@openvtc/trust-tasks 0.20.3 → 0.20.5

package/dist/git-ns/bridge/job/0.2/payload.d.ts

@@ -0,0 +1,1068 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/git-ns/bridge/job/0.2/payload.schema.json
+ */
+import type { Did, Ext, ForgeAccount, ForgeHost, ForgeId, NamespaceId, RepoResource, RepoVisibility, Right, Segment } from "../../../../_shared/components.js";
+/**
+ * One step of a forge adapter's plan. Forge-neutral names: `create`, `workflow`, `keyring`, `variables`, `requiredCheck`, `roles`, `archive`. An adapter MAY add its own (`mergeStyle`, `runner`), which a VTC displays but need not understand.
+ */
+export type StepName = string;
+/**
+ * The VTC's identifier for a job, unique across the VTC's jobs.
+ */
+export type JobId = string;
+/**
+ * The VTC asks its bridge to do one piece of forge work in a namespace. The job names what to do (`kind`) and carries the desired state, never forge credentials — the bridge holds those. Which optional members a job carries is fixed by its `kind` (see the specification's kind table); a bridge refuses a job that carries a member its kind does not use, or lacks one its kind requires.
+ */
+export interface GitNamespacesBridgeJobPayload {
+    /**
+     * The VTC's identifier for this job. The bridge reports on it with git-ns/bridge/result.
+     */
+    jobId: string;
+    /**
+     * The namespace the job acts in. It also selects the bridge's forge credentials for it.
+     */
+    namespace: NamespaceId;
+    /**
+     * What to do. `projectRoles` — converge forge roles to `desiredRoles`, and remove whatever role each of `removeAccounts` holds on `repo`. `createRepo` — create `repo`, run the bootstrap plan, and project `desiredRoles`. `bootstrap` — run the bootstrap plan, or the listed `steps` of it, on an existing `repo`. `archive` — archive `repo`. `inspect` — compare the forge with the projection for `repo`, or for the whole namespace. `beginBind` — start the proof that the binding admin controls `target`. `beginAccountLink` — start linking `subject`'s account on this namespace's forge.
+     */
+    kind: "projectRoles" | "createRepo" | "bootstrap" | "archive" | "inspect" | "beginBind" | "beginAccountLink";
+    /**
+     * The repository. Required for `createRepo`, `bootstrap` and `archive`. For `projectRoles`, absent means the namespace-level roles (organisation owners), where only `git.ns.admin` is projected. For `inspect`, absent means a sweep of every repository in the namespace.
+     */
+    repo?: RepoResource;
+    spec?: RepoSpec;
+    /**
+     * The complete set of people who should hold a forge role on the target. The bridge converges to exactly this set among the roles it manages: it adds or changes roles to match and removes managed roles not listed. `projectRoles` and `createRepo` only.
+     */
+    desiredRoles?: DesiredRole[];
+    /**
+     * Accounts whose direct role on `repo` the bridge removes, whatever that role is — including a role the bridge does not manage and would otherwise only report as drift. Matched by `forge` and `id`; `login` is display only. No account listed here may also appear in `desiredRoles`. `projectRoles` with `repo` only.
+     *
+     * @minItems 1
+     */
+    removeAccounts?: [ForgeAccount, ...ForgeAccount[]];
+    /**
+     * Run only these steps of the adapter's bootstrap plan, in the plan's order. Absent: the whole plan. `bootstrap` only.
+     *
+     * @minItems 1
+     */
+    steps?: [StepName, ...StepName[]];
+    target?: BindTarget;
+    /**
+     * The member whose forge account is being linked. `beginAccountLink` only.
+     */
+    subject?: Did;
+    ext?: Ext;
+}
+/**
+ * How to create the repository. `createRepo` only.
+ */
+export interface RepoSpec {
+    visibility: RepoVisibility;
+    description?: string;
+}
+export interface DesiredRole {
+    subject: Did;
+    /**
+     * The subject's linked account on this namespace's forge.
+     */
+    account: ForgeAccount;
+    /**
+     * The subject's highest effective right on the target, which the forge adapter maps to one of its roles.
+     */
+    right: Right;
+}
+/**
+ * `beginBind` only.
+ */
+export interface BindTarget {
+    forge: ForgeHost;
+    owner: Segment;
+}
+/**
+ * Whether the bridge took the job.
