@openvtc/trust-tasks 0.26.14 → 0.26.16

package/src/rooms/owner/revoke/0.1/payload.ts

@@ -0,0 +1,954 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/rooms/owner/revoke/0.1/payload.schema.json
+ */
+
+import type { CredentialRevocation, DigestMultibase, Ext, RevocationEntry, RevocationHead, RevocationList, RoomRevocation, SubjectRevocation } from "../../../../_shared/components.js";
+
+
+/**
+ * One withdrawal to add, discriminated by `kind` as a RevocationEntry is. It carries no `revokedAt`: the recipient stamps the time it signs, so that a subject or room entry withdraws exactly what the room had issued until then and nothing the caller dated.
+ */
+export type Withdrawal = WithdrawCredential | WithdrawSubject | WithdrawRoom;
+
+/**
+ * A room's owner asks their own agent to withdraw credentials the room issued: sign the room's next revocation list as the room, keep it, and deliver it to each host serving the room.
+ */
+export interface RoomsOwnerRevokePayload {
+  /**
+   * The room whose credentials are withdrawn. The recipient signs as this room.
+   */
+  roomId: string;
+  /**
+   * Which held key signs as the room — named explicitly, as for rooms/owner/issue-authority, because nothing maps a DID to the key it was minted with. A key that is not one the room's DID document lists for `assertionMethod` produces a list every host refuses.
+   */
+  signingKeyId: string;
+  /**
+   * Every host serving the room, as DIDs: its primary, any mirror, and a host it is moving to. A withdrawal binds only the hosts that hold it, so a host left off this list honours what the room withdrew.
+   *
+   * @minItems 1
+   * @maxItems 8
+   */
+  hosts:
+    | [string]
+    | [string, string]
+    | [string, string, string]
+    | [string, string, string, string]
+    | [string, string, string, string, string]
+    | [string, string, string, string, string, string]
+    | [string, string, string, string, string, string, string]
+    | [string, string, string, string, string, string, string, string];
+  /**
+   * What to withdraw now. Absent or empty: sign nothing new, and deliver the list the recipient holds — how a host the room has moved to, or one that missed a delivery, is brought up to date.
+   *
+   * @maxItems 64
+   */
+  withdraw?: Withdrawal[];
+  /**
+   * Why, for the owner's own record. Never put into the list, which reaches every host: it MUST NOT carry personal data or a credential.
+   */
+  reason?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+export interface WithdrawCredential {
+  kind: "credential";
+  /**
+   * The `id` of the credential withdrawn.
+   */
+  credentialId: string;
+  /**
+   * OPTIONAL. The credential's own `validUntil`, after which the entry can be dropped.
+   */
+  until?: string;
+}
+export interface WithdrawSubject {
+  kind: "subject";
+  /**
+   * The party withdrawn: every credential naming them as subject or issuer that the room's chain gave them before now. Never the room.
+   */
+  subject: string;
+  /**
+   * OPTIONAL. When the last credential the room issued them expires, after which the entry can be dropped.
+   */
+  until?: string;
+}
+export interface WithdrawRoom {
+  kind: "room";
+  /**
+   * OPTIONAL. When the last credential the room issued before now expires.
+   */
+  until?: string;
+}
+/**
+ * Success response to rooms/owner/revoke. Type https://trusttasks.org/spec/rooms/owner/revoke/0.1#response. The list the recipient now holds for the room, and what each host did with it. A success says the list was signed and kept; only a delivery whose outcome is `accepted` says a host enforces it.
+ */
+export interface RoomsOwnerRevokeResponsePayload {
+  roomId: string;
+  /**
+   * The room's current list, as signed. Returned so the owner holds a copy that does not depend on the recipient.
+   */
+  list: RevocationList;
+  head: RevocationHead;
+  /**
+   * One per host in the request, in its order.
