@openvtc/trust-tasks 0.28.23 → 0.28.25

package/src/messaging/mux/grant/0.1/payload.ts

@@ -0,0 +1,710 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/messaging/mux/grant/0.1/payload.schema.json
+ */
+
+import type { DataIntegrityProof, Ext, GrantId, GrantStatement, MuxDataIntegrityProof, MuxDid, MuxScopeValue, StatementScope } from "../../../../_shared/components.js";
+
+
+/**
+ * Store or replace grants: each a grant statement in which a member DID, with an embedded Data Integrity proof, delegates to a principal the carrying of its messages, under the member's current epoch and an explicit scope and expiry. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface MessagingMuxGrantPayload {
+  /**
+   * The grant statements to store; the member DID is each statement's `issuer`. Each is checked and answered on its own; the batch is never all-or-nothing.
+   *
+   * @minItems 1
+   * @maxItems 256
+   */
+  grants: [GrantStatement, ...GrantStatement[]];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * The success response to a messaging/mux/grant request: one outcome per submitted grant, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/grant/0.1#response.
+ */
+export interface MessagingMuxGrantResponsePayload {
+  /**
+   * @maxItems 256
+   */
+  results: GrantOutcome[];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * The outcome for one submitted grant.
+ */
+export interface GrantOutcome {
+  status: "stored" | "refused";
+  /**
+   * The grant's identifier, from its statement.
+   */
+  grantId: GrantId;
+  /**
+   * The member DID: the statement's `issuer`.
+   */
+  did: MuxDid;
+  /**
+   * The principal DID, from the statement.
+   */
+  principal: MuxDid;
+  /**
+   * Present exactly when `status` is `refused`: the first check the grant failed, in the order the specification lists them.
+   */
+  code?:
+    | "messaging/mux:statementProofInvalid"
+    | "messaging/mux:didUnresolvable"
+    | "messaging/mux:proofPurposeInvalid"
+    | "messaging/mux:audienceMismatch"
+    | "messaging/mux:principalMismatch"
+    | "messaging/mux:notYetValid"
+    | "messaging/mux:statementExpired"
+    | "messaging/mux:lifetimeTooLong"
+    | "messaging/mux:emptyScope"
+    | "messaging/mux:accountUnavailable"
+    | "messaging/mux:scopeNotPermitted"
+    | "messaging/mux/grant:epochMismatch"
+    | "messaging/mux/grant:replayed"
+    | "messaging/mux/grant:grantIdReused"
+    | "messaging/mux/grant:didQuota"
+    | "messaging/mux/grant:principalQuota"
+    | "messaging/mux/grant:contended";
+  /**
+   * Present exactly when `code` is `messaging/mux/grant:epochMismatch`: the member DID's current epoch, under which the member re-signs.
+   */
+  currentEpoch?: number;
+  /**
+   * Present exactly when `code` is `messaging/mux/grant:replayed`: the instant a replacement grant's `iat` must be strictly later than — the principal's replay floor for this member, or the `iat` of the grant it would replace, whichever is later.
+   */
+  replayFloorAt?: string;
+  /**
+   * Present when this grant replaced an earlier grant for the same member and principal, in whatever state that grant was. Replacing raises the principal's replay floor, so the replaced statement can never be stored again.
+   */
+  replacedGrantId?: GrantId;
+  /**
+   * Present exactly when `status` is `stored`: whether the member was attached at once to a connection the principal holds.
