@openvtc/trust-tasks 0.19.21 → 0.20.0

package/src/persona/world/put/1.0/payload.ts

@@ -0,0 +1,339 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/persona/world/put/1.0/payload.schema.json
+ */
+
+import type { ExpectedVersion_PersonaV0_1 as ExpectedVersion, Ext, Ulid, Version_PersonaV0_1 as Version, WorldColour } from "../../../../_shared/components.js";
+
+
+/**
+ * Create or replace one world: a named part of the holder's life, and the faces and attributes that belong to it. Omit `worldId` to create; supply it to replace. `expectedVersion` makes the write conditional.
+ */
+export interface PersonaWorldPutPayload {
+  /**
+   * Omit to create — the maintainer assigns one and returns it. Supply to replace an existing world, or to make a create idempotent under retry; a supplied id that already exists is a replacement, and a producer that meant to create MUST pair it with `expectedVersion: 0`.
+   */
+  worldId?: Ulid;
+  /**
+   * The holder's name for this part of their life — "Work", "Home", "Play". Never disclosed to a verifier; it is how the holder finds it again. A maintainer MUST NOT interpret it: it is not a scope, a policy input, or a name a counterparty ever sees.
+   */
+  name: string;
+  colour: WorldColour;
+  /**
+   * One or two emoji, as a decorative mark beside the name. Bounded at 8 bytes because it is a mark and not a field: anything longer is text, and text belongs in `name` where a consumer will lay it out. A maintainer stores it opaquely and MUST NOT parse it; a consumer that cannot render emoji omits it and shows the name, which is why it is OPTIONAL and carries no meaning of its own.
+   */
+  icon?: string;
+  /**
+   * Profiles belonging to this world. A profile belongs to at most one world — see `persona/world/put:faceAlreadyPlaced` — because the world is where a consumer reads a profile's colour from, and two answers is no answer. Omission on a replace means an empty list, not 'leave as they were': this is a replace, and a member whose absence meant 'keep' would make it impossible to empty one.
+   *
+   * @maxItems 256
+   */
+  faceIds?: Ulid[];
+  /**
+   * Attributes belonging to this world. Unlike a profile, an attribute MAY belong to several — a mobile number is genuinely both work and home — so no exclusivity is enforced and none should be inferred. Same replace semantics as `faceIds`.
+   *
+   * @maxItems 1024
+   */
+  attributeIds?: Ulid[];
+  /**
+   * Optional precondition. Omit for last-writer-wins. Supply the version a prior read returned to make the write conditional; supply 0 to create only.
+   */
+  expectedVersion?: ExpectedVersion;
+  ext?: Ext;
+}
+/**
+ * Success response to persona/world/put. Type https://trusttasks.org/spec/persona/world/put/1.0#response. A failed precondition is not a success: it is a trust-task-error carrying persona/world/put:versionConflict.
+ */
+export interface PersonaWorldPutResponsePayload {
+  worldId: Ulid;
+  version: Version;
+  /**
+   * True when this write created the world, false when it replaced one. A producer that omitted `worldId` can still be told which happened, because a retried create with a supplied id is a replacement.
+   */
+  created: boolean;
+  createdAt?: string;
+  updatedAt: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ExpectedVersion, Ext, Ulid, Version, WorldColour };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/persona/world/put/1.0" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = PersonaWorldPutPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/persona/world/put/1.0#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PersonaWorldPutResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/persona/world/put/1.0",
+  "title": "Persona — World Put — payload",
+  "description": "Create or replace one world: a named part of the holder's life, and the faces and attributes that belong to it. Omit `worldId` to create; supply it to replace. `expectedVersion` makes the write conditional.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "name",
+    "colour"
+  ],
+  "properties": {
+    "worldId": {
+      "$ref": "#/$defs/Ulid",
+      "description": "Omit to create — the maintainer assigns one and returns it. Supply to replace an existing world, or to make a create idempotent under retry; a supplied id that already exists is a replacement, and a producer that meant to create MUST pair it with `expectedVersion: 0`."
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "description": "The holder's name for this part of their life — \"Work\", \"Home\", \"Play\". Never disclosed to a verifier; it is how the holder finds it again. A maintainer MUST NOT interpret it: it is not a scope, a policy input, or a name a counterparty ever sees."
