential's own `validUntil`, after which the entry can be dropped.";
+                };
+            };
+        };
+        readonly WithdrawSubject: {
+            readonly title: "WithdrawSubject";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "subject"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "subject";
+                };
+                readonly subject: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                    readonly description: "The party withdrawn: every credential naming them as subject or issuer that the room's chain gave them before now. Never the room.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. When the last credential the room issued them expires, after which the entry can be dropped.";
+                };
+            };
+        };
+        readonly WithdrawRoom: {
+            readonly title: "WithdrawRoom";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "room";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. When the last credential the room issued before now expires.";
+                };
+            };
+        };
+        readonly Delivery: {
+            readonly title: "Delivery";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["host", "outcome"];
+            readonly description: "What one host did with the list.";
+            readonly properties: {
+                readonly host: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                };
+                readonly outcome: {
+                    readonly type: "string";
+                    readonly enum: readonly ["accepted", "refused", "unreachable"];
+                    readonly description: "`accepted`: the host holds this list, or answered it as a repeat, and enforces it from `inForceAt`. `refused`: it answered and declined; its code is in `code`. `unreachable`: no answer, so the outcome is unknown — repeat the request with no `withdraw` to deliver again.";
+                };
+                readonly head: {
+                    readonly $ref: "#/$defs/RevocationHead";
+                    readonly description: "The head the host answered with. Present when `accepted`.";
+                };
+                readonly inForceAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the host began enforcing the list. Present when `accepted`.";
+                };
+                readonly code: {
+                    readonly type: "string";
+                    readonly maxLength: 128;
+                    readonly description: "The host's error code. Present when `refused`.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Rooms Owner Revoke — response payload";
+            readonly description: "Success response to rooms/owner/revoke. Type https://trusttasks.org/spec/rooms/owner/revoke/0.1#response. The list the recipient now holds for the room, and what each host did with it. A success says the list was signed and kept; only a delivery whose outcome is `accepted` says a host enforces it.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["roomId", "list", "head", "deliveries"];
+            readonly properties: {
+                readonly roomId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                };
+                readonly list: {
+                    readonly $ref: "#/$defs/RevocationList";
+                    readonly description: "The room's current list, as signed. Returned so the owner holds a copy that does not depend on the recipient.";
+                };
+                readonly head: {
+                    readonly $ref: "#/$defs/RevocationHead";
+                };
+                readonly deliveries: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 8;
+                    readonly items: {
+                        readonly $ref: "#/$defs/Delivery";
+                    };
+                    readonly description: "One per host in the request, in its order.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RevocationHead: {
+            readonly title: "RevocationHead";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["sequence", "digest"];
+            readonly description: "Which `RevocationList` a party holds, without its entries: comparable between the room's key holder and a host, and between two hosts, without disclosing whom the room withdrew.";
+            readonly properties: {
+                readonly sequence: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "The list's `sequence`.";
+                };
+                readonly digest: {
+                    readonly $ref: "#/$defs/DigestMultibase";
+                    readonly description: "SHA-256 multihash of the list's RFC 8785 (JCS) canonicalization, `proof` included. Two parties holding one sequence with different digests have been given two lists the room signed at one sequence.";
+                };
+            };
+        };
+        readonly DigestMultibase: {
+            readonly title: "DigestMultibase";
+            readonly description: "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.";
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly pattern: "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$";
+            readonly examples: readonly ["zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"];
+        };
+        readonly RevocationList: {
+            readonly title: "RevocationList";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["roomId", "sequence", "issuedAt", "entries", "proof"];
+            readonly description: "The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.\n\n**Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.\n\n**Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.\n\n**Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.\n\n**Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.\n\n**Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.";
+            readonly properties: {
+                readonly roomId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                    readonly description: "The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room.";
+                };
+                readonly sequence: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back.";
+                };
+                readonly issuedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room signed this list.";
+                };
+                readonly entries: {
+                    readonly type: "array";
+                    readonly maxItems: 4096;
+                    readonly items: {
+                        readonly $ref: "#/$defs/RevocationEntry";
+                    };
+                    readonly description: "Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence.";
+                };
