@openvtc/trust-tasks 0.28.23 → 0.28.25

package/dist/messaging/mux/grant/0.1/payload.d.ts

@@ -0,0 +1,1008 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/messaging/mux/grant/0.1/payload.schema.json
+ */
+import type { DataIntegrityProof, Ext, GrantId, GrantStatement, MuxDataIntegrityProof, MuxDid, MuxScopeValue, StatementScope } from "../../../../_shared/components.js";
+/**
+ * Store or replace grants: each a grant statement in which a member DID, with an embedded Data Integrity proof, delegates to a principal the carrying of its messages, under the member's current epoch and an explicit scope and expiry. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface MessagingMuxGrantPayload {
+    /**
+     * The grant statements to store; the member DID is each statement's `issuer`. Each is checked and answered on its own; the batch is never all-or-nothing.
+     *
+     * @minItems 1
+     * @maxItems 256
+     */
+    grants: [GrantStatement, ...GrantStatement[]];
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * The success response to a messaging/mux/grant request: one outcome per submitted grant, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/grant/0.1#response.
+ */
+export interface MessagingMuxGrantResponsePayload {
+    /**
+     * @maxItems 256
+     */
+    results: GrantOutcome[];
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * The outcome for one submitted grant.
+ */
+export interface GrantOutcome {
+    status: "stored" | "refused";
+    /**
+     * The grant's identifier, from its statement.
+     */
+    grantId: GrantId;
+    /**
+     * The member DID: the statement's `issuer`.
+     */
+    did: MuxDid;
+    /**
+     * The principal DID, from the statement.
+     */
+    principal: MuxDid;
+    /**
+     * Present exactly when `status` is `refused`: the first check the grant failed, in the order the specification lists them.
+     */
+    code?: "messaging/mux:statementProofInvalid" | "messaging/mux:didUnresolvable" | "messaging/mux:proofPurposeInvalid" | "messaging/mux:audienceMismatch" | "messaging/mux:principalMismatch" | "messaging/mux:notYetValid" | "messaging/mux:statementExpired" | "messaging/mux:lifetimeTooLong" | "messaging/mux:emptyScope" | "messaging/mux:accountUnavailable" | "messaging/mux:scopeNotPermitted" | "messaging/mux/grant:epochMismatch" | "messaging/mux/grant:replayed" | "messaging/mux/grant:grantIdReused" | "messaging/mux/grant:didQuota" | "messaging/mux/grant:principalQuota" | "messaging/mux/grant:contended";
+    /**
+     * Present exactly when `code` is `messaging/mux/grant:epochMismatch`: the member DID's current epoch, under which the member re-signs.
+     */
+    currentEpoch?: number;
+    /**
+     * Present exactly when `code` is `messaging/mux/grant:replayed`: the instant a replacement grant's `iat` must be strictly later than — the principal's replay floor for this member, or the `iat` of the grant it would replace, whichever is later.
+     */
+    replayFloorAt?: string;
+    /**
+     * Present when this grant replaced an earlier grant for the same member and principal, in whatever state that grant was. Replacing raises the principal's replay floor, so the replaced statement can never be stored again.
+     */
+    replacedGrantId?: GrantId;
+    /**
+     * Present exactly when `status` is `stored`: whether the member was attached at once to a connection the principal holds.
