@openvtc/trust-tasks 0.28.23 → 0.28.24

package/src/messaging/mux/attach/0.1/payload.ts

@@ -0,0 +1,682 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/messaging/mux/attach/0.1/payload.schema.json
+ */
+
+import type { AttachStatement, DataIntegrityProof, Ext, MuxDataIntegrityProof, MuxDid, MuxNonce, MuxScope, MuxScopeValue, SessionId_MessagingMuxV0_1 as SessionId, StatementScope } from "../../../../_shared/components.js";
+
+
+/**
+ * A principal attaches member DIDs to the connection that carries the request, each by an attach statement the member DID signed with an embedded Data Integrity proof, bound to this connection. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface MessagingMuxAttachPayload {
+  /**
+   * The members to attach, one attach statement each; the member DID is the statement's `issuer`. Each is checked and answered on its own; the batch is never all-or-nothing. A member DID appears at most once.
+   *
+   * @minItems 1
+   * @maxItems 256
+   */
+  attachments: [AttachStatement, ...AttachStatement[]];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * The success response to a messaging/mux/attach request: one outcome per attach statement, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/attach/0.1#response.
+ */
+export interface MessagingMuxAttachResponsePayload {
+  /**
+   * @maxItems 256
+   */
+  results: AttachOutcome[];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * The outcome for one requested member. An `attached` outcome carries `scope`, `expiresAt` and `deliveryActive`; a `refused` outcome carries `code` and nothing else.
+ */
+export interface AttachOutcome {
+  /**
+   * The member DID: the statement's `issuer`.
+   */
+  did: MuxDid;
+  status: "attached" | "refused";
+  /**
+   * Present exactly when `status` is `refused`: the first check the member failed, in the order the specification lists them.
+   */
+  code?:
+    | "messaging/mux:statementProofInvalid"
+    | "messaging/mux:didUnresolvable"
+    | "messaging/mux:proofPurposeInvalid"
+    | "messaging/mux:audienceMismatch"
+    | "messaging/mux:principalMismatch"
+    | "messaging/mux/attach:sessionMismatch"
+    | "messaging/mux:notYetValid"
+    | "messaging/mux:statementExpired"
+    | "messaging/mux:lifetimeTooLong"
+    | "messaging/mux:emptyScope"
+    | "messaging/mux:accountUnavailable"
+    | "messaging/mux:scopeNotPermitted"
+    | "messaging/mux/attach:memberQuota";
+  /**
+   * Present exactly when `status` is `attached`: the scope in force.
+   */
+  scope?: MuxScope;
+  /**
+   * Present exactly when `status` is `attached`: when the attach lapses (the statement's `exp`).
+   */
+  expiresAt?: string;
+  /**
+   * Present exactly when `status` is `attached`. False when the member DID has its own direct connection, which takes precedence: the attach is held, and becomes active when that connection ends.
+   */
+  deliveryActive?: boolean;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AttachStatement, DataIntegrityProof, Ext, MuxDataIntegrityProof, MuxDid, MuxNonce, MuxScope, MuxScopeValue, SessionId, StatementScope };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/messaging/mux/attach/0.1" as const;
+
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = MessagingMuxAttachPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/messaging/mux/attach/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = MessagingMuxAttachResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/messaging/mux/attach/0.1",
+  "title": "Messaging — Mux Attach — payload",
+  "description": "A principal attaches member DIDs to the connection that carries the request, each by an attach statement the member DID signed with an embedded Data Integrity proof, bound to this connection. The outer document members are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "attachments"
+  ],
+  "properties": {
+    "attachments": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 256,
+      "description": "The members to attach, one attach statement each; the member DID is the statement's `issuer`. Each is checked and answered on its own; the batch is never all-or-nothing. A member DID appears at most once.",
+      "items": {
+        "$ref": "#/$defs/AttachStatement"
+      }
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Messaging — Mux Attach — response payload",
+      "description": "The success response to a messaging/mux/attach request: one outcome per attach statement, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/attach/0.1#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "results"
+      ],
+      "properties": {
+        "results": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/AttachOutcome"
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "AttachOutcome": {
+      "title": "AttachOutcome",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "did",
+        "status"
+      ],
+      "description": "The outcome for one requested member. An `attached` outcome carries `scope`, `expiresAt` and `deliveryActive`; a `refused` outcome carries `code` and nothing else.",
+      "properties": {
+        "did": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The member DID: the statement's `issuer`."