+   *
+   * @minItems 1
+   * @maxItems 8
+   */
+  deliveries:
+    | [Delivery]
+    | [Delivery, Delivery]
+    | [Delivery, Delivery, Delivery]
+    | [Delivery, Delivery, Delivery, Delivery]
+    | [Delivery, Delivery, Delivery, Delivery, Delivery]
+    | [Delivery, Delivery, Delivery, Delivery, Delivery, Delivery]
+    | [Delivery, Delivery, Delivery, Delivery, Delivery, Delivery, Delivery]
+    | [Delivery, Delivery, Delivery, Delivery, Delivery, Delivery, Delivery, Delivery];
+  ext?: Ext;
+}
+/**
+ * What one host did with the list.
+ */
+export interface Delivery {
+  host: string;
+  /**
+   * `accepted`: the host holds this list, or answered it as a repeat, and enforces it from `inForceAt`. `refused`: it answered and declined; its code is in `code`. `unreachable`: no answer, so the outcome is unknown — repeat the request with no `withdraw` to deliver again.
+   */
+  outcome: "accepted" | "refused" | "unreachable";
+  /**
+   * The head the host answered with. Present when `accepted`.
+   */
+  head?: RevocationHead;
+  /**
+   * When the host began enforcing the list. Present when `accepted`.
+   */
+  inForceAt?: string;
+  /**
+   * The host's error code. Present when `refused`.
+   */
+  code?: string;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { CredentialRevocation, DigestMultibase, Ext, RevocationEntry, RevocationHead, RevocationList, RoomRevocation, SubjectRevocation };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/rooms/owner/revoke/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = RoomsOwnerRevokePayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/rooms/owner/revoke/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = RoomsOwnerRevokeResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/rooms/owner/revoke/0.1",
+  "title": "Rooms Owner Revoke — payload",
+  "description": "A room's owner asks their own agent to withdraw credentials the room issued: sign the room's next revocation list as the room, keep it, and deliver it to each host serving the room.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "roomId",
+    "signingKeyId",
+    "hosts"
+  ],
+  "properties": {
+    "roomId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512,
+      "description": "The room whose credentials are withdrawn. The recipient signs as this room."
+    },
+    "signingKeyId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "Which held key signs as the room — named explicitly, as for rooms/owner/issue-authority, because nothing maps a DID to the key it was minted with. A key that is not one the room's DID document lists for `assertionMethod` produces a list every host refuses."
+    },
+    "hosts": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 8,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^did:",
+        "maxLength": 2048
+      },
+      "description": "Every host serving the room, as DIDs: its primary, any mirror, and a host it is moving to. A withdrawal binds only the hosts that hold it, so a host left off this list honours what the room withdrew."
+    },
+    "withdraw": {
+      "type": "array",
+      "maxItems": 64,
+      "items": {
+        "$ref": "#/$defs/Withdrawal"
+      },
+      "description": "What to withdraw now. Absent or empty: sign nothing new, and deliver the list the recipient holds — how a host the room has moved to, or one that missed a delivery, is brought up to date."
+    },
+    "reason": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 500,
+      "description": "Why, for the owner's own record. Never put into the list, which reaches every host: it MUST NOT carry personal data or a credential."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "Withdrawal": {
+      "title": "Withdrawal",
+      "description": "One withdrawal to add, discriminated by `kind` as a RevocationEntry is. It carries no `revokedAt`: the recipient stamps the time it signs, so that a subject or room entry withdraws exactly what the room had issued until then and nothing the caller dated.",
+      "oneOf": [
+        {
+          "$ref": "#/$defs/WithdrawCredential"
+        },
+        {
+          "$ref": "#/$defs/WithdrawSubject"
+        },
+        {
+          "$ref": "#/$defs/WithdrawRoom"
+        }
+      ]
+    },
+    "WithdrawCredential": {
+      "title": "WithdrawCredential",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "credentialId"
+      ],
+      "properties": {
+        "kind": {
+          "const": "credential"
+        },
+        "credentialId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048,
+          "description": "The `id` of the credential withdrawn."
+        },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL. The credential's own `validUntil`, after which the entry can be dropped."