+                readonly proof: {
+                    readonly type: "object";
+                    readonly description: "The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`.";
+                };
+            };
+        };
+        readonly RevocationEntry: {
+            readonly title: "RevocationEntry";
+            readonly description: "One withdrawal in a `RevocationList`, discriminated by `kind`.\n\n  - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.\n  - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.\n  - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.\n\n**Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.\n\n**Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CredentialRevocation";
+            }, {
+                readonly $ref: "#/$defs/SubjectRevocation";
+            }, {
+                readonly $ref: "#/$defs/RoomRevocation";
+            }];
+        };
+        readonly RoomRevocation: {
+            readonly title: "RoomRevocation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "revokedAt"];
+            readonly description: "Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.";
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "room";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room made this withdrawal.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                };
+            };
+        };
+        readonly SubjectRevocation: {
+            readonly title: "SubjectRevocation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "subject", "revokedAt"];
+            readonly description: "Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.";
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "subject";
+                };
+                readonly subject: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                    readonly description: "The party withdrawn. Never the room itself.";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room made this withdrawal.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                };
+            };
+        };
+        readonly CredentialRevocation: {
+            readonly title: "CredentialRevocation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "credentialId", "revokedAt"];
+            readonly description: "Withdraws one credential — a membership credential or any authority link — by its `id`.";
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "credential";
+                };
+                readonly credentialId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it.";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room made this withdrawal.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/rooms/owner/revoke/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/rooms/owner/revoke/0.1";
+        readonly title: "Rooms Owner Revoke — payload";
+        readonly description: "A room's owner asks their own agent to withdraw credentials the room issued: sign the room's next revocation list as the room, keep it, and deliver it to each host serving the room.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["roomId", "signingKeyId", "hosts"];
+        readonly properties: {
+            readonly roomId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+                readonly description: "The room whose credentials are withdrawn. The recipient signs as this room.";
+            };
+            readonly signingKeyId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly description: "Which held key signs as the room — named explicitly, as for rooms/owner/issue-authority, because nothing maps a DID to the key it was minted with. A key that is not one the room's DID document lists for `assertionMethod` produces a list every host refuses.";
+            };
+            readonly hosts: {
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly maxItems: 8;
+                readonly uniqueItems: true;
+                readonly items: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                };
+                readonly description: "Every host serving the room, as DIDs: its primary, any mirror, and a host it is moving to. A withdrawal binds only the hosts that hold it, so a host left off this list honours what the room withdrew.";
+            };
+            readonly withdraw: {
+                readonly type: "array";
+                readonly maxItems: 64;
+                readonly items: {
+                    readonly $ref: "#/$defs/Withdrawal";
+                };
+                readonly description: "What to withdraw now. Absent or empty: sign nothing new, and deliver the list the recipient holds — how a host the room has moved to, or one that missed a delivery, is brought up to date.";
+            };
+            readonly reason: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 500;
+                readonly description: "Why, for the owner's own record. Never put into the list, which reaches every host: it MUST NOT carry personal data or a credential.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Withdrawal: {
+                readonly title: "Withdrawal";
+                readonly description: "One withdrawal to add, discriminated by `kind` as a RevocationEntry is. It carries no `revokedAt`: the recipient stamps the time it signs, so that a subject or room entry withdraws exactly what the room had issued until then and nothing the caller dated.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/WithdrawCredential";
+                }, {
+                    readonly $ref: "#/$defs/WithdrawSubject";
+                }, {
+                    readonly $ref: "#/$defs/WithdrawRoom";
+                }];
+            };
+            readonly WithdrawCredential: {
+                readonly title: "WithdrawCredential";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "credentialId"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "credential";
+                    };
+                    readonly credentialId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "The `id` of the credential withdrawn.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. The credential's own `validUntil`, after which the entry can be dropped.";
+                    };
+                };
+            };
+            readonly WithdrawSubject: {
+                readonly title: "WithdrawSubject";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "subject"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "subject";
+                    };
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                        readonly description: "The party withdrawn: every credential naming them as subject or issuer that the room's chain gave them before now. Never the room.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. When the last credential the room issued them expires, after which the entry can be dropped.";
