@openvtc/trust-tasks 0.27.0 → 0.27.2

package/dist/rooms/create/0.2/payload.d.ts

@@ -0,0 +1,534 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/rooms/create/0.2/payload.schema.json
+ */
+import type { AnchorCadence, Ext, RecordRetention, RetentionPolicy, Visibility } from "../../../_shared/components.js";
+/**
+ * An owner registers a data room with a host. 0.2 adds `recordRetention`: how long the room keeps its records by age, stated at creation so that no record is ever removed under a rule its readers could not have read.
+ */
+export interface RoomsCreatePayload {
+    /**
+     * The room's identifier, minted by its owner before this call. A host is told the identifier; it does not assign one, because a room whose identity the host chose could not move to another host.
+     */
+    roomId: string;
+    visibility: Visibility;
+    /**
+     * The room's accountable party: the controller of the room's identifier, the issuer of every credential in it, and the party a host addresses about quota, abuse, or lifecycle. Visible at every visibility, including `private` — a room has someone answerable for it.
+     */
+    ownerDid: string;
+    /**
+     * Whether this room keeps its history readable across a membership change. Absent means `chained`, which is the choice a room wants unless it has a reason not to: joining a room should mean being able to read it. A host MUST reject an epoch link for a room whose policy is `fromJoin` rather than storing one it declared it would not have.
+     */
+    retentionPolicy?: RetentionPolicy;
+    /**
+     * How long the host will hold the room after its epoch lapses without renewal, before storage may be reclaimed. Stated at creation rather than discovered: reclamation that surprises a member is a failure of the design, not of the member.
+     */
+    retentionDays?: number;
+    /**
+     * What this room intends about anchoring. OPTIONAL; absent reads as `manual`, which draws no expectation and is the honest default for a room whose owner has not decided. A host stores it and serves it back — it constrains nothing the host does.
+     */
+    anchorCadence?: AnchorCadence;
+    /**
+     * How long the room keeps its records, by age: which records `rooms/records/prune` may remove. OPTIONAL; absent means no record is ever eligible by age. Unlike `retentionPolicy` it is not fixed: a holder of `admin` changes it with `rooms/records/retention/set`.
+     */
+    recordRetention?: RecordRetention;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * Success response to rooms/create. Type https://trusttasks.org/spec/rooms/create/0.2#response.
+ */
+export interface RoomsCreateResponsePayload {
+    roomId: string;
+    /**
+     * Always 1 for a new room.
+     */
+    epoch: number;
+    /**
+     * Echoed so a caller knows what was recorded rather than what was asked — the two differ on a host that predates this member.
+     */
+    anchorCadence?: AnchorCadence;
+    /**
+     * The record retention the host recorded, echoed for the same reason `anchorCadence` is: a caller learns what is in force rather than what it asked for. Absent when none was recorded.
+     */
+    recordRetention?: RecordRetention;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AnchorCadence, Ext, RecordRetention, RetentionPolicy, Visibility };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/rooms/create/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = RoomsCreatePayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/rooms/create/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = RoomsCreateResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/rooms/create/0.2";
+    readonly title: "Rooms Create — payload";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["roomId", "visibility", "ownerDid"];
+    readonly properties: {
+        readonly roomId: {
+            readonly type: "string";
+            readonly description: "The room's identifier, minted by its owner before this call. A host is told the identifier; it does not assign one, because a room whose identity the host chose could not move to another host.";
+        };
+        readonly visibility: {
+            readonly $ref: "#/$defs/Visibility";
+        };
+        readonly ownerDid: {
+            readonly type: "string";
+            readonly description: "The room's accountable party: the controller of the room's identifier, the issuer of every credential in it, and the party a host addresses about quota, abuse, or lifecycle. Visible at every visibility, including `private` — a room has someone answerable for it.";
+        };
+        readonly retentionPolicy: {
+            readonly $ref: "#/$defs/RetentionPolicy";
+            readonly description: "Whether this room keeps its history readable across a membership change. Absent means `chained`, which is the choice a room wants unless it has a reason not to: joining a room should mean being able to read it. A host MUST reject an epoch link for a room whose policy is `fromJoin` rather than storing one it declared it would not have.";
+        };
+        readonly retentionDays: {
+            readonly type: "integer";
+            readonly minimum: 1;
+            readonly description: "How long the host will hold the room after its epoch lapses without renewal, before storage may be reclaimed. Stated at creation rather than discovered: reclamation that surprises a member is a failure of the design, not of the member.";
+        };
+        readonly anchorCadence: {