+     */
+    attachedNow?: boolean;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DataIntegrityProof, Ext, GrantId, GrantStatement, MuxDataIntegrityProof, MuxDid, MuxScopeValue, StatementScope };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/messaging/mux/grant/0.1";
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export declare const EXTENDS: string | null;
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export declare const DEPRECATION: string | null;
+/** Stable alias for this specification's request payload shape. */
+export type Payload = MessagingMuxGrantPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/messaging/mux/grant/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = MessagingMuxGrantResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/messaging/mux/grant/0.1";
+    readonly title: "Messaging — Mux Grant — payload";
+    readonly description: "Store or replace grants: each a grant statement in which a member DID, with an embedded Data Integrity proof, delegates to a principal the carrying of its messages, under the member's current epoch and an explicit scope and expiry. The outer document members are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["grants"];
+    readonly properties: {
+        readonly grants: {
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly maxItems: 256;
+            readonly description: "The grant statements to store; the member DID is each statement's `issuer`. Each is checked and answered on its own; the batch is never all-or-nothing.";
+            readonly items: {
+                readonly $ref: "#/$defs/GrantStatement";
+            };
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Messaging — Mux Grant — response payload";
+            readonly description: "The success response to a messaging/mux/grant request: one outcome per submitted grant, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/grant/0.1#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["results"];
+            readonly properties: {
+                readonly results: {
+                    readonly type: "array";
+                    readonly maxItems: 256;
+                    readonly items: {
+                        readonly $ref: "#/$defs/GrantOutcome";
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly GrantOutcome: {
+            readonly title: "GrantOutcome";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["status", "grantId", "did", "principal"];
+            readonly description: "The outcome for one submitted grant.";
+            readonly properties: {
+                readonly status: {
+                    readonly type: "string";
+                    readonly enum: readonly ["stored", "refused"];
+                };
+                readonly grantId: {
+                    readonly $ref: "#/$defs/GrantId";
+                    readonly description: "The grant's identifier, from its statement.";
+                };
+                readonly did: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The member DID: the statement's `issuer`.";
+                };
+                readonly principal: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The principal DID, from the statement.";
+                };
+                readonly code: {
+                    readonly type: "string";
+                    readonly enum: readonly ["messaging/mux:statementProofInvalid", "messaging/mux:didUnresolvable", "messaging/mux:proofPurposeInvalid", "messaging/mux:audienceMismatch", "messaging/mux:principalMismatch", "messaging/mux:notYetValid", "messaging/mux:statementExpired", "messaging/mux:lifetimeTooLong", "messaging/mux:emptyScope", "messaging/mux:accountUnavailable", "messaging/mux:scopeNotPermitted", "messaging/mux/grant:epochMismatch", "messaging/mux/grant:replayed", "messaging/mux/grant:grantIdReused", "messaging/mux/grant:didQuota", "messaging/mux/grant:principalQuota", "messaging/mux/grant:contended"];
+                    readonly description: "Present exactly when `status` is `refused`: the first check the grant failed, in the order the specification lists them.";
+                };
+                readonly currentEpoch: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Present exactly when `code` is `messaging/mux/grant:epochMismatch`: the member DID's current epoch, under which the member re-signs.";
+                };
+                readonly replayFloorAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Present exactly when `code` is `messaging/mux/grant:replayed`: the instant a replacement grant's `iat` must be strictly later than — the principal's replay floor for this member, or the `iat` of the grant it would replace, whichever is later.";
+                };
+                readonly replacedGrantId: {
+                    readonly $ref: "#/$defs/GrantId";
+                    readonly description: "Present when this grant replaced an earlier grant for the same member and principal, in whatever state that grant was. Replacing raises the principal's replay floor, so the replaced statement can never be stored again.";
+                };
+                readonly attachedNow: {
+                    readonly type: "boolean";
+                    readonly description: "Present exactly when `status` is `stored`: whether the member was attached at once to a connection the principal holds.";
+                };
+            };
+        };
+        readonly GrantId: {
+            readonly title: "GrantId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly pattern: "^[A-Za-z0-9._:-]+$";
+            readonly description: "A grant's identifier, chosen by the member DID's signer and carried in its grant statement; a UUID is RECOMMENDED. A mediator refuses a grant whose identifier is already on the member DID's record.";
+        };
+        readonly MuxDid: {
+            readonly title: "MuxDid";
+            readonly type: "string";
+            readonly minLength: 7;
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:\\S+$";
+            readonly description: "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself.";
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly GrantStatement: {
+            readonly title: "GrantStatement";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "issuer", "audience", "grantId", "principal", "scope", "epoch", "iat", "exp", "proof"];