+   */
+  attachedNow?: boolean;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DataIntegrityProof, Ext, GrantId, GrantStatement, MuxDataIntegrityProof, MuxDid, MuxScopeValue, StatementScope };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/messaging/mux/grant/0.1" as const;
+
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = MessagingMuxGrantPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/messaging/mux/grant/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = MessagingMuxGrantResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/messaging/mux/grant/0.1",
+  "title": "Messaging — Mux Grant — payload",
+  "description": "Store or replace grants: each a grant statement in which a member DID, with an embedded Data Integrity proof, delegates to a principal the carrying of its messages, under the member's current epoch and an explicit scope and expiry. The outer document members are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "grants"
+  ],
+  "properties": {
+    "grants": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 256,
+      "description": "The grant statements to store; the member DID is each statement's `issuer`. Each is checked and answered on its own; the batch is never all-or-nothing.",
+      "items": {
+        "$ref": "#/$defs/GrantStatement"
+      }
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Messaging — Mux Grant — response payload",
+      "description": "The success response to a messaging/mux/grant request: one outcome per submitted grant, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/grant/0.1#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "results"
+      ],
+      "properties": {
+        "results": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/GrantOutcome"
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "GrantOutcome": {
+      "title": "GrantOutcome",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status",
+        "grantId",
+        "did",
+        "principal"
+      ],
+      "description": "The outcome for one submitted grant.",
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": [
+            "stored",
+            "refused"
+          ]
+        },
+        "grantId": {
+          "$ref": "#/$defs/GrantId",
+          "description": "The grant's identifier, from its statement."
+        },
+        "did": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The member DID: the statement's `issuer`."
+        },
+        "principal": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The principal DID, from the statement."
+        },
+        "code": {
+          "type": "string",
+          "enum": [
+            "messaging/mux:statementProofInvalid",
+            "messaging/mux:didUnresolvable",
+            "messaging/mux:proofPurposeInvalid",
+            "messaging/mux:audienceMismatch",
+            "messaging/mux:principalMismatch",
+            "messaging/mux:notYetValid",
+            "messaging/mux:statementExpired",
+            "messaging/mux:lifetimeTooLong",
+            "messaging/mux:emptyScope",
+            "messaging/mux:accountUnavailable",
+            "messaging/mux:scopeNotPermitted",
+            "messaging/mux/grant:epochMismatch",
+            "messaging/mux/grant:replayed",
+            "messaging/mux/grant:grantIdReused",
+            "messaging/mux/grant:didQuota",
+            "messaging/mux/grant:principalQuota",
+            "messaging/mux/grant:contended"
+          ],
+          "description": "Present exactly when `status` is `refused`: the first check the grant failed, in the order the specification lists them."
+        },
+        "currentEpoch": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Present exactly when `code` is `messaging/mux/grant:epochMismatch`: the member DID's current epoch, under which the member re-signs."
+        },
+        "replayFloorAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "Present exactly when `code` is `messaging/mux/grant:replayed`: the instant a replacement grant's `iat` must be strictly later than — the principal's replay floor for this member, or the `iat` of the grant it would replace, whichever is later."
+        },
+        "replacedGrantId": {
+          "$ref": "#/$defs/GrantId",
+          "description": "Present when this grant replaced an earlier grant for the same member and principal, in whatever state that grant was. Replacing raises the principal's replay floor, so the replaced statement can never be stored again."
+        },
+        "attachedNow": {
+          "type": "boolean",
+          "description": "Present exactly when `status` is `stored`: whether the member was attached at once to a connection the principal holds."
+        }
+      }
+    },
+    "GrantId": {
+      "title": "GrantId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^[A-Za-z0-9._:-]+$",
+      "description": "A grant's identifier, chosen by the member DID's signer and carried in its grant statement; a UUID is RECOMMENDED. A mediator refuses a grant whose identifier is already on the member DID's record."
+    },
+    "MuxDid": {
+      "title": "MuxDid",
+      "type": "string",
+      "minLength": 7,
+      "maxLength": 2048,
+      "pattern": "^did:[a-z0-9]+:\\S+$",
+      "description": "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself."
