@openvtc/trust-tasks 0.28.23 → 0.28.24

package/dist/messaging/mux/attach/0.1/payload.d.ts

@@ -0,0 +1,996 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/messaging/mux/attach/0.1/payload.schema.json
+ */
+import type { AttachStatement, DataIntegrityProof, Ext, MuxDataIntegrityProof, MuxDid, MuxNonce, MuxScope, MuxScopeValue, SessionId_MessagingMuxV0_1 as SessionId, StatementScope } from "../../../../_shared/components.js";
+/**
+ * A principal attaches member DIDs to the connection that carries the request, each by an attach statement the member DID signed with an embedded Data Integrity proof, bound to this connection. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface MessagingMuxAttachPayload {
+    /**
+     * The members to attach, one attach statement each; the member DID is the statement's `issuer`. Each is checked and answered on its own; the batch is never all-or-nothing. A member DID appears at most once.
+     *
+     * @minItems 1
+     * @maxItems 256
+     */
+    attachments: [AttachStatement, ...AttachStatement[]];
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * The success response to a messaging/mux/attach request: one outcome per attach statement, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/attach/0.1#response.
+ */
+export interface MessagingMuxAttachResponsePayload {
+    /**
+     * @maxItems 256
+     */
+    results: AttachOutcome[];
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * The outcome for one requested member. An `attached` outcome carries `scope`, `expiresAt` and `deliveryActive`; a `refused` outcome carries `code` and nothing else.
+ */
+export interface AttachOutcome {
+    /**
+     * The member DID: the statement's `issuer`.
+     */
+    did: MuxDid;
+    status: "attached" | "refused";
+    /**
+     * Present exactly when `status` is `refused`: the first check the member failed, in the order the specification lists them.
+     */
+    code?: "messaging/mux:statementProofInvalid" | "messaging/mux:didUnresolvable" | "messaging/mux:proofPurposeInvalid" | "messaging/mux:audienceMismatch" | "messaging/mux:principalMismatch" | "messaging/mux/attach:sessionMismatch" | "messaging/mux:notYetValid" | "messaging/mux:statementExpired" | "messaging/mux:lifetimeTooLong" | "messaging/mux:emptyScope" | "messaging/mux:accountUnavailable" | "messaging/mux:scopeNotPermitted" | "messaging/mux/attach:memberQuota";
+    /**
+     * Present exactly when `status` is `attached`: the scope in force.
+     */
+    scope?: MuxScope;
+    /**
+     * Present exactly when `status` is `attached`: when the attach lapses (the statement's `exp`).
+     */
+    expiresAt?: string;
+    /**
+     * Present exactly when `status` is `attached`. False when the member DID has its own direct connection, which takes precedence: the attach is held, and becomes active when that connection ends.
+     */
+    deliveryActive?: boolean;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AttachStatement, DataIntegrityProof, Ext, MuxDataIntegrityProof, MuxDid, MuxNonce, MuxScope, MuxScopeValue, SessionId, StatementScope };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/messaging/mux/attach/0.1";
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export declare const EXTENDS: string | null;
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export declare const DEPRECATION: string | null;
+/** Stable alias for this specification's request payload shape. */
+export type Payload = MessagingMuxAttachPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/messaging/mux/attach/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = MessagingMuxAttachResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/messaging/mux/attach/0.1";
+    readonly title: "Messaging — Mux Attach — payload";
+    readonly description: "A principal attaches member DIDs to the connection that carries the request, each by an attach statement the member DID signed with an embedded Data Integrity proof, bound to this connection. The outer document members are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["attachments"];
+    readonly properties: {
+        readonly attachments: {
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly maxItems: 256;
+            readonly description: "The members to attach, one attach statement each; the member DID is the statement's `issuer`. Each is checked and answered on its own; the batch is never all-or-nothing. A member DID appears at most once.";
+            readonly items: {
+                readonly $ref: "#/$defs/AttachStatement";
+            };
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Messaging — Mux Attach — response payload";
+            readonly description: "The success response to a messaging/mux/attach request: one outcome per attach statement, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/attach/0.1#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["results"];
+            readonly properties: {
+                readonly results: {
+                    readonly type: "array";
+                    readonly maxItems: 256;
+                    readonly items: {
+                        readonly $ref: "#/$defs/AttachOutcome";
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly AttachOutcome: {
+            readonly title: "AttachOutcome";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["did", "status"];
+            readonly description: "The outcome for one requested member. An `attached` outcome carries `scope`, `expiresAt` and `deliveryActive`; a `refused` outcome carries `code` and nothing else.";
+            readonly properties: {
+                readonly did: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The member DID: the statement's `issuer`.";
+                };
+                readonly status: {
+                    readonly type: "string";
+                    readonly enum: readonly ["attached", "refused"];
+                };
+                readonly code: {
+                    readonly type: "string";