+    },
+    "colour": {
+      "$ref": "#/$defs/WorldColour"
+    },
+    "icon": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 8,
+      "description": "One or two emoji, as a decorative mark beside the name. Bounded at 8 bytes because it is a mark and not a field: anything longer is text, and text belongs in `name` where a consumer will lay it out. A maintainer stores it opaquely and MUST NOT parse it; a consumer that cannot render emoji omits it and shows the name, which is why it is OPTIONAL and carries no meaning of its own."
+    },
+    "faceIds": {
+      "type": "array",
+      "maxItems": 256,
+      "uniqueItems": true,
+      "default": [],
+      "items": {
+        "$ref": "#/$defs/Ulid"
+      },
+      "description": "Profiles belonging to this world. A profile belongs to at most one world — see `persona/world/put:faceAlreadyPlaced` — because the world is where a consumer reads a profile's colour from, and two answers is no answer. Omission on a replace means an empty list, not 'leave as they were': this is a replace, and a member whose absence meant 'keep' would make it impossible to empty one."
+    },
+    "attributeIds": {
+      "type": "array",
+      "maxItems": 1024,
+      "uniqueItems": true,
+      "default": [],
+      "items": {
+        "$ref": "#/$defs/Ulid"
+      },
+      "description": "Attributes belonging to this world. Unlike a profile, an attribute MAY belong to several — a mobile number is genuinely both work and home — so no exclusivity is enforced and none should be inferred. Same replace semantics as `faceIds`."
+    },
+    "expectedVersion": {
+      "$ref": "#/$defs/ExpectedVersion",
+      "description": "Optional precondition. Omit for last-writer-wins. Supply the version a prior read returned to make the write conditional; supply 0 to create only."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Persona World Put — response payload",
+      "description": "Success response to persona/world/put. Type https://trusttasks.org/spec/persona/world/put/1.0#response. A failed precondition is not a success: it is a trust-task-error carrying persona/world/put:versionConflict.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "worldId",
+        "version",
+        "created",
+        "updatedAt"
+      ],
+      "properties": {
+        "worldId": {
+          "$ref": "#/$defs/Ulid"
+        },
+        "version": {
+          "$ref": "#/$defs/Version"
+        },
+        "created": {
+          "type": "boolean",
+          "description": "True when this write created the world, false when it replaced one. A producer that omitted `worldId` can still be told which happened, because a retried create with a supplied id is a replacement."
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "Version": {
+      "title": "Version",
+      "description": "A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.",
+      "type": "integer",
+      "minimum": 1
+    },
+    "Ulid": {
+      "title": "Ulid",
+      "description": "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.",
+      "type": "string",
+      "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$"
+    },
+    "ExpectedVersion": {
+      "title": "ExpectedVersion",
+      "description": "Optimistic-concurrency precondition. A positive value requires the record's current `version` to equal it exactly; zero means create-only and applies only when no live record exists at the address.",
+      "type": "integer",
+      "minimum": 0
+    },
+    "WorldColour": {
+      "title": "WorldColour",
+      "description": "A colour **name**, resolved by each consumer against its own palette — never a hex value or any other literal. Two reasons, and both are about the consumer rather than the holder. A literal cannot be legible in a terminal, in a light theme and in a dark one at once, so a stored `#8B0000` is a colour that is wrong somewhere and the holder has no way to know where. And a consumer that reserves colours to mean something — an error, a warning, an irreversible act — must be able to keep a holder's decorative choice out of that channel; it cannot do that with an arbitrary value, and it can do it trivially with a closed set it maps itself. The eight members are chosen to be distinguishable from one another and deliberately carry no status connotation: none is named for success, warning or danger.",
+      "type": "string",
+      "enum": [
+        "slate",
+        "indigo",
+        "teal",
+        "moss",
+        "sand",
+        "clay",
+        "rose",
+        "plum"
+      ]
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Persona World Put — response payload",
+      "description": "Success response to persona/world/put. Type https://trusttasks.org/spec/persona/world/put/1.0#response. A failed precondition is not a success: it is a trust-task-error carrying persona/world/put:versionConflict.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "worldId",
+        "version",
+        "created",
+        "updatedAt"
+      ],
+      "properties": {
+        "worldId": {
+          "$ref": "#/$defs/Ulid"
+        },
+        "version": {
+          "$ref": "#/$defs/Version"
+        },
+        "created": {
+          "type": "boolean",
+          "description": "True when this write created the world, false when it replaced one. A producer that omitted `worldId` can still be told which happened, because a retried create with a supplied id is a replacement."