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "GrantStatement": {
+      "title": "GrantStatement",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "issuer",
+        "audience",
+        "grantId",
+        "principal",
+        "scope",
+        "epoch",
+        "iat",
+        "exp",
+        "proof"
+      ],
+      "description": "A member DID's standing statement that the named principal may carry its traffic at this mediator, on any connection, until `exp`, within `scope`, under the member's current `epoch`. Signed by the member with an embedded Data Integrity proof whose purpose is `authentication`, and stored verbatim by the mediator as the only evidence of the delegation.",
+      "properties": {
+        "type": {
+          "type": "string",
+          "const": "muxGrant",
+          "description": "Always `muxGrant`; names the statement kind, so a statement of one kind is never accepted as another."
+        },
+        "issuer": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The member DID: the signer, and the DID the statement concerns."
+        },
+        "audience": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The mediator's DID. A statement names exactly one mediator and is refused by every other."
+        },
+        "grantId": {
+          "$ref": "#/$defs/GrantId"
+        },
+        "principal": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The principal DID that may carry the member's traffic. MUST differ from `issuer`."
+        },
+        "scope": {
+          "$ref": "#/$defs/StatementScope"
+        },
+        "epoch": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "The member DID's current epoch at the mediator. Only messaging/mux/revoke-all advances it."
+        },
+        "iat": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "JWT NumericDate (RFC 7519 §2), whole seconds since 1970-01-01T00:00:00Z UTC: when the statement was signed. MUST NOT be more than 60 seconds in the mediator's future."
+        },
+        "exp": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "JWT NumericDate (RFC 7519 §2): when the statement stops being accepted. REQUIRED; MUST be after `iat` and in the future."
+        },
+        "proof": {
+          "$ref": "#/$defs/MuxDataIntegrityProof"
+        }
+      }
+    },
+    "MuxDataIntegrityProof": {
+      "title": "MuxDataIntegrityProof",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "cryptosuite",
+        "verificationMethod",
+        "proofPurpose",
+        "proofValue"
+      ],
+      "description": "The W3C Data Integrity proof embedded in a mux statement, made by the member DID: the format and verifier Trust Tasks already use for document proofs (SPEC §4.7). The proof covers the whole statement except `proof` itself, as the cryptosuite defines. Closed: a member Data Integrity defines but this list omits is refused.",
+      "properties": {
+        "type": {
+          "type": "string",
+          "const": "DataIntegrityProof"
+        },
+        "cryptosuite": {
+          "type": "string",
+          "enum": [
+            "eddsa-jcs-2022",
+            "eddsa-rdfc-2022"
+          ],
+          "description": "The W3C Data Integrity EdDSA cryptosuite used."
+        },
+        "verificationMethod": {
+          "type": "string",
+          "minLength": 5,
+          "maxLength": 2048,
+          "pattern": "^did:\\S+#\\S+$",
+          "description": "The DID URL of the verification method that signed. MUST be controlled by the statement's `issuer` and listed in that DID's current `authentication` relationship."
+        },
+        "proofPurpose": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64,
+          "description": "MUST be `authentication`. Any other value is refused with `messaging/mux:proofPurposeInvalid` — a proof made for another relationship (an `assertionMethod` credential signature, say) is never accepted as control of the DID."
+        },
+        "created": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL: when the proof was made, as Data Integrity defines it. Covered by the proof; the statement's own `iat` is what the mediator checks."
+        },
+        "proofValue": {
+          "type": "string",
+          "minLength": 2,
+          "maxLength": 4096,
+          "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$",
+          "description": "The multibase (base58btc) signature."
+        }
+      }
+    },
+    "StatementScope": {
+      "title": "StatementScope",
+      "type": "array",
+      "maxItems": 16,
+      "items": {
+        "$ref": "#/$defs/MuxScopeValue"
+      },
+      "description": "The scope a member DID signs into a statement: a JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses. It MUST NOT be empty; an empty signed scope is refused with the task's `emptyScope` code, never read as \"all\". Unlike MuxScope, emptiness is not a schema failure here, so that the refusal is reported per statement rather than failing the whole batch."
