@openvtc/trust-tasks 0.26.14 → 0.26.15

package/dist/rooms/revocations/get/0.1/payload.d.ts

@@ -0,0 +1,905 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/rooms/revocations/get/0.1/payload.schema.json
+ */
+import type { AuthorityPresentation, CredentialRevocation, Ext, RevocationEntry, RevocationList, RoomRevocation, SubjectRevocation } from "../../../../_shared/components.js";
+/**
+ * An administrator of a room reads the revocation list its host holds and enforces for it.
+ */
+export interface RoomsRevocationsGetPayload {
+    /**
+     * The room.
+     */
+    roomId: string;
+    /**
+     * Must confer the `admin` action at this room's scope. The list names withdrawn parties on `open` and `attributed` rooms, which is the room's administration and not a member's business.
+     */
+    presentation: AuthorityPresentation;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * Success response to rooms/revocations/get. Type https://trusttasks.org/spec/rooms/revocations/get/0.1#response. The list the host holds, exactly as the room signed it, or nothing when it holds none.
+ */
+export interface RoomsRevocationsGetResponsePayload {
+    roomId: string;
+    /**
+     * The list the host holds, as the room signed it. Absent when the host holds none. A reader MUST verify it as a host does — the room's own key, this room — before relying on it, and MUST NOT adopt it in place of a list it holds at a higher sequence.
+     */
+    list?: RevocationList;
+    /**
+     * When the host began enforcing `list`. Present with it.
+     */
+    inForceAt?: string;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthorityPresentation, CredentialRevocation, Ext, RevocationEntry, RevocationList, RoomRevocation, SubjectRevocation };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/rooms/revocations/get/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = RoomsRevocationsGetPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/rooms/revocations/get/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = RoomsRevocationsGetResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/rooms/revocations/get/0.1";
+    readonly title: "Rooms Revocations Get — payload";
+    readonly description: "An administrator of a room reads the revocation list its host holds and enforces for it.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["roomId", "presentation"];
+    readonly properties: {
+        readonly roomId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+            readonly description: "The room.";
+        };
+        readonly presentation: {
+            readonly $ref: "#/$defs/AuthorityPresentation";
+            readonly description: "Must confer the `admin` action at this room's scope. The list names withdrawn parties on `open` and `attributed` rooms, which is the room's administration and not a member's business.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Rooms Revocations Get — response payload";
+            readonly description: "Success response to rooms/revocations/get. Type https://trusttasks.org/spec/rooms/revocations/get/0.1#response. The list the host holds, exactly as the room signed it, or nothing when it holds none.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["roomId"];
+            readonly properties: {
+                readonly roomId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                };
+                readonly list: {
+                    readonly $ref: "#/$defs/RevocationList";
+                    readonly description: "The list the host holds, as the room signed it. Absent when the host holds none. A reader MUST verify it as a host does — the room's own key, this room — before relying on it, and MUST NOT adopt it in place of a list it holds at a higher sequence.";
+                };
+                readonly inForceAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the host began enforcing `list`. Present with it.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RevocationList: {
+            readonly title: "RevocationList";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["roomId", "sequence", "issuedAt", "entries", "proof"];
+            readonly description: "The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.\n\n**Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.\n\n**Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.\n\n**Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.\n\n**Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.\n\n**Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.";
+            readonly properties: {
+                readonly roomId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                    readonly description: "The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room.";
+                };
+                readonly sequence: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back.";
+                };
+                readonly issuedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room signed this list.";
+                };
+                readonly entries: {
+                    readonly type: "array";
+                    readonly maxItems: 4096;
+                    readonly items: {
+                        readonly $ref: "#/$defs/RevocationEntry";
+                    };
+                    readonly description: "Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence.";
+                };
+                readonly proof: {
+                    readonly type: "object";
+                    readonly description: "The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`.";
+                };
+            };
+        };
+        readonly RevocationEntry: {
+            readonly title: "RevocationEntry";
+            readonly description: "One withdrawal in a `RevocationList`, discriminated by `kind`.\n\n  - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.\n  - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.\n  - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.\n\n**Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.\n\n**Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CredentialRevocation";
+            }, {
+                readonly $ref: "#/$defs/SubjectRevocation";
+            }, {
+                readonly $ref: "#/$defs/RoomRevocation";
+            }];
+        };
+        readonly RoomRevocation: {
+            readonly title: "RoomRevocation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "revokedAt"];
+            readonly description: "Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.";
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "room";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room made this withdrawal.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                };
+            };
+        };
+        readonly SubjectRevocation: {