+                    readonly enum: readonly ["messaging/mux:statementProofInvalid", "messaging/mux:didUnresolvable", "messaging/mux:proofPurposeInvalid", "messaging/mux:audienceMismatch", "messaging/mux:principalMismatch", "messaging/mux/attach:sessionMismatch", "messaging/mux:notYetValid", "messaging/mux:statementExpired", "messaging/mux:lifetimeTooLong", "messaging/mux:emptyScope", "messaging/mux:accountUnavailable", "messaging/mux:scopeNotPermitted", "messaging/mux/attach:memberQuota"];
+                    readonly description: "Present exactly when `status` is `refused`: the first check the member failed, in the order the specification lists them.";
+                };
+                readonly scope: {
+                    readonly $ref: "#/$defs/MuxScope";
+                    readonly description: "Present exactly when `status` is `attached`: the scope in force.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Present exactly when `status` is `attached`: when the attach lapses (the statement's `exp`).";
+                };
+                readonly deliveryActive: {
+                    readonly type: "boolean";
+                    readonly description: "Present exactly when `status` is `attached`. False when the member DID has its own direct connection, which takes precedence: the attach is held, and becomes active when that connection ends.";
+                };
+            };
+        };
+        readonly MuxScope: {
+            readonly title: "MuxScope";
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly maxItems: 16;
+            readonly items: {
+                readonly $ref: "#/$defs/MuxScopeValue";
+            };
+            readonly description: "A set of capabilities: a non-empty JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses into one. Never empty: an empty scope is refused, never read as \"all\". There is no default scope anywhere — every attach and every grant names its scope explicitly. A scope is always bounded by the member DID's own access-control capabilities at the mediator.";
+        };
+        readonly MuxScopeValue: {
+            readonly title: "MuxScopeValue";
+            readonly type: "string";
+            readonly enum: readonly ["receive", "pickup", "delete", "send"];
+            readonly description: "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket.";
+        };
+        readonly MuxDid: {
+            readonly title: "MuxDid";
+            readonly type: "string";
+            readonly minLength: 7;
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:\\S+$";
+            readonly description: "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself.";
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AttachStatement: {
+            readonly title: "AttachStatement";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "issuer", "audience", "principal", "sessionId", "muxNonce", "scope", "iat", "exp", "proof"];
+            readonly description: "A member DID's statement that the named principal may carry its traffic on one connection — the one whose `sessionId` and `muxNonce` it names — until `exp`, within `scope`. Signed by the member with an embedded Data Integrity proof whose purpose is `authentication`.";
+            readonly properties: {
+                readonly type: {
+                    readonly type: "string";
+                    readonly const: "muxAttach";
+                    readonly description: "Always `muxAttach`; names the statement kind, so a statement of one kind is never accepted as another.";
+                };
+                readonly issuer: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The member DID: the signer, and the DID the statement concerns.";
+                };
+                readonly audience: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The mediator's DID. A statement names exactly one mediator and is refused by every other.";
+                };
+                readonly principal: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The principal DID the connection is authenticated as. MUST differ from `issuer`.";
+                };
+                readonly sessionId: {
+                    readonly $ref: "#/$defs/SessionId";
+                };
+                readonly muxNonce: {
+                    readonly $ref: "#/$defs/MuxNonce";
+                };
+                readonly scope: {
+                    readonly $ref: "#/$defs/StatementScope";
+                };
+                readonly iat: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "JWT NumericDate (RFC 7519 §2), whole seconds since 1970-01-01T00:00:00Z UTC: when the statement was signed. MUST NOT be more than 60 seconds in the mediator's future.";
+                };
+                readonly exp: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "JWT NumericDate (RFC 7519 §2): when the statement stops being accepted. REQUIRED; MUST be after `iat` and in the future.";
+                };
+                readonly proof: {
+                    readonly $ref: "#/$defs/MuxDataIntegrityProof";
+                };
+            };
+        };
+        readonly MuxDataIntegrityProof: {
+            readonly title: "MuxDataIntegrityProof";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "cryptosuite", "verificationMethod", "proofPurpose", "proofValue"];
+            readonly description: "The W3C Data Integrity proof embedded in a mux statement, made by the member DID: the format and verifier Trust Tasks already use for document proofs (SPEC §4.7). The proof covers the whole statement except `proof` itself, as the cryptosuite defines. Closed: a member Data Integrity defines but this list omits is refused.";
+            readonly properties: {
+                readonly type: {
+                    readonly type: "string";
+                    readonly const: "DataIntegrityProof";
+                };
+                readonly cryptosuite: {
+                    readonly type: "string";
+                    readonly enum: readonly ["eddsa-jcs-2022", "eddsa-rdfc-2022"];
