@openvtc/trust-tasks 0.28.1 → 0.28.2

package/src/auth/step-up/approver/attest/0.1/payload.ts

@@ -11,7 +11,7 @@ import type { Ext } from "../../../../../_shared/components.js";
  */
 export interface AuthStepUpApproverAttestPayload {
   /**
-   * What the statement attests. `stepUp`: a re-authentication bound to one operation (carried in auth/step-up/approve-response/0.6). `decision`: the factor backing a consent decision (carried in task-consent/decision/0.2 `evidence`). `enrol`: proof of possession of the approver key at enrolment. Signed, so a statement made for one use is refused at another.
+   * What the statement attests. `stepUp`: a re-authentication bound to one operation (carried in auth/step-up/approve-response/0.7). `decision`: the factor backing a consent decision (carried in task-consent/decision/0.2 `evidence`). `enrol`: proof of possession of the approver key at enrolment. Signed, so a statement made for one use is refused at another.
    */
   purpose: "stepUp" | "decision" | "enrol";
   /**
@@ -89,7 +89,7 @@ export const PAYLOAD_SCHEMA = {
         "decision",
         "enrol"
       ],
-      "description": "What the statement attests. `stepUp`: a re-authentication bound to one operation (carried in auth/step-up/approve-response/0.6). `decision`: the factor backing a consent decision (carried in task-consent/decision/0.2 `evidence`). `enrol`: proof of possession of the approver key at enrolment. Signed, so a statement made for one use is refused at another."
+      "description": "What the statement attests. `stepUp`: a re-authentication bound to one operation (carried in auth/step-up/approve-response/0.7). `decision`: the factor backing a consent decision (carried in task-consent/decision/0.2 `evidence`). `enrol`: proof of possession of the approver key at enrolment. Signed, so a statement made for one use is refused at another."
     },
     "subject": {
       "type": "string",

package/src/index.ts

@@ -292,6 +292,9 @@ export import AuthStepUpApproveResponse_v0_5 = _AuthStepUpApproveResponse_v0_5;
 import * as _AuthStepUpApproveResponse_v0_6 from "./auth/step-up/approve-response/0.6/payload.js";
 /** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
 export import AuthStepUpApproveResponse_v0_6 = _AuthStepUpApproveResponse_v0_6;
+import * as _AuthStepUpApproveResponse_v0_7 from "./auth/step-up/approve-response/0.7/payload.js";
+/** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
+export import AuthStepUpApproveResponse_v0_7 = _AuthStepUpApproveResponse_v0_7;
 import * as _ApproverShared_v0_1 from "./auth/step-up/approver/_shared/0.1/approver.js";
 /** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
 export import ApproverShared_v0_1 = _ApproverShared_v0_1;
@@ -1792,6 +1795,9 @@ export import RoomsOwnerGroupRemove_v0_2 = _RoomsOwnerGroupRemove_v0_2;
 import * as _RoomsOwnerGroupRemove_v0_3 from "./rooms/owner/group/remove/0.3/payload.js";
 /** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
 export import RoomsOwnerGroupRemove_v0_3 = _RoomsOwnerGroupRemove_v0_3;
+import * as _RoomsOwnerGroupRemove_v0_4 from "./rooms/owner/group/remove/0.4/payload.js";
+/** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
+export import RoomsOwnerGroupRemove_v0_4 = _RoomsOwnerGroupRemove_v0_4;
 import * as _RoomsOwnerGroupRenew_v0_1 from "./rooms/owner/group/renew/0.1/payload.js";
 /** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
 export import RoomsOwnerGroupRenew_v0_1 = _RoomsOwnerGroupRenew_v0_1;
@@ -3206,6 +3212,12 @@ export import VtcInstallClaimFinish_v0_2 = _VtcInstallClaimFinish_v0_2;
 import * as _VtcInstallClaimFinish_v0_3 from "./vtc/install/claim/finish/0.3/payload.js";
 /** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
 export import VtcInstallClaimFinish_v0_3 = _VtcInstallClaimFinish_v0_3;
+import * as _VtcInstallClaimPasskeyFinish_v0_1 from "./vtc/install/claim/passkey/finish/0.1/payload.js";
+/** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
+export import VtcInstallClaimPasskeyFinish_v0_1 = _VtcInstallClaimPasskeyFinish_v0_1;
+import * as _VtcInstallClaimPasskeyStart_v0_1 from "./vtc/install/claim/passkey/start/0.1/payload.js";
+/** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
+export import VtcInstallClaimPasskeyStart_v0_1 = _VtcInstallClaimPasskeyStart_v0_1;
 import * as _VtcInstallClaimStart_v0_1 from "./vtc/install/claim/start/0.1/payload.js";
 /** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
 export import VtcInstallClaimStart_v0_1 = _VtcInstallClaimStart_v0_1;
@@ -3347,6 +3359,9 @@ export import VtcMembersRenew_v0_1 = _VtcMembersRenew_v0_1;
 import * as _VtcMembersRequestVmc_v0_1 from "./vtc/members/request-vmc/0.1/payload.js";
 /** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
 export import VtcMembersRequestVmc_v0_1 = _VtcMembersRequestVmc_v0_1;
+import * as _VtcMembersRoleSet_v0_1 from "./vtc/members/role/set/0.1/payload.js";
+/** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
+export import VtcMembersRoleSet_v0_1 = _VtcMembersRoleSet_v0_1;
 import * as _VtcMembersRotateChallenge_v0_1 from "./vtc/members/rotate-challenge/0.1/payload.js";
 /** @deprecated The prebuilt specification modules will be removed: pin the tasks you use with the `trust-tasks` CLI, generate them with `@openvtc/trust-tasks-gen`, and import the runtime from `@openvtc/trust-tasks/runtime` (GETTING-STARTED.md). */
 export import VtcMembersRotateChallenge_v0_1 = _VtcMembersRotateChallenge_v0_1;