+            readonly title: "SubjectRevocation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "subject", "revokedAt"];
+            readonly description: "Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.";
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "subject";
+                };
+                readonly subject: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                    readonly description: "The party withdrawn. Never the room itself.";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room made this withdrawal.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                };
+            };
+        };
+        readonly CredentialRevocation: {
+            readonly title: "CredentialRevocation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "credentialId", "revokedAt"];
+            readonly description: "Withdraws one credential — a membership credential or any authority link — by its `id`.";
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "credential";
+                };
+                readonly credentialId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it.";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room made this withdrawal.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                };
+            };
+        };
+        readonly AuthorityPresentation: {
+            readonly title: "AuthorityPresentation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["membership", "authority"];
+            readonly description: "What a party presents to act on a room. Carries the whole authority chain: a host MUST NOT dereference an authority credential's `parent` to fetch a link it was not given. Resolving over the network would make verification depend on availability, turn every identifier into a request the host can be induced to make against an address the holder chooses, and signal credential use to whoever hosts the identifier. A host MUST bind the presenter to the chain's leaf. A chain that verifies is evidence that authority was conferred on somebody; it is not evidence that the party presenting it is that somebody. The leaf's subject MUST equal the party the host authenticated for this request — an identity the transport established or a document `proof` proved, never one named in a payload. A host that omits this check authorizes every captured presentation, and the omission is silent, because the chain still verifies.\n\n**Every credential is its issuer's attestation, and only its issuer's.** For the membership credential and for every link of `authority`, a host MUST verify the credential's `proof` with a key that the credential's own `issuer` lists for `assertionMethod` in its DID document, and MUST refuse a credential whose proof names a verification method that is not its issuer's. A proof that verifies under some other party's key is that party's statement, not the issuer's, and confers nothing. The same binding holds for every other document a room signs, such as a `RevocationList`.\n\n**A chain that verifies may still be revoked.** A host that has accepted a `RevocationList` for the room (`rooms/revocations/put`) MUST, from the moment it accepted it, refuse every presentation in which the membership credential or any link of `authority` is revoked by that list, under every task and every version of every task it serves for the room. A chain from which any link is revoked is refused whole: a credential delegated from a revoked one confers nothing, however it was attenuated. The refusal is the same `permissionDenied` as any other failed presentation.";
+            readonly properties: {
+                readonly membership: {
+                    readonly type: "string";
+                    readonly description: "The presenter's membership credential for this room, or — on a `private` room — a zero-knowledge presentation of it. Serialized per the governing profile.";
+                };
+                readonly authority: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 8;
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "The authority chain, LEAF FIRST: the first element is the credential being relied on and the last MUST be one issued by the room itself. Every link the presenter relies on is present, because the host will not fetch one. Capped at 8: verification is linear in chain length and runs on every operation, so an unbounded chain is a denial-of-service surface against the host. The known uses need 2 to 3 — a person attenuating to an agent, and that agent to a sub-agent.";
+                };
+                readonly subjectBinding: {
+                    readonly type: "string";
+                    readonly description: "REQUIRED on a `private` room, where the subject identifier is withheld: a proof that the membership credential and the authority chain's leaf describe the SAME subject. Without it two parties pool credentials — one contributes membership, the other authority — and the combination verifies as a single party holding both. A host MUST refuse a private-room presentation that omits this.";
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Rooms Revocations Get — response payload";
+            readonly description: "Success response to rooms/revocations/get. Type https://trusttasks.org/spec/rooms/revocations/get/0.1#response. The list the host holds, exactly as the room signed it, or nothing when it holds none.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["roomId"];
+            readonly properties: {
+                readonly roomId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                };
+                readonly list: {
+                    readonly $ref: "#/$defs/RevocationList";
+                    readonly description: "The list the host holds, as the room signed it. Absent when the host holds none. A reader MUST verify it as a host does — the room's own key, this room — before relying on it, and MUST NOT adopt it in place of a list it holds at a higher sequence.";
+                };
+                readonly inForceAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the host began enforcing `list`. Present with it.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RevocationList: {
+            readonly title: "RevocationList";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["roomId", "sequence", "issuedAt", "entries", "proof"];
+            readonly description: "The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.\n\n**Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.\n\n**Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.\n\n**Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.\n\n**Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.\n\n**Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.";
+            readonly properties: {