+    },
+    "MuxScopeValue": {
+      "title": "MuxScopeValue",
+      "type": "string",
+      "enum": [
+        "receive",
+        "pickup",
+        "delete",
+        "send"
+      ],
+      "description": "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Messaging — Mux Grant — response payload",
+      "description": "The success response to a messaging/mux/grant request: one outcome per submitted grant, in request order. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/grant/0.1#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "results"
+      ],
+      "properties": {
+        "results": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/GrantOutcome"
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "GrantOutcome": {
+      "title": "GrantOutcome",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status",
+        "grantId",
+        "did",
+        "principal"
+      ],
+      "description": "The outcome for one submitted grant.",
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": [
+            "stored",
+            "refused"
+          ]
+        },
+        "grantId": {
+          "$ref": "#/$defs/GrantId",
+          "description": "The grant's identifier, from its statement."
+        },
+        "did": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The member DID: the statement's `issuer`."
+        },
+        "principal": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The principal DID, from the statement."
+        },
+        "code": {
+          "type": "string",
+          "enum": [
+            "messaging/mux:statementProofInvalid",
+            "messaging/mux:didUnresolvable",
+            "messaging/mux:proofPurposeInvalid",
+            "messaging/mux:audienceMismatch",
+            "messaging/mux:principalMismatch",
+            "messaging/mux:notYetValid",
+            "messaging/mux:statementExpired",
+            "messaging/mux:lifetimeTooLong",
+            "messaging/mux:emptyScope",
+            "messaging/mux:accountUnavailable",
+            "messaging/mux:scopeNotPermitted",
+            "messaging/mux/grant:epochMismatch",
+            "messaging/mux/grant:replayed",
+            "messaging/mux/grant:grantIdReused",
+            "messaging/mux/grant:didQuota",
+            "messaging/mux/grant:principalQuota",
+            "messaging/mux/grant:contended"
+          ],
+          "description": "Present exactly when `status` is `refused`: the first check the grant failed, in the order the specification lists them."
+        },
+        "currentEpoch": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Present exactly when `code` is `messaging/mux/grant:epochMismatch`: the member DID's current epoch, under which the member re-signs."
+        },
+        "replayFloorAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "Present exactly when `code` is `messaging/mux/grant:replayed`: the instant a replacement grant's `iat` must be strictly later than — the principal's replay floor for this member, or the `iat` of the grant it would replace, whichever is later."
+        },
+        "replacedGrantId": {
+          "$ref": "#/$defs/GrantId",
+          "description": "Present when this grant replaced an earlier grant for the same member and principal, in whatever state that grant was. Replacing raises the principal's replay floor, so the replaced statement can never be stored again."
+        },
+        "attachedNow": {
+          "type": "boolean",
+          "description": "Present exactly when `status` is `stored`: whether the member was attached at once to a connection the principal holds."
+        }
+      }
+    },
+    "GrantId": {
+      "title": "GrantId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^[A-Za-z0-9._:-]+$",
+      "description": "A grant's identifier, chosen by the member DID's signer and carried in its grant statement; a UUID is RECOMMENDED. A mediator refuses a grant whose identifier is already on the member DID's record."
+    },
+    "MuxDid": {
+      "title": "MuxDid",
+      "type": "string",
+      "minLength": 7,
+      "maxLength": 2048,
+      "pattern": "^did:[a-z0-9]+:\\S+$",
+      "description": "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself."
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "GrantStatement": {
+      "title": "GrantStatement",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "issuer",
+        "audience",
+        "grantId",
+        "principal",
+        "scope",
+        "epoch",
+        "iat",
+        "exp",
+        "proof"
+      ],
+      "description": "A member DID's standing statement that the named principal may carry its traffic at this mediator, on any connection, until `exp`, within `scope`, under the member's current `epoch`. Signed by the member with an embedded Data Integrity proof whose purpose is `authentication`, and stored verbatim by the mediator as the only evidence of the delegation.",
+      "properties": {
+        "type": {
+          "type": "string",
+          "const": "muxGrant",
+          "description": "Always `muxGrant`; names the statement kind, so a statement of one kind is never accepted as another."