+            readonly $ref: "#/$defs/AnchorCadence";
+            readonly description: "What this room intends about anchoring. OPTIONAL; absent reads as `manual`, which draws no expectation and is the honest default for a room whose owner has not decided. A host stores it and serves it back — it constrains nothing the host does.";
+        };
+        readonly recordRetention: {
+            readonly $ref: "#/$defs/RecordRetention";
+            readonly description: "How long the room keeps its records, by age: which records `rooms/records/prune` may remove. OPTIONAL; absent means no record is ever eligible by age. Unlike `retentionPolicy` it is not fixed: a holder of `admin` changes it with `rooms/records/retention/set`.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Rooms Create — response payload";
+            readonly description: "Success response to rooms/create. Type https://trusttasks.org/spec/rooms/create/0.2#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["roomId", "epoch"];
+            readonly properties: {
+                readonly roomId: {
+                    readonly type: "string";
+                };
+                readonly epoch: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Always 1 for a new room.";
+                };
+                readonly anchorCadence: {
+                    readonly $ref: "#/$defs/AnchorCadence";
+                    readonly description: "Echoed so a caller knows what was recorded rather than what was asked — the two differ on a host that predates this member.";
+                };
+                readonly recordRetention: {
+                    readonly $ref: "#/$defs/RecordRetention";
+                    readonly description: "The record retention the host recorded, echoed for the same reason `anchorCadence` is: a caller learns what is in force rather than what it asked for. Absent when none was recorded.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RecordRetention: {
+            readonly title: "RecordRetention";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "How long a room keeps its records, by age: the room's **record retention**. Records older than it states become **eligible** to be removed by `rooms/records/prune`; nothing is removed until a holder of `admin` asks for a prune, and nothing a prune removes can be brought back.\n\n**Not `retentionPolicy`, and not `retentionDays`.** Both names are taken in this family and mean other things. `retentionPolicy` (`RetentionPolicy`) is whether a room's *key chain* lets a member read epochs from before they joined, fixed at creation because key material either exists for an epoch or it does not. `retentionDays` (`rooms/create`) is how long a host keeps a whole room after it lapses unrenewed. This is a third question — how long the room keeps its *records* while it is live — and unlike the first it is a decision a room revisits, so it is changeable (`rooms/records/retention/set`). A name sharing either's would invite a reader to apply one's rules to the other.\n\n**Age is the host's to measure, so age is `updatedAt`.** On the sealed tiers a host can read nothing of a record but its key, version, status, pinning and when it last changed, so a policy the host applies can only be stated in those terms. That is also why it cannot use a record's own `validUntil`, which is sealed: expiry is a reader's rule, retention a host's. A curation is a change, so it restarts a record's age — a retraction starts a tombstone's.\n\n**Absent, or `{}`, means no record is ever eligible by age**, and that is the reading a host MUST apply whenever it cannot read a policy: removing data under a rule nobody stated is the failure this member exists to prevent. Every member can read the policy in force (`rooms/info`), so a record is never removed under a rule its readers could not have known.";
+            readonly properties: {
+                readonly tombstoneDays: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 36500;
+                    readonly description: "Days a retracted record's tombstone is kept after its retraction. A tombstone whose `updatedAt` is more than this long ago is eligible. Tombstones exist so that a member syncing incrementally learns of a retraction (`rooms/records/curate`); this is how long a member may stay away and still learn of one that way rather than by rebuilding their copy of the room. Absent means tombstones are never eligible.";
+                };
+                readonly recordDays: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 36500;
+                    readonly description: "Days a record is kept after it last changed, whatever its standing. A record — `active`, `deprecated` or `retracted` — whose `updatedAt` is more than this long ago is eligible, **unless it is pinned**: pinning says what matters in the room, and a room that wants a pinned record gone unpins it first. Absent means records are never eligible by age.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. A host MUST NOT treat a member here as making more records eligible: a removal rule a member's reader cannot understand is one they were never told about.";
+                };
+            };
+        };
+        readonly AnchorCadence: {
+            readonly title: "AnchorCadence";
+            readonly type: "string";
+            readonly enum: readonly ["never", "renewal", "manual"];
