@openvtc/trust-tasks 0.20.1 → 0.20.3

package/dist/vtc/vetting/vetters/pcs-tokens/0.1/payload.js

@@ -0,0 +1,205 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/vetting/vetters/pcs-tokens/0.1/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/vetting/vetters/pcs-tokens/0.1";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/vetting/vetters/pcs-tokens/0.1#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/vtc/vetting/vetters/pcs-tokens/0.1",
+    "title": "VTC — Vetting PCS Tokens — payload",
+    "description": "A vetter draws its tick of attestation tokens. The draw is unconditional and on a schedule — a vetter asks whether or not it has vetted anyone — because a fetch that tracked activity would report activity.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "label",
+        "tick",
+        "requests"
+    ],
+    "properties": {
+        "label": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "description": "The token label to draw under: the community's current monthly label, or an event label it has approved for this vetter."
+        },
+        "tick": {
+            "type": "integer",
+            "minimum": 0,
+            "description": "The vetter's own schedule counter for this label. It makes `once per tick` a rule the community can enforce without learning whether the vetter has been busy."
+        },
+        "requests": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 64,
+            "description": "One blinded serial per token asked for. More than the community's published `dripPerTick` is refused outright — the cap is the community's, not the asker's restraint.",
+            "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                    "commitment",
+                    "openingProof"
+                ],
+                "properties": {
+                    "commitment": {
+                        "type": "string",
+                        "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$",
+                        "description": "A commitment to a serial only the vetter knows."
+                    },
+                    "openingProof": {
+                        "type": "string",
+                        "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$",
+                        "description": "Proof that the commitment opens to a serial the vetter holds, bound to this label, member and tick."
+                    }
+                }
+            }
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTC Vetting PCS Tokens — response payload",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "label",
+                "tick",
+                "preCredentials"
+            ],
+            "description": "One blind signature per request, in the order asked.",
+            "properties": {
+                "label": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 128,
+                    "description": "The label served."
+                },
+                "tick": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "The tick served."
+                },
+                "preCredentials": {
+                    "type": "array",
+                    "minItems": 1,
+                    "maxItems": 64,
+                    "description": "The blind signatures, positionally matching `requests`.",
+                    "items": {
+                        "type": "string",
+                        "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+                    }
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTC Vetting PCS Tokens — response payload",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "label",
+                "tick",
+                "preCredentials"
+            ],
+            "description": "One blind signature per request, in the order asked.",
+            "properties": {
+                "label": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 128,
+                    "description": "The label served."
+                },
+                "tick": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "The tick served."
+                },
+                "preCredentials": {
+                    "type": "array",
+                    "minItems": 1,
+                    "maxItems": 64,
+                    "description": "The blind signatures, positionally matching `requests`.",
+                    "items": {
+                        "type": "string",
+                        "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+                    }
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map

package/dist/vtc/vetting/vetters/pcs-tokens/0.1/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../../../src/vtc/vetting/vetters/pcs-tokens/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwEH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,gEAAyE,CAAC;AAKlG,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,yEAAkF,CAAC;AAKpH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,gEAAgE;IACvE,OAAO,EAAE,oCAAoC;IAC7C,aAAa,EAAE,+MAA+M;IAC9N,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,OAAO;QACP,MAAM;QACN,UAAU;KACX;IACD,YAAY,EAAE;QACZ,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,0HAA0H;SAC1I;QACD,MAAM,EAAE;YACN,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,gKAAgK;SAChL;QACD,UAAU,EAAE;YACV,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,EAAE;YACd,aAAa,EAAE,wKAAwK;YACvL,OAAO,EAAE;gBACP,MAAM,EAAE,QAAQ;gBAChB,sBAAsB,EAAE,KAAK;gBAC7B,UAAU,EAAE;oBACV,YAAY;oBACZ,cAAc;iBACf;gBACD,YAAY,EAAE;oBACZ,YAAY,EAAE;wBACZ,MAAM,EAAE,QAAQ;wBAChB,SAAS,EAAE,0BAA0B;wBACrC,aAAa,EAAE,iDAAiD;qBACjE;oBACD,cAAc,EAAE;wBACd,MAAM,EAAE,QAAQ;wBAChB,SAAS,EAAE,0BAA0B;wBACrC,aAAa,EAAE,qGAAqG;qBACrH;iBACF;aACF;SACF;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;SACtB;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,2CAA2C;YACpD,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,MAAM;gBACN,gBAAgB;aACjB;YACD,aAAa,EAAE,sDAAsD;YACrE,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,mBAAmB;iBACnC;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,kBAAkB;iBAClC;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,EAAE;oBACd,aAAa,EAAE,yDAAyD;oBACxE,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,SAAS,EAAE,0BAA0B;qBACtC;iBACF;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,2CAA2C;YACpD,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,MAAM;gBACN,gBAAgB;aACjB;YACD,aAAa,EAAE,sDAAsD;YACrE,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,GAAG;oBAChB,aAAa,EAAE,mBAAmB;iBACnC;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,kBAAkB;iBAClC;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,UAAU,EAAE,EAAE;oBACd,aAAa,EAAE,yDAAyD;oBACxE,OAAO,EAAE;wBACP,MAAM,EAAE,QAAQ;wBAChB,SAAS,EAAE,0BAA0B;qBACtC;iBACF;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.20.1",
+  "version": "0.20.3",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/_shared/components.ts

@@ -179,6 +179,10 @@ export type DeviceAttestation_DeviceV0_2 =
   | Tpm_DeviceV0_2
   | NitroEnclave_DeviceV0_2
   | NoAttestation_DeviceV0_2;
+/**
+ * A DID, compared by exact string equality.
