@openvtc/trust-tasks 0.20.7 → 0.21.0

package/dist/git-ns/right/break-glass/0.1/payload.d.ts

@@ -0,0 +1,685 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/git-ns/right/break-glass/0.1/payload.schema.json
+ */
+import type { BreakGlass, Did_GitNsV0_3 as Did, ElevatedRight, Ext, Resource, Right, RightRecord_GitNsV0_4 as RightRecord } from "../../../../_shared/components.js";
+/**
+ * The actor records an elevated git right for themselves — one they already have the authority to grant, but which separation of duties forbids them granting to themselves through git-ns/right/grant — with a mandatory justification. The right takes effect at once, never expires on its own, and is flagged as break-glass, and shown to every other administrator, until another administrator ratifies it with git-ns/right/ratify or anyone entitled revokes it.
+ */
+export interface GitNamespacesBreakGlassPayload {
+    /**
+     * The elevated right the actor records for themselves. The other two rights need no break-glass: git-ns/right/grant lets anyone with authority over them grant them to themselves.
+     */
+    right: ElevatedRight;
+    /**
+     * Where the right applies: the namespace resource for `git.ns.admin` and `git.repo.create`, a repository resource for `git.repo.own`.
+     */
+    resource: Resource;
+    /**
+     * Why nobody else could grant this right now, in the actor's words. Required and never blank. Recorded with the right as `breakGlass.justification`, carried in the audit record and in every notice, and shown to every community administrator, every namespace admin of the namespace and every owner of the resource. Never published to the Trust Registry.
+     */
+    justification: string;
+    ext?: Ext;
+}
+/**
+ * The recorded right, carrying its `breakGlass` flag.
+ */
+export interface GitNamespacesBreakGlassResponsePayload {
+    /**
+     * The recorded right — newly recorded with `breakGlass`, or the live record the actor already held, returned unchanged.
+     */
+    right: RightRecord;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { BreakGlass, Did, ElevatedRight, Ext, Resource, Right, RightRecord };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/git-ns/right/break-glass/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = GitNamespacesBreakGlassPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/git-ns/right/break-glass/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = GitNamespacesBreakGlassResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/git-ns/right/break-glass/0.1";
+    readonly title: "Git Namespaces — Break Glass — payload";
+    readonly description: "The actor records an elevated git right for themselves — one they already have the authority to grant, but which separation of duties forbids them granting to themselves through git-ns/right/grant — with a mandatory justification. The right takes effect at once, never expires on its own, and is flagged as break-glass, and shown to every other administrator, until another administrator ratifies it with git-ns/right/ratify or anyone entitled revokes it.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["right", "resource", "justification"];
+    readonly properties: {
+        readonly right: {
+            readonly $ref: "#/$defs/ElevatedRight";
+            readonly description: "The elevated right the actor records for themselves. The other two rights need no break-glass: git-ns/right/grant lets anyone with authority over them grant them to themselves.";
+        };
+        readonly resource: {
+            readonly $ref: "#/$defs/Resource";
+            readonly description: "Where the right applies: the namespace resource for `git.ns.admin` and `git.repo.create`, a repository resource for `git.repo.own`.";
+        };
+        readonly justification: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 2048;
+            readonly pattern: "\\S";
+            readonly description: "Why nobody else could grant this right now, in the actor's words. Required and never blank. Recorded with the right as `breakGlass.justification`, carried in the audit record and in every notice, and shown to every community administrator, every namespace admin of the namespace and every owner of the resource. Never published to the Trust Registry.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — Break Glass — response payload";
+            readonly description: "The recorded right, carrying its `breakGlass` flag.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["right"];
+            readonly properties: {
+                readonly right: {
+                    readonly $ref: "#/$defs/RightRecord";
+                    readonly description: "The recorded right — newly recorded with `breakGlass`, or the live record the actor already held, returned unchanged.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RightRecord: {
+            readonly title: "RightRecord";
+            readonly description: "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "right", "resource", "grantedBy", "grantedAt"];
+            readonly properties: {
+                readonly subject: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.";
+                };
+                readonly right: {
+                    readonly $ref: "#/$defs/Right";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/Resource";
+                };
+                readonly grantedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.";
+                };
+                readonly grantedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right lapses. Absent: no expiry.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.";
+                };
+                readonly breakGlass: {
+                    readonly $ref: "#/$defs/BreakGlass";
+                    readonly description: "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.";
+                };
+            };
+        };
+        readonly BreakGlass: {
+            readonly title: "BreakGlass";
+            readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["by", "at", "justification"];
+            readonly properties: {
+                readonly by: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                };
+                readonly at: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the VTC recorded the break-glass.";
+                };
+                readonly justification: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly pattern: "\\S";
+                    readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                };
+                readonly effectiveAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                };
+                readonly ratifiedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                };
+                readonly ratifiedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                };
+            };
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+        };
+        readonly Resource: {
+            readonly title: "Resource";
+            readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+        readonly ElevatedRight: {
+            readonly title: "ElevatedRight";
+            readonly description: "The three rights that carry authority over other people's rights: `git.ns.admin`, `git.repo.create` (which makes its holder the owner of every repository they create) and `git.repo.own`. Separation of duties applies to these: nobody grants one to themselves through git-ns/right/grant, or records one for themselves through any other task that grants on the actor's own authority. The explicit self-grant is git-ns/right/break-glass. `git.repo.maintain` and `git.commit.sign` are not elevated.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own"];