+            readonly description: "How often this room intends to write an `EpochAnchor`. **A statement of intent, not a schedule anything enforces** — nothing in this family can make an owner anchor.\n\nIt is worth stating anyway, and the reason is the interesting part: it makes **silence legible**. A room that says `renewal` and has not anchored in ten epochs is telling a member something, and a member who did not know what to expect could not have noticed. A room that says `never` is telling them not to wait for one.\n\n  - `never` — no anchor is intended. Honest, and cheap: anchoring costs a witnessed update and a rotation of the room DID's update key each time.\n  - `renewal` — one anchor per epoch change, which is the cadence §9's lifecycle already moves at.\n  - `manual` — the owner anchors when they decide to. A member should draw no freshness expectation from this at all, which is exactly what it is for: it is the honest answer where there is no rule.\n\nDeliberately not a duration. A room that promised \"daily\" would be making a claim its owner's availability cannot keep, and a member comparing against a clock would read an owner's holiday as a host's misbehaviour.";
+        };
+        readonly RetentionPolicy: {
+            readonly title: "RetentionPolicy";
+            readonly type: "string";
+            readonly enum: readonly ["chained", "fromJoin"];
+            readonly description: "Whether a room keeps its history readable across a membership change, fixed at creation and immutable thereafter — like `Visibility`, and for the same reason: the rungs of an epoch key chain either exist for an epoch or they do not, and no later change of mind can seal key material that was never sealed or unseal what was already severed. `chained`: each advance produces an `EpochLink`, so every member reads the room's whole retained history however long they have been in it — what a **library** wants, at the cost of post-compromise security for record content, since a compromised current key then reaches every retained epoch. `fromJoin`: no rungs are produced, so a member reads only from the epoch their group state is at — what a **stream** wants, and what a room under a strict forward-secrecy obligation wants, at the cost that a joining member finds an empty-looking room and nobody can reread a record once their group state has moved past the epoch it was sealed under. Absent means `chained`; see the prose on why the absent case is the readable one.";
+            readonly $comment: "Deliberately no JSON Schema `default`. A declared default is materialised by the generated bindings — the member becomes non-optional with a serde default — so an absent value would reappear as an explicit one on re-serialisation and break round-trip idempotence for every document written before this member existed. The meaning of absence is stated in prose, where a binding cannot act on it.";
+        };
+        readonly Visibility: {
+            readonly title: "Visibility";
+            readonly type: "string";
+            readonly enum: readonly ["open", "attributed", "private"];
+            readonly description: "How much of a room its host can see, fixed at creation and immutable thereafter. `open`: records are cleartext, searchable and fully audited. `attributed`: record content is sealed, and the host still learns which member acted. `private`: content is sealed and membership is presented in zero knowledge, so the host verifies that a member acted without learning which. Immutable because a downgrade cannot un-see cleartext and an upgrade would protect only what came after while presenting as though it protected everything.";
+        };
+    };
+    readonly description: "An owner registers a data room with a host. 0.2 adds `recordRetention`: how long the room keeps its records by age, stated at creation so that no record is ever removed under a rule its readers could not have read.";
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Rooms Create — response payload";
+            readonly description: "Success response to rooms/create. Type https://trusttasks.org/spec/rooms/create/0.2#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["roomId", "epoch"];
+            readonly properties: {
+                readonly roomId: {
+                    readonly type: "string";
+                };
+                readonly epoch: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Always 1 for a new room.";
+                };
+                readonly anchorCadence: {
+                    readonly $ref: "#/$defs/AnchorCadence";
+                    readonly description: "Echoed so a caller knows what was recorded rather than what was asked — the two differ on a host that predates this member.";
+                };
+                readonly recordRetention: {
+                    readonly $ref: "#/$defs/RecordRetention";
+                    readonly description: "The record retention the host recorded, echoed for the same reason `anchorCadence` is: a caller learns what is in force rather than what it asked for. Absent when none was recorded.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RecordRetention: {