+                readonly roomId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 512;
+                    readonly description: "The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room.";
+                };
+                readonly sequence: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back.";
+                };
+                readonly issuedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room signed this list.";
+                };
+                readonly entries: {
+                    readonly type: "array";
+                    readonly maxItems: 4096;
+                    readonly items: {
+                        readonly $ref: "#/$defs/RevocationEntry";
+                    };
+                    readonly description: "Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence.";
+                };
+                readonly proof: {
+                    readonly type: "object";
+                    readonly description: "The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`.";
+                };
+            };
+        };
+        readonly RevocationEntry: {
+            readonly title: "RevocationEntry";
+            readonly description: "One withdrawal in a `RevocationList`, discriminated by `kind`.\n\n  - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.\n  - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.\n  - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.\n\n**Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.\n\n**Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CredentialRevocation";
+            }, {
+                readonly $ref: "#/$defs/SubjectRevocation";
+            }, {
+                readonly $ref: "#/$defs/RoomRevocation";
+            }];
+        };
+        readonly RoomRevocation: {
+            readonly title: "RoomRevocation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "revokedAt"];
+            readonly description: "Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.";
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "room";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room made this withdrawal.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                };
+            };
+        };
+        readonly SubjectRevocation: {
+            readonly title: "SubjectRevocation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "subject", "revokedAt"];
+            readonly description: "Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.";
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "subject";
+                };
+                readonly subject: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                    readonly description: "The party withdrawn. Never the room itself.";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room made this withdrawal.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                };
+            };
+        };
+        readonly CredentialRevocation: {
+            readonly title: "CredentialRevocation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "credentialId", "revokedAt"];
+            readonly description: "Withdraws one credential — a membership credential or any authority link — by its `id`.";
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "credential";
+                };
+                readonly credentialId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it.";
+                };
+                readonly revokedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the room made this withdrawal.";
+                };
+                readonly until: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                };
+            };
+        };
+        readonly AuthorityPresentation: {
+            readonly title: "AuthorityPresentation";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["membership", "authority"];
+            readonly description: "What a party presents to act on a room. Carries the whole authority chain: a host MUST NOT dereference an authority credential's `parent` to fetch a link it was not given. Resolving over the network would make verification depend on availability, turn every identifier into a request the host can be induced to make against an address the holder chooses, and signal credential use to whoever hosts the identifier. A host MUST bind the presenter to the chain's leaf. A chain that verifies is evidence that authority was conferred on somebody; it is not evidence that the party presenting it is that somebody. The leaf's subject MUST equal the party the host authenticated for this request — an identity the transport established or a document `proof` proved, never one named in a payload. A host that omits this check authorizes every captured presentation, and the omission is silent, because the chain still verifies.\n\n**Every credential is its issuer's attestation, and only its issuer's.** For the membership credential and for every link of `authority`, a host MUST verify the credential's `proof` with a key that the credential's own `issuer` lists for `assertionMethod` in its DID document, and MUST refuse a credential whose proof names a verification method that is not its issuer's. A proof that verifies under some other party's key is that party's statement, not the issuer's, and confers nothing. The same binding holds for every other document a room signs, such as a `RevocationList`.\n\n**A chain that verifies may still be revoked.** A host that has accepted a `RevocationList` for the room (`rooms/revocations/put`) MUST, from the moment it accepted it, refuse every presentation in which the membership credential or any link of `authority` is revoked by that list, under every task and every version of every task it serves for the room. A chain from which any link is revoked is refused whole: a credential delegated from a revoked one confers nothing, however it was attenuated. The refusal is the same `permissionDenied` as any other failed presentation.";
+            readonly properties: {
+                readonly membership: {
+                    readonly type: "string";
+                    readonly description: "The presenter's membership credential for this room, or — on a `private` room — a zero-knowledge presentation of it. Serialized per the governing profile.";
+                };
+                readonly authority: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 8;
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "The authority chain, LEAF FIRST: the first element is the credential being relied on and the last MUST be one issued by the room itself. Every link the presenter relies on is present, because the host will not fetch one. Capped at 8: verification is linear in chain length and runs on every operation, so an unbounded chain is a denial-of-service surface against the host. The known uses need 2 to 3 — a person attenuating to an agent, and that agent to a sub-agent.";