+                    readonly description: "The W3C Data Integrity EdDSA cryptosuite used.";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                    readonly minLength: 5;
+                    readonly maxLength: 2048;
+                    readonly pattern: "^did:\\S+#\\S+$";
+                    readonly description: "The DID URL of the verification method that signed. MUST be controlled by the statement's `issuer` and listed in that DID's current `authentication` relationship.";
+                };
+                readonly proofPurpose: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 64;
+                    readonly description: "MUST be `authentication`. Any other value is refused with `messaging/mux:proofPurposeInvalid` — a proof made for another relationship (an `assertionMethod` credential signature, say) is never accepted as control of the DID.";
+                };
+                readonly created: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL: when the proof was made, as Data Integrity defines it. Covered by the proof; the statement's own `iat` is what the mediator checks.";
+                };
+                readonly proofValue: {
+                    readonly type: "string";
+                    readonly minLength: 2;
+                    readonly maxLength: 4096;
+                    readonly pattern: "^z[1-9A-HJ-NP-Za-km-z]+$";
+                    readonly description: "The multibase (base58btc) signature.";
+                };
+            };
+        };
+        readonly StatementScope: {
+            readonly title: "StatementScope";
+            readonly type: "array";
+            readonly maxItems: 16;
+            readonly items: {
+                readonly $ref: "#/$defs/MuxScopeValue";
+            };
+            readonly description: "The scope a member DID signs into a statement: a JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses. It MUST NOT be empty; an empty signed scope is refused with the task's `emptyScope` code, never read as \"all\". Unlike MuxScope, emptiness is not a schema failure here, so that the refusal is reported per statement rather than failing the whole batch.";
+        };
+        readonly MuxNonce: {
+            readonly title: "MuxNonce";
+            readonly type: "string";
+            readonly pattern: "^[A-Za-z0-9_-]{43}$";
+            readonly description: "32 random bytes, base64url without padding, that belong to exactly one connection and are never reused. Attach statements sign over it, which is what makes an attach statement unusable on any other connection.";
+        };
+        readonly SessionId: {
+            readonly title: "SessionId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly description: "The mediator's identifier for one authenticated connection, as announced in that connection's `ready` event.";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Messaging — Mux Attach — response payload";
+            readonly description: "The success response to a messaging/mux/attach request: one outcome per attach statement, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/attach/0.1#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["results"];
+            readonly properties: {
+                readonly results: {
+                    readonly type: "array";
+                    readonly maxItems: 256;
+                    readonly items: {
+                        readonly $ref: "#/$defs/AttachOutcome";
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly AttachOutcome: {
+            readonly title: "AttachOutcome";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["did", "status"];
+            readonly description: "The outcome for one requested member. An `attached` outcome carries `scope`, `expiresAt` and `deliveryActive`; a `refused` outcome carries `code` and nothing else.";
+            readonly properties: {
+                readonly did: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The member DID: the statement's `issuer`.";
+                };
+                readonly status: {
+                    readonly type: "string";
+                    readonly enum: readonly ["attached", "refused"];
+                };
+                readonly code: {
+                    readonly type: "string";
+                    readonly enum: readonly ["messaging/mux:statementProofInvalid", "messaging/mux:didUnresolvable", "messaging/mux:proofPurposeInvalid", "messaging/mux:audienceMismatch", "messaging/mux:principalMismatch", "messaging/mux/attach:sessionMismatch", "messaging/mux:notYetValid", "messaging/mux:statementExpired", "messaging/mux:lifetimeTooLong", "messaging/mux:emptyScope", "messaging/mux:accountUnavailable", "messaging/mux:scopeNotPermitted", "messaging/mux/attach:memberQuota"];
+                    readonly description: "Present exactly when `status` is `refused`: the first check the member failed, in the order the specification lists them.";
+                };
+                readonly scope: {
+                    readonly $ref: "#/$defs/MuxScope";
+                    readonly description: "Present exactly when `status` is `attached`: the scope in force.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Present exactly when `status` is `attached`: when the attach lapses (the statement's `exp`).";
+                };
+                readonly deliveryActive: {
+                    readonly type: "boolean";
+                    readonly description: "Present exactly when `status` is `attached`. False when the member DID has its own direct connection, which takes precedence: the attach is held, and becomes active when that connection ends.";
+                };
+            };
+        };
+        readonly MuxScope: {
+            readonly title: "MuxScope";
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly maxItems: 16;
+            readonly items: {
+                readonly $ref: "#/$defs/MuxScopeValue";
+            };