+            readonly title: "RecordRetention";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "How long a room keeps its records, by age: the room's **record retention**. Records older than it states become **eligible** to be removed by `rooms/records/prune`; nothing is removed until a holder of `admin` asks for a prune, and nothing a prune removes can be brought back.\n\n**Not `retentionPolicy`, and not `retentionDays`.** Both names are taken in this family and mean other things. `retentionPolicy` (`RetentionPolicy`) is whether a room's *key chain* lets a member read epochs from before they joined, fixed at creation because key material either exists for an epoch or it does not. `retentionDays` (`rooms/create`) is how long a host keeps a whole room after it lapses unrenewed. This is a third question — how long the room keeps its *records* while it is live — and unlike the first it is a decision a room revisits, so it is changeable (`rooms/records/retention/set`). A name sharing either's would invite a reader to apply one's rules to the other.\n\n**Age is the host's to measure, so age is `updatedAt`.** On the sealed tiers a host can read nothing of a record but its key, version, status, pinning and when it last changed, so a policy the host applies can only be stated in those terms. That is also why it cannot use a record's own `validUntil`, which is sealed: expiry is a reader's rule, retention a host's. A curation is a change, so it restarts a record's age — a retraction starts a tombstone's.\n\n**Absent, or `{}`, means no record is ever eligible by age**, and that is the reading a host MUST apply whenever it cannot read a policy: removing data under a rule nobody stated is the failure this member exists to prevent. Every member can read the policy in force (`rooms/info`), so a record is never removed under a rule its readers could not have known.";
+            readonly properties: {
+                readonly tombstoneDays: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 36500;
+                    readonly description: "Days a retracted record's tombstone is kept after its retraction. A tombstone whose `updatedAt` is more than this long ago is eligible. Tombstones exist so that a member syncing incrementally learns of a retraction (`rooms/records/curate`); this is how long a member may stay away and still learn of one that way rather than by rebuilding their copy of the room. Absent means tombstones are never eligible.";
+                };
+                readonly recordDays: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 36500;
+                    readonly description: "Days a record is kept after it last changed, whatever its standing. A record — `active`, `deprecated` or `retracted` — whose `updatedAt` is more than this long ago is eligible, **unless it is pinned**: pinning says what matters in the room, and a room that wants a pinned record gone unpins it first. Absent means records are never eligible by age.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. A host MUST NOT treat a member here as making more records eligible: a removal rule a member's reader cannot understand is one they were never told about.";
+                };
+            };
+        };
+        readonly AnchorCadence: {
+            readonly title: "AnchorCadence";
+            readonly type: "string";
+            readonly enum: readonly ["never", "renewal", "manual"];
+            readonly description: "How often this room intends to write an `EpochAnchor`. **A statement of intent, not a schedule anything enforces** — nothing in this family can make an owner anchor.\n\nIt is worth stating anyway, and the reason is the interesting part: it makes **silence legible**. A room that says `renewal` and has not anchored in ten epochs is telling a member something, and a member who did not know what to expect could not have noticed. A room that says `never` is telling them not to wait for one.\n\n  - `never` — no anchor is intended. Honest, and cheap: anchoring costs a witnessed update and a rotation of the room DID's update key each time.\n  - `renewal` — one anchor per epoch change, which is the cadence §9's lifecycle already moves at.\n  - `manual` — the owner anchors when they decide to. A member should draw no freshness expectation from this at all, which is exactly what it is for: it is the honest answer where there is no rule.\n\nDeliberately not a duration. A room that promised \"daily\" would be making a claim its owner's availability cannot keep, and a member comparing against a clock would read an owner's holiday as a host's misbehaviour.";
+        };
+        readonly RetentionPolicy: {
+            readonly title: "RetentionPolicy";
+            readonly type: "string";
+            readonly enum: readonly ["chained", "fromJoin"];
+            readonly description: "Whether a room keeps its history readable across a membership change, fixed at creation and immutable thereafter — like `Visibility`, and for the same reason: the rungs of an epoch key chain either exist for an epoch or they do not, and no later change of mind can seal key material that was never sealed or unseal what was already severed. `chained`: each advance produces an `EpochLink`, so every member reads the room's whole retained history however long they have been in it — what a **library** wants, at the cost of post-compromise security for record content, since a compromised current key then reaches every retained epoch. `fromJoin`: no rungs are produced, so a member reads only from the epoch their group state is at — what a **stream** wants, and what a room under a strict forward-secrecy obligation wants, at the cost that a joining member finds an empty-looking room and nobody can reread a record once their group state has moved past the epoch it was sealed under. Absent means `chained`; see the prose on why the absent case is the readable one.";