package/src/rooms/owner/group/remove/0.1/payload.ts

@@ -6,7 +6,7 @@
 import type { Ext } from "../../../../../_shared/components.js";
 
 
-/** @deprecated superseded by rooms/owner/group/remove/0.3 */
+/** @deprecated superseded by rooms/owner/group/remove/0.4 */
 export interface RoomsOwnerGroupRemovePayload {
   /**
    * The room whose group loses a member. The recipient MUST hold its group.
@@ -32,7 +32,7 @@ export interface RoomsOwnerGroupRemovePayload {
 /**
  * Success response to rooms/owner/group/remove. Type https://trusttasks.org/spec/rooms/owner/group/remove/0.1#response. The room's new epoch, which the removed member holds no key for.
  *
- * @deprecated superseded by rooms/owner/group/remove/0.3
+ * @deprecated superseded by rooms/owner/group/remove/0.4
  */
 export interface RoomsOwnerGroupRemoveResponsePayload {
   /**
@@ -70,12 +70,12 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = "superseded by rooms/owner/group/remove/0.3";
+export const DEPRECATION: string | null = "superseded by rooms/owner/group/remove/0.4";
 
 /**
  * Stable alias for this specification's request payload shape.
  *
- * @deprecated superseded by rooms/owner/group/remove/0.3
+ * @deprecated superseded by rooms/owner/group/remove/0.4
  */
 export type Payload = RoomsOwnerGroupRemovePayload;
 
@@ -85,7 +85,7 @@ export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/rooms/owner/group/
 /**
  * Stable alias for this specification's success-response payload shape.
  *
- * @deprecated superseded by rooms/owner/group/remove/0.3
+ * @deprecated superseded by rooms/owner/group/remove/0.4
  */
 export type Response = RoomsOwnerGroupRemoveResponsePayload;
 

package/src/rooms/owner/group/remove/0.2/payload.ts

@@ -9,7 +9,7 @@ import type { DigestMultibase, Ext, RevocationHead } from "../../../../../_share
 /**
  * A room's owner asks their own agent to remove a member: withdraw every credential the room gave them, at its host at once, and then remove their leaf from the room's MLS group and advance its epoch. 0.2 adds the withdrawal, made first.
  *
- * @deprecated superseded by rooms/owner/group/remove/0.3
+ * @deprecated superseded by rooms/owner/group/remove/0.4
  */
 export interface RoomsOwnerGroupRemovePayload {
   /**
@@ -58,7 +58,7 @@ export interface RoomsOwnerGroupRemovePayload {
 /**
  * Success response to rooms/owner/group/remove. Type https://trusttasks.org/spec/rooms/owner/group/remove/0.2#response. The revocation list in force at the host, and the room's new epoch, which the removed member holds no key for.
  *
- * @deprecated superseded by rooms/owner/group/remove/0.3
+ * @deprecated superseded by rooms/owner/group/remove/0.4
  */
 export interface RoomsOwnerGroupRemoveResponsePayload {
   /**
@@ -118,12 +118,12 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = "superseded by rooms/owner/group/remove/0.3";
+export const DEPRECATION: string | null = "superseded by rooms/owner/group/remove/0.4";
 
 /**
  * Stable alias for this specification's request payload shape.
  *
- * @deprecated superseded by rooms/owner/group/remove/0.3
+ * @deprecated superseded by rooms/owner/group/remove/0.4
  */
 export type Payload = RoomsOwnerGroupRemovePayload;
 