+ */
+export interface GitNamespacesBridgeJobResponsePayload {
+    jobId: JobId;
+    /**
+     * `true` — the job is durably queued, or was already queued or running under this `jobId`; a git-ns/bridge/result follows. `false` — the bridge already finished this `jobId`; it does not run it again, and sends its git-ns/bridge/result again.
+     */
+    accepted: boolean;
+    /**
+     * For `beginBind` and `beginAccountLink` when `accepted` is `true`: where the VTC sends the person.
+     */
+    next?: {
+        url: string;
+        /**
+         * The device-flow code, for a forge that uses one.
+         */
+        userCode?: string;
+        expiresAt: string;
+    };
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Did, Ext, ForgeAccount, ForgeHost, ForgeId, NamespaceId, RepoResource, RepoVisibility, Right, Segment };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/git-ns/bridge/job/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = GitNamespacesBridgeJobPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/git-ns/bridge/job/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = GitNamespacesBridgeJobResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/git-ns/bridge/job/0.2";
+    readonly title: "Git Namespaces — Bridge Job — payload";
+    readonly description: "The VTC asks its bridge to do one piece of forge work in a namespace. The job names what to do (`kind`) and carries the desired state, never forge credentials — the bridge holds those. Which optional members a job carries is fixed by its `kind` (see the specification's kind table); a bridge refuses a job that carries a member its kind does not use, or lacks one its kind requires.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["jobId", "namespace", "kind"];
+    readonly properties: {
+        readonly jobId: {
+            readonly $ref: "#/$defs/JobId";
+            readonly description: "The VTC's identifier for this job. The bridge reports on it with git-ns/bridge/result.";
+        };
+        readonly namespace: {
+            readonly $ref: "#/$defs/NamespaceId";
+            readonly description: "The namespace the job acts in. It also selects the bridge's forge credentials for it.";
+        };
+        readonly kind: {
+            readonly type: "string";
+            readonly enum: readonly ["projectRoles", "createRepo", "bootstrap", "archive", "inspect", "beginBind", "beginAccountLink"];
+            readonly description: "What to do. `projectRoles` — converge forge roles to `desiredRoles`, and remove whatever role each of `removeAccounts` holds on `repo`. `createRepo` — create `repo`, run the bootstrap plan, and project `desiredRoles`. `bootstrap` — run the bootstrap plan, or the listed `steps` of it, on an existing `repo`. `archive` — archive `repo`. `inspect` — compare the forge with the projection for `repo`, or for the whole namespace. `beginBind` — start the proof that the binding admin controls `target`. `beginAccountLink` — start linking `subject`'s account on this namespace's forge.";
+        };
+        readonly repo: {
+            readonly $ref: "#/$defs/RepoResource";
+            readonly description: "The repository. Required for `createRepo`, `bootstrap` and `archive`. For `projectRoles`, absent means the namespace-level roles (organisation owners), where only `git.ns.admin` is projected. For `inspect`, absent means a sweep of every repository in the namespace.";
+        };
+        readonly spec: {
+            readonly $ref: "#/$defs/RepoSpec";
+            readonly description: "How to create the repository. `createRepo` only.";
+        };
+        readonly desiredRoles: {
+            readonly type: "array";
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly $ref: "#/$defs/DesiredRole";
+            };
+            readonly description: "The complete set of people who should hold a forge role on the target. The bridge converges to exactly this set among the roles it manages: it adds or changes roles to match and removes managed roles not listed. `projectRoles` and `createRepo` only.";
+        };
+        readonly removeAccounts: {
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly $ref: "#/$defs/ForgeAccount";
+            };
+            readonly description: "Accounts whose direct role on `repo` the bridge removes, whatever that role is — including a role the bridge does not manage and would otherwise only report as drift. Matched by `forge` and `id`; `login` is display only. No account listed here may also appear in `desiredRoles`. `projectRoles` with `repo` only.";
+        };
+        readonly steps: {
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly $ref: "#/$defs/StepName";
+            };
+            readonly description: "Run only these steps of the adapter's bootstrap plan, in the plan's order. Absent: the whole plan. `bootstrap` only.";
+        };
+        readonly target: {
+            readonly $ref: "#/$defs/BindTarget";
+            readonly description: "`beginBind` only.";
+        };
+        readonly subject: {
+            readonly $ref: "#/$defs/Did";
+            readonly description: "The member whose forge account is being linked. `beginAccountLink` only.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly JobId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly description: "The VTC's identifier for a job, unique across the VTC's jobs.";
+        };
+        readonly StepName: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly pattern: "^[a-z][A-Za-z0-9]*$";
+            readonly description: "One step of a forge adapter's plan. Forge-neutral names: `create`, `workflow`, `keyring`, `variables`, `requiredCheck`, `roles`, `archive`. An adapter MAY add its own (`mergeStyle`, `runner`), which a VTC displays but need not understand.";
+        };
+        readonly DesiredRole: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "account", "right"];
+            readonly properties: {