+            readonly description: "A set of capabilities: a non-empty JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses into one. Never empty: an empty scope is refused, never read as \"all\". There is no default scope anywhere — every attach and every grant names its scope explicitly. A scope is always bounded by the member DID's own access-control capabilities at the mediator.";
+        };
+        readonly MuxScopeValue: {
+            readonly title: "MuxScopeValue";
+            readonly type: "string";
+            readonly enum: readonly ["receive", "pickup", "delete", "send"];
+            readonly description: "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket.";
+        };
+        readonly MuxDid: {
+            readonly title: "MuxDid";
+            readonly type: "string";
+            readonly minLength: 7;
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:\\S+$";
+            readonly description: "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself.";
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AttachStatement: {
+            readonly title: "AttachStatement";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "issuer", "audience", "principal", "sessionId", "muxNonce", "scope", "iat", "exp", "proof"];
+            readonly description: "A member DID's statement that the named principal may carry its traffic on one connection — the one whose `sessionId` and `muxNonce` it names — until `exp`, within `scope`. Signed by the member with an embedded Data Integrity proof whose purpose is `authentication`.";
+            readonly properties: {
+                readonly type: {
+                    readonly type: "string";
+                    readonly const: "muxAttach";
+                    readonly description: "Always `muxAttach`; names the statement kind, so a statement of one kind is never accepted as another.";
+                };
+                readonly issuer: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The member DID: the signer, and the DID the statement concerns.";
+                };
+                readonly audience: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The mediator's DID. A statement names exactly one mediator and is refused by every other.";
+                };
+                readonly principal: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The principal DID the connection is authenticated as. MUST differ from `issuer`.";
+                };
+                readonly sessionId: {
+                    readonly $ref: "#/$defs/SessionId";
+                };
+                readonly muxNonce: {
+                    readonly $ref: "#/$defs/MuxNonce";
+                };
+                readonly scope: {
+                    readonly $ref: "#/$defs/StatementScope";
+                };
+                readonly iat: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "JWT NumericDate (RFC 7519 §2), whole seconds since 1970-01-01T00:00:00Z UTC: when the statement was signed. MUST NOT be more than 60 seconds in the mediator's future.";
+                };
+                readonly exp: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "JWT NumericDate (RFC 7519 §2): when the statement stops being accepted. REQUIRED; MUST be after `iat` and in the future.";
+                };
+                readonly proof: {
+                    readonly $ref: "#/$defs/MuxDataIntegrityProof";
+                };
+            };
+        };
+        readonly MuxDataIntegrityProof: {
+            readonly title: "MuxDataIntegrityProof";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "cryptosuite", "verificationMethod", "proofPurpose", "proofValue"];
+            readonly description: "The W3C Data Integrity proof embedded in a mux statement, made by the member DID: the format and verifier Trust Tasks already use for document proofs (SPEC §4.7). The proof covers the whole statement except `proof` itself, as the cryptosuite defines. Closed: a member Data Integrity defines but this list omits is refused.";
+            readonly properties: {
+                readonly type: {
+                    readonly type: "string";
+                    readonly const: "DataIntegrityProof";
+                };
+                readonly cryptosuite: {
+                    readonly type: "string";
+                    readonly enum: readonly ["eddsa-jcs-2022", "eddsa-rdfc-2022"];
+                    readonly description: "The W3C Data Integrity EdDSA cryptosuite used.";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                    readonly minLength: 5;
+                    readonly maxLength: 2048;
+                    readonly pattern: "^did:\\S+#\\S+$";
+                    readonly description: "The DID URL of the verification method that signed. MUST be controlled by the statement's `issuer` and listed in that DID's current `authentication` relationship.";
+                };
+                readonly proofPurpose: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 64;
+                    readonly description: "MUST be `authentication`. Any other value is refused with `messaging/mux:proofPurposeInvalid` — a proof made for another relationship (an `assertionMethod` credential signature, say) is never accepted as control of the DID.";
+                };
+                readonly created: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL: when the proof was made, as Data Integrity defines it. Covered by the proof; the statement's own `iat` is what the mediator checks.";
+                };
+                readonly proofValue: {
+                    readonly type: "string";
+                    readonly minLength: 2;
+                    readonly maxLength: 4096;
+                    readonly pattern: "^z[1-9A-HJ-NP-Za-km-z]+$";
+                    readonly description: "The multibase (base58btc) signature.";
+                };
+            };
+        };
+        readonly StatementScope: {
+            readonly title: "StatementScope";
+            readonly type: "array";