@@ -133,7 +133,7 @@ export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/rooms/owner/group/
 /**
  * Stable alias for this specification's success-response payload shape.
  *
- * @deprecated superseded by rooms/owner/group/remove/0.3
+ * @deprecated superseded by rooms/owner/group/remove/0.4
  */
 export type Response = RoomsOwnerGroupRemoveResponsePayload;
 

package/src/rooms/owner/group/remove/0.3/payload.ts

@@ -8,6 +8,8 @@ import type { DigestMultibase, Ext, RevocationHead } from "../../../../../_share
 
 /**
  * A room's owner asks their own agent to remove a member: withdraw every credential the room gave them, at its host at once, and then remove their leaf from the room's MLS group and advance its epoch. 0.2 adds the withdrawal, made first.
+ *
+ * @deprecated superseded by rooms/owner/group/remove/0.4
  */
 export interface RoomsOwnerGroupRemovePayload {
   /**
@@ -55,6 +57,8 @@ export interface RoomsOwnerGroupRemovePayload {
 }
 /**
  * Success response to rooms/owner/group/remove. Type https://trusttasks.org/spec/rooms/owner/group/remove/0.3#response. The revocation list in force at the host, and the room's new epoch, which the removed member holds no key for.
+ *
+ * @deprecated superseded by rooms/owner/group/remove/0.4
  */
 export interface RoomsOwnerGroupRemoveResponsePayload {
   /**
@@ -114,15 +118,23 @@ export const EXTENDS: string | null = null;
  * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
  * Versions").
  */
-export const DEPRECATION: string | null = null;
+export const DEPRECATION: string | null = "superseded by rooms/owner/group/remove/0.4";
 
-/** Stable alias for this specification's request payload shape. */
+/**
+ * Stable alias for this specification's request payload shape.
+ *
+ * @deprecated superseded by rooms/owner/group/remove/0.4
+ */
 export type Payload = RoomsOwnerGroupRemovePayload;
 
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/rooms/owner/group/remove/0.3#response" as const;
 
-/** Stable alias for this specification's success-response payload shape. */
+/**
+ * Stable alias for this specification's success-response payload shape.
+ *
+ * @deprecated superseded by rooms/owner/group/remove/0.4
+ */
 export type Response = RoomsOwnerGroupRemoveResponsePayload;
 