+                readonly subject: {
+                    readonly $ref: "#/$defs/Did";
+                };
+                readonly account: {
+                    readonly $ref: "#/$defs/ForgeAccount";
+                    readonly description: "The subject's linked account on this namespace's forge.";
+                };
+                readonly right: {
+                    readonly $ref: "#/$defs/Right";
+                    readonly description: "The subject's highest effective right on the target, which the forge adapter maps to one of its roles.";
+                };
+            };
+        };
+        readonly RepoSpec: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["visibility"];
+            readonly properties: {
+                readonly visibility: {
+                    readonly $ref: "#/$defs/RepoVisibility";
+                };
+                readonly description: {
+                    readonly type: "string";
+                    readonly maxLength: 350;
+                };
+            };
+        };
+        readonly BindTarget: {
+            readonly title: "BindTarget";
+            readonly description: "The forge owner whose control the binding admin is to prove.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["forge", "owner"];
+            readonly properties: {
+                readonly forge: {
+                    readonly $ref: "#/$defs/ForgeHost";
+                };
+                readonly owner: {
+                    readonly $ref: "#/$defs/Segment";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — Bridge Job — response payload";
+            readonly description: "Whether the bridge took the job.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["jobId", "accepted"];
+            readonly properties: {
+                readonly jobId: {
+                    readonly $ref: "#/$defs/JobId";
+                };
+                readonly accepted: {
+                    readonly type: "boolean";
+                    readonly description: "`true` — the job is durably queued, or was already queued or running under this `jobId`; a git-ns/bridge/result follows. `false` — the bridge already finished this `jobId`; it does not run it again, and sends its git-ns/bridge/result again.";
+                };
+                readonly next: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["url", "expiresAt"];
+                    readonly description: "For `beginBind` and `beginAccountLink` when `accepted` is `true`: where the VTC sends the person.";
+                    readonly properties: {
+                        readonly url: {
+                            readonly type: "string";
+                            readonly format: "uri";
+                            readonly maxLength: 2048;
+                            readonly pattern: "^https://";
+                        };
+                        readonly userCode: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 64;
+                            readonly description: "The device-flow code, for a forge that uses one.";
+                        };
+                        readonly expiresAt: {
+                            readonly type: "string";
+                            readonly format: "date-time";
+                        };
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Segment: {
+            readonly title: "Segment";
+            readonly description: "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 100;
+            readonly pattern: "^[a-z0-9_-][a-z0-9._-]*$";
+        };
+        readonly ForgeHost: {
+            readonly title: "ForgeHost";
+            readonly description: "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.";
+            readonly type: "string";
+            readonly minLength: 3;
+            readonly maxLength: 253;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$";
+        };
+        readonly RepoVisibility: {
+            readonly title: "RepoVisibility";
+            readonly type: "string";
+            readonly enum: readonly ["public", "private"];
+            readonly description: "Repository visibility on the forge.";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+        readonly ForgeAccount: {
+            readonly title: "ForgeAccount";
+            readonly description: "A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["forge", "id", "login"];
+            readonly properties: {
+                readonly forge: {
+                    readonly $ref: "#/$defs/ForgeHost";
+                };
+                readonly id: {
+                    readonly $ref: "#/$defs/ForgeId";
+                };
+                readonly login: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 100;
+                    readonly description: "The account's current login, as the forge reported it when last seen. Display only.";
+                };
+            };
+        };
+        readonly ForgeId: {
+            readonly title: "ForgeId";
+            readonly description: "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A DID, compared by exact string equality.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:\\S+$";
+        };
+        readonly RepoResource: {
+            readonly title: "RepoResource";
+            readonly description: "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$";
+        };
+        readonly NamespaceId: {
+            readonly title: "NamespaceId";
+            readonly description: "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly JobId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly description: "The VTC's identifier for a job, unique across the VTC's jobs.";
+        };
+        readonly StepName: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly pattern: "^[a-z][A-Za-z0-9]*$";