+ */
+export type Did = string;
 /**
  * A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.
  *
@@ -246,6 +250,14 @@ export type FaceReach =
  * **Superseded by `WorldColour`** — the same set, under the name the rest of the family now uses. Retained because `persona/facet/*` is retired in favour of `persona/world/*`, and a retired specification's schema is frozen, so the definition it references has to stay. New work references `WorldColour`. A colour **name**, resolved by each consumer against its own palette — never a hex value or any other literal. Two reasons, and both are about the consumer rather than the holder. A literal cannot be legible in a terminal, in a light theme and in a dark one at once, so a stored `#8B0000` is a colour that is wrong somewhere and the holder has no way to know where. And a consumer that reserves colours to mean something — an error, a warning, an irreversible act — must be able to keep a holder's decorative choice out of that channel; it cannot do that with an arbitrary value, and it can do it trivially with a closed set it maps itself. The eight members are chosen to be distinguishable from one another and deliberately carry no status connotation: none is named for success, warning or danger.
  */
 export type FacetColour = "slate" | "indigo" | "teal" | "moss" | "sand" | "clay" | "rose" | "plum";
+/**
+ * The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.
+ */
+export type ForgeHost = string;
+/**
+ * An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`"812736451"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.
+ */
+export type ForgeId = string;
 /**
  * The highest version among the records `DataCommitment` covers. `0` for a room that holds none.
  *
@@ -294,6 +306,10 @@ export type LanguageTag = string;
  * Scopes one application's records within a context, so several tools can share a context without colliding — `openvtc`, `cnm`, an agent runtime. The maintainer MUST NOT interpret the value; it is an opaque partition name. Namespaces are first-come and unreserved, so an application SHOULD pick a stable, specific one: a future per-namespace ACL would grant on this exact string, which makes renaming a namespace a migration rather than an edit.
  */
 export type Namespace = string;
+/**
+ * The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.
+ */
+export type NamespaceId = string;
 /**
  * A region or city name as the vetter writes it. Compared case-insensitively and otherwise exactly.
  */
@@ -470,10 +486,26 @@ export type RecordType = "authorization" | "recognition";
  * Absent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.
  */
 export type ReleaseRequirement = "consent" | "stepUp";
+/**
+ * A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.
+ */
+export type RepoResource = string;
+/**
+ * Repository visibility on the forge.
+ */
+export type RepoVisibility = "public" | "private";
+/**
+ * A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.
+ */
+export type Resource = string;
 /**
  * Whether a room keeps its history readable across a membership change, fixed at creation and immutable thereafter — like `Visibility`, and for the same reason: the rungs of an epoch key chain either exist for an epoch or they do not, and no later change of mind can seal key material that was never sealed or unseal what was already severed. `chained`: each advance produces an `EpochLink`, so every member reads the room's whole retained history however long they have been in it — what a **library** wants, at the cost of post-compromise security for record content, since a compromised current key then reaches every retained epoch. `fromJoin`: no rungs are produced, so a member reads only from the epoch their group state is at — what a **stream** wants, and what a room under a strict forward-secrecy obligation wants, at the cost that a joining member finds an empty-looking room and nobody can reread a record once their group state has moved past the epoch it was sealed under. Absent means `chained`; see the prose on why the absent case is the readable one.
  */
 export type RetentionPolicy = "chained" | "fromJoin";
+/**
+ * One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.