+            readonly maxItems: 16;
+            readonly items: {
+                readonly $ref: "#/$defs/MuxScopeValue";
+            };
+            readonly description: "The scope a member DID signs into a statement: a JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses. It MUST NOT be empty; an empty signed scope is refused with the task's `emptyScope` code, never read as \"all\". Unlike MuxScope, emptiness is not a schema failure here, so that the refusal is reported per statement rather than failing the whole batch.";
+        };
+        readonly MuxNonce: {
+            readonly title: "MuxNonce";
+            readonly type: "string";
+            readonly pattern: "^[A-Za-z0-9_-]{43}$";
+            readonly description: "32 random bytes, base64url without padding, that belong to exactly one connection and are never reused. Attach statements sign over it, which is what makes an attach statement unusable on any other connection.";
+        };
+        readonly SessionId: {
+            readonly title: "SessionId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly description: "The mediator's identifier for one authenticated connection, as announced in that connection's `ready` event.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/messaging/mux/attach/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/messaging/mux/attach/0.1";
+        readonly title: "Messaging — Mux Attach — payload";
+        readonly description: "A principal attaches member DIDs to the connection that carries the request, each by an attach statement the member DID signed with an embedded Data Integrity proof, bound to this connection. The outer document members are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["attachments"];
+        readonly properties: {
+            readonly attachments: {
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly maxItems: 256;
+                readonly description: "The members to attach, one attach statement each; the member DID is the statement's `issuer`. Each is checked and answered on its own; the batch is never all-or-nothing. A member DID appears at most once.";
+                readonly items: {
+                    readonly $ref: "#/$defs/AttachStatement";
+                };
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Messaging — Mux Attach — response payload";
+                readonly description: "The success response to a messaging/mux/attach request: one outcome per attach statement, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/attach/0.1#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["results"];
+                readonly properties: {
+                    readonly results: {
+                        readonly type: "array";
+                        readonly maxItems: 256;
+                        readonly items: {
+                            readonly $ref: "#/$defs/AttachOutcome";
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly AttachOutcome: {
+                readonly title: "AttachOutcome";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["did", "status"];
+                readonly description: "The outcome for one requested member. An `attached` outcome carries `scope`, `expiresAt` and `deliveryActive`; a `refused` outcome carries `code` and nothing else.";
+                readonly properties: {
+                    readonly did: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The member DID: the statement's `issuer`.";
+                    };
+                    readonly status: {
+                        readonly type: "string";
+                        readonly enum: readonly ["attached", "refused"];
+                    };
+                    readonly code: {
+                        readonly type: "string";
+                        readonly enum: readonly ["messaging/mux:statementProofInvalid", "messaging/mux:didUnresolvable", "messaging/mux:proofPurposeInvalid", "messaging/mux:audienceMismatch", "messaging/mux:principalMismatch", "messaging/mux/attach:sessionMismatch", "messaging/mux:notYetValid", "messaging/mux:statementExpired", "messaging/mux:lifetimeTooLong", "messaging/mux:emptyScope", "messaging/mux:accountUnavailable", "messaging/mux:scopeNotPermitted", "messaging/mux/attach:memberQuota"];
+                        readonly description: "Present exactly when `status` is `refused`: the first check the member failed, in the order the specification lists them.";
+                    };
+                    readonly scope: {
+                        readonly $ref: "#/$defs/MuxScope";
+                        readonly description: "Present exactly when `status` is `attached`: the scope in force.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Present exactly when `status` is `attached`: when the attach lapses (the statement's `exp`).";
+                    };
+                    readonly deliveryActive: {
+                        readonly type: "boolean";
+                        readonly description: "Present exactly when `status` is `attached`. False when the member DID has its own direct connection, which takes precedence: the attach is held, and becomes active when that connection ends.";
+                    };
+                };
+            };
+            readonly MuxScope: {
+                readonly title: "MuxScope";
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly maxItems: 16;
+                readonly items: {
+                    readonly $ref: "#/$defs/MuxScopeValue";
+                };
+                readonly description: "A set of capabilities: a non-empty JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses into one. Never empty: an empty scope is refused, never read as \"all\". There is no default scope anywhere — every attach and every grant names its scope explicitly. A scope is always bounded by the member DID's own access-control capabilities at the mediator.";
+            };
+            readonly MuxScopeValue: {
+                readonly title: "MuxScopeValue";