+            readonly description: "One step of a forge adapter's plan. Forge-neutral names: `create`, `workflow`, `keyring`, `variables`, `requiredCheck`, `roles`, `archive`. An adapter MAY add its own (`mergeStyle`, `runner`), which a VTC displays but need not understand.";
+        };
+        readonly DesiredRole: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "account", "right"];
+            readonly properties: {
+                readonly subject: {
+                    readonly $ref: "#/$defs/Did";
+                };
+                readonly account: {
+                    readonly $ref: "#/$defs/ForgeAccount";
+                    readonly description: "The subject's linked account on this namespace's forge.";
+                };
+                readonly right: {
+                    readonly $ref: "#/$defs/Right";
+                    readonly description: "The subject's highest effective right on the target, which the forge adapter maps to one of its roles.";
+                };
+            };
+        };
+        readonly RepoSpec: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["visibility"];
+            readonly properties: {
+                readonly visibility: {
+                    readonly $ref: "#/$defs/RepoVisibility";
+                };
+                readonly description: {
+                    readonly type: "string";
+                    readonly maxLength: 350;
+                };
+            };
+        };
+        readonly BindTarget: {
+            readonly title: "BindTarget";
+            readonly description: "The forge owner whose control the binding admin is to prove.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["forge", "owner"];
+            readonly properties: {
+                readonly forge: {
+                    readonly $ref: "#/$defs/ForgeHost";
+                };
+                readonly owner: {
+                    readonly $ref: "#/$defs/Segment";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — Bridge Job — response payload";
+            readonly description: "Whether the bridge took the job.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["jobId", "accepted"];
+            readonly properties: {
+                readonly jobId: {
+                    readonly $ref: "#/$defs/JobId";
+                };
+                readonly accepted: {
+                    readonly type: "boolean";
+                    readonly description: "`true` — the job is durably queued, or was already queued or running under this `jobId`; a git-ns/bridge/result follows. `false` — the bridge already finished this `jobId`; it does not run it again, and sends its git-ns/bridge/result again.";
+                };
+                readonly next: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["url", "expiresAt"];
+                    readonly description: "For `beginBind` and `beginAccountLink` when `accepted` is `true`: where the VTC sends the person.";
+                    readonly properties: {
+                        readonly url: {
+                            readonly type: "string";
+                            readonly format: "uri";
+                            readonly maxLength: 2048;
+                            readonly pattern: "^https://";
+                        };
+                        readonly userCode: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 64;
+                            readonly description: "The device-flow code, for a forge that uses one.";
+                        };
+                        readonly expiresAt: {
+                            readonly type: "string";
+                            readonly format: "date-time";
+                        };
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Segment: {
+            readonly title: "Segment";
+            readonly description: "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 100;
+            readonly pattern: "^[a-z0-9_-][a-z0-9._-]*$";
+        };
+        readonly ForgeHost: {
+            readonly title: "ForgeHost";
+            readonly description: "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.";
+            readonly type: "string";
+            readonly minLength: 3;
+            readonly maxLength: 253;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$";
+        };
+        readonly RepoVisibility: {
+            readonly title: "RepoVisibility";
+            readonly type: "string";
+            readonly enum: readonly ["public", "private"];
+            readonly description: "Repository visibility on the forge.";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+        readonly ForgeAccount: {
+            readonly title: "ForgeAccount";
+            readonly description: "A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["forge", "id", "login"];
+            readonly properties: {
+                readonly forge: {
+                    readonly $ref: "#/$defs/ForgeHost";
+                };
+                readonly id: {
+                    readonly $ref: "#/$defs/ForgeId";
+                };
+                readonly login: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 100;
+                    readonly description: "The account's current login, as the forge reported it when last seen. Display only.";
+                };
+            };
+        };
+        readonly ForgeId: {
+            readonly title: "ForgeId";
+            readonly description: "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A DID, compared by exact string equality.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:\\S+$";
+        };
+        readonly RepoResource: {
+            readonly title: "RepoResource";
+            readonly description: "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$";
+        };
+        readonly NamespaceId: {
+            readonly title: "NamespaceId";
+            readonly description: "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/bridge/job/0.2";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/git-ns/bridge/job/0.2";