+                };
+                readonly subjectBinding: {
+                    readonly type: "string";
+                    readonly description: "REQUIRED on a `private` room, where the subject identifier is withheld: a proof that the membership credential and the authority chain's leaf describe the SAME subject. Without it two parties pool credentials — one contributes membership, the other authority — and the combination verifies as a single party holding both. A host MUST refuse a private-room presentation that omits this.";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/rooms/revocations/get/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/rooms/revocations/get/0.1";
+        readonly title: "Rooms Revocations Get — payload";
+        readonly description: "An administrator of a room reads the revocation list its host holds and enforces for it.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["roomId", "presentation"];
+        readonly properties: {
+            readonly roomId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+                readonly description: "The room.";
+            };
+            readonly presentation: {
+                readonly $ref: "#/$defs/AuthorityPresentation";
+                readonly description: "Must confer the `admin` action at this room's scope. The list names withdrawn parties on `open` and `attributed` rooms, which is the room's administration and not a member's business.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Rooms Revocations Get — response payload";
+                readonly description: "Success response to rooms/revocations/get. Type https://trusttasks.org/spec/rooms/revocations/get/0.1#response. The list the host holds, exactly as the room signed it, or nothing when it holds none.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["roomId"];
+                readonly properties: {
+                    readonly roomId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                    };
+                    readonly list: {
+                        readonly $ref: "#/$defs/RevocationList";
+                        readonly description: "The list the host holds, as the room signed it. Absent when the host holds none. A reader MUST verify it as a host does — the room's own key, this room — before relying on it, and MUST NOT adopt it in place of a list it holds at a higher sequence.";
+                    };
+                    readonly inForceAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the host began enforcing `list`. Present with it.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RevocationList: {
+                readonly title: "RevocationList";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["roomId", "sequence", "issuedAt", "entries", "proof"];
+                readonly description: "The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.\n\n**Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.\n\n**Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.\n\n**Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.\n\n**Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.\n\n**Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.";
+                readonly properties: {
+                    readonly roomId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                        readonly description: "The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room.";
+                    };
+                    readonly sequence: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back.";
+                    };
+                    readonly issuedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room signed this list.";
+                    };
+                    readonly entries: {
+                        readonly type: "array";
+                        readonly maxItems: 4096;
+                        readonly items: {
+                            readonly $ref: "#/$defs/RevocationEntry";
+                        };
+                        readonly description: "Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence.";
+                    };
+                    readonly proof: {
+                        readonly type: "object";
+                        readonly description: "The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`.";
+                    };
+                };
+            };
+            readonly RevocationEntry: {
+                readonly title: "RevocationEntry";
+                readonly description: "One withdrawal in a `RevocationList`, discriminated by `kind`.\n\n  - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.\n  - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.\n  - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.\n\n**Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.\n\n**Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CredentialRevocation";
+                }, {
+                    readonly $ref: "#/$defs/SubjectRevocation";
+                }, {
+                    readonly $ref: "#/$defs/RoomRevocation";
+                }];
+            };
+            readonly RoomRevocation: {
+                readonly title: "RoomRevocation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "revokedAt"];
+                readonly description: "Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.";
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "room";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room made this withdrawal.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                    };
+                };
+            };
+            readonly SubjectRevocation: {
+                readonly title: "SubjectRevocation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "subject", "revokedAt"];
+                readonly description: "Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.";
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "subject";
+                    };
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                        readonly description: "The party withdrawn. Never the room itself.";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room made this withdrawal.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                    };
+                };
+            };
+            readonly CredentialRevocation: {
+                readonly title: "CredentialRevocation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "credentialId", "revokedAt"];
+                readonly description: "Withdraws one credential — a membership credential or any authority link — by its `id`.";
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "credential";
+                    };