+        },
+        "status": {
+          "type": "string",
+          "enum": [
+            "attached",
+            "refused"
+          ]
+        },
+        "code": {
+          "type": "string",
+          "enum": [
+            "messaging/mux:statementProofInvalid",
+            "messaging/mux:didUnresolvable",
+            "messaging/mux:proofPurposeInvalid",
+            "messaging/mux:audienceMismatch",
+            "messaging/mux:principalMismatch",
+            "messaging/mux/attach:sessionMismatch",
+            "messaging/mux:notYetValid",
+            "messaging/mux:statementExpired",
+            "messaging/mux:lifetimeTooLong",
+            "messaging/mux:emptyScope",
+            "messaging/mux:accountUnavailable",
+            "messaging/mux:scopeNotPermitted",
+            "messaging/mux/attach:memberQuota"
+          ],
+          "description": "Present exactly when `status` is `refused`: the first check the member failed, in the order the specification lists them."
+        },
+        "scope": {
+          "$ref": "#/$defs/MuxScope",
+          "description": "Present exactly when `status` is `attached`: the scope in force."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "Present exactly when `status` is `attached`: when the attach lapses (the statement's `exp`)."
+        },
+        "deliveryActive": {
+          "type": "boolean",
+          "description": "Present exactly when `status` is `attached`. False when the member DID has its own direct connection, which takes precedence: the attach is held, and becomes active when that connection ends."
+        }
+      }
+    },
+    "MuxScope": {
+      "title": "MuxScope",
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 16,
+      "items": {
+        "$ref": "#/$defs/MuxScopeValue"
+      },
+      "description": "A set of capabilities: a non-empty JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses into one. Never empty: an empty scope is refused, never read as \"all\". There is no default scope anywhere — every attach and every grant names its scope explicitly. A scope is always bounded by the member DID's own access-control capabilities at the mediator."
+    },
+    "MuxScopeValue": {
+      "title": "MuxScopeValue",
+      "type": "string",
+      "enum": [
+        "receive",
+        "pickup",
+        "delete",
+        "send"
+      ],
+      "description": "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket."
+    },
+    "MuxDid": {
+      "title": "MuxDid",
+      "type": "string",
+      "minLength": 7,
+      "maxLength": 2048,
+      "pattern": "^did:[a-z0-9]+:\\S+$",
+      "description": "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself."
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "AttachStatement": {
+      "title": "AttachStatement",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "issuer",
+        "audience",
+        "principal",
+        "sessionId",
+        "muxNonce",
+        "scope",
+        "iat",
+        "exp",
+        "proof"
+      ],
+      "description": "A member DID's statement that the named principal may carry its traffic on one connection — the one whose `sessionId` and `muxNonce` it names — until `exp`, within `scope`. Signed by the member with an embedded Data Integrity proof whose purpose is `authentication`.",
+      "properties": {
+        "type": {
+          "type": "string",
+          "const": "muxAttach",
+          "description": "Always `muxAttach`; names the statement kind, so a statement of one kind is never accepted as another."
+        },
+        "issuer": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The member DID: the signer, and the DID the statement concerns."
+        },
+        "audience": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The mediator's DID. A statement names exactly one mediator and is refused by every other."
+        },
+        "principal": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The principal DID the connection is authenticated as. MUST differ from `issuer`."
+        },
+        "sessionId": {
+          "$ref": "#/$defs/SessionId"
+        },
+        "muxNonce": {
+          "$ref": "#/$defs/MuxNonce"
+        },
+        "scope": {
+          "$ref": "#/$defs/StatementScope"
+        },
+        "iat": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "JWT NumericDate (RFC 7519 §2), whole seconds since 1970-01-01T00:00:00Z UTC: when the statement was signed. MUST NOT be more than 60 seconds in the mediator's future."
+        },
+        "exp": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "JWT NumericDate (RFC 7519 §2): when the statement stops being accepted. REQUIRED; MUST be after `iat` and in the future."
+        },
+        "proof": {
+          "$ref": "#/$defs/MuxDataIntegrityProof"
+        }
+      }
+    },
+    "MuxDataIntegrityProof": {
+      "title": "MuxDataIntegrityProof",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "cryptosuite",
+        "verificationMethod",
+        "proofPurpose",
+        "proofValue"
+      ],
+      "description": "The W3C Data Integrity proof embedded in a mux statement, made by the member DID: the format and verifier Trust Tasks already use for document proofs (SPEC §4.7). The proof covers the whole statement except `proof` itself, as the cryptosuite defines. Closed: a member Data Integrity defines but this list omits is refused.",
+      "properties": {
+        "type": {
+          "type": "string",
+          "const": "DataIntegrityProof"
+        },
+        "cryptosuite": {
+          "type": "string",
+          "enum": [
+            "eddsa-jcs-2022",
+            "eddsa-rdfc-2022"
+          ],
+          "description": "The W3C Data Integrity EdDSA cryptosuite used."