+        }
+      }
+    },
+    "WithdrawSubject": {
+      "title": "WithdrawSubject",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "subject"
+      ],
+      "properties": {
+        "kind": {
+          "const": "subject"
+        },
+        "subject": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "The party withdrawn: every credential naming them as subject or issuer that the room's chain gave them before now. Never the room."
+        },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL. When the last credential the room issued them expires, after which the entry can be dropped."
+        }
+      }
+    },
+    "WithdrawRoom": {
+      "title": "WithdrawRoom",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind"
+      ],
+      "properties": {
+        "kind": {
+          "const": "room"
+        },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL. When the last credential the room issued before now expires."
+        }
+      }
+    },
+    "Delivery": {
+      "title": "Delivery",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "host",
+        "outcome"
+      ],
+      "description": "What one host did with the list.",
+      "properties": {
+        "host": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048
+        },
+        "outcome": {
+          "type": "string",
+          "enum": [
+            "accepted",
+            "refused",
+            "unreachable"
+          ],
+          "description": "`accepted`: the host holds this list, or answered it as a repeat, and enforces it from `inForceAt`. `refused`: it answered and declined; its code is in `code`. `unreachable`: no answer, so the outcome is unknown — repeat the request with no `withdraw` to deliver again."
+        },
+        "head": {
+          "$ref": "#/$defs/RevocationHead",
+          "description": "The head the host answered with. Present when `accepted`."
+        },
+        "inForceAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the host began enforcing the list. Present when `accepted`."
+        },
+        "code": {
+          "type": "string",
+          "maxLength": 128,
+          "description": "The host's error code. Present when `refused`."
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "Rooms Owner Revoke — response payload",
+      "description": "Success response to rooms/owner/revoke. Type https://trusttasks.org/spec/rooms/owner/revoke/0.1#response. The list the recipient now holds for the room, and what each host did with it. A success says the list was signed and kept; only a delivery whose outcome is `accepted` says a host enforces it.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "roomId",
+        "list",
+        "head",
+        "deliveries"
+      ],
+      "properties": {
+        "roomId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "list": {
+          "$ref": "#/$defs/RevocationList",
+          "description": "The room's current list, as signed. Returned so the owner holds a copy that does not depend on the recipient."
+        },
+        "head": {
+          "$ref": "#/$defs/RevocationHead"
+        },
+        "deliveries": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 8,
+          "items": {
+            "$ref": "#/$defs/Delivery"
+          },
+          "description": "One per host in the request, in its order."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "RevocationHead": {
+      "title": "RevocationHead",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "sequence",
+        "digest"
+      ],
+      "description": "Which `RevocationList` a party holds, without its entries: comparable between the room's key holder and a host, and between two hosts, without disclosing whom the room withdrew.",
+      "properties": {
+        "sequence": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The list's `sequence`."
+        },
+        "digest": {
+          "$ref": "#/$defs/DigestMultibase",
+          "description": "SHA-256 multihash of the list's RFC 8785 (JCS) canonicalization, `proof` included. Two parties holding one sequence with different digests have been given two lists the room signed at one sequence."
+        }
+      }
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    },
+    "RevocationList": {
+      "title": "RevocationList",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "roomId",
+        "sequence",
+        "issuedAt",
+        "entries",
+        "proof"
+      ],
+      "description": "The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.\n\n**Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.\n\n**Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.\n\n**Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.\n\n**Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.\n\n**Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.",
+      "properties": {
+        "roomId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room."
+        },
+        "sequence": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back."
+        },
+        "issuedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the room signed this list."
+        },
+        "entries": {
+          "type": "array",
+          "maxItems": 4096,
+          "items": {
+            "$ref": "#/$defs/RevocationEntry"
+          },
+          "description": "Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence."
+        },
+        "proof": {
+          "type": "object",
+          "description": "The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`."