+                    readonly credentialId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it.";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room made this withdrawal.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                    };
+                };
+            };
+            readonly AuthorityPresentation: {
+                readonly title: "AuthorityPresentation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["membership", "authority"];
+                readonly description: "What a party presents to act on a room. Carries the whole authority chain: a host MUST NOT dereference an authority credential's `parent` to fetch a link it was not given. Resolving over the network would make verification depend on availability, turn every identifier into a request the host can be induced to make against an address the holder chooses, and signal credential use to whoever hosts the identifier. A host MUST bind the presenter to the chain's leaf. A chain that verifies is evidence that authority was conferred on somebody; it is not evidence that the party presenting it is that somebody. The leaf's subject MUST equal the party the host authenticated for this request — an identity the transport established or a document `proof` proved, never one named in a payload. A host that omits this check authorizes every captured presentation, and the omission is silent, because the chain still verifies.\n\n**Every credential is its issuer's attestation, and only its issuer's.** For the membership credential and for every link of `authority`, a host MUST verify the credential's `proof` with a key that the credential's own `issuer` lists for `assertionMethod` in its DID document, and MUST refuse a credential whose proof names a verification method that is not its issuer's. A proof that verifies under some other party's key is that party's statement, not the issuer's, and confers nothing. The same binding holds for every other document a room signs, such as a `RevocationList`.\n\n**A chain that verifies may still be revoked.** A host that has accepted a `RevocationList` for the room (`rooms/revocations/put`) MUST, from the moment it accepted it, refuse every presentation in which the membership credential or any link of `authority` is revoked by that list, under every task and every version of every task it serves for the room. A chain from which any link is revoked is refused whole: a credential delegated from a revoked one confers nothing, however it was attenuated. The refusal is the same `permissionDenied` as any other failed presentation.";
+                readonly properties: {
+                    readonly membership: {
+                        readonly type: "string";
+                        readonly description: "The presenter's membership credential for this room, or — on a `private` room — a zero-knowledge presentation of it. Serialized per the governing profile.";
+                    };
+                    readonly authority: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 8;
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "The authority chain, LEAF FIRST: the first element is the credential being relied on and the last MUST be one issued by the room itself. Every link the presenter relies on is present, because the host will not fetch one. Capped at 8: verification is linear in chain length and runs on every operation, so an unbounded chain is a denial-of-service surface against the host. The known uses need 2 to 3 — a person attenuating to an agent, and that agent to a sub-agent.";
+                    };
+                    readonly subjectBinding: {
+                        readonly type: "string";
+                        readonly description: "REQUIRED on a `private` room, where the subject identifier is withheld: a proof that the membership credential and the authority chain's leaf describe the SAME subject. Without it two parties pool credentials — one contributes membership, the other authority — and the combination verifies as a single party holding both. A host MUST refuse a private-room presentation that omits this.";
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/rooms/revocations/get/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Rooms Revocations Get — response payload";
+                readonly description: "Success response to rooms/revocations/get. Type https://trusttasks.org/spec/rooms/revocations/get/0.1#response. The list the host holds, exactly as the room signed it, or nothing when it holds none.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["roomId"];
+                readonly properties: {
+                    readonly roomId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                    };
+                    readonly list: {
+                        readonly $ref: "#/$defs/RevocationList";
+                        readonly description: "The list the host holds, as the room signed it. Absent when the host holds none. A reader MUST verify it as a host does — the room's own key, this room — before relying on it, and MUST NOT adopt it in place of a list it holds at a higher sequence.";
+                    };
+                    readonly inForceAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the host began enforcing `list`. Present with it.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RevocationList: {
+                readonly title: "RevocationList";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["roomId", "sequence", "issuedAt", "entries", "proof"];
+                readonly description: "The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.\n\n**Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.\n\n**Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.\n\n**Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.\n\n**Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.\n\n**Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.";
+                readonly properties: {
+                    readonly roomId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                        readonly description: "The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room.";
+                    };
+                    readonly sequence: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back.";
+                    };
+                    readonly issuedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room signed this list.";
+                    };
+                    readonly entries: {
+                        readonly type: "array";
+                        readonly maxItems: 4096;
+                        readonly items: {
+                            readonly $ref: "#/$defs/RevocationEntry";
+                        };
+                        readonly description: "Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence.";
+                    };
+                    readonly proof: {
