@openvtc/trust-tasks 0.20.6 → 0.20.7

package/src/git-ns/bridge/job/0.3/payload.ts

@@ -0,0 +1,691 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/git-ns/bridge/job/0.3/payload.schema.json
+ */
+
+import type { Did_GitNsV0_3 as Did, Ext, ForgeAccount, ForgeHost, ForgeId, NamespaceId, RepoResource, RepoVisibility, Right, Segment } from "../../../../_shared/components.js";
+
+
+/**
+ * One step of a forge adapter's plan. Forge-neutral names: `create`, `workflow`, `keyring`, `variables`, `requiredCheck`, `roles`, `archive`. An adapter MAY add its own (`mergeStyle`, `runner`), which a VTC displays but need not understand.
+ */
+export type StepName = string;
+/**
+ * The VTC's identifier for a job, unique across the VTC's jobs.
+ */
+export type JobId = string;
+
+/**
+ * The VTC asks its bridge to do one piece of forge work in a namespace. The job names what to do (`kind`) and carries the desired state, never forge credentials — the bridge holds those. Which optional members a job carries is fixed by its `kind` (see the specification's kind table); a bridge refuses a job that carries a member its kind does not use, or lacks one its kind requires.
+ */
+export interface GitNamespacesBridgeJobPayload {
+  /**
+   * The VTC's identifier for this job. The bridge reports on it with git-ns/bridge/result.
+   */
+  jobId: string;
+  /**
+   * The namespace the job acts in. It also selects the bridge's forge credentials for it.
+   */
+  namespace: NamespaceId;
+  /**
+   * What to do. `projectRoles` — converge forge roles to `desiredRoles`, and remove whatever role each of `removeAccounts` holds on `repo`. `createRepo` — create `repo`, run the bootstrap plan, and project `desiredRoles`. `bootstrap` — run the bootstrap plan, or the listed `steps` of it, on an existing `repo`. `archive` — archive `repo`. `inspect` — compare the forge with the projection for `repo`, or for the whole namespace. `beginBind` — start the proof that the binding admin controls `target`. `beginAccountLink` — start linking `subject`'s account on this namespace's forge.
+   */
+  kind: "projectRoles" | "createRepo" | "bootstrap" | "archive" | "inspect" | "beginBind" | "beginAccountLink";
+  /**
+   * The repository. Required for `createRepo`, `bootstrap` and `archive`. For `projectRoles`, absent means the namespace-level roles (organisation owners), where only `git.ns.admin` is projected. For `inspect`, absent means a sweep of every repository in the namespace.
+   */
+  repo?: RepoResource;
+  spec?: RepoSpec;
+  /**
+   * The complete set of people who should hold a forge role on the target. The bridge converges to exactly this set among the roles it manages: it adds or changes roles to match and removes managed roles not listed. `projectRoles` and `createRepo` only.
+   */
+  desiredRoles?: DesiredRole[];
+  /**
+   * Accounts whose direct role on `repo` the bridge removes, whatever that role is — including a role the bridge does not manage and would otherwise only report as drift. Matched by `forge` and `id`; `login` is display only. No account listed here may also appear in `desiredRoles`. `projectRoles` with `repo` only.
+   *
+   * @minItems 1
+   */
+  removeAccounts?: [ForgeAccount, ...ForgeAccount[]];
+  /**
+   * Run only these steps of the adapter's bootstrap plan, in the plan's order. Absent: the whole plan. `bootstrap` only.
+   *
+   * @minItems 1
+   */
+  steps?: [StepName, ...StepName[]];
+  target?: BindTarget;
+  /**
+   * The member whose forge account is being linked. `beginAccountLink` only.
+   */
+  subject?: Did;
+  ext?: Ext;
+}
+/**
+ * How to create the repository. `createRepo` only.
+ */
+export interface RepoSpec {
+  visibility: RepoVisibility;
+  description?: string;
+}
+export interface DesiredRole {
+  subject: Did;
+  /**
+   * The subject's linked account on this namespace's forge.
+   */
+  account: ForgeAccount;
+  /**
+   * The subject's highest effective right on the target, which the forge adapter maps to one of its roles.
+   */
+  right: Right;
+}
+/**
+ * `beginBind` only.
+ */
+export interface BindTarget {
+  forge: ForgeHost;
+  owner: Segment;
+}
+/**
+ * Whether the bridge took the job.