+                    };
+                };
+            };
+            readonly WithdrawRoom: {
+                readonly title: "WithdrawRoom";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "room";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. When the last credential the room issued before now expires.";
+                    };
+                };
+            };
+            readonly Delivery: {
+                readonly title: "Delivery";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["host", "outcome"];
+                readonly description: "What one host did with the list.";
+                readonly properties: {
+                    readonly host: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                    };
+                    readonly outcome: {
+                        readonly type: "string";
+                        readonly enum: readonly ["accepted", "refused", "unreachable"];
+                        readonly description: "`accepted`: the host holds this list, or answered it as a repeat, and enforces it from `inForceAt`. `refused`: it answered and declined; its code is in `code`. `unreachable`: no answer, so the outcome is unknown — repeat the request with no `withdraw` to deliver again.";
+                    };
+                    readonly head: {
+                        readonly $ref: "#/$defs/RevocationHead";
+                        readonly description: "The head the host answered with. Present when `accepted`.";
+                    };
+                    readonly inForceAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the host began enforcing the list. Present when `accepted`.";
+                    };
+                    readonly code: {
+                        readonly type: "string";
+                        readonly maxLength: 128;
+                        readonly description: "The host's error code. Present when `refused`.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Rooms Owner Revoke — response payload";
+                readonly description: "Success response to rooms/owner/revoke. Type https://trusttasks.org/spec/rooms/owner/revoke/0.1#response. The list the recipient now holds for the room, and what each host did with it. A success says the list was signed and kept; only a delivery whose outcome is `accepted` says a host enforces it.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["roomId", "list", "head", "deliveries"];
+                readonly properties: {
+                    readonly roomId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                    };
+                    readonly list: {
+                        readonly $ref: "#/$defs/RevocationList";
+                        readonly description: "The room's current list, as signed. Returned so the owner holds a copy that does not depend on the recipient.";
+                    };
+                    readonly head: {
+                        readonly $ref: "#/$defs/RevocationHead";
+                    };
+                    readonly deliveries: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 8;
+                        readonly items: {
+                            readonly $ref: "#/$defs/Delivery";
+                        };
+                        readonly description: "One per host in the request, in its order.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RevocationHead: {
+                readonly title: "RevocationHead";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["sequence", "digest"];
+                readonly description: "Which `RevocationList` a party holds, without its entries: comparable between the room's key holder and a host, and between two hosts, without disclosing whom the room withdrew.";
+                readonly properties: {
+                    readonly sequence: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "The list's `sequence`.";
+                    };
+                    readonly digest: {
+                        readonly $ref: "#/$defs/DigestMultibase";
+                        readonly description: "SHA-256 multihash of the list's RFC 8785 (JCS) canonicalization, `proof` included. Two parties holding one sequence with different digests have been given two lists the room signed at one sequence.";
+                    };
+                };
+            };
+            readonly DigestMultibase: {
+                readonly title: "DigestMultibase";
+                readonly description: "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.";
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly pattern: "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$";
+                readonly examples: readonly ["zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"];
+            };
+            readonly RevocationList: {
+                readonly title: "RevocationList";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["roomId", "sequence", "issuedAt", "entries", "proof"];
+                readonly description: "The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.\n\n**Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.\n\n**Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.\n\n**Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.\n\n**Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.\n\n**Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.";
+                readonly properties: {
+                    readonly roomId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                        readonly description: "The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room.";
+                    };
+                    readonly sequence: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back.";
+                    };
+                    readonly issuedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room signed this list.";
+                    };
+                    readonly entries: {
+                        readonly type: "array";
+                        readonly maxItems: 4096;
+                        readonly items: {
+                            readonly $ref: "#/$defs/RevocationEntry";
+                        };
+                        readonly description: "Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence.";
+                    };
+                    readonly proof: {
+                        readonly type: "object";
+                        readonly description: "The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`.";
+                    };
+                };
+            };
+            readonly RevocationEntry: {