+                        readonly type: "object";
+                        readonly description: "The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`.";
+                    };
+                };
+            };
+            readonly RevocationEntry: {
+                readonly title: "RevocationEntry";
+                readonly description: "One withdrawal in a `RevocationList`, discriminated by `kind`.\n\n  - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.\n  - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.\n  - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.\n\n**Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.\n\n**Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CredentialRevocation";
+                }, {
+                    readonly $ref: "#/$defs/SubjectRevocation";
+                }, {
+                    readonly $ref: "#/$defs/RoomRevocation";
+                }];
+            };
+            readonly RoomRevocation: {
+                readonly title: "RoomRevocation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "revokedAt"];
+                readonly description: "Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.";
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "room";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room made this withdrawal.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                    };
+                };
+            };
+            readonly SubjectRevocation: {
+                readonly title: "SubjectRevocation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "subject", "revokedAt"];
+                readonly description: "Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.";
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "subject";
+                    };
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                        readonly description: "The party withdrawn. Never the room itself.";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room made this withdrawal.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                    };
+                };
+            };
+            readonly CredentialRevocation: {
+                readonly title: "CredentialRevocation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "credentialId", "revokedAt"];
+                readonly description: "Withdraws one credential — a membership credential or any authority link — by its `id`.";
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "credential";
+                    };
+                    readonly credentialId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it.";
+                    };
+                    readonly revokedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the room made this withdrawal.";
+                    };
+                    readonly until: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list.";
+                    };
+                };
+            };
+            readonly AuthorityPresentation: {
+                readonly title: "AuthorityPresentation";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["membership", "authority"];
+                readonly description: "What a party presents to act on a room. Carries the whole authority chain: a host MUST NOT dereference an authority credential's `parent` to fetch a link it was not given. Resolving over the network would make verification depend on availability, turn every identifier into a request the host can be induced to make against an address the holder chooses, and signal credential use to whoever hosts the identifier. A host MUST bind the presenter to the chain's leaf. A chain that verifies is evidence that authority was conferred on somebody; it is not evidence that the party presenting it is that somebody. The leaf's subject MUST equal the party the host authenticated for this request — an identity the transport established or a document `proof` proved, never one named in a payload. A host that omits this check authorizes every captured presentation, and the omission is silent, because the chain still verifies.\n\n**Every credential is its issuer's attestation, and only its issuer's.** For the membership credential and for every link of `authority`, a host MUST verify the credential's `proof` with a key that the credential's own `issuer` lists for `assertionMethod` in its DID document, and MUST refuse a credential whose proof names a verification method that is not its issuer's. A proof that verifies under some other party's key is that party's statement, not the issuer's, and confers nothing. The same binding holds for every other document a room signs, such as a `RevocationList`.\n\n**A chain that verifies may still be revoked.** A host that has accepted a `RevocationList` for the room (`rooms/revocations/put`) MUST, from the moment it accepted it, refuse every presentation in which the membership credential or any link of `authority` is revoked by that list, under every task and every version of every task it serves for the room. A chain from which any link is revoked is refused whole: a credential delegated from a revoked one confers nothing, however it was attenuated. The refusal is the same `permissionDenied` as any other failed presentation.";
+                readonly properties: {
+                    readonly membership: {
+                        readonly type: "string";
+                        readonly description: "The presenter's membership credential for this room, or — on a `private` room — a zero-knowledge presentation of it. Serialized per the governing profile.";
+                    };
+                    readonly authority: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 8;
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "The authority chain, LEAF FIRST: the first element is the credential being relied on and the last MUST be one issued by the room itself. Every link the presenter relies on is present, because the host will not fetch one. Capped at 8: verification is linear in chain length and runs on every operation, so an unbounded chain is a denial-of-service surface against the host. The known uses need 2 to 3 — a person attenuating to an agent, and that agent to a sub-agent.";
+                    };
+                    readonly subjectBinding: {
+                        readonly type: "string";
+                        readonly description: "REQUIRED on a `private` room, where the subject identifier is withheld: a proof that the membership credential and the authority chain's leaf describe the SAME subject. Without it two parties pool credentials — one contributes membership, the other authority — and the combination verifies as a single party holding both. A host MUST refuse a private-room presentation that omits this.";
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map