+            readonly $comment: "Deliberately no JSON Schema `default`. A declared default is materialised by the generated bindings — the member becomes non-optional with a serde default — so an absent value would reappear as an explicit one on re-serialisation and break round-trip idempotence for every document written before this member existed. The meaning of absence is stated in prose, where a binding cannot act on it.";
+        };
+        readonly Visibility: {
+            readonly title: "Visibility";
+            readonly type: "string";
+            readonly enum: readonly ["open", "attributed", "private"];
+            readonly description: "How much of a room its host can see, fixed at creation and immutable thereafter. `open`: records are cleartext, searchable and fully audited. `attributed`: record content is sealed, and the host still learns which member acted. `private`: content is sealed and membership is presented in zero knowledge, so the host verifies that a member acted without learning which. Immutable because a downgrade cannot un-see cleartext and an upgrade would protect only what came after while presenting as though it protected everything.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/rooms/create/0.2";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/rooms/create/0.2";
+        readonly title: "Rooms Create — payload";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["roomId", "visibility", "ownerDid"];
+        readonly properties: {
+            readonly roomId: {
+                readonly type: "string";
+                readonly description: "The room's identifier, minted by its owner before this call. A host is told the identifier; it does not assign one, because a room whose identity the host chose could not move to another host.";
+            };
+            readonly visibility: {
+                readonly $ref: "#/$defs/Visibility";
+            };
+            readonly ownerDid: {
+                readonly type: "string";
+                readonly description: "The room's accountable party: the controller of the room's identifier, the issuer of every credential in it, and the party a host addresses about quota, abuse, or lifecycle. Visible at every visibility, including `private` — a room has someone answerable for it.";
+            };
+            readonly retentionPolicy: {
+                readonly $ref: "#/$defs/RetentionPolicy";
+                readonly description: "Whether this room keeps its history readable across a membership change. Absent means `chained`, which is the choice a room wants unless it has a reason not to: joining a room should mean being able to read it. A host MUST reject an epoch link for a room whose policy is `fromJoin` rather than storing one it declared it would not have.";
+            };
+            readonly retentionDays: {
+                readonly type: "integer";
+                readonly minimum: 1;
+                readonly description: "How long the host will hold the room after its epoch lapses without renewal, before storage may be reclaimed. Stated at creation rather than discovered: reclamation that surprises a member is a failure of the design, not of the member.";
+            };
+            readonly anchorCadence: {
+                readonly $ref: "#/$defs/AnchorCadence";
+                readonly description: "What this room intends about anchoring. OPTIONAL; absent reads as `manual`, which draws no expectation and is the honest default for a room whose owner has not decided. A host stores it and serves it back — it constrains nothing the host does.";
+            };
+            readonly recordRetention: {
+                readonly $ref: "#/$defs/RecordRetention";
+                readonly description: "How long the room keeps its records, by age: which records `rooms/records/prune` may remove. OPTIONAL; absent means no record is ever eligible by age. Unlike `retentionPolicy` it is not fixed: a holder of `admin` changes it with `rooms/records/retention/set`.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Rooms Create — response payload";
+                readonly description: "Success response to rooms/create. Type https://trusttasks.org/spec/rooms/create/0.2#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["roomId", "epoch"];
+                readonly properties: {
+                    readonly roomId: {
+                        readonly type: "string";
+                    };
+                    readonly epoch: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Always 1 for a new room.";
+                    };
+                    readonly anchorCadence: {
+                        readonly $ref: "#/$defs/AnchorCadence";
+                        readonly description: "Echoed so a caller knows what was recorded rather than what was asked — the two differ on a host that predates this member.";
+                    };
+                    readonly recordRetention: {
+                        readonly $ref: "#/$defs/RecordRetention";
+                        readonly description: "The record retention the host recorded, echoed for the same reason `anchorCadence` is: a caller learns what is in force rather than what it asked for. Absent when none was recorded.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RecordRetention: {