+                readonly title: "RevocationEntry";
+                readonly description: "One withdrawal in a `RevocationList`, discriminated by `kind`.\n\n  - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.\n  - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.\n  - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.\n\n**Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.\n\n**Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CredentialRevocation";
+                }, {
+                    readonly $ref: "#/$defs/SubjectRevocation";
+                }, {
+                    readonly $ref: "#/$defs/RoomRevocation";
+                }];
+            };
+            readonly RoomRevocation: {
+                readonly title: "RoomRevocation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "revokedAt"];
+                readonly description: "Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.";
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "room";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room made this withdrawal.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                    };
+                };
+            };
+            readonly SubjectRevocation: {
+                readonly title: "SubjectRevocation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "subject", "revokedAt"];
+                readonly description: "Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.";
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "subject";
+                    };
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                        readonly description: "The party withdrawn. Never the room itself.";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room made this withdrawal.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                    };
+                };
+            };
+            readonly CredentialRevocation: {
+                readonly title: "CredentialRevocation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "credentialId", "revokedAt"];
+                readonly description: "Withdraws one credential — a membership credential or any authority link — by its `id`.";
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "credential";
+                    };
+                    readonly credentialId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it.";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room made this withdrawal.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/rooms/owner/revoke/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Withdrawal: {
+                readonly title: "Withdrawal";
+                readonly description: "One withdrawal to add, discriminated by `kind` as a RevocationEntry is. It carries no `revokedAt`: the recipient stamps the time it signs, so that a subject or room entry withdraws exactly what the room had issued until then and nothing the caller dated.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/WithdrawCredential";
+                }, {
+                    readonly $ref: "#/$defs/WithdrawSubject";
+                }, {
+                    readonly $ref: "#/$defs/WithdrawRoom";
+                }];
+            };
+            readonly WithdrawCredential: {
+                readonly title: "WithdrawCredential";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "credentialId"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "credential";
+                    };
+                    readonly credentialId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "The `id` of the credential withdrawn.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. The credential's own `validUntil`, after which the entry can be dropped.";
+                    };
+                };
+            };
+            readonly WithdrawSubject: {
+                readonly title: "WithdrawSubject";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "subject"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "subject";
+                    };
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                        readonly description: "The party withdrawn: every credential naming them as subject or issuer that the room's chain gave them before now. Never the room.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. When the last credential the room issued them expires, after which the entry can be dropped.";
+                    };
+                };
+            };
+            readonly WithdrawRoom: {
+                readonly title: "WithdrawRoom";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "room";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. When the last credential the room issued before now expires.";
+                    };
+                };
+            };
+            readonly Delivery: {
+                readonly title: "Delivery";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["host", "outcome"];
+                readonly description: "What one host did with the list.";
+                readonly properties: {
+                    readonly host: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                    };
+                    readonly outcome: {
+                        readonly type: "string";
+                        readonly enum: readonly ["accepted", "refused", "unreachable"];
+                        readonly description: "`accepted`: the host holds this list, or answered it as a repeat, and enforces it from `inForceAt`. `refused`: it answered and declined; its code is in `code`. `unreachable`: no answer, so the outcome is unknown — repeat the request with no `withdraw` to deliver again.";
+                    };
+                    readonly head: {
+                        readonly $ref: "#/$defs/RevocationHead";
+                        readonly description: "The head the host answered with. Present when `accepted`.";
+                    };
+                    readonly inForceAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the host began enforcing the list. Present when `accepted`.";
+                    };
+                    readonly code: {
+                        readonly type: "string";
+                        readonly maxLength: 128;
+                        readonly description: "The host's error code. Present when `refused`.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Rooms Owner Revoke — response payload";
+                readonly description: "Success response to rooms/owner/revoke. Type https://trusttasks.org/spec/rooms/owner/revoke/0.1#response. The list the recipient now holds for the room, and what each host did with it. A success says the list was signed and kept; only a delivery whose outcome is `accepted` says a host enforces it.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["roomId", "list", "head", "deliveries"];