+            readonly description: "A member DID's standing statement that the named principal may carry its traffic at this mediator, on any connection, until `exp`, within `scope`, under the member's current `epoch`. Signed by the member with an embedded Data Integrity proof whose purpose is `authentication`, and stored verbatim by the mediator as the only evidence of the delegation.";
+            readonly properties: {
+                readonly type: {
+                    readonly type: "string";
+                    readonly const: "muxGrant";
+                    readonly description: "Always `muxGrant`; names the statement kind, so a statement of one kind is never accepted as another.";
+                };
+                readonly issuer: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The member DID: the signer, and the DID the statement concerns.";
+                };
+                readonly audience: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The mediator's DID. A statement names exactly one mediator and is refused by every other.";
+                };
+                readonly grantId: {
+                    readonly $ref: "#/$defs/GrantId";
+                };
+                readonly principal: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The principal DID that may carry the member's traffic. MUST differ from `issuer`.";
+                };
+                readonly scope: {
+                    readonly $ref: "#/$defs/StatementScope";
+                };
+                readonly epoch: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "The member DID's current epoch at the mediator. Only messaging/mux/revoke-all advances it.";
+                };
+                readonly iat: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "JWT NumericDate (RFC 7519 §2), whole seconds since 1970-01-01T00:00:00Z UTC: when the statement was signed. MUST NOT be more than 60 seconds in the mediator's future.";
+                };
+                readonly exp: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "JWT NumericDate (RFC 7519 §2): when the statement stops being accepted. REQUIRED; MUST be after `iat` and in the future.";
+                };
+                readonly proof: {
+                    readonly $ref: "#/$defs/MuxDataIntegrityProof";
+                };
+            };
+        };
+        readonly MuxDataIntegrityProof: {
+            readonly title: "MuxDataIntegrityProof";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "cryptosuite", "verificationMethod", "proofPurpose", "proofValue"];
+            readonly description: "The W3C Data Integrity proof embedded in a mux statement, made by the member DID: the format and verifier Trust Tasks already use for document proofs (SPEC §4.7). The proof covers the whole statement except `proof` itself, as the cryptosuite defines. Closed: a member Data Integrity defines but this list omits is refused.";
+            readonly properties: {
+                readonly type: {
+                    readonly type: "string";
+                    readonly const: "DataIntegrityProof";
+                };
+                readonly cryptosuite: {
+                    readonly type: "string";
+                    readonly enum: readonly ["eddsa-jcs-2022", "eddsa-rdfc-2022"];
+                    readonly description: "The W3C Data Integrity EdDSA cryptosuite used.";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                    readonly minLength: 5;
+                    readonly maxLength: 2048;
+                    readonly pattern: "^did:\\S+#\\S+$";
+                    readonly description: "The DID URL of the verification method that signed. MUST be controlled by the statement's `issuer` and listed in that DID's current `authentication` relationship.";
+                };
+                readonly proofPurpose: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 64;
+                    readonly description: "MUST be `authentication`. Any other value is refused with `messaging/mux:proofPurposeInvalid` — a proof made for another relationship (an `assertionMethod` credential signature, say) is never accepted as control of the DID.";
+                };
+                readonly created: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL: when the proof was made, as Data Integrity defines it. Covered by the proof; the statement's own `iat` is what the mediator checks.";
+                };
+                readonly proofValue: {
+                    readonly type: "string";
+                    readonly minLength: 2;
+                    readonly maxLength: 4096;
+                    readonly pattern: "^z[1-9A-HJ-NP-Za-km-z]+$";
+                    readonly description: "The multibase (base58btc) signature.";
+                };
+            };
+        };
+        readonly StatementScope: {
+            readonly title: "StatementScope";
+            readonly type: "array";
+            readonly maxItems: 16;
+            readonly items: {
+                readonly $ref: "#/$defs/MuxScopeValue";
+            };
+            readonly description: "The scope a member DID signs into a statement: a JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses. It MUST NOT be empty; an empty signed scope is refused with the task's `emptyScope` code, never read as \"all\". Unlike MuxScope, emptiness is not a schema failure here, so that the refusal is reported per statement rather than failing the whole batch.";
+        };
+        readonly MuxScopeValue: {
+            readonly title: "MuxScopeValue";
+            readonly type: "string";
+            readonly enum: readonly ["receive", "pickup", "delete", "send"];
+            readonly description: "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket.";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Messaging — Mux Grant — response payload";
+            readonly description: "The success response to a messaging/mux/grant request: one outcome per submitted grant, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/grant/0.1#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["results"];
+            readonly properties: {
+                readonly results: {
+                    readonly type: "array";
+                    readonly maxItems: 256;
+                    readonly items: {
+                        readonly $ref: "#/$defs/GrantOutcome";
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly GrantOutcome: {
+            readonly title: "GrantOutcome";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["status", "grantId", "did", "principal"];
+            readonly description: "The outcome for one submitted grant.";
+            readonly properties: {