+ */
+export interface GitNamespacesBridgeJobResponsePayload {
+  jobId: JobId;
+  /**
+   * `true` — the job is durably queued, or was already queued or running under this `jobId`; a git-ns/bridge/result follows. `false` — the bridge already finished this `jobId`; it does not run it again, and sends its git-ns/bridge/result again.
+   */
+  accepted: boolean;
+  /**
+   * For `beginBind` and `beginAccountLink` when `accepted` is `true`: where the VTC sends the person.
+   */
+  next?: {
+    url: string;
+    /**
+     * The device-flow code, for a forge that uses one.
+     */
+    userCode?: string;
+    expiresAt: string;
+  };
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Did, Ext, ForgeAccount, ForgeHost, ForgeId, NamespaceId, RepoResource, RepoVisibility, Right, Segment };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/git-ns/bridge/job/0.3" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = GitNamespacesBridgeJobPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/git-ns/bridge/job/0.3#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = GitNamespacesBridgeJobResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/git-ns/bridge/job/0.3",
+  "title": "Git Namespaces — Bridge Job — payload",
+  "description": "The VTC asks its bridge to do one piece of forge work in a namespace. The job names what to do (`kind`) and carries the desired state, never forge credentials — the bridge holds those. Which optional members a job carries is fixed by its `kind` (see the specification's kind table); a bridge refuses a job that carries a member its kind does not use, or lacks one its kind requires.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "jobId",
+    "namespace",
+    "kind"
+  ],
+  "properties": {
+    "jobId": {
+      "$ref": "#/$defs/JobId",
+      "description": "The VTC's identifier for this job. The bridge reports on it with git-ns/bridge/result."
+    },
+    "namespace": {
+      "$ref": "#/$defs/NamespaceId",
+      "description": "The namespace the job acts in. It also selects the bridge's forge credentials for it."
+    },
+    "kind": {
+      "type": "string",
+      "enum": [
+        "projectRoles",
+        "createRepo",
+        "bootstrap",
+        "archive",
+        "inspect",
+        "beginBind",
+        "beginAccountLink"
+      ],
+      "description": "What to do. `projectRoles` — converge forge roles to `desiredRoles`, and remove whatever role each of `removeAccounts` holds on `repo`. `createRepo` — create `repo`, run the bootstrap plan, and project `desiredRoles`. `bootstrap` — run the bootstrap plan, or the listed `steps` of it, on an existing `repo`. `archive` — archive `repo`. `inspect` — compare the forge with the projection for `repo`, or for the whole namespace. `beginBind` — start the proof that the binding admin controls `target`. `beginAccountLink` — start linking `subject`'s account on this namespace's forge."
+    },
+    "repo": {
+      "$ref": "#/$defs/RepoResource",
+      "description": "The repository. Required for `createRepo`, `bootstrap` and `archive`. For `projectRoles`, absent means the namespace-level roles (organisation owners), where only `git.ns.admin` is projected. For `inspect`, absent means a sweep of every repository in the namespace."
+    },
+    "spec": {
+      "$ref": "#/$defs/RepoSpec",
+      "description": "How to create the repository. `createRepo` only."
+    },
+    "desiredRoles": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/DesiredRole"
+      },
+      "description": "The complete set of people who should hold a forge role on the target. The bridge converges to exactly this set among the roles it manages: it adds or changes roles to match and removes managed roles not listed. `projectRoles` and `createRepo` only."
+    },
+    "removeAccounts": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/ForgeAccount"
+      },
+      "description": "Accounts whose direct role on `repo` the bridge removes, whatever that role is — including a role the bridge does not manage and would otherwise only report as drift. Matched by `forge` and `id`; `login` is display only. No account listed here may also appear in `desiredRoles`. `projectRoles` with `repo` only."
+    },
+    "steps": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/StepName"
+      },
+      "description": "Run only these steps of the adapter's bootstrap plan, in the plan's order. Absent: the whole plan. `bootstrap` only."
+    },
+    "target": {
+      "$ref": "#/$defs/BindTarget",
+      "description": "`beginBind` only."
+    },
+    "subject": {
+      "$ref": "#/$defs/Did",
+      "description": "The member whose forge account is being linked. `beginAccountLink` only."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "JobId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "The VTC's identifier for a job, unique across the VTC's jobs."