+        },
+        "verificationMethod": {
+          "type": "string",
+          "minLength": 5,
+          "maxLength": 2048,
+          "pattern": "^did:\\S+#\\S+$",
+          "description": "The DID URL of the verification method that signed. MUST be controlled by the statement's `issuer` and listed in that DID's current `authentication` relationship."
+        },
+        "proofPurpose": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64,
+          "description": "MUST be `authentication`. Any other value is refused with `messaging/mux:proofPurposeInvalid` — a proof made for another relationship (an `assertionMethod` credential signature, say) is never accepted as control of the DID."
+        },
+        "created": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL: when the proof was made, as Data Integrity defines it. Covered by the proof; the statement's own `iat` is what the mediator checks."
+        },
+        "proofValue": {
+          "type": "string",
+          "minLength": 2,
+          "maxLength": 4096,
+          "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$",
+          "description": "The multibase (base58btc) signature."
+        }
+      }
+    },
+    "StatementScope": {
+      "title": "StatementScope",
+      "type": "array",
+      "maxItems": 16,
+      "items": {
+        "$ref": "#/$defs/MuxScopeValue"
+      },
+      "description": "The scope a member DID signs into a statement: a JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses. It MUST NOT be empty; an empty signed scope is refused with the task's `emptyScope` code, never read as \"all\". Unlike MuxScope, emptiness is not a schema failure here, so that the refusal is reported per statement rather than failing the whole batch."
+    },
+    "MuxNonce": {
+      "title": "MuxNonce",
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]{43}$",
+      "description": "32 random bytes, base64url without padding, that belong to exactly one connection and are never reused. Attach statements sign over it, which is what makes an attach statement unusable on any other connection."
+    },
+    "SessionId": {
+      "title": "SessionId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The mediator's identifier for one authenticated connection, as announced in that connection's `ready` event."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Messaging — Mux Attach — response payload",
+      "description": "The success response to a messaging/mux/attach request: one outcome per attach statement, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/attach/0.1#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "results"
+      ],
+      "properties": {
+        "results": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/AttachOutcome"
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "AttachOutcome": {
+      "title": "AttachOutcome",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "did",
+        "status"
+      ],
+      "description": "The outcome for one requested member. An `attached` outcome carries `scope`, `expiresAt` and `deliveryActive`; a `refused` outcome carries `code` and nothing else.",
+      "properties": {
+        "did": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The member DID: the statement's `issuer`."
+        },
+        "status": {
+          "type": "string",
+          "enum": [
+            "attached",
+            "refused"
+          ]
+        },
+        "code": {
+          "type": "string",
+          "enum": [
+            "messaging/mux:statementProofInvalid",
+            "messaging/mux:didUnresolvable",
+            "messaging/mux:proofPurposeInvalid",
+            "messaging/mux:audienceMismatch",
+            "messaging/mux:principalMismatch",
+            "messaging/mux/attach:sessionMismatch",
+            "messaging/mux:notYetValid",
+            "messaging/mux:statementExpired",
+            "messaging/mux:lifetimeTooLong",
+            "messaging/mux:emptyScope",
+            "messaging/mux:accountUnavailable",
+            "messaging/mux:scopeNotPermitted",
+            "messaging/mux/attach:memberQuota"
+          ],
+          "description": "Present exactly when `status` is `refused`: the first check the member failed, in the order the specification lists them."
+        },
+        "scope": {
+          "$ref": "#/$defs/MuxScope",
+          "description": "Present exactly when `status` is `attached`: the scope in force."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "Present exactly when `status` is `attached`: when the attach lapses (the statement's `exp`)."
+        },
+        "deliveryActive": {
+          "type": "boolean",
+          "description": "Present exactly when `status` is `attached`. False when the member DID has its own direct connection, which takes precedence: the attach is held, and becomes active when that connection ends."
+        }
+      }
+    },
+    "MuxScope": {
+      "title": "MuxScope",
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 16,
+      "items": {
+        "$ref": "#/$defs/MuxScopeValue"
+      },
+      "description": "A set of capabilities: a non-empty JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses into one. Never empty: an empty scope is refused, never read as \"all\". There is no default scope anywhere — every attach and every grant names its scope explicitly. A scope is always bounded by the member DID's own access-control capabilities at the mediator."
+    },
+    "MuxScopeValue": {
+      "title": "MuxScopeValue",
+      "type": "string",
+      "enum": [
+        "receive",
+        "pickup",
+        "delete",
+        "send"
+      ],
+      "description": "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket."