+                readonly title: "RecordRetention";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "How long a room keeps its records, by age: the room's **record retention**. Records older than it states become **eligible** to be removed by `rooms/records/prune`; nothing is removed until a holder of `admin` asks for a prune, and nothing a prune removes can be brought back.\n\n**Not `retentionPolicy`, and not `retentionDays`.** Both names are taken in this family and mean other things. `retentionPolicy` (`RetentionPolicy`) is whether a room's *key chain* lets a member read epochs from before they joined, fixed at creation because key material either exists for an epoch or it does not. `retentionDays` (`rooms/create`) is how long a host keeps a whole room after it lapses unrenewed. This is a third question — how long the room keeps its *records* while it is live — and unlike the first it is a decision a room revisits, so it is changeable (`rooms/records/retention/set`). A name sharing either's would invite a reader to apply one's rules to the other.\n\n**Age is the host's to measure, so age is `updatedAt`.** On the sealed tiers a host can read nothing of a record but its key, version, status, pinning and when it last changed, so a policy the host applies can only be stated in those terms. That is also why it cannot use a record's own `validUntil`, which is sealed: expiry is a reader's rule, retention a host's. A curation is a change, so it restarts a record's age — a retraction starts a tombstone's.\n\n**Absent, or `{}`, means no record is ever eligible by age**, and that is the reading a host MUST apply whenever it cannot read a policy: removing data under a rule nobody stated is the failure this member exists to prevent. Every member can read the policy in force (`rooms/info`), so a record is never removed under a rule its readers could not have known.";
+                readonly properties: {
+                    readonly tombstoneDays: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 36500;
+                        readonly description: "Days a retracted record's tombstone is kept after its retraction. A tombstone whose `updatedAt` is more than this long ago is eligible. Tombstones exist so that a member syncing incrementally learns of a retraction (`rooms/records/curate`); this is how long a member may stay away and still learn of one that way rather than by rebuilding their copy of the room. Absent means tombstones are never eligible.";
+                    };
+                    readonly recordDays: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 36500;
+                        readonly description: "Days a record is kept after it last changed, whatever its standing. A record — `active`, `deprecated` or `retracted` — whose `updatedAt` is more than this long ago is eligible, **unless it is pinned**: pinning says what matters in the room, and a room that wants a pinned record gone unpins it first. Absent means records are never eligible by age.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. A host MUST NOT treat a member here as making more records eligible: a removal rule a member's reader cannot understand is one they were never told about.";
+                    };
+                };
+            };
+            readonly AnchorCadence: {
+                readonly title: "AnchorCadence";
+                readonly type: "string";
+                readonly enum: readonly ["never", "renewal", "manual"];
+                readonly description: "How often this room intends to write an `EpochAnchor`. **A statement of intent, not a schedule anything enforces** — nothing in this family can make an owner anchor.\n\nIt is worth stating anyway, and the reason is the interesting part: it makes **silence legible**. A room that says `renewal` and has not anchored in ten epochs is telling a member something, and a member who did not know what to expect could not have noticed. A room that says `never` is telling them not to wait for one.\n\n  - `never` — no anchor is intended. Honest, and cheap: anchoring costs a witnessed update and a rotation of the room DID's update key each time.\n  - `renewal` — one anchor per epoch change, which is the cadence §9's lifecycle already moves at.\n  - `manual` — the owner anchors when they decide to. A member should draw no freshness expectation from this at all, which is exactly what it is for: it is the honest answer where there is no rule.\n\nDeliberately not a duration. A room that promised \"daily\" would be making a claim its owner's availability cannot keep, and a member comparing against a clock would read an owner's holiday as a host's misbehaviour.";
+            };
+            readonly RetentionPolicy: {
+                readonly title: "RetentionPolicy";
+                readonly type: "string";
+                readonly enum: readonly ["chained", "fromJoin"];
+                readonly description: "Whether a room keeps its history readable across a membership change, fixed at creation and immutable thereafter — like `Visibility`, and for the same reason: the rungs of an epoch key chain either exist for an epoch or they do not, and no later change of mind can seal key material that was never sealed or unseal what was already severed. `chained`: each advance produces an `EpochLink`, so every member reads the room's whole retained history however long they have been in it — what a **library** wants, at the cost of post-compromise security for record content, since a compromised current key then reaches every retained epoch. `fromJoin`: no rungs are produced, so a member reads only from the epoch their group state is at — what a **stream** wants, and what a room under a strict forward-secrecy obligation wants, at the cost that a joining member finds an empty-looking room and nobody can reread a record once their group state has moved past the epoch it was sealed under. Absent means `chained`; see the prose on why the absent case is the readable one.";