+ */
+export type Right = "git.ns.admin" | "git.repo.create" | "git.repo.own" | "git.repo.maintain" | "git.commit.sign";
 /**
  * How a consent prompt reaches the approver: `wake` pushes to the approver's device for a DID-signed decision; `bridge-relay` renders it through an enrolled bridge (e.g. a numbered card in the operator's messaging app) for a bridge-attested decision.
  */
@@ -540,6 +572,10 @@ export type SecretKind_VaultV0_2 =
   | "bearerToken"
   | "sshKey"
   | "custom";
+/**
+ * One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.
+ */
+export type Segment = string;
 /**
  * How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.
  *
@@ -1373,6 +1409,27 @@ export interface BackupEnvelope {
    */
   ciphertext: string;
 }
+/**
+ * Whether each step that turns commit trust on for a repository is in place, as last reported. A step that this forge's plan does not need reads `true`.
+ */
+export interface Bootstrap {
+  /**
+   * The verify-trust check runs on the repository's pull requests — from a workflow committed to it, or, where the forge supports it, required on it from the namespace's own bridge-managed workflow repository at a pinned commit.
+   */
+  workflow: boolean;
+  /**
+   * The exempt platform keyring for forge-signed merge commits is committed, or the forge's plan does not need one.
+   */
+  keyring: boolean;
+  /**
+   * The repository names the Trust Registry and this VTC as its trust anchors.
+   */
+  variables: boolean;
+  /**
+   * The forge refuses to merge into the default branch unless the verify-trust check passes, with no bypass, and a pull request cannot change what that check runs: an organisation-required workflow, code-owner review of workflow files, or protected workflow paths, as the forge allows.
+   */
+  requiredCheck: boolean;
+}
 /**
  * The self-description of a pluggable community capability: the Trust Task families it serves, the trust-registry vocabulary it reads and writes, the roles that may operate it, the membership lifecycle hooks it consumes, and the external adapters that act on its decisions. The manifest is what governance approves, what discovery advertises, and what a management UX renders.
  */
@@ -2369,6 +2426,34 @@ export interface DrainEntry {
   drainsUntil: string;
   ext?: Ext;
 }
+/**
+ * One difference between the forge's observed state and the VTC's projection of a repository.
+ */
+export interface DriftItem {
+  /**
+   * `roleAdded` — someone holds a forge role the projection does not give them. `roleRemoved` — a projected role is missing. `roleChanged` — a projected role is present at another level. `requiredCheckMissing` — the verify-trust check is no longer required. `protectionWeakened` — branch protection or a ruleset is weaker than the projection in another way (force-push allowed, bypass actors added). `bootstrapMissing` — a bootstrap file or variable is gone.
+   */
+  type:
+    | "roleAdded"
+    | "roleRemoved"
+    | "roleChanged"
+    | "requiredCheckMissing"
+    | "protectionWeakened"
+    | "bootstrapMissing";
+  resource: RepoResource;
+  /**
+   * Whose role differs, for the three role types.
+   */
+  account?: ForgeAccount;
+  /**
+   * What the forge shows, in the forge's own vocabulary (a role name such as `maintain`, a setting name). Absent when nothing is there.
+   */
+  observed?: string;
+  /**
+   * What the projection calls for, in the forge's own vocabulary. Absent when the projection calls for nothing.
+   */
+  expected?: string;
+}
 /**
  * One consequence of executing the pending task, authored by the executor that is about to run it. An effect is produced by dry-running the real handler against the executor's own prior state — never by the requester, and never by re-implementing the handler's semantics elsewhere. A consent surface renders ONLY effects it received under the executor's signature.
  */
@@ -2527,6 +2612,40 @@ export interface Exposure {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.
+ */
+export interface ForgeAccount {
+  forge: ForgeHost;
+  id: ForgeId;
+  /**
+   * The account's current login, as the forge reported it when last seen. Display only.
+   */
+  login: string;
+}
+/**
+ * The VTC's binding to one owner on one forge.
+ */
+export interface GitNamespace {
+  id: NamespaceId;
+  forge: ForgeHost;
+  /**
+   * The organisation or user on the forge, lowercased.
+   */
+  owner: Segment;
+  /**
+   * Whether the owner is an organisation or a personal account, as the forge reports it. Present once known: a bridge-mode namespace learns it when binding completes, and a manual-mode namespace MAY never learn it.
+   */
+  kind?: "organization" | "user";
+  /**
+   * `bridge` — a bridge service acts on the forge for this namespace (creates repositories, projects roles, reports drift). `manual` — no automation; people with forge access carry out the steps the VTC names, and the VTC governs the rights alone.