+    },
+    "StepName": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "pattern": "^[a-z][A-Za-z0-9]*$",
+      "description": "One step of a forge adapter's plan. Forge-neutral names: `create`, `workflow`, `keyring`, `variables`, `requiredCheck`, `roles`, `archive`. An adapter MAY add its own (`mergeStyle`, `runner`), which a VTC displays but need not understand."
+    },
+    "DesiredRole": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "subject",
+        "account",
+        "right"
+      ],
+      "properties": {
+        "subject": {
+          "$ref": "#/$defs/Did"
+        },
+        "account": {
+          "$ref": "#/$defs/ForgeAccount",
+          "description": "The subject's linked account on this namespace's forge."
+        },
+        "right": {
+          "$ref": "#/$defs/Right",
+          "description": "The subject's highest effective right on the target, which the forge adapter maps to one of its roles."
+        }
+      }
+    },
+    "RepoSpec": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "visibility"
+      ],
+      "properties": {
+        "visibility": {
+          "$ref": "#/$defs/RepoVisibility"
+        },
+        "description": {
+          "type": "string",
+          "maxLength": 350
+        }
+      }
+    },
+    "BindTarget": {
+      "title": "BindTarget",
+      "description": "The forge owner whose control the binding admin is to prove.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "forge",
+        "owner"
+      ],
+      "properties": {
+        "forge": {
+          "$ref": "#/$defs/ForgeHost"
+        },
+        "owner": {
+          "$ref": "#/$defs/Segment"
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "Git Namespaces — Bridge Job — response payload",
+      "description": "Whether the bridge took the job.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "jobId",
+        "accepted"
+      ],
+      "properties": {
+        "jobId": {
+          "$ref": "#/$defs/JobId"
+        },
+        "accepted": {
+          "type": "boolean",
+          "description": "`true` — the job is durably queued, or was already queued or running under this `jobId`; a git-ns/bridge/result follows. `false` — the bridge already finished this `jobId`; it does not run it again, and sends its git-ns/bridge/result again."
+        },
+        "next": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "url",
+            "expiresAt"
+          ],
+          "description": "For `beginBind` and `beginAccountLink` when `accepted` is `true`: where the VTC sends the person.",
+          "properties": {
+            "url": {
+              "type": "string",
+              "format": "uri",
+              "maxLength": 2048,
+              "pattern": "^https://"
+            },
+            "userCode": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64,
+              "description": "The device-flow code, for a forge that uses one."
+            },
+            "expiresAt": {
+              "type": "string",
+              "format": "date-time"
+            }
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "Segment": {
+      "title": "Segment",
+      "description": "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 100,
+      "pattern": "^[a-z0-9_-][a-z0-9._-]*$"
+    },
+    "ForgeHost": {
+      "title": "ForgeHost",
+      "description": "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.",
+      "type": "string",
+      "minLength": 3,
+      "maxLength": 253,
+      "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$"
+    },
+    "RepoVisibility": {
+      "title": "RepoVisibility",
+      "type": "string",
+      "enum": [
+        "public",
+        "private"
+      ],
+      "description": "Repository visibility on the forge."
+    },
+    "Right": {
+      "title": "Right",
+      "description": "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.",
+      "type": "string",
+      "enum": [
+        "git.ns.admin",
+        "git.repo.create",
+        "git.repo.own",
+        "git.repo.maintain",
+        "git.commit.sign"
+      ]
+    },
+    "ForgeAccount": {
+      "title": "ForgeAccount",
+      "description": "A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "forge",
+        "id",
+        "login"
+      ],
+      "properties": {
+        "forge": {
+          "$ref": "#/$defs/ForgeHost"
+        },
+        "id": {
+          "$ref": "#/$defs/ForgeId"
+        },
+        "login": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 100,
+          "description": "The account's current login, as the forge reported it when last seen. Display only."
+        }
+      }
+    },
+    "ForgeId": {
+      "title": "ForgeId",
+      "description": "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64
+    },
+    "Did": {
+      "title": "Did",
+      "description": "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.",
+      "type": "string",
+      "maxLength": 2048,
+      "pattern": "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$"
+    },
+    "RepoResource": {
+      "title": "RepoResource",
+      "description": "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.",
+      "type": "string",
+      "maxLength": 455,
+      "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$"
+    },
+    "NamespaceId": {
+      "title": "NamespaceId",
+      "description": "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "JobId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "The VTC's identifier for a job, unique across the VTC's jobs."