+        readonly title: "Git Namespaces — Bridge Job — payload";
+        readonly description: "The VTC asks its bridge to do one piece of forge work in a namespace. The job names what to do (`kind`) and carries the desired state, never forge credentials — the bridge holds those. Which optional members a job carries is fixed by its `kind` (see the specification's kind table); a bridge refuses a job that carries a member its kind does not use, or lacks one its kind requires.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["jobId", "namespace", "kind"];
+        readonly properties: {
+            readonly jobId: {
+                readonly $ref: "#/$defs/JobId";
+                readonly description: "The VTC's identifier for this job. The bridge reports on it with git-ns/bridge/result.";
+            };
+            readonly namespace: {
+                readonly $ref: "#/$defs/NamespaceId";
+                readonly description: "The namespace the job acts in. It also selects the bridge's forge credentials for it.";
+            };
+            readonly kind: {
+                readonly type: "string";
+                readonly enum: readonly ["projectRoles", "createRepo", "bootstrap", "archive", "inspect", "beginBind", "beginAccountLink"];
+                readonly description: "What to do. `projectRoles` — converge forge roles to `desiredRoles`, and remove whatever role each of `removeAccounts` holds on `repo`. `createRepo` — create `repo`, run the bootstrap plan, and project `desiredRoles`. `bootstrap` — run the bootstrap plan, or the listed `steps` of it, on an existing `repo`. `archive` — archive `repo`. `inspect` — compare the forge with the projection for `repo`, or for the whole namespace. `beginBind` — start the proof that the binding admin controls `target`. `beginAccountLink` — start linking `subject`'s account on this namespace's forge.";
+            };
+            readonly repo: {
+                readonly $ref: "#/$defs/RepoResource";
+                readonly description: "The repository. Required for `createRepo`, `bootstrap` and `archive`. For `projectRoles`, absent means the namespace-level roles (organisation owners), where only `git.ns.admin` is projected. For `inspect`, absent means a sweep of every repository in the namespace.";
+            };
+            readonly spec: {
+                readonly $ref: "#/$defs/RepoSpec";
+                readonly description: "How to create the repository. `createRepo` only.";
+            };
+            readonly desiredRoles: {
+                readonly type: "array";
+                readonly uniqueItems: true;
+                readonly items: {
+                    readonly $ref: "#/$defs/DesiredRole";
+                };
+                readonly description: "The complete set of people who should hold a forge role on the target. The bridge converges to exactly this set among the roles it manages: it adds or changes roles to match and removes managed roles not listed. `projectRoles` and `createRepo` only.";
+            };
+            readonly removeAccounts: {
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly uniqueItems: true;
+                readonly items: {
+                    readonly $ref: "#/$defs/ForgeAccount";
+                };
+                readonly description: "Accounts whose direct role on `repo` the bridge removes, whatever that role is — including a role the bridge does not manage and would otherwise only report as drift. Matched by `forge` and `id`; `login` is display only. No account listed here may also appear in `desiredRoles`. `projectRoles` with `repo` only.";
+            };
+            readonly steps: {
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly uniqueItems: true;
+                readonly items: {
+                    readonly $ref: "#/$defs/StepName";
+                };
+                readonly description: "Run only these steps of the adapter's bootstrap plan, in the plan's order. Absent: the whole plan. `bootstrap` only.";
+            };
+            readonly target: {
+                readonly $ref: "#/$defs/BindTarget";
+                readonly description: "`beginBind` only.";
+            };
+            readonly subject: {
+                readonly $ref: "#/$defs/Did";
+                readonly description: "The member whose forge account is being linked. `beginAccountLink` only.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly JobId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly description: "The VTC's identifier for a job, unique across the VTC's jobs.";
+            };
+            readonly StepName: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly pattern: "^[a-z][A-Za-z0-9]*$";
+                readonly description: "One step of a forge adapter's plan. Forge-neutral names: `create`, `workflow`, `keyring`, `variables`, `requiredCheck`, `roles`, `archive`. An adapter MAY add its own (`mergeStyle`, `runner`), which a VTC displays but need not understand.";
+            };
+            readonly DesiredRole: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "account", "right"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly $ref: "#/$defs/Did";
+                    };
+                    readonly account: {
+                        readonly $ref: "#/$defs/ForgeAccount";
+                        readonly description: "The subject's linked account on this namespace's forge.";
+                    };
+                    readonly right: {
+                        readonly $ref: "#/$defs/Right";
+                        readonly description: "The subject's highest effective right on the target, which the forge adapter maps to one of its roles.";
+                    };
+                };
+            };
+            readonly RepoSpec: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["visibility"];
+                readonly properties: {
+                    readonly visibility: {