 /**

package/src/rooms/owner/group/remove/0.4/payload.ts

@@ -0,0 +1,442 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/rooms/owner/group/remove/0.4/payload.schema.json
+ */
+
+import type { DigestMultibase, Ext, RevocationHead } from "../../../../../_shared/components.js";
+
+
+/**
+ * A room's owner asks their own agent to remove a member from a sealed room: on an attributed room withdraw every credential the room gave them, at its host at once, and on either sealed tier remove their leaf from the room's MLS group and advance its epoch. 0.4 removes a private room's member from the group, withdrawing nothing, where 0.2 and 0.3 refused.
+ */
+export interface RoomsOwnerGroupRemovePayload {
+  /**
+   * The room whose group loses a member. The recipient MUST hold its group and a signing key for it.
+   */
+  roomId: string;
+  /**
+   * The room's host, as a DID: where the withdrawal, if any, is delivered first and the room's epoch advances.
+   */
+  host: string;
+  /**
+   * Any other host serving the room, as DIDs. On a room that is not private, each is delivered the withdrawal too: a host that does not hold it honours the member's credentials still. Unused on a private room.
+   *
+   * @maxItems 7
+   */
+  mirrors?:
+    | []
+    | [string]
+    | [string, string]
+    | [string, string, string]
+    | [string, string, string, string]
+    | [string, string, string, string, string]
+    | [string, string, string, string, string, string]
+    | [string, string, string, string, string, string, string];
+  /**
+   * The DID whose leaf is removed and, on a room that is not private, whose credentials the room withdraws. Never the recipient's own leaf.
+   */
+  member: string;
+  /**
+   * Which held key signs the room's revocation list as the room, named explicitly as for rooms/owner/revoke. Required unless the room is private, whose removal signs nothing as the room: a request naming none for any other room is refused with noSigningKey.
+   */
+  signingKeyId?: string;
+  /**
+   * OPTIONAL. When the last credential the room issued `member` expires, after which the withdrawal can be dropped from the room's list. Unused on a private room.
+   */
+  until?: string;
+  /**
+   * Why, carried to the host's epoch advance. Untrusted and attributed to its author: it MUST NOT carry personal data or a credential. Never put into the revocation list.
+   */
+  reason?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * Success response to rooms/owner/group/remove. Type https://trusttasks.org/spec/rooms/owner/group/remove/0.4#response. Whether the member was withdrawn at the host, the revocation list in force there when they were, and the room's new epoch, which the removed member holds no key for.
+ */
+export interface RoomsOwnerGroupRemoveResponsePayload {
+  /**
+   * The room.
+   */
+  roomId: string;
+  /**
+   * Who was removed.
+   */
+  member: string;
+  /**
+   * Whether the member's credentials were withdrawn at the host. True on an attributed room, with `revocation` and `revokedAt`; false on a private room, whose host cannot be told whom to refuse: the member's credentials stay valid there until they expire, and only a reset of every credential (rooms/owner/revoke, a `room` entry) withdraws them. A surface MUST NOT report false as a withdrawal.
+   */
+  withdrawn: boolean;
+  /**
+   * The revocation list carrying the withdrawal, as `host` accepted it. Present exactly when `withdrawn` is true.
+   */
+  revocation?: RevocationHead;
+  /**
+   * The withdrawal's `revokedAt`: credentials the room issued `member` before it are refused, and fresh ones issued after it are not. Present only when `withdrawn` is true.
+   */
+  revokedAt?: string;
+  /**
+   * The room epoch after the removal, as the host recorded it.
+   */
+  epoch: number;
+  /**
+   * Mirrors that did not confirm the withdrawal. Each still honours the member's credentials until the list is delivered — with rooms/owner/revoke and no `withdraw`. Absent when every mirror confirmed. Never present when `withdrawn` is false.
+   *
+   * @maxItems 7
+   */
+  mirrorsPending?:
+    | []
+    | [string]
+    | [string, string]
+    | [string, string, string]
+    | [string, string, string, string]
+    | [string, string, string, string, string]
+    | [string, string, string, string, string, string]
+    | [string, string, string, string, string, string, string];
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DigestMultibase, Ext, RevocationHead };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/rooms/owner/group/remove/0.4" as const;
+
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = RoomsOwnerGroupRemovePayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/rooms/owner/group/remove/0.4#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = RoomsOwnerGroupRemoveResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/rooms/owner/group/remove/0.4",
+  "title": "Rooms Owner Group Remove — payload",
+  "description": "A room's owner asks their own agent to remove a member from a sealed room: on an attributed room withdraw every credential the room gave them, at its host at once, and on either sealed tier remove their leaf from the room's MLS group and advance its epoch. 0.4 removes a private room's member from the group, withdrawing nothing, where 0.2 and 0.3 refused.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "roomId",
+    "host",
+    "member"
+  ],
+  "properties": {
+    "roomId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512,
+      "description": "The room whose group loses a member. The recipient MUST hold its group and a signing key for it."
+    },
+    "host": {
+      "type": "string",
+      "pattern": "^did:",
+      "maxLength": 2048,
+      "description": "The room's host, as a DID: where the withdrawal, if any, is delivered first and the room's epoch advances."
+    },
+    "mirrors": {
+      "type": "array",
+      "maxItems": 7,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^did:",
+        "maxLength": 2048
+      },
+      "description": "Any other host serving the room, as DIDs. On a room that is not private, each is delivered the withdrawal too: a host that does not hold it honours the member's credentials still. Unused on a private room."
+    },
+    "member": {
+      "type": "string",
+      "pattern": "^did:",
+      "maxLength": 2048,
+      "description": "The DID whose leaf is removed and, on a room that is not private, whose credentials the room withdraws. Never the recipient's own leaf."
+    },
+    "signingKeyId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "Which held key signs the room's revocation list as the room, named explicitly as for rooms/owner/revoke. Required unless the room is private, whose removal signs nothing as the room: a request naming none for any other room is refused with noSigningKey."
+    },
+    "until": {
+      "type": "string",
+      "format": "date-time",