+        }
+      }
+    },
+    "RevocationEntry": {
+      "title": "RevocationEntry",
+      "description": "One withdrawal in a `RevocationList`, discriminated by `kind`.\n\n  - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.\n  - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.\n  - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.\n\n**Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.\n\n**Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.",
+      "oneOf": [
+        {
+          "$ref": "#/$defs/CredentialRevocation"
+        },
+        {
+          "$ref": "#/$defs/SubjectRevocation"
+        },
+        {
+          "$ref": "#/$defs/RoomRevocation"
+        }
+      ]
+    },
+    "RoomRevocation": {
+      "title": "RoomRevocation",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "revokedAt"
+      ],
+      "description": "Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.",
+      "properties": {
+        "kind": {
+          "const": "room"
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the room made this withdrawal."
+        },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list."
+        }
+      }
+    },
+    "SubjectRevocation": {
+      "title": "SubjectRevocation",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "subject",
+        "revokedAt"
+      ],
+      "description": "Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.",
+      "properties": {
+        "kind": {
+          "const": "subject"
+        },
+        "subject": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "The party withdrawn. Never the room itself."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the room made this withdrawal."
+        },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list."
+        }
+      }
+    },
+    "CredentialRevocation": {
+      "title": "CredentialRevocation",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "credentialId",
+        "revokedAt"
+      ],
+      "description": "Withdraws one credential — a membership credential or any authority link — by its `id`.",
+      "properties": {
+        "kind": {
+          "const": "credential"
+        },
+        "credentialId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048,
+          "description": "The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the room made this withdrawal."
+        },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list."
+        }
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Withdrawal": {
+      "title": "Withdrawal",
+      "description": "One withdrawal to add, discriminated by `kind` as a RevocationEntry is. It carries no `revokedAt`: the recipient stamps the time it signs, so that a subject or room entry withdraws exactly what the room had issued until then and nothing the caller dated.",
+      "oneOf": [
+        {
+          "$ref": "#/$defs/WithdrawCredential"
+        },
+        {
+          "$ref": "#/$defs/WithdrawSubject"
+        },
+        {
+          "$ref": "#/$defs/WithdrawRoom"
+        }
+      ]
+    },
+    "WithdrawCredential": {
+      "title": "WithdrawCredential",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "credentialId"
+      ],
+      "properties": {
+        "kind": {
+          "const": "credential"
+        },
+        "credentialId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048,
+          "description": "The `id` of the credential withdrawn."
+        },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL. The credential's own `validUntil`, after which the entry can be dropped."
+        }
+      }
+    },
+    "WithdrawSubject": {
+      "title": "WithdrawSubject",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "subject"
+      ],
+      "properties": {
+        "kind": {
+          "const": "subject"
+        },
+        "subject": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "The party withdrawn: every credential naming them as subject or issuer that the room's chain gave them before now. Never the room."
+        },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL. When the last credential the room issued them expires, after which the entry can be dropped."
+        }
+      }
+    },
+    "WithdrawRoom": {
+      "title": "WithdrawRoom",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind"
+      ],
+      "properties": {
+        "kind": {
+          "const": "room"
+        },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL. When the last credential the room issued before now expires."
+        }
+      }
+    },
+    "Delivery": {
+      "title": "Delivery",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "host",
+        "outcome"
+      ],
+      "description": "What one host did with the list.",
+      "properties": {
+        "host": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048
+        },
+        "outcome": {
+          "type": "string",
+          "enum": [
+            "accepted",
+            "refused",
+            "unreachable"
+          ],
+          "description": "`accepted`: the host holds this list, or answered it as a repeat, and enforces it from `inForceAt`. `refused`: it answered and declined; its code is in `code`. `unreachable`: no answer, so the outcome is unknown — repeat the request with no `withdraw` to deliver again."
+        },
+        "head": {
+          "$ref": "#/$defs/RevocationHead",
+          "description": "The head the host answered with. Present when `accepted`."
+        },
+        "inForceAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the host began enforcing the list. Present when `accepted`."
+        },
+        "code": {
+          "type": "string",
+          "maxLength": 128,
+          "description": "The host's error code. Present when `refused`."