+                readonly status: {
+                    readonly type: "string";
+                    readonly enum: readonly ["stored", "refused"];
+                };
+                readonly grantId: {
+                    readonly $ref: "#/$defs/GrantId";
+                    readonly description: "The grant's identifier, from its statement.";
+                };
+                readonly did: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The member DID: the statement's `issuer`.";
+                };
+                readonly principal: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The principal DID, from the statement.";
+                };
+                readonly code: {
+                    readonly type: "string";
+                    readonly enum: readonly ["messaging/mux:statementProofInvalid", "messaging/mux:didUnresolvable", "messaging/mux:proofPurposeInvalid", "messaging/mux:audienceMismatch", "messaging/mux:principalMismatch", "messaging/mux:notYetValid", "messaging/mux:statementExpired", "messaging/mux:lifetimeTooLong", "messaging/mux:emptyScope", "messaging/mux:accountUnavailable", "messaging/mux:scopeNotPermitted", "messaging/mux/grant:epochMismatch", "messaging/mux/grant:replayed", "messaging/mux/grant:grantIdReused", "messaging/mux/grant:didQuota", "messaging/mux/grant:principalQuota", "messaging/mux/grant:contended"];
+                    readonly description: "Present exactly when `status` is `refused`: the first check the grant failed, in the order the specification lists them.";
+                };
+                readonly currentEpoch: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Present exactly when `code` is `messaging/mux/grant:epochMismatch`: the member DID's current epoch, under which the member re-signs.";
+                };
+                readonly replayFloorAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Present exactly when `code` is `messaging/mux/grant:replayed`: the instant a replacement grant's `iat` must be strictly later than — the principal's replay floor for this member, or the `iat` of the grant it would replace, whichever is later.";
+                };
+                readonly replacedGrantId: {
+                    readonly $ref: "#/$defs/GrantId";
+                    readonly description: "Present when this grant replaced an earlier grant for the same member and principal, in whatever state that grant was. Replacing raises the principal's replay floor, so the replaced statement can never be stored again.";
+                };
+                readonly attachedNow: {
+                    readonly type: "boolean";
+                    readonly description: "Present exactly when `status` is `stored`: whether the member was attached at once to a connection the principal holds.";
+                };
+            };
+        };
+        readonly GrantId: {
+            readonly title: "GrantId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly pattern: "^[A-Za-z0-9._:-]+$";
+            readonly description: "A grant's identifier, chosen by the member DID's signer and carried in its grant statement; a UUID is RECOMMENDED. A mediator refuses a grant whose identifier is already on the member DID's record.";
+        };
+        readonly MuxDid: {
+            readonly title: "MuxDid";
+            readonly type: "string";
+            readonly minLength: 7;
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:\\S+$";
+            readonly description: "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself.";
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly GrantStatement: {
+            readonly title: "GrantStatement";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "issuer", "audience", "grantId", "principal", "scope", "epoch", "iat", "exp", "proof"];
+            readonly description: "A member DID's standing statement that the named principal may carry its traffic at this mediator, on any connection, until `exp`, within `scope`, under the member's current `epoch`. Signed by the member with an embedded Data Integrity proof whose purpose is `authentication`, and stored verbatim by the mediator as the only evidence of the delegation.";
+            readonly properties: {
+                readonly type: {
+                    readonly type: "string";
+                    readonly const: "muxGrant";
+                    readonly description: "Always `muxGrant`; names the statement kind, so a statement of one kind is never accepted as another.";
+                };
+                readonly issuer: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The member DID: the signer, and the DID the statement concerns.";
+                };
+                readonly audience: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The mediator's DID. A statement names exactly one mediator and is refused by every other.";
+                };
+                readonly grantId: {
+                    readonly $ref: "#/$defs/GrantId";
+                };
+                readonly principal: {
+                    readonly $ref: "#/$defs/MuxDid";
+                    readonly description: "The principal DID that may carry the member's traffic. MUST differ from `issuer`.";
+                };
+                readonly scope: {
+                    readonly $ref: "#/$defs/StatementScope";
+                };
+                readonly epoch: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "The member DID's current epoch at the mediator. Only messaging/mux/revoke-all advances it.";
+                };
+                readonly iat: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "JWT NumericDate (RFC 7519 §2), whole seconds since 1970-01-01T00:00:00Z UTC: when the statement was signed. MUST NOT be more than 60 seconds in the mediator's future.";
+                };
+                readonly exp: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "JWT NumericDate (RFC 7519 §2): when the statement stops being accepted. REQUIRED; MUST be after `iat` and in the future.";
+                };
+                readonly proof: {
+                    readonly $ref: "#/$defs/MuxDataIntegrityProof";
+                };
+            };
+        };
+        readonly MuxDataIntegrityProof: {
+            readonly title: "MuxDataIntegrityProof";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "cryptosuite", "verificationMethod", "proofPurpose", "proofValue"];