+      "description": "OPTIONAL. When the last credential the room issued `member` expires, after which the withdrawal can be dropped from the room's list. Unused on a private room."
+    },
+    "reason": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 500,
+      "description": "Why, carried to the host's epoch advance. Untrusted and attributed to its author: it MUST NOT carry personal data or a credential. Never put into the revocation list."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Rooms Owner Group Remove — response payload",
+      "description": "Success response to rooms/owner/group/remove. Type https://trusttasks.org/spec/rooms/owner/group/remove/0.4#response. Whether the member was withdrawn at the host, the revocation list in force there when they were, and the room's new epoch, which the removed member holds no key for.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "roomId",
+        "member",
+        "withdrawn",
+        "epoch"
+      ],
+      "properties": {
+        "roomId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "The room."
+        },
+        "member": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "Who was removed."
+        },
+        "withdrawn": {
+          "type": "boolean",
+          "description": "Whether the member's credentials were withdrawn at the host. True on an attributed room, with `revocation` and `revokedAt`; false on a private room, whose host cannot be told whom to refuse: the member's credentials stay valid there until they expire, and only a reset of every credential (rooms/owner/revoke, a `room` entry) withdraws them. A surface MUST NOT report false as a withdrawal."
+        },
+        "revocation": {
+          "$ref": "#/$defs/RevocationHead",
+          "description": "The revocation list carrying the withdrawal, as `host` accepted it. Present exactly when `withdrawn` is true."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "The withdrawal's `revokedAt`: credentials the room issued `member` before it are refused, and fresh ones issued after it are not. Present only when `withdrawn` is true."
+        },
+        "epoch": {
+          "type": "integer",
+          "minimum": 2,
+          "description": "The room epoch after the removal, as the host recorded it."
+        },
+        "mirrorsPending": {
+          "type": "array",
+          "maxItems": 7,
+          "items": {
+            "type": "string",
+            "pattern": "^did:",
+            "maxLength": 2048
+          },
+          "description": "Mirrors that did not confirm the withdrawal. Each still honours the member's credentials until the list is delivered — with rooms/owner/revoke and no `withdraw`. Absent when every mirror confirmed. Never present when `withdrawn` is false."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "RevocationHead": {
+      "title": "RevocationHead",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "sequence",
+        "digest"
+      ],
+      "description": "Which `RevocationList` a party holds, without its entries: comparable between the room's key holder and a host, and between two hosts, without disclosing whom the room withdrew.",
+      "properties": {
+        "sequence": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The list's `sequence`."
+        },
+        "digest": {
+          "$ref": "#/$defs/DigestMultibase",
+          "description": "SHA-256 multihash of the list's RFC 8785 (JCS) canonicalization, `proof` included. Two parties holding one sequence with different digests have been given two lists the room signed at one sequence."
+        }
+      }
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Rooms Owner Group Remove — response payload",
+      "description": "Success response to rooms/owner/group/remove. Type https://trusttasks.org/spec/rooms/owner/group/remove/0.4#response. Whether the member was withdrawn at the host, the revocation list in force there when they were, and the room's new epoch, which the removed member holds no key for.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "roomId",
+        "member",
+        "withdrawn",
+        "epoch"
+      ],
+      "properties": {
+        "roomId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "The room."
+        },
+        "member": {
+          "type": "string",
+          "pattern": "^did:",
+          "maxLength": 2048,
+          "description": "Who was removed."
+        },
+        "withdrawn": {
+          "type": "boolean",
+          "description": "Whether the member's credentials were withdrawn at the host. True on an attributed room, with `revocation` and `revokedAt`; false on a private room, whose host cannot be told whom to refuse: the member's credentials stay valid there until they expire, and only a reset of every credential (rooms/owner/revoke, a `room` entry) withdraws them. A surface MUST NOT report false as a withdrawal."
+        },
+        "revocation": {
+          "$ref": "#/$defs/RevocationHead",
+          "description": "The revocation list carrying the withdrawal, as `host` accepted it. Present exactly when `withdrawn` is true."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "The withdrawal's `revokedAt`: credentials the room issued `member` before it are refused, and fresh ones issued after it are not. Present only when `withdrawn` is true."
+        },
+        "epoch": {
+          "type": "integer",
+          "minimum": 2,
+          "description": "The room epoch after the removal, as the host recorded it."
+        },
+        "mirrorsPending": {
+          "type": "array",
+          "maxItems": 7,
+          "items": {
+            "type": "string",
+            "pattern": "^did:",
+            "maxLength": 2048
+          },
+          "description": "Mirrors that did not confirm the withdrawal. Each still honours the member's credentials until the list is delivered — with rooms/owner/revoke and no `withdraw`. Absent when every mirror confirmed. Never present when `withdrawn` is false."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "RevocationHead": {
+      "title": "RevocationHead",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "sequence",
+        "digest"
+      ],
+      "description": "Which `RevocationList` a party holds, without its entries: comparable between the room's key holder and a host, and between two hosts, without disclosing whom the room withdrew.",
+      "properties": {
+        "sequence": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The list's `sequence`."
+        },
+        "digest": {
+          "$ref": "#/$defs/DigestMultibase",
+          "description": "SHA-256 multihash of the list's RFC 8785 (JCS) canonicalization, `proof` included. Two parties holding one sequence with different digests have been given two lists the room signed at one sequence."
+        }
+      }
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;