+    },
+    "MuxDid": {
+      "title": "MuxDid",
+      "type": "string",
+      "minLength": 7,
+      "maxLength": 2048,
+      "pattern": "^did:[a-z0-9]+:\\S+$",
+      "description": "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself."
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "AttachStatement": {
+      "title": "AttachStatement",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "issuer",
+        "audience",
+        "principal",
+        "sessionId",
+        "muxNonce",
+        "scope",
+        "iat",
+        "exp",
+        "proof"
+      ],
+      "description": "A member DID's statement that the named principal may carry its traffic on one connection — the one whose `sessionId` and `muxNonce` it names — until `exp`, within `scope`. Signed by the member with an embedded Data Integrity proof whose purpose is `authentication`.",
+      "properties": {
+        "type": {
+          "type": "string",
+          "const": "muxAttach",
+          "description": "Always `muxAttach`; names the statement kind, so a statement of one kind is never accepted as another."
+        },
+        "issuer": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The member DID: the signer, and the DID the statement concerns."
+        },
+        "audience": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The mediator's DID. A statement names exactly one mediator and is refused by every other."
+        },
+        "principal": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The principal DID the connection is authenticated as. MUST differ from `issuer`."
+        },
+        "sessionId": {
+          "$ref": "#/$defs/SessionId"
+        },
+        "muxNonce": {
+          "$ref": "#/$defs/MuxNonce"
+        },
+        "scope": {
+          "$ref": "#/$defs/StatementScope"
+        },
+        "iat": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "JWT NumericDate (RFC 7519 §2), whole seconds since 1970-01-01T00:00:00Z UTC: when the statement was signed. MUST NOT be more than 60 seconds in the mediator's future."
+        },
+        "exp": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "JWT NumericDate (RFC 7519 §2): when the statement stops being accepted. REQUIRED; MUST be after `iat` and in the future."
+        },
+        "proof": {
+          "$ref": "#/$defs/MuxDataIntegrityProof"
+        }
+      }
+    },
+    "MuxDataIntegrityProof": {
+      "title": "MuxDataIntegrityProof",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "cryptosuite",
+        "verificationMethod",
+        "proofPurpose",
+        "proofValue"
+      ],
+      "description": "The W3C Data Integrity proof embedded in a mux statement, made by the member DID: the format and verifier Trust Tasks already use for document proofs (SPEC §4.7). The proof covers the whole statement except `proof` itself, as the cryptosuite defines. Closed: a member Data Integrity defines but this list omits is refused.",
+      "properties": {
+        "type": {
+          "type": "string",
+          "const": "DataIntegrityProof"
+        },
+        "cryptosuite": {
+          "type": "string",
+          "enum": [
+            "eddsa-jcs-2022",
+            "eddsa-rdfc-2022"
+          ],
+          "description": "The W3C Data Integrity EdDSA cryptosuite used."
+        },
+        "verificationMethod": {
+          "type": "string",
+          "minLength": 5,
+          "maxLength": 2048,
+          "pattern": "^did:\\S+#\\S+$",
+          "description": "The DID URL of the verification method that signed. MUST be controlled by the statement's `issuer` and listed in that DID's current `authentication` relationship."
+        },
+        "proofPurpose": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64,
+          "description": "MUST be `authentication`. Any other value is refused with `messaging/mux:proofPurposeInvalid` — a proof made for another relationship (an `assertionMethod` credential signature, say) is never accepted as control of the DID."
+        },
+        "created": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL: when the proof was made, as Data Integrity defines it. Covered by the proof; the statement's own `iat` is what the mediator checks."
+        },
+        "proofValue": {
+          "type": "string",
+          "minLength": 2,
+          "maxLength": 4096,
+          "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$",
+          "description": "The multibase (base58btc) signature."
+        }
+      }
+    },
+    "StatementScope": {
+      "title": "StatementScope",
+      "type": "array",
+      "maxItems": 16,
+      "items": {
+        "$ref": "#/$defs/MuxScopeValue"
+      },
+      "description": "The scope a member DID signs into a statement: a JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses. It MUST NOT be empty; an empty signed scope is refused with the task's `emptyScope` code, never read as \"all\". Unlike MuxScope, emptiness is not a schema failure here, so that the refusal is reported per statement rather than failing the whole batch."
+    },
+    "MuxNonce": {
+      "title": "MuxNonce",
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]{43}$",
+      "description": "32 random bytes, base64url without padding, that belong to exactly one connection and are never reused. Attach statements sign over it, which is what makes an attach statement unusable on any other connection."
+    },
+    "SessionId": {
+      "title": "SessionId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The mediator's identifier for one authenticated connection, as announced in that connection's `ready` event."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;