+            readonly description: "The W3C Data Integrity proof embedded in a mux statement, made by the member DID: the format and verifier Trust Tasks already use for document proofs (SPEC §4.7). The proof covers the whole statement except `proof` itself, as the cryptosuite defines. Closed: a member Data Integrity defines but this list omits is refused.";
+            readonly properties: {
+                readonly type: {
+                    readonly type: "string";
+                    readonly const: "DataIntegrityProof";
+                };
+                readonly cryptosuite: {
+                    readonly type: "string";
+                    readonly enum: readonly ["eddsa-jcs-2022", "eddsa-rdfc-2022"];
+                    readonly description: "The W3C Data Integrity EdDSA cryptosuite used.";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                    readonly minLength: 5;
+                    readonly maxLength: 2048;
+                    readonly pattern: "^did:\\S+#\\S+$";
+                    readonly description: "The DID URL of the verification method that signed. MUST be controlled by the statement's `issuer` and listed in that DID's current `authentication` relationship.";
+                };
+                readonly proofPurpose: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 64;
+                    readonly description: "MUST be `authentication`. Any other value is refused with `messaging/mux:proofPurposeInvalid` — a proof made for another relationship (an `assertionMethod` credential signature, say) is never accepted as control of the DID.";
+                };
+                readonly created: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "OPTIONAL: when the proof was made, as Data Integrity defines it. Covered by the proof; the statement's own `iat` is what the mediator checks.";
+                };
+                readonly proofValue: {
+                    readonly type: "string";
+                    readonly minLength: 2;
+                    readonly maxLength: 4096;
+                    readonly pattern: "^z[1-9A-HJ-NP-Za-km-z]+$";
+                    readonly description: "The multibase (base58btc) signature.";
+                };
+            };
+        };
+        readonly StatementScope: {
+            readonly title: "StatementScope";
+            readonly type: "array";
+            readonly maxItems: 16;
+            readonly items: {
+                readonly $ref: "#/$defs/MuxScopeValue";
+            };
+            readonly description: "The scope a member DID signs into a statement: a JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses. It MUST NOT be empty; an empty signed scope is refused with the task's `emptyScope` code, never read as \"all\". Unlike MuxScope, emptiness is not a schema failure here, so that the refusal is reported per statement rather than failing the whole batch.";
+        };
+        readonly MuxScopeValue: {
+            readonly title: "MuxScopeValue";
+            readonly type: "string";
+            readonly enum: readonly ["receive", "pickup", "delete", "send"];
+            readonly description: "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/messaging/mux/grant/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/messaging/mux/grant/0.1";
+        readonly title: "Messaging — Mux Grant — payload";
+        readonly description: "Store or replace grants: each a grant statement in which a member DID, with an embedded Data Integrity proof, delegates to a principal the carrying of its messages, under the member's current epoch and an explicit scope and expiry. The outer document members are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["grants"];
+        readonly properties: {
+            readonly grants: {
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly maxItems: 256;
+                readonly description: "The grant statements to store; the member DID is each statement's `issuer`. Each is checked and answered on its own; the batch is never all-or-nothing.";
+                readonly items: {
+                    readonly $ref: "#/$defs/GrantStatement";
+                };
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Messaging — Mux Grant — response payload";
+                readonly description: "The success response to a messaging/mux/grant request: one outcome per submitted grant, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/grant/0.1#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["results"];
+                readonly properties: {
+                    readonly results: {
+                        readonly type: "array";
+                        readonly maxItems: 256;
+                        readonly items: {
+                            readonly $ref: "#/$defs/GrantOutcome";
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly GrantOutcome: {
+                readonly title: "GrantOutcome";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["status", "grantId", "did", "principal"];
+                readonly description: "The outcome for one submitted grant.";
+                readonly properties: {
+                    readonly status: {
+                        readonly type: "string";
+                        readonly enum: readonly ["stored", "refused"];
+                    };
+                    readonly grantId: {
+                        readonly $ref: "#/$defs/GrantId";
+                        readonly description: "The grant's identifier, from its statement.";
+                    };
+                    readonly did: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The member DID: the statement's `issuer`.";
+                    };
+                    readonly principal: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The principal DID, from the statement.";
+                    };
+                    readonly code: {
+                        readonly type: "string";
+                        readonly enum: readonly ["messaging/mux:statementProofInvalid", "messaging/mux:didUnresolvable", "messaging/mux:proofPurposeInvalid", "messaging/mux:audienceMismatch", "messaging/mux:principalMismatch", "messaging/mux:notYetValid", "messaging/mux:statementExpired", "messaging/mux:lifetimeTooLong", "messaging/mux:emptyScope", "messaging/mux:accountUnavailable", "messaging/mux:scopeNotPermitted", "messaging/mux/grant:epochMismatch", "messaging/mux/grant:replayed", "messaging/mux/grant:grantIdReused", "messaging/mux/grant:didQuota", "messaging/mux/grant:principalQuota", "messaging/mux/grant:contended"];