+        },
+        "createdAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "Version": {
+      "title": "Version",
+      "description": "A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.",
+      "type": "integer",
+      "minimum": 1
+    },
+    "Ulid": {
+      "title": "Ulid",
+      "description": "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.",
+      "type": "string",
+      "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$"
+    },
+    "ExpectedVersion": {
+      "title": "ExpectedVersion",
+      "description": "Optimistic-concurrency precondition. A positive value requires the record's current `version` to equal it exactly; zero means create-only and applies only when no live record exists at the address.",
+      "type": "integer",
+      "minimum": 0
+    },
+    "WorldColour": {
+      "title": "WorldColour",
+      "description": "A colour **name**, resolved by each consumer against its own palette — never a hex value or any other literal. Two reasons, and both are about the consumer rather than the holder. A literal cannot be legible in a terminal, in a light theme and in a dark one at once, so a stored `#8B0000` is a colour that is wrong somewhere and the holder has no way to know where. And a consumer that reserves colours to mean something — an error, a warning, an irreversible act — must be able to keep a holder's decorative choice out of that channel; it cannot do that with an arbitrary value, and it can do it trivially with a closed set it maps itself. The eight members are chosen to be distinguishable from one another and deliberately carry no status connotation: none is named for success, warning or danger.",
+      "type": "string",
+      "enum": [
+        "slate",
+        "indigo",
+        "teal",
+        "moss",
+        "sand",
+        "clay",
+        "rose",
+        "plum"
+      ]
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/vtc/vetting/vetters/show/0.1/payload.ts

@@ -0,0 +1,267 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/vetting/vetters/show/0.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../../../_shared/components.js";
+
+
+/**
+ * The state of a vetter's grant in this community. The three refusing values are deliberately distinct: `revoked` says the community withdrew a grant it had made, `expired` says one ran out, and `none` says there is nothing to withdraw. An applicant reads those differently, and so does a vetter checking their own standing.
+ */
+export type GrantStatus = "live" | "revoked" | "expired" | "none";
+
+/**
+ * An authenticated applicant or member asks a community about one vetter, by DID. The answer is the state of that vetter's grant — `live`, `revoked`, `expired` or `none` — which a list of vetters cannot express, because an absent vetter and a revoked one look identical in it. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface VTCVettingShowVetterPayload {
+  /**
+   * The DID of the vetter being asked about — the subject of the vetter role credential. The caller usually holds it from an earlier listing, or from a vetting exchange that has since gone quiet.
+   */
+  vetterDid: string;
+  ext?: Ext;
+}
+/**
+ * One vetter's grant status. Carries no profile: what a vetter published for a directory is answered by vtc/vetting/vetters/list, and this task answers a caller who already knows which vetter they mean.
+ */
+export interface VTCVettingShowVetterResponsePayload {
+  /**
+   * The DID asked about, echoed so a response is self-contained.
+   */
+  vetterDid: string;
+  status: GrantStatus;
+  /**
+   * The identifier of the grant this status is about. Present for `live`, `revoked` and `expired`; absent for `none`, which is the absence of a grant and so has nothing to identify.
+   */
+  grantId?: string;
+  /**
+   * The grant's `validUntil`. Present for `live` and `expired` — for `expired` it is when it ran out, which tells a caller whether it lapsed long ago or yesterday. Absent for `none`, and for `revoked`, where the revocation and not the expiry is what ended it.
+   */
+  validUntil?: string;
+  /**
+   * When the grant was revoked. Present only for `revoked`. The reason is deliberately not carried: it is the community's internal record, and an applicant needs to know the grant does not hold, not why.
+   */
+  revokedAt?: string;
+  /**
+   * Whether this vetter has a profile stored with `listed: true`, and so would appear in vtc/vetting/vetters/list. Present only for `live`. It is what separates the two reasons a live vetter is missing from a listing: unlisted by choice, rather than not a vetter.