+                readonly properties: {
+                    readonly roomId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                    };
+                    readonly list: {
+                        readonly $ref: "#/$defs/RevocationList";
+                        readonly description: "The room's current list, as signed. Returned so the owner holds a copy that does not depend on the recipient.";
+                    };
+                    readonly head: {
+                        readonly $ref: "#/$defs/RevocationHead";
+                    };
+                    readonly deliveries: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 8;
+                        readonly items: {
+                            readonly $ref: "#/$defs/Delivery";
+                        };
+                        readonly description: "One per host in the request, in its order.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RevocationHead: {
+                readonly title: "RevocationHead";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["sequence", "digest"];
+                readonly description: "Which `RevocationList` a party holds, without its entries: comparable between the room's key holder and a host, and between two hosts, without disclosing whom the room withdrew.";
+                readonly properties: {
+                    readonly sequence: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "The list's `sequence`.";
+                    };
+                    readonly digest: {
+                        readonly $ref: "#/$defs/DigestMultibase";
+                        readonly description: "SHA-256 multihash of the list's RFC 8785 (JCS) canonicalization, `proof` included. Two parties holding one sequence with different digests have been given two lists the room signed at one sequence.";
+                    };
+                };
+            };
+            readonly DigestMultibase: {
+                readonly title: "DigestMultibase";
+                readonly description: "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.";
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly pattern: "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$";
+                readonly examples: readonly ["zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"];
+            };
+            readonly RevocationList: {
+                readonly title: "RevocationList";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["roomId", "sequence", "issuedAt", "entries", "proof"];
+                readonly description: "The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.\n\n**Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.\n\n**Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.\n\n**Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.\n\n**Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.\n\n**Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.";
+                readonly properties: {
+                    readonly roomId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                        readonly description: "The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room.";
+                    };
+                    readonly sequence: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back.";
+                    };
+                    readonly issuedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room signed this list.";
+                    };
+                    readonly entries: {
+                        readonly type: "array";
+                        readonly maxItems: 4096;
+                        readonly items: {
+                            readonly $ref: "#/$defs/RevocationEntry";
+                        };
+                        readonly description: "Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence.";
+                    };
+                    readonly proof: {
+                        readonly type: "object";
+                        readonly description: "The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`.";
+                    };
+                };
+            };
+            readonly RevocationEntry: {
+                readonly title: "RevocationEntry";
+                readonly description: "One withdrawal in a `RevocationList`, discriminated by `kind`.\n\n  - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.\n  - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.\n  - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.\n\n**Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.\n\n**Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CredentialRevocation";
+                }, {
+                    readonly $ref: "#/$defs/SubjectRevocation";
+                }, {
+                    readonly $ref: "#/$defs/RoomRevocation";
+                }];
+            };
+            readonly RoomRevocation: {
+                readonly title: "RoomRevocation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "revokedAt"];
+                readonly description: "Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.";
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "room";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room made this withdrawal.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                    };
+                };
+            };
+            readonly SubjectRevocation: {
+                readonly title: "SubjectRevocation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "subject", "revokedAt"];
+                readonly description: "Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.";
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "subject";
+                    };
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                        readonly description: "The party withdrawn. Never the room itself.";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room made this withdrawal.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                    };
+                };
+            };
+            readonly CredentialRevocation: {
+                readonly title: "CredentialRevocation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "credentialId", "revokedAt"];
+                readonly description: "Withdraws one credential — a membership credential or any authority link — by its `id`.";
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "credential";
+                    };
+                    readonly credentialId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it.";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room made this withdrawal.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map