+                        readonly description: "Present exactly when `status` is `refused`: the first check the grant failed, in the order the specification lists them.";
+                    };
+                    readonly currentEpoch: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Present exactly when `code` is `messaging/mux/grant:epochMismatch`: the member DID's current epoch, under which the member re-signs.";
+                    };
+                    readonly replayFloorAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Present exactly when `code` is `messaging/mux/grant:replayed`: the instant a replacement grant's `iat` must be strictly later than — the principal's replay floor for this member, or the `iat` of the grant it would replace, whichever is later.";
+                    };
+                    readonly replacedGrantId: {
+                        readonly $ref: "#/$defs/GrantId";
+                        readonly description: "Present when this grant replaced an earlier grant for the same member and principal, in whatever state that grant was. Replacing raises the principal's replay floor, so the replaced statement can never be stored again.";
+                    };
+                    readonly attachedNow: {
+                        readonly type: "boolean";
+                        readonly description: "Present exactly when `status` is `stored`: whether the member was attached at once to a connection the principal holds.";
+                    };
+                };
+            };
+            readonly GrantId: {
+                readonly title: "GrantId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly pattern: "^[A-Za-z0-9._:-]+$";
+                readonly description: "A grant's identifier, chosen by the member DID's signer and carried in its grant statement; a UUID is RECOMMENDED. A mediator refuses a grant whose identifier is already on the member DID's record.";
+            };
+            readonly MuxDid: {
+                readonly title: "MuxDid";
+                readonly type: "string";
+                readonly minLength: 7;
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:\\S+$";
+                readonly description: "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself.";
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly GrantStatement: {
+                readonly title: "GrantStatement";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "issuer", "audience", "grantId", "principal", "scope", "epoch", "iat", "exp", "proof"];
+                readonly description: "A member DID's standing statement that the named principal may carry its traffic at this mediator, on any connection, until `exp`, within `scope`, under the member's current `epoch`. Signed by the member with an embedded Data Integrity proof whose purpose is `authentication`, and stored verbatim by the mediator as the only evidence of the delegation.";
+                readonly properties: {
+                    readonly type: {
+                        readonly type: "string";
+                        readonly const: "muxGrant";
+                        readonly description: "Always `muxGrant`; names the statement kind, so a statement of one kind is never accepted as another.";
+                    };
+                    readonly issuer: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The member DID: the signer, and the DID the statement concerns.";
+                    };
+                    readonly audience: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The mediator's DID. A statement names exactly one mediator and is refused by every other.";
+                    };
+                    readonly grantId: {
+                        readonly $ref: "#/$defs/GrantId";
+                    };
+                    readonly principal: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The principal DID that may carry the member's traffic. MUST differ from `issuer`.";
+                    };
+                    readonly scope: {
+                        readonly $ref: "#/$defs/StatementScope";
+                    };
+                    readonly epoch: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "The member DID's current epoch at the mediator. Only messaging/mux/revoke-all advances it.";
+                    };
+                    readonly iat: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "JWT NumericDate (RFC 7519 §2), whole seconds since 1970-01-01T00:00:00Z UTC: when the statement was signed. MUST NOT be more than 60 seconds in the mediator's future.";
+                    };
+                    readonly exp: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "JWT NumericDate (RFC 7519 §2): when the statement stops being accepted. REQUIRED; MUST be after `iat` and in the future.";
+                    };
+                    readonly proof: {
+                        readonly $ref: "#/$defs/MuxDataIntegrityProof";
+                    };
+                };
+            };
+            readonly MuxDataIntegrityProof: {
+                readonly title: "MuxDataIntegrityProof";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "cryptosuite", "verificationMethod", "proofPurpose", "proofValue"];
+                readonly description: "The W3C Data Integrity proof embedded in a mux statement, made by the member DID: the format and verifier Trust Tasks already use for document proofs (SPEC §4.7). The proof covers the whole statement except `proof` itself, as the cryptosuite defines. Closed: a member Data Integrity defines but this list omits is refused.";
+                readonly properties: {
+                    readonly type: {
+                        readonly type: "string";
+                        readonly const: "DataIntegrityProof";
+                    };
+                    readonly cryptosuite: {
+                        readonly type: "string";
+                        readonly enum: readonly ["eddsa-jcs-2022", "eddsa-rdfc-2022"];
+                        readonly description: "The W3C Data Integrity EdDSA cryptosuite used.";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                        readonly minLength: 5;
+                        readonly maxLength: 2048;
+                        readonly pattern: "^did:\\S+#\\S+$";
+                        readonly description: "The DID URL of the verification method that signed. MUST be controlled by the statement's `issuer` and listed in that DID's current `authentication` relationship.";
+                    };