+                readonly type: "string";
+                readonly enum: readonly ["receive", "pickup", "delete", "send"];
+                readonly description: "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket.";
+            };
+            readonly MuxDid: {
+                readonly title: "MuxDid";
+                readonly type: "string";
+                readonly minLength: 7;
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:\\S+$";
+                readonly description: "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself.";
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AttachStatement: {
+                readonly title: "AttachStatement";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "issuer", "audience", "principal", "sessionId", "muxNonce", "scope", "iat", "exp", "proof"];
+                readonly description: "A member DID's statement that the named principal may carry its traffic on one connection — the one whose `sessionId` and `muxNonce` it names — until `exp`, within `scope`. Signed by the member with an embedded Data Integrity proof whose purpose is `authentication`.";
+                readonly properties: {
+                    readonly type: {
+                        readonly type: "string";
+                        readonly const: "muxAttach";
+                        readonly description: "Always `muxAttach`; names the statement kind, so a statement of one kind is never accepted as another.";
+                    };
+                    readonly issuer: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The member DID: the signer, and the DID the statement concerns.";
+                    };
+                    readonly audience: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The mediator's DID. A statement names exactly one mediator and is refused by every other.";
+                    };
+                    readonly principal: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The principal DID the connection is authenticated as. MUST differ from `issuer`.";
+                    };
+                    readonly sessionId: {
+                        readonly $ref: "#/$defs/SessionId";
+                    };
+                    readonly muxNonce: {
+                        readonly $ref: "#/$defs/MuxNonce";
+                    };
+                    readonly scope: {
+                        readonly $ref: "#/$defs/StatementScope";
+                    };
+                    readonly iat: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "JWT NumericDate (RFC 7519 §2), whole seconds since 1970-01-01T00:00:00Z UTC: when the statement was signed. MUST NOT be more than 60 seconds in the mediator's future.";
+                    };
+                    readonly exp: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "JWT NumericDate (RFC 7519 §2): when the statement stops being accepted. REQUIRED; MUST be after `iat` and in the future.";
+                    };
+                    readonly proof: {
+                        readonly $ref: "#/$defs/MuxDataIntegrityProof";
+                    };
+                };
+            };
+            readonly MuxDataIntegrityProof: {
+                readonly title: "MuxDataIntegrityProof";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "cryptosuite", "verificationMethod", "proofPurpose", "proofValue"];
+                readonly description: "The W3C Data Integrity proof embedded in a mux statement, made by the member DID: the format and verifier Trust Tasks already use for document proofs (SPEC §4.7). The proof covers the whole statement except `proof` itself, as the cryptosuite defines. Closed: a member Data Integrity defines but this list omits is refused.";
+                readonly properties: {
+                    readonly type: {
+                        readonly type: "string";
+                        readonly const: "DataIntegrityProof";
+                    };
+                    readonly cryptosuite: {
+                        readonly type: "string";
+                        readonly enum: readonly ["eddsa-jcs-2022", "eddsa-rdfc-2022"];
+                        readonly description: "The W3C Data Integrity EdDSA cryptosuite used.";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                        readonly minLength: 5;
+                        readonly maxLength: 2048;
+                        readonly pattern: "^did:\\S+#\\S+$";
+                        readonly description: "The DID URL of the verification method that signed. MUST be controlled by the statement's `issuer` and listed in that DID's current `authentication` relationship.";
+                    };
+                    readonly proofPurpose: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly description: "MUST be `authentication`. Any other value is refused with `messaging/mux:proofPurposeInvalid` — a proof made for another relationship (an `assertionMethod` credential signature, say) is never accepted as control of the DID.";
+                    };
+                    readonly created: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL: when the proof was made, as Data Integrity defines it. Covered by the proof; the statement's own `iat` is what the mediator checks.";
+                    };
+                    readonly proofValue: {
+                        readonly type: "string";
+                        readonly minLength: 2;
+                        readonly maxLength: 4096;
+                        readonly pattern: "^z[1-9A-HJ-NP-Za-km-z]+$";
+                        readonly description: "The multibase (base58btc) signature.";
+                    };
+                };
+            };
+            readonly StatementScope: {
+                readonly title: "StatementScope";
+                readonly type: "array";
+                readonly maxItems: 16;
+                readonly items: {
+                    readonly $ref: "#/$defs/MuxScopeValue";
+                };