+                readonly $comment: "Deliberately no JSON Schema `default`. A declared default is materialised by the generated bindings — the member becomes non-optional with a serde default — so an absent value would reappear as an explicit one on re-serialisation and break round-trip idempotence for every document written before this member existed. The meaning of absence is stated in prose, where a binding cannot act on it.";
+            };
+            readonly Visibility: {
+                readonly title: "Visibility";
+                readonly type: "string";
+                readonly enum: readonly ["open", "attributed", "private"];
+                readonly description: "How much of a room its host can see, fixed at creation and immutable thereafter. `open`: records are cleartext, searchable and fully audited. `attributed`: record content is sealed, and the host still learns which member acted. `private`: content is sealed and membership is presented in zero knowledge, so the host verifies that a member acted without learning which. Immutable because a downgrade cannot un-see cleartext and an upgrade would protect only what came after while presenting as though it protected everything.";
+            };
+        };
+        readonly description: "An owner registers a data room with a host. 0.2 adds `recordRetention`: how long the room keeps its records by age, stated at creation so that no record is ever removed under a rule its readers could not have read.";
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/rooms/create/0.2#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Rooms Create — response payload";
+                readonly description: "Success response to rooms/create. Type https://trusttasks.org/spec/rooms/create/0.2#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["roomId", "epoch"];
+                readonly properties: {
+                    readonly roomId: {
+                        readonly type: "string";
+                    };
+                    readonly epoch: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Always 1 for a new room.";
+                    };
+                    readonly anchorCadence: {
+                        readonly $ref: "#/$defs/AnchorCadence";
+                        readonly description: "Echoed so a caller knows what was recorded rather than what was asked — the two differ on a host that predates this member.";
+                    };
+                    readonly recordRetention: {
+                        readonly $ref: "#/$defs/RecordRetention";
+                        readonly description: "The record retention the host recorded, echoed for the same reason `anchorCadence` is: a caller learns what is in force rather than what it asked for. Absent when none was recorded.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RecordRetention: {
+                readonly title: "RecordRetention";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "How long a room keeps its records, by age: the room's **record retention**. Records older than it states become **eligible** to be removed by `rooms/records/prune`; nothing is removed until a holder of `admin` asks for a prune, and nothing a prune removes can be brought back.\n\n**Not `retentionPolicy`, and not `retentionDays`.** Both names are taken in this family and mean other things. `retentionPolicy` (`RetentionPolicy`) is whether a room's *key chain* lets a member read epochs from before they joined, fixed at creation because key material either exists for an epoch or it does not. `retentionDays` (`rooms/create`) is how long a host keeps a whole room after it lapses unrenewed. This is a third question — how long the room keeps its *records* while it is live — and unlike the first it is a decision a room revisits, so it is changeable (`rooms/records/retention/set`). A name sharing either's would invite a reader to apply one's rules to the other.\n\n**Age is the host's to measure, so age is `updatedAt`.** On the sealed tiers a host can read nothing of a record but its key, version, status, pinning and when it last changed, so a policy the host applies can only be stated in those terms. That is also why it cannot use a record's own `validUntil`, which is sealed: expiry is a reader's rule, retention a host's. A curation is a change, so it restarts a record's age — a retraction starts a tombstone's.\n\n**Absent, or `{}`, means no record is ever eligible by age**, and that is the reading a host MUST apply whenever it cannot read a policy: removing data under a rule nobody stated is the failure this member exists to prevent. Every member can read the policy in force (`rooms/info`), so a record is never removed under a rule its readers could not have known.";
+                readonly properties: {
+                    readonly tombstoneDays: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 36500;
+                        readonly description: "Days a retracted record's tombstone is kept after its retraction. A tombstone whose `updatedAt` is more than this long ago is eligible. Tombstones exist so that a member syncing incrementally learns of a retraction (`rooms/records/curate`); this is how long a member may stay away and still learn of one that way rather than by rebuilding their copy of the room. Absent means tombstones are never eligible.";