+    },
+    "StepName": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "pattern": "^[a-z][A-Za-z0-9]*$",
+      "description": "One step of a forge adapter's plan. Forge-neutral names: `create`, `workflow`, `keyring`, `variables`, `requiredCheck`, `roles`, `archive`. An adapter MAY add its own (`mergeStyle`, `runner`), which a VTC displays but need not understand."
+    },
+    "DesiredRole": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "subject",
+        "account",
+        "right"
+      ],
+      "properties": {
+        "subject": {
+          "$ref": "#/$defs/Did"
+        },
+        "account": {
+          "$ref": "#/$defs/ForgeAccount",
+          "description": "The subject's linked account on this namespace's forge."
+        },
+        "right": {
+          "$ref": "#/$defs/Right",
+          "description": "The subject's highest effective right on the target, which the forge adapter maps to one of its roles."
+        }
+      }
+    },
+    "RepoSpec": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "visibility"
+      ],
+      "properties": {
+        "visibility": {
+          "$ref": "#/$defs/RepoVisibility"
+        },
+        "description": {
+          "type": "string",
+          "maxLength": 350
+        }
+      }
+    },
+    "BindTarget": {
+      "title": "BindTarget",
+      "description": "The forge owner whose control the binding admin is to prove.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "forge",
+        "owner"
+      ],
+      "properties": {
+        "forge": {
+          "$ref": "#/$defs/ForgeHost"
+        },
+        "owner": {
+          "$ref": "#/$defs/Segment"
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "Git Namespaces — Bridge Job — response payload",
+      "description": "Whether the bridge took the job.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "jobId",
+        "accepted"
+      ],
+      "properties": {
+        "jobId": {
+          "$ref": "#/$defs/JobId"
+        },
+        "accepted": {
+          "type": "boolean",
+          "description": "`true` — the job is durably queued, or was already queued or running under this `jobId`; a git-ns/bridge/result follows. `false` — the bridge already finished this `jobId`; it does not run it again, and sends its git-ns/bridge/result again."
+        },
+        "next": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "url",
+            "expiresAt"
+          ],
+          "description": "For `beginBind` and `beginAccountLink` when `accepted` is `true`: where the VTC sends the person.",
+          "properties": {
+            "url": {
+              "type": "string",
+              "format": "uri",
+              "maxLength": 2048,
+              "pattern": "^https://"
+            },
+            "userCode": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64,
+              "description": "The device-flow code, for a forge that uses one."
+            },
+            "expiresAt": {
+              "type": "string",
+              "format": "date-time"
+            }
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "Segment": {
+      "title": "Segment",
+      "description": "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 100,
+      "pattern": "^[a-z0-9_-][a-z0-9._-]*$"
+    },
+    "ForgeHost": {
+      "title": "ForgeHost",
+      "description": "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.",
+      "type": "string",
+      "minLength": 3,
+      "maxLength": 253,
+      "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$"
+    },
+    "RepoVisibility": {
+      "title": "RepoVisibility",
+      "type": "string",
+      "enum": [
+        "public",
+        "private"
+      ],
+      "description": "Repository visibility on the forge."
+    },
+    "Right": {
+      "title": "Right",
+      "description": "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.",
+      "type": "string",
+      "enum": [
+        "git.ns.admin",
+        "git.repo.create",
+        "git.repo.own",
+        "git.repo.maintain",
+        "git.commit.sign"
+      ]
+    },
+    "ForgeAccount": {
+      "title": "ForgeAccount",
+      "description": "A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "forge",
+        "id",
+        "login"
+      ],
+      "properties": {
+        "forge": {
+          "$ref": "#/$defs/ForgeHost"
+        },
+        "id": {
+          "$ref": "#/$defs/ForgeId"
+        },
+        "login": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 100,
+          "description": "The account's current login, as the forge reported it when last seen. Display only."
+        }
+      }
+    },
+    "ForgeId": {
+      "title": "ForgeId",
+      "description": "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64
+    },
+    "Did": {
+      "title": "Did",
+      "description": "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.",
+      "type": "string",
+      "maxLength": 2048,
+      "pattern": "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$"
+    },
+    "RepoResource": {
+      "title": "RepoResource",
+      "description": "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.",
+      "type": "string",
+      "maxLength": 455,
+      "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$"
+    },
+    "NamespaceId": {
+      "title": "NamespaceId",
+      "description": "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;