+                readonly description: "The scope a member DID signs into a statement: a JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses. It MUST NOT be empty; an empty signed scope is refused with the task's `emptyScope` code, never read as \"all\". Unlike MuxScope, emptiness is not a schema failure here, so that the refusal is reported per statement rather than failing the whole batch.";
+            };
+            readonly MuxNonce: {
+                readonly title: "MuxNonce";
+                readonly type: "string";
+                readonly pattern: "^[A-Za-z0-9_-]{43}$";
+                readonly description: "32 random bytes, base64url without padding, that belong to exactly one connection and are never reused. Attach statements sign over it, which is what makes an attach statement unusable on any other connection.";
+            };
+            readonly SessionId: {
+                readonly title: "SessionId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly description: "The mediator's identifier for one authenticated connection, as announced in that connection's `ready` event.";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/messaging/mux/attach/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Messaging — Mux Attach — response payload";
+                readonly description: "The success response to a messaging/mux/attach request: one outcome per attach statement, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/attach/0.1#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["results"];
+                readonly properties: {
+                    readonly results: {
+                        readonly type: "array";
+                        readonly maxItems: 256;
+                        readonly items: {
+                            readonly $ref: "#/$defs/AttachOutcome";
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly AttachOutcome: {
+                readonly title: "AttachOutcome";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["did", "status"];
+                readonly description: "The outcome for one requested member. An `attached` outcome carries `scope`, `expiresAt` and `deliveryActive`; a `refused` outcome carries `code` and nothing else.";
+                readonly properties: {
+                    readonly did: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The member DID: the statement's `issuer`.";
+                    };
+                    readonly status: {
+                        readonly type: "string";
+                        readonly enum: readonly ["attached", "refused"];
+                    };
+                    readonly code: {
+                        readonly type: "string";
+                        readonly enum: readonly ["messaging/mux:statementProofInvalid", "messaging/mux:didUnresolvable", "messaging/mux:proofPurposeInvalid", "messaging/mux:audienceMismatch", "messaging/mux:principalMismatch", "messaging/mux/attach:sessionMismatch", "messaging/mux:notYetValid", "messaging/mux:statementExpired", "messaging/mux:lifetimeTooLong", "messaging/mux:emptyScope", "messaging/mux:accountUnavailable", "messaging/mux:scopeNotPermitted", "messaging/mux/attach:memberQuota"];
+                        readonly description: "Present exactly when `status` is `refused`: the first check the member failed, in the order the specification lists them.";
+                    };
+                    readonly scope: {
+                        readonly $ref: "#/$defs/MuxScope";
+                        readonly description: "Present exactly when `status` is `attached`: the scope in force.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Present exactly when `status` is `attached`: when the attach lapses (the statement's `exp`).";
+                    };
+                    readonly deliveryActive: {
+                        readonly type: "boolean";
+                        readonly description: "Present exactly when `status` is `attached`. False when the member DID has its own direct connection, which takes precedence: the attach is held, and becomes active when that connection ends.";
+                    };
+                };
+            };
+            readonly MuxScope: {
+                readonly title: "MuxScope";
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly maxItems: 16;
+                readonly items: {
+                    readonly $ref: "#/$defs/MuxScopeValue";
+                };
+                readonly description: "A set of capabilities: a non-empty JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses into one. Never empty: an empty scope is refused, never read as \"all\". There is no default scope anywhere — every attach and every grant names its scope explicitly. A scope is always bounded by the member DID's own access-control capabilities at the mediator.";
+            };
+            readonly MuxScopeValue: {
+                readonly title: "MuxScopeValue";
+                readonly type: "string";
+                readonly enum: readonly ["receive", "pickup", "delete", "send"];
+                readonly description: "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket.";
+            };
+            readonly MuxDid: {
+                readonly title: "MuxDid";
+                readonly type: "string";
+                readonly minLength: 7;
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:\\S+$";
+                readonly description: "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself.";
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AttachStatement: {
+                readonly title: "AttachStatement";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "issuer", "audience", "principal", "sessionId", "muxNonce", "scope", "iat", "exp", "proof"];
+                readonly description: "A member DID's statement that the named principal may carry its traffic on one connection — the one whose `sessionId` and `muxNonce` it names — until `exp`, within `scope`. Signed by the member with an embedded Data Integrity proof whose purpose is `authentication`.";