+                        readonly $ref: "#/$defs/RepoVisibility";
+                    };
+                    readonly description: {
+                        readonly type: "string";
+                        readonly maxLength: 350;
+                    };
+                };
+            };
+            readonly BindTarget: {
+                readonly title: "BindTarget";
+                readonly description: "The forge owner whose control the binding admin is to prove.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["forge", "owner"];
+                readonly properties: {
+                    readonly forge: {
+                        readonly $ref: "#/$defs/ForgeHost";
+                    };
+                    readonly owner: {
+                        readonly $ref: "#/$defs/Segment";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — Bridge Job — response payload";
+                readonly description: "Whether the bridge took the job.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["jobId", "accepted"];
+                readonly properties: {
+                    readonly jobId: {
+                        readonly $ref: "#/$defs/JobId";
+                    };
+                    readonly accepted: {
+                        readonly type: "boolean";
+                        readonly description: "`true` — the job is durably queued, or was already queued or running under this `jobId`; a git-ns/bridge/result follows. `false` — the bridge already finished this `jobId`; it does not run it again, and sends its git-ns/bridge/result again.";
+                    };
+                    readonly next: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["url", "expiresAt"];
+                        readonly description: "For `beginBind` and `beginAccountLink` when `accepted` is `true`: where the VTC sends the person.";
+                        readonly properties: {
+                            readonly url: {
+                                readonly type: "string";
+                                readonly format: "uri";
+                                readonly maxLength: 2048;
+                                readonly pattern: "^https://";
+                            };
+                            readonly userCode: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                                readonly maxLength: 64;
+                                readonly description: "The device-flow code, for a forge that uses one.";
+                            };
+                            readonly expiresAt: {
+                                readonly type: "string";
+                                readonly format: "date-time";
+                            };
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Segment: {
+                readonly title: "Segment";
+                readonly description: "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 100;
+                readonly pattern: "^[a-z0-9_-][a-z0-9._-]*$";
+            };
+            readonly ForgeHost: {
+                readonly title: "ForgeHost";
+                readonly description: "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.";
+                readonly type: "string";
+                readonly minLength: 3;
+                readonly maxLength: 253;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$";
+            };
+            readonly RepoVisibility: {
+                readonly title: "RepoVisibility";
+                readonly type: "string";
+                readonly enum: readonly ["public", "private"];
+                readonly description: "Repository visibility on the forge.";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+            readonly ForgeAccount: {
+                readonly title: "ForgeAccount";
+                readonly description: "A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["forge", "id", "login"];
+                readonly properties: {
+                    readonly forge: {
+                        readonly $ref: "#/$defs/ForgeHost";
+                    };
+                    readonly id: {
+                        readonly $ref: "#/$defs/ForgeId";
+                    };
+                    readonly login: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 100;
+                        readonly description: "The account's current login, as the forge reported it when last seen. Display only.";
+                    };
+                };
+            };
+            readonly ForgeId: {
+                readonly title: "ForgeId";
+                readonly description: "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A DID, compared by exact string equality.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:\\S+$";
+            };
+            readonly RepoResource: {
+                readonly title: "RepoResource";
+                readonly description: "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$";
+            };
+            readonly NamespaceId: {
+                readonly title: "NamespaceId";
+                readonly description: "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/bridge/job/0.2#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly JobId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly description: "The VTC's identifier for a job, unique across the VTC's jobs.";
+            };
+            readonly StepName: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly pattern: "^[a-z][A-Za-z0-9]*$";
+                readonly description: "One step of a forge adapter's plan. Forge-neutral names: `create`, `workflow`, `keyring`, `variables`, `requiredCheck`, `roles`, `archive`. An adapter MAY add its own (`mergeStyle`, `runner`), which a VTC displays but need not understand.";
+            };
+            readonly DesiredRole: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "account", "right"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly $ref: "#/$defs/Did";