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "Rooms Owner Revoke — response payload",
+      "description": "Success response to rooms/owner/revoke. Type https://trusttasks.org/spec/rooms/owner/revoke/0.1#response. The list the recipient now holds for the room, and what each host did with it. A success says the list was signed and kept; only a delivery whose outcome is `accepted` says a host enforces it.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "roomId",
+        "list",
+        "head",
+        "deliveries"
+      ],
+      "properties": {
+        "roomId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "list": {
+          "$ref": "#/$defs/RevocationList",
+          "description": "The room's current list, as signed. Returned so the owner holds a copy that does not depend on the recipient."
+        },
+        "head": {
+          "$ref": "#/$defs/RevocationHead"
+        },
+        "deliveries": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 8,
+          "items": {
+            "$ref": "#/$defs/Delivery"
+          },
+          "description": "One per host in the request, in its order."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "RevocationHead": {
+      "title": "RevocationHead",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "sequence",
+        "digest"
+      ],
+      "description": "Which `RevocationList` a party holds, without its entries: comparable between the room's key holder and a host, and between two hosts, without disclosing whom the room withdrew.",
+      "properties": {
+        "sequence": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The list's `sequence`."
+        },
+        "digest": {
+          "$ref": "#/$defs/DigestMultibase",
+          "description": "SHA-256 multihash of the list's RFC 8785 (JCS) canonicalization, `proof` included. Two parties holding one sequence with different digests have been given two lists the room signed at one sequence."
+        }
+      }
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    },
+    "RevocationList": {
+      "title": "RevocationList",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "roomId",
+        "sequence",
+        "issuedAt",
+        "entries",
+        "proof"
+      ],
+      "description": "The room's own statement of which credentials it has withdrawn before they expire — signed by the room, cumulative, and numbered, so that it means the same thing at every host it is delivered to.\n\n**Why the room signs it, and why it is cumulative.** A host authorizes from credentials the room issued and keeps no roster; a withdrawal kept only as a host's own state would make the room unmovable and the host part of the membership. A list the room signed is room state: it moves with the room, any host it is delivered to reaches the same decision, and nothing a host invents can be mistaken for it. It is cumulative — every list carries every entry still in force — so a host holding any one list holds the room's whole withdrawal state, and a host that missed a list loses nothing once it receives a later one.\n\n**Producing.** The room's key holder builds the object without `proof` and signs it with a W3C Data Integrity proof whose `verificationMethod` is a key the room's DID document lists for `assertionMethod` and whose `proofPurpose` is `assertionMethod`. A producer MUST support `eddsa-jcs-2022`. Each list's `sequence` is exactly one greater than the last list the room signed, and the producer MUST NOT sign two different lists at one `sequence`.\n\n**Accepting.** A host MUST refuse a list unless: (1) `roomId` is the room it is delivered for; (2) `proof` verifies with a key of `roomId` listed for `assertionMethod` — a list signed by any other key, however valid the signature, is not the room's; (3) `sequence` is greater than that of the list it holds, or equal with an identical list (a repeat, answered as accepted and changing nothing); (4) it is **append-only** against the list it holds: every entry of the held list appears in it unchanged, unless that entry's `until` has passed. A list that lowers the sequence is a rollback and one that drops a live entry is a reinstatement nobody signed for, and both are refused; two different lists at one `sequence` is the room's key equivocating, and the host keeps the list it holds.\n\n**Applying.** A credential is revoked by an accepted list when any entry matches it (see `RevocationEntry`). An entry whose `until` has passed MAY be discarded by a host and omitted from later lists; no other entry is ever dropped.\n\n**Size.** A list is bounded at 4096 entries. A room that would exceed it uses a `room` entry, which withdraws everything issued before it and lets the room re-issue to those who remain.",
+      "properties": {
+        "roomId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "The room whose credentials this list withdraws, exactly as on the wire. Signed, so a list cannot be replayed against another room."
+        },
+        "sequence": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The list's position in the room's sequence: exactly one greater than the last list the room signed. A host accepts only a list whose sequence is above the one it holds, which is what stops a host, a relayer or an attacker holding an old list from rolling the room's withdrawals back."