+   */
+  mode: "bridge" | "manual";
+  /**
+   * `pending` — binding has started and the forge-side proof has not arrived yet. `bound` — the VTC governs rights under this namespace.
+   */
+  state: "pending" | "bound";
+}
 /**
  * OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`did-signed` / `attested` / `pinned-only`) is the integrity / authenticity anchor.
  *
@@ -3804,6 +3923,27 @@ export interface RejectedKey {
    */
   reason: string;
 }
+/**
+ * One repository as the VTC records it.
+ */
+export interface RepoSummary {
+  resource: RepoResource;
+  /**
+   * The forge's repository id. Absent until the forge has confirmed the repository exists (a `pendingCreate` repository, or one adopted in bridge mode before the first inspection).
+   */
+  forgeId?: ForgeId;
+  visibility: RepoVisibility;
+  /**
+   * `pendingCreate` — the name is reserved and the repository is not yet confirmed on the forge. `active` — managed. `archived` — archived through git-ns/repo/archive; commit rights on it are revoked. `detached` — no longer governed: its namespace was unbound, or it moved outside the namespace. `orphaned` — its last owner left the community and ownership passed to the namespace admins, who have not yet named a new owner. `unmanaged` — it exists on the forge inside a bound namespace but was never created or adopted through the VTC.
+   */
+  state: "pendingCreate" | "active" | "archived" | "detached" | "orphaned" | "unmanaged";
+  /**
+   * The DIDs holding `git.repo.own` on this repository by an explicit grant. Empty only for an `unmanaged` repository, and for an `orphaned` one whose ownership rests with the namespace admins by implication.
+   */
+  owners: Did[];
+  bootstrap: Bootstrap;
+  sync: Sync;
+}
 /**
  * One held credential a deferred query asked for, and the claims of it that would be disclosed.
  */
@@ -3879,6 +4019,30 @@ export interface RevocationReceipt {
    */
   revokedAt: string;
 }
+/**
+ * One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords.
+ */
+export interface RightRecord {
+  /**
+   * Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.
+   */
+  subject: Did;
+  right: Right;
+  resource: Resource;
+  /**
+   * The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.
+   */
+  grantedBy: Did;
+  grantedAt: string;
+  /**
+   * When the right lapses. Absent: no expiry.
+   */
+  expiresAt?: string;
+  /**
+   * The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.
+   */
+  reason?: string;
+}
 /**
  * The outcome of a rollback. Distinct from ServiceMutationResult because a rollback can legitimately publish nothing: if the previous state already equals the current one there is no change to write, and `kind: "noOp"` says so with `logEntryVersionId` absent. Treating that as a failure would be wrong — the requested state holds — and treating it as an ordinary success would report a log entry that does not exist.
  */
@@ -4178,6 +4342,23 @@ export interface StreamDescriptor {
   expectedSizeBytes: ExpectedSizeBytes;
   expiresAt: ExpiresAt;
 }
+/**
+ * How the forge compares with the VTC's projection for one repository.
+ */
+export interface Sync {
+  /**
+   * `inSync` — the last comparison found no drift. `drift` — it found some, listed in `drift`. `pending` — a change has been sent to the forge and not yet confirmed. `unchecked` — nothing compares this repository (a manual-mode namespace).
+   */
+  state: "inSync" | "drift" | "pending" | "unchecked";
+  /**
+   * When the forge was last compared. Absent if never.
+   */
+  checkedAt?: string;
+  /**
+   * Outstanding drift. Empty unless `state` is `drift`.
+   */
+  drift: DriftItem[];
+}
 /**
  * An access token (typically short-lived JWT) paired with an optional refresh token (typically long-lived opaque string). The shapes follow OAuth 2.0 (RFC 6749 §5.1) conventions but are not coupled to any particular OAuth profile.
  */

package/src/git-ns/_shared/0.1/git-ns.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/git-ns/_shared/0.1/git-ns.schema.json
+ */
+
+/**
+ * Shapes used by more than one git-ns/* task: forge-qualified resources, the five git rights, namespaces, repositories, rights records, forge accounts and drift. Not itself a Trust Task specification. A VTC is the source of truth for all of these; the Trust Registry and the forge are projections of them.
+ */
+export interface GitNamespacesSharedDefinitionsForTheGitNsSpecFamily {
+  [k: string]: unknown | undefined;
+}
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { Bootstrap, Did, DriftItem, ForgeAccount, ForgeHost, ForgeId, GitNamespace, NamespaceId, RepoResource, RepoSummary, RepoVisibility, Resource, Right, RightRecord, Segment, Sync } from "../../../_shared/components.js";