+                    readonly proofPurpose: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly description: "MUST be `authentication`. Any other value is refused with `messaging/mux:proofPurposeInvalid` — a proof made for another relationship (an `assertionMethod` credential signature, say) is never accepted as control of the DID.";
+                    };
+                    readonly created: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL: when the proof was made, as Data Integrity defines it. Covered by the proof; the statement's own `iat` is what the mediator checks.";
+                    };
+                    readonly proofValue: {
+                        readonly type: "string";
+                        readonly minLength: 2;
+                        readonly maxLength: 4096;
+                        readonly pattern: "^z[1-9A-HJ-NP-Za-km-z]+$";
+                        readonly description: "The multibase (base58btc) signature.";
+                    };
+                };
+            };
+            readonly StatementScope: {
+                readonly title: "StatementScope";
+                readonly type: "array";
+                readonly maxItems: 16;
+                readonly items: {
+                    readonly $ref: "#/$defs/MuxScopeValue";
+                };
+                readonly description: "The scope a member DID signs into a statement: a JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses. It MUST NOT be empty; an empty signed scope is refused with the task's `emptyScope` code, never read as \"all\". Unlike MuxScope, emptiness is not a schema failure here, so that the refusal is reported per statement rather than failing the whole batch.";
+            };
+            readonly MuxScopeValue: {
+                readonly title: "MuxScopeValue";
+                readonly type: "string";
+                readonly enum: readonly ["receive", "pickup", "delete", "send"];
+                readonly description: "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket.";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/messaging/mux/grant/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Messaging — Mux Grant — response payload";
+                readonly description: "The success response to a messaging/mux/grant request: one outcome per submitted grant, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/grant/0.1#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["results"];
+                readonly properties: {
+                    readonly results: {
+                        readonly type: "array";
+                        readonly maxItems: 256;
+                        readonly items: {
+                            readonly $ref: "#/$defs/GrantOutcome";
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly GrantOutcome: {
+                readonly title: "GrantOutcome";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["status", "grantId", "did", "principal"];
+                readonly description: "The outcome for one submitted grant.";
+                readonly properties: {
+                    readonly status: {
+                        readonly type: "string";
+                        readonly enum: readonly ["stored", "refused"];
+                    };
+                    readonly grantId: {
+                        readonly $ref: "#/$defs/GrantId";
+                        readonly description: "The grant's identifier, from its statement.";
+                    };
+                    readonly did: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The member DID: the statement's `issuer`.";
+                    };
+                    readonly principal: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The principal DID, from the statement.";
+                    };
+                    readonly code: {
+                        readonly type: "string";
+                        readonly enum: readonly ["messaging/mux:statementProofInvalid", "messaging/mux:didUnresolvable", "messaging/mux:proofPurposeInvalid", "messaging/mux:audienceMismatch", "messaging/mux:principalMismatch", "messaging/mux:notYetValid", "messaging/mux:statementExpired", "messaging/mux:lifetimeTooLong", "messaging/mux:emptyScope", "messaging/mux:accountUnavailable", "messaging/mux:scopeNotPermitted", "messaging/mux/grant:epochMismatch", "messaging/mux/grant:replayed", "messaging/mux/grant:grantIdReused", "messaging/mux/grant:didQuota", "messaging/mux/grant:principalQuota", "messaging/mux/grant:contended"];
+                        readonly description: "Present exactly when `status` is `refused`: the first check the grant failed, in the order the specification lists them.";
+                    };
+                    readonly currentEpoch: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Present exactly when `code` is `messaging/mux/grant:epochMismatch`: the member DID's current epoch, under which the member re-signs.";
+                    };
+                    readonly replayFloorAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Present exactly when `code` is `messaging/mux/grant:replayed`: the instant a replacement grant's `iat` must be strictly later than — the principal's replay floor for this member, or the `iat` of the grant it would replace, whichever is later.";
+                    };
+                    readonly replacedGrantId: {
+                        readonly $ref: "#/$defs/GrantId";
+                        readonly description: "Present when this grant replaced an earlier grant for the same member and principal, in whatever state that grant was. Replacing raises the principal's replay floor, so the replaced statement can never be stored again.";
+                    };
+                    readonly attachedNow: {
+                        readonly type: "boolean";
+                        readonly description: "Present exactly when `status` is `stored`: whether the member was attached at once to a connection the principal holds.";
+                    };
+                };
+            };
+            readonly GrantId: {
+                readonly title: "GrantId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly pattern: "^[A-Za-z0-9._:-]+$";
+                readonly description: "A grant's identifier, chosen by the member DID's signer and carried in its grant statement; a UUID is RECOMMENDED. A mediator refuses a grant whose identifier is already on the member DID's record.";
+            };
+            readonly MuxDid: {
+                readonly title: "MuxDid";
+                readonly type: "string";
+                readonly minLength: 7;