+                    };
+                    readonly recordDays: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 36500;
+                        readonly description: "Days a record is kept after it last changed, whatever its standing. A record — `active`, `deprecated` or `retracted` — whose `updatedAt` is more than this long ago is eligible, **unless it is pinned**: pinning says what matters in the room, and a room that wants a pinned record gone unpins it first. Absent means records are never eligible by age.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. A host MUST NOT treat a member here as making more records eligible: a removal rule a member's reader cannot understand is one they were never told about.";
+                    };
+                };
+            };
+            readonly AnchorCadence: {
+                readonly title: "AnchorCadence";
+                readonly type: "string";
+                readonly enum: readonly ["never", "renewal", "manual"];
+                readonly description: "How often this room intends to write an `EpochAnchor`. **A statement of intent, not a schedule anything enforces** — nothing in this family can make an owner anchor.\n\nIt is worth stating anyway, and the reason is the interesting part: it makes **silence legible**. A room that says `renewal` and has not anchored in ten epochs is telling a member something, and a member who did not know what to expect could not have noticed. A room that says `never` is telling them not to wait for one.\n\n  - `never` — no anchor is intended. Honest, and cheap: anchoring costs a witnessed update and a rotation of the room DID's update key each time.\n  - `renewal` — one anchor per epoch change, which is the cadence §9's lifecycle already moves at.\n  - `manual` — the owner anchors when they decide to. A member should draw no freshness expectation from this at all, which is exactly what it is for: it is the honest answer where there is no rule.\n\nDeliberately not a duration. A room that promised \"daily\" would be making a claim its owner's availability cannot keep, and a member comparing against a clock would read an owner's holiday as a host's misbehaviour.";
+            };
+            readonly RetentionPolicy: {
+                readonly title: "RetentionPolicy";
+                readonly type: "string";
+                readonly enum: readonly ["chained", "fromJoin"];
+                readonly description: "Whether a room keeps its history readable across a membership change, fixed at creation and immutable thereafter — like `Visibility`, and for the same reason: the rungs of an epoch key chain either exist for an epoch or they do not, and no later change of mind can seal key material that was never sealed or unseal what was already severed. `chained`: each advance produces an `EpochLink`, so every member reads the room's whole retained history however long they have been in it — what a **library** wants, at the cost of post-compromise security for record content, since a compromised current key then reaches every retained epoch. `fromJoin`: no rungs are produced, so a member reads only from the epoch their group state is at — what a **stream** wants, and what a room under a strict forward-secrecy obligation wants, at the cost that a joining member finds an empty-looking room and nobody can reread a record once their group state has moved past the epoch it was sealed under. Absent means `chained`; see the prose on why the absent case is the readable one.";
+                readonly $comment: "Deliberately no JSON Schema `default`. A declared default is materialised by the generated bindings — the member becomes non-optional with a serde default — so an absent value would reappear as an explicit one on re-serialisation and break round-trip idempotence for every document written before this member existed. The meaning of absence is stated in prose, where a binding cannot act on it.";
+            };
+            readonly Visibility: {
+                readonly title: "Visibility";
+                readonly type: "string";
+                readonly enum: readonly ["open", "attributed", "private"];
+                readonly description: "How much of a room its host can see, fixed at creation and immutable thereafter. `open`: records are cleartext, searchable and fully audited. `attributed`: record content is sealed, and the host still learns which member acted. `private`: content is sealed and membership is presented in zero knowledge, so the host verifies that a member acted without learning which. Immutable because a downgrade cannot un-see cleartext and an upgrade would protect only what came after while presenting as though it protected everything.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/rooms/create/0.2/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/rooms/create/0.2/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAGvH;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;OAEG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;OAEG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;OAEG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAEjF,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,8CAAuD,CAAC;AAEhF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAEzC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,uDAAgE,CAAC;AAElG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgJjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqG1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}