+                readonly properties: {
+                    readonly type: {
+                        readonly type: "string";
+                        readonly const: "muxAttach";
+                        readonly description: "Always `muxAttach`; names the statement kind, so a statement of one kind is never accepted as another.";
+                    };
+                    readonly issuer: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The member DID: the signer, and the DID the statement concerns.";
+                    };
+                    readonly audience: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The mediator's DID. A statement names exactly one mediator and is refused by every other.";
+                    };
+                    readonly principal: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The principal DID the connection is authenticated as. MUST differ from `issuer`.";
+                    };
+                    readonly sessionId: {
+                        readonly $ref: "#/$defs/SessionId";
+                    };
+                    readonly muxNonce: {
+                        readonly $ref: "#/$defs/MuxNonce";
+                    };
+                    readonly scope: {
+                        readonly $ref: "#/$defs/StatementScope";
+                    };
+                    readonly iat: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "JWT NumericDate (RFC 7519 §2), whole seconds since 1970-01-01T00:00:00Z UTC: when the statement was signed. MUST NOT be more than 60 seconds in the mediator's future.";
+                    };
+                    readonly exp: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "JWT NumericDate (RFC 7519 §2): when the statement stops being accepted. REQUIRED; MUST be after `iat` and in the future.";
+                    };
+                    readonly proof: {
+                        readonly $ref: "#/$defs/MuxDataIntegrityProof";
+                    };
+                };
+            };
+            readonly MuxDataIntegrityProof: {
+                readonly title: "MuxDataIntegrityProof";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "cryptosuite", "verificationMethod", "proofPurpose", "proofValue"];
+                readonly description: "The W3C Data Integrity proof embedded in a mux statement, made by the member DID: the format and verifier Trust Tasks already use for document proofs (SPEC §4.7). The proof covers the whole statement except `proof` itself, as the cryptosuite defines. Closed: a member Data Integrity defines but this list omits is refused.";
+                readonly properties: {
+                    readonly type: {
+                        readonly type: "string";
+                        readonly const: "DataIntegrityProof";
+                    };
+                    readonly cryptosuite: {
+                        readonly type: "string";
+                        readonly enum: readonly ["eddsa-jcs-2022", "eddsa-rdfc-2022"];
+                        readonly description: "The W3C Data Integrity EdDSA cryptosuite used.";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                        readonly minLength: 5;
+                        readonly maxLength: 2048;
+                        readonly pattern: "^did:\\S+#\\S+$";
+                        readonly description: "The DID URL of the verification method that signed. MUST be controlled by the statement's `issuer` and listed in that DID's current `authentication` relationship.";
+                    };
+                    readonly proofPurpose: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly description: "MUST be `authentication`. Any other value is refused with `messaging/mux:proofPurposeInvalid` — a proof made for another relationship (an `assertionMethod` credential signature, say) is never accepted as control of the DID.";
+                    };
+                    readonly created: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL: when the proof was made, as Data Integrity defines it. Covered by the proof; the statement's own `iat` is what the mediator checks.";
+                    };
+                    readonly proofValue: {
+                        readonly type: "string";
+                        readonly minLength: 2;
+                        readonly maxLength: 4096;
+                        readonly pattern: "^z[1-9A-HJ-NP-Za-km-z]+$";
+                        readonly description: "The multibase (base58btc) signature.";
+                    };
+                };
+            };
+            readonly StatementScope: {
+                readonly title: "StatementScope";
+                readonly type: "array";
+                readonly maxItems: 16;
+                readonly items: {
+                    readonly $ref: "#/$defs/MuxScopeValue";
+                };
+                readonly description: "The scope a member DID signs into a statement: a JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses. It MUST NOT be empty; an empty signed scope is refused with the task's `emptyScope` code, never read as \"all\". Unlike MuxScope, emptiness is not a schema failure here, so that the refusal is reported per statement rather than failing the whole batch.";
+            };
+            readonly MuxNonce: {
+                readonly title: "MuxNonce";
+                readonly type: "string";
+                readonly pattern: "^[A-Za-z0-9_-]{43}$";
+                readonly description: "32 random bytes, base64url without padding, that belong to exactly one connection and are never reused. Attach statements sign over it, which is what makes an attach statement unusable on any other connection.";
+            };
+            readonly SessionId: {
+                readonly title: "SessionId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly description: "The mediator's identifier for one authenticated connection, as announced in that connection's `ready` event.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map