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:\\S+$";
+                readonly description: "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself.";
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly GrantStatement: {
+                readonly title: "GrantStatement";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "issuer", "audience", "grantId", "principal", "scope", "epoch", "iat", "exp", "proof"];
+                readonly description: "A member DID's standing statement that the named principal may carry its traffic at this mediator, on any connection, until `exp`, within `scope`, under the member's current `epoch`. Signed by the member with an embedded Data Integrity proof whose purpose is `authentication`, and stored verbatim by the mediator as the only evidence of the delegation.";
+                readonly properties: {
+                    readonly type: {
+                        readonly type: "string";
+                        readonly const: "muxGrant";
+                        readonly description: "Always `muxGrant`; names the statement kind, so a statement of one kind is never accepted as another.";
+                    };
+                    readonly issuer: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The member DID: the signer, and the DID the statement concerns.";
+                    };
+                    readonly audience: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The mediator's DID. A statement names exactly one mediator and is refused by every other.";
+                    };
+                    readonly grantId: {
+                        readonly $ref: "#/$defs/GrantId";
+                    };
+                    readonly principal: {
+                        readonly $ref: "#/$defs/MuxDid";
+                        readonly description: "The principal DID that may carry the member's traffic. MUST differ from `issuer`.";
+                    };
+                    readonly scope: {
+                        readonly $ref: "#/$defs/StatementScope";
+                    };
+                    readonly epoch: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "The member DID's current epoch at the mediator. Only messaging/mux/revoke-all advances it.";
+                    };
+                    readonly iat: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "JWT NumericDate (RFC 7519 §2), whole seconds since 1970-01-01T00:00:00Z UTC: when the statement was signed. MUST NOT be more than 60 seconds in the mediator's future.";
+                    };
+                    readonly exp: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "JWT NumericDate (RFC 7519 §2): when the statement stops being accepted. REQUIRED; MUST be after `iat` and in the future.";
+                    };
+                    readonly proof: {
+                        readonly $ref: "#/$defs/MuxDataIntegrityProof";
+                    };
+                };
+            };
+            readonly MuxDataIntegrityProof: {
+                readonly title: "MuxDataIntegrityProof";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "cryptosuite", "verificationMethod", "proofPurpose", "proofValue"];
+                readonly description: "The W3C Data Integrity proof embedded in a mux statement, made by the member DID: the format and verifier Trust Tasks already use for document proofs (SPEC §4.7). The proof covers the whole statement except `proof` itself, as the cryptosuite defines. Closed: a member Data Integrity defines but this list omits is refused.";
+                readonly properties: {
+                    readonly type: {
+                        readonly type: "string";
+                        readonly const: "DataIntegrityProof";
+                    };
+                    readonly cryptosuite: {
+                        readonly type: "string";
+                        readonly enum: readonly ["eddsa-jcs-2022", "eddsa-rdfc-2022"];
+                        readonly description: "The W3C Data Integrity EdDSA cryptosuite used.";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                        readonly minLength: 5;
+                        readonly maxLength: 2048;
+                        readonly pattern: "^did:\\S+#\\S+$";
+                        readonly description: "The DID URL of the verification method that signed. MUST be controlled by the statement's `issuer` and listed in that DID's current `authentication` relationship.";
+                    };
+                    readonly proofPurpose: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly description: "MUST be `authentication`. Any other value is refused with `messaging/mux:proofPurposeInvalid` — a proof made for another relationship (an `assertionMethod` credential signature, say) is never accepted as control of the DID.";
+                    };
+                    readonly created: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "OPTIONAL: when the proof was made, as Data Integrity defines it. Covered by the proof; the statement's own `iat` is what the mediator checks.";
+                    };
+                    readonly proofValue: {
+                        readonly type: "string";
+                        readonly minLength: 2;
+                        readonly maxLength: 4096;
+                        readonly pattern: "^z[1-9A-HJ-NP-Za-km-z]+$";
+                        readonly description: "The multibase (base58btc) signature.";
+                    };
+                };
+            };
+            readonly StatementScope: {
+                readonly title: "StatementScope";
+                readonly type: "array";
+                readonly maxItems: 16;
+                readonly items: {
+                    readonly $ref: "#/$defs/MuxScopeValue";
+                };
+                readonly description: "The scope a member DID signs into a statement: a JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses. It MUST NOT be empty; an empty signed scope is refused with the task's `emptyScope` code, never read as \"all\". Unlike MuxScope, emptiness is not a schema failure here, so that the refusal is reported per statement rather than failing the whole batch.";
+            };
+            readonly MuxScopeValue: {
+                readonly title: "MuxScopeValue";
+                readonly type: "string";
+                readonly enum: readonly ["receive", "pickup", "delete", "send"];
+                readonly description: "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map