+        },
+        "issuedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the room signed this list."
+        },
+        "entries": {
+          "type": "array",
+          "maxItems": 4096,
+          "items": {
+            "$ref": "#/$defs/RevocationEntry"
+          },
+          "description": "Every withdrawal still in force, in the order the room made them. Empty is valid: a room that has revoked nothing, or whose every entry has lapsed, can still state its sequence."
+        },
+        "proof": {
+          "type": "object",
+          "description": "The room's Data Integrity proof over every other member, made with a key the room's DID document lists for `assertionMethod`."
+        }
+      }
+    },
+    "RevocationEntry": {
+      "title": "RevocationEntry",
+      "description": "One withdrawal in a `RevocationList`, discriminated by `kind`.\n\n  - `credential` withdraws one credential, named by its `id`. It matches the membership credential or any authority link whose `id` equals `credentialId`.\n  - `subject` withdraws a party: every credential the room's chain gave them **before** `revokedAt`. It matches the membership credential or any authority link whose `credentialSubject` id **or** `issuer` is `subject` and whose `validFrom` is earlier than `revokedAt`. Matching the issuer as well as the subject withdraws what the party delegated before their removal, which no re-admission revives. A credential carrying no `validFrom` is treated as issued before every entry.\n  - `room` withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it. It is how a room resets access — after a compromise, or on a `private` room, where naming a party would disclose who was a member.\n\n**Keyed on time, so a party can come back.** A `subject` or `room` entry withdraws what was issued before it and nothing after, so a room that re-admits a removed party issues fresh credentials and they verify. A `credential` entry is permanent for that one credential, which nobody re-issues.\n\n**Tiers.** On a `private` room a host MUST refuse a list carrying a `credential` or `subject` entry: a presentation there withholds the credential and its subject, so such an entry is one the host cannot apply and a disclosure of who was in the room. Only `room` entries are permitted, and a host serving a `private` room MUST refuse any presentation for which it cannot establish that no credential in it has a `validFrom` earlier than the latest `room` entry's `revokedAt`.",
+      "oneOf": [
+        {
+          "$ref": "#/$defs/CredentialRevocation"
+        },
+        {
+          "$ref": "#/$defs/SubjectRevocation"
+        },
+        {
+          "$ref": "#/$defs/RoomRevocation"
+        }
+      ]
+    },
+    "RoomRevocation": {
+      "title": "RoomRevocation",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "revokedAt"
+      ],
+      "description": "Withdraws every credential whose `validFrom` is earlier than `revokedAt`, whoever holds it.",
+      "properties": {
+        "kind": {
+          "const": "room"
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the room made this withdrawal."
+        },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list."
+        }
+      }
+    },
+    "SubjectRevocation": {
+      "title": "SubjectRevocation",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "subject",
+        "revokedAt"
+      ],
+      "description": "Withdraws a party: every credential naming them as subject or issuer whose `validFrom` is earlier than `revokedAt`.",
+      "properties": {
+        "kind": {
+          "const": "subject"
+        },
+        "subject": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "The party withdrawn. Never the room itself."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the room made this withdrawal."
+        },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list."
+        }
+      }
+    },
+    "CredentialRevocation": {
+      "title": "CredentialRevocation",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "credentialId",
+        "revokedAt"
+      ],
+      "description": "Withdraws one credential — a membership credential or any authority link — by its `id`.",
+      "properties": {
+        "kind": {
+          "const": "credential"
+        },
+        "credentialId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048,
+          "description": "The `id` of the credential withdrawn, as `rooms/owner/issue-authority` and `rooms/owner/issue-membership` return it, or as an attenuated credential carries it."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the room made this withdrawal."
+        },
+        "until": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL. After this instant every credential the entry matches has expired anyway, so a host MAY discard the entry and the room MAY omit it from later lists. Absent means the entry is kept for as long as the room keeps a list."
+        }
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;