+                    };
+                    readonly account: {
+                        readonly $ref: "#/$defs/ForgeAccount";
+                        readonly description: "The subject's linked account on this namespace's forge.";
+                    };
+                    readonly right: {
+                        readonly $ref: "#/$defs/Right";
+                        readonly description: "The subject's highest effective right on the target, which the forge adapter maps to one of its roles.";
+                    };
+                };
+            };
+            readonly RepoSpec: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["visibility"];
+                readonly properties: {
+                    readonly visibility: {
+                        readonly $ref: "#/$defs/RepoVisibility";
+                    };
+                    readonly description: {
+                        readonly type: "string";
+                        readonly maxLength: 350;
+                    };
+                };
+            };
+            readonly BindTarget: {
+                readonly title: "BindTarget";
+                readonly description: "The forge owner whose control the binding admin is to prove.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["forge", "owner"];
+                readonly properties: {
+                    readonly forge: {
+                        readonly $ref: "#/$defs/ForgeHost";
+                    };
+                    readonly owner: {
+                        readonly $ref: "#/$defs/Segment";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — Bridge Job — response payload";
+                readonly description: "Whether the bridge took the job.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["jobId", "accepted"];
+                readonly properties: {
+                    readonly jobId: {
+                        readonly $ref: "#/$defs/JobId";
+                    };
+                    readonly accepted: {
+                        readonly type: "boolean";
+                        readonly description: "`true` — the job is durably queued, or was already queued or running under this `jobId`; a git-ns/bridge/result follows. `false` — the bridge already finished this `jobId`; it does not run it again, and sends its git-ns/bridge/result again.";
+                    };
+                    readonly next: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["url", "expiresAt"];
+                        readonly description: "For `beginBind` and `beginAccountLink` when `accepted` is `true`: where the VTC sends the person.";
+                        readonly properties: {
+                            readonly url: {
+                                readonly type: "string";
+                                readonly format: "uri";
+                                readonly maxLength: 2048;
+                                readonly pattern: "^https://";
+                            };
+                            readonly userCode: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                                readonly maxLength: 64;
+                                readonly description: "The device-flow code, for a forge that uses one.";
+                            };
+                            readonly expiresAt: {
+                                readonly type: "string";
+                                readonly format: "date-time";
+                            };
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Segment: {
+                readonly title: "Segment";
+                readonly description: "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 100;
+                readonly pattern: "^[a-z0-9_-][a-z0-9._-]*$";
+            };
+            readonly ForgeHost: {
+                readonly title: "ForgeHost";
+                readonly description: "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.";
+                readonly type: "string";
+                readonly minLength: 3;
+                readonly maxLength: 253;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$";
+            };
+            readonly RepoVisibility: {
+                readonly title: "RepoVisibility";
+                readonly type: "string";
+                readonly enum: readonly ["public", "private"];
+                readonly description: "Repository visibility on the forge.";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+            readonly ForgeAccount: {
+                readonly title: "ForgeAccount";
+                readonly description: "A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["forge", "id", "login"];
+                readonly properties: {
+                    readonly forge: {
+                        readonly $ref: "#/$defs/ForgeHost";
+                    };
+                    readonly id: {
+                        readonly $ref: "#/$defs/ForgeId";
+                    };
+                    readonly login: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 100;
+                        readonly description: "The account's current login, as the forge reported it when last seen. Display only.";
+                    };
+                };
+            };
+            readonly ForgeId: {
+                readonly title: "ForgeId";
+                readonly description: "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A DID, compared by exact string equality.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:\\S+$";
+            };
+            readonly RepoResource: {
+                readonly title: "RepoResource";
+                readonly description: "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$";
+            };
+            readonly NamespaceId: {
+                readonly title: "NamespaceId";
+                readonly description: "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map