+        },
+        "issuer": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The member DID: the signer, and the DID the statement concerns."
+        },
+        "audience": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The mediator's DID. A statement names exactly one mediator and is refused by every other."
+        },
+        "grantId": {
+          "$ref": "#/$defs/GrantId"
+        },
+        "principal": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The principal DID that may carry the member's traffic. MUST differ from `issuer`."
+        },
+        "scope": {
+          "$ref": "#/$defs/StatementScope"
+        },
+        "epoch": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "The member DID's current epoch at the mediator. Only messaging/mux/revoke-all advances it."
+        },
+        "iat": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "JWT NumericDate (RFC 7519 §2), whole seconds since 1970-01-01T00:00:00Z UTC: when the statement was signed. MUST NOT be more than 60 seconds in the mediator's future."
+        },
+        "exp": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "JWT NumericDate (RFC 7519 §2): when the statement stops being accepted. REQUIRED; MUST be after `iat` and in the future."
+        },
+        "proof": {
+          "$ref": "#/$defs/MuxDataIntegrityProof"
+        }
+      }
+    },
+    "MuxDataIntegrityProof": {
+      "title": "MuxDataIntegrityProof",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "cryptosuite",
+        "verificationMethod",
+        "proofPurpose",
+        "proofValue"
+      ],
+      "description": "The W3C Data Integrity proof embedded in a mux statement, made by the member DID: the format and verifier Trust Tasks already use for document proofs (SPEC §4.7). The proof covers the whole statement except `proof` itself, as the cryptosuite defines. Closed: a member Data Integrity defines but this list omits is refused.",
+      "properties": {
+        "type": {
+          "type": "string",
+          "const": "DataIntegrityProof"
+        },
+        "cryptosuite": {
+          "type": "string",
+          "enum": [
+            "eddsa-jcs-2022",
+            "eddsa-rdfc-2022"
+          ],
+          "description": "The W3C Data Integrity EdDSA cryptosuite used."
+        },
+        "verificationMethod": {
+          "type": "string",
+          "minLength": 5,
+          "maxLength": 2048,
+          "pattern": "^did:\\S+#\\S+$",
+          "description": "The DID URL of the verification method that signed. MUST be controlled by the statement's `issuer` and listed in that DID's current `authentication` relationship."
+        },
+        "proofPurpose": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64,
+          "description": "MUST be `authentication`. Any other value is refused with `messaging/mux:proofPurposeInvalid` — a proof made for another relationship (an `assertionMethod` credential signature, say) is never accepted as control of the DID."
+        },
+        "created": {
+          "type": "string",
+          "format": "date-time",
+          "description": "OPTIONAL: when the proof was made, as Data Integrity defines it. Covered by the proof; the statement's own `iat` is what the mediator checks."
+        },
+        "proofValue": {
+          "type": "string",
+          "minLength": 2,
+          "maxLength": 4096,
+          "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$",
+          "description": "The multibase (base58btc) signature."
+        }
+      }
+    },
+    "StatementScope": {
+      "title": "StatementScope",
+      "type": "array",
+      "maxItems": 16,
+      "items": {
+        "$ref": "#/$defs/MuxScopeValue"
+      },
+      "description": "The scope a member DID signs into a statement: a JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses. It MUST NOT be empty; an empty signed scope is refused with the task's `emptyScope` code, never read as \"all\". Unlike MuxScope, emptiness is not a schema failure here, so that the refusal is reported per statement rather than failing the whole batch."
+    },
+    "MuxScopeValue": {
+      "title": "MuxScopeValue",
+      "type": "string",
+      "enum": [
+        "receive",
+        "pickup",
+        "delete",
+        "send"
+      ],
+      "description": "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;