+   */
+  listed?: boolean;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/vetting/vetters/show/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCVettingShowVetterPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/vetting/vetters/show/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCVettingShowVetterResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vtc/vetting/vetters/show/0.1",
+  "title": "VTC Vetting — Show Vetter — payload",
+  "description": "An authenticated applicant or member asks a community about one vetter, by DID. The answer is the state of that vetter's grant — `live`, `revoked`, `expired` or `none` — which a list of vetters cannot express, because an absent vetter and a revoked one look identical in it. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "vetterDid"
+  ],
+  "properties": {
+    "vetterDid": {
+      "type": "string",
+      "pattern": "^did:",
+      "minLength": 1,
+      "maxLength": 2048,
+      "description": "The DID of the vetter being asked about — the subject of the vetter role credential. The caller usually holds it from an earlier listing, or from a vetting exchange that has since gone quiet."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "GrantStatus": {
+      "title": "GrantStatus",
+      "description": "The state of a vetter's grant in this community. The three refusing values are deliberately distinct: `revoked` says the community withdrew a grant it had made, `expired` says one ran out, and `none` says there is nothing to withdraw. An applicant reads those differently, and so does a vetter checking their own standing.",
+      "type": "string",
+      "enum": [
+        "live",
+        "revoked",
+        "expired",
+        "none"
+      ]
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Vetting — Show Vetter — response payload",
+      "description": "One vetter's grant status. Carries no profile: what a vetter published for a directory is answered by vtc/vetting/vetters/list, and this task answers a caller who already knows which vetter they mean.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "vetterDid",
+        "status"
+      ],
+      "properties": {
+        "vetterDid": {
+          "type": "string",
+          "pattern": "^did:",
+          "description": "The DID asked about, echoed so a response is self-contained."
+        },
+        "status": {
+          "$ref": "#/$defs/GrantStatus"
+        },
+        "grantId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "The identifier of the grant this status is about. Present for `live`, `revoked` and `expired`; absent for `none`, which is the absence of a grant and so has nothing to identify."
+        },
+        "validUntil": {
+          "type": "string",
+          "format": "date-time",
+          "description": "The grant's `validUntil`. Present for `live` and `expired` — for `expired` it is when it ran out, which tells a caller whether it lapsed long ago or yesterday. Absent for `none`, and for `revoked`, where the revocation and not the expiry is what ended it."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the grant was revoked. Present only for `revoked`. The reason is deliberately not carried: it is the community's internal record, and an applicant needs to know the grant does not hold, not why."
+        },
+        "listed": {
+          "type": "boolean",
+          "description": "Whether this vetter has a profile stored with `listed: true`, and so would appear in vtc/vetting/vetters/list. Present only for `live`. It is what separates the two reasons a live vetter is missing from a listing: unlisted by choice, rather than not a vetter."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "GrantStatus": {
+      "title": "GrantStatus",
+      "description": "The state of a vetter's grant in this community. The three refusing values are deliberately distinct: `revoked` says the community withdrew a grant it had made, `expired` says one ran out, and `none` says there is nothing to withdraw. An applicant reads those differently, and so does a vetter checking their own standing.",
+      "type": "string",
+      "enum": [
+        "live",
+        "revoked",
+        "expired",
+        "none"
+      ]
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Vetting — Show Vetter — response payload",
+      "description": "One vetter's grant status. Carries no profile: what a vetter published for a directory is answered by vtc/vetting/vetters/list, and this task answers a caller who already knows which vetter they mean.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "vetterDid",
+        "status"
+      ],
+      "properties": {
+        "vetterDid": {
+          "type": "string",
+          "pattern": "^did:",
+          "description": "The DID asked about, echoed so a response is self-contained."
+        },
+        "status": {
+          "$ref": "#/$defs/GrantStatus"
+        },
+        "grantId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "The identifier of the grant this status is about. Present for `live`, `revoked` and `expired`; absent for `none`, which is the absence of a grant and so has nothing to identify."
+        },
+        "validUntil": {
+          "type": "string",
+          "format": "date-time",
+          "description": "The grant's `validUntil`. Present for `live` and `expired` — for `expired` it is when it ran out, which tells a caller whether it lapsed long ago or yesterday. Absent for `none`, and for `revoked`, where the revocation and not the expiry is what ended it."
+        },
+        "revokedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "When the grant was revoked. Present only for `revoked`. The reason is deliberately not carried: it is the community's internal record, and an applicant needs to know the grant does not hold, not why."
+        },
+        "listed": {
+          "type": "boolean",
+          "description": "Whether this vetter has a profile stored with `listed: true`, and so would appear in vtc/vetting/vetters/list. Present only for `live`. It is what separates the two reasons a live vetter is missing from a listing: unlisted by choice, rather than not a vetter."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: false,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: false,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;