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — Break Glass — response payload";
+            readonly description: "The recorded right, carrying its `breakGlass` flag.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["right"];
+            readonly properties: {
+                readonly right: {
+                    readonly $ref: "#/$defs/RightRecord";
+                    readonly description: "The recorded right — newly recorded with `breakGlass`, or the live record the actor already held, returned unchanged.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RightRecord: {
+            readonly title: "RightRecord";
+            readonly description: "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "right", "resource", "grantedBy", "grantedAt"];
+            readonly properties: {
+                readonly subject: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.";
+                };
+                readonly right: {
+                    readonly $ref: "#/$defs/Right";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/Resource";
+                };
+                readonly grantedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.";
+                };
+                readonly grantedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right lapses. Absent: no expiry.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.";
+                };
+                readonly breakGlass: {
+                    readonly $ref: "#/$defs/BreakGlass";
+                    readonly description: "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.";
+                };
+            };
+        };
+        readonly BreakGlass: {
+            readonly title: "BreakGlass";
+            readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["by", "at", "justification"];
+            readonly properties: {
+                readonly by: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                };
+                readonly at: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the VTC recorded the break-glass.";
+                };
+                readonly justification: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly pattern: "\\S";
+                    readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                };
+                readonly effectiveAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                };
+                readonly ratifiedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                };
+                readonly ratifiedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                };
+            };
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+        };
+        readonly Resource: {
+            readonly title: "Resource";
+            readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+        readonly ElevatedRight: {
+            readonly title: "ElevatedRight";
+            readonly description: "The three rights that carry authority over other people's rights: `git.ns.admin`, `git.repo.create` (which makes its holder the owner of every repository they create) and `git.repo.own`. Separation of duties applies to these: nobody grants one to themselves through git-ns/right/grant, or records one for themselves through any other task that grants on the actor's own authority. The explicit self-grant is git-ns/right/break-glass. `git.repo.maintain` and `git.commit.sign` are not elevated.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own"];
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/right/break-glass/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/git-ns/right/break-glass/0.1";
+        readonly title: "Git Namespaces — Break Glass — payload";
+        readonly description: "The actor records an elevated git right for themselves — one they already have the authority to grant, but which separation of duties forbids them granting to themselves through git-ns/right/grant — with a mandatory justification. The right takes effect at once, never expires on its own, and is flagged as break-glass, and shown to every other administrator, until another administrator ratifies it with git-ns/right/ratify or anyone entitled revokes it.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["right", "resource", "justification"];
+        readonly properties: {
+            readonly right: {
+                readonly $ref: "#/$defs/ElevatedRight";
+                readonly description: "The elevated right the actor records for themselves. The other two rights need no break-glass: git-ns/right/grant lets anyone with authority over them grant them to themselves.";
+            };
+            readonly resource: {
+                readonly $ref: "#/$defs/Resource";
+                readonly description: "Where the right applies: the namespace resource for `git.ns.admin` and `git.repo.create`, a repository resource for `git.repo.own`.";
+            };
+            readonly justification: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 2048;
+                readonly pattern: "\\S";
+                readonly description: "Why nobody else could grant this right now, in the actor's words. Required and never blank. Recorded with the right as `breakGlass.justification`, carried in the audit record and in every notice, and shown to every community administrator, every namespace admin of the namespace and every owner of the resource. Never published to the Trust Registry.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — Break Glass — response payload";
+                readonly description: "The recorded right, carrying its `breakGlass` flag.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["right"];
+                readonly properties: {
+                    readonly right: {
+                        readonly $ref: "#/$defs/RightRecord";
+                        readonly description: "The recorded right — newly recorded with `breakGlass`, or the live record the actor already held, returned unchanged.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RightRecord: {
+                readonly title: "RightRecord";
+                readonly description: "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "right", "resource", "grantedBy", "grantedAt"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.";
+                    };
+                    readonly right: {
+                        readonly $ref: "#/$defs/Right";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/Resource";
+                    };
+                    readonly grantedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.";
+                    };
+                    readonly grantedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right lapses. Absent: no expiry.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.";
+                    };
+                    readonly breakGlass: {
+                        readonly $ref: "#/$defs/BreakGlass";
+                        readonly description: "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.";
+                    };
+                };
+            };
+            readonly BreakGlass: {
+                readonly title: "BreakGlass";
+                readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["by", "at", "justification"];
+                readonly properties: {
+                    readonly by: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                    };
+                    readonly at: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the VTC recorded the break-glass.";
+                    };
+                    readonly justification: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly pattern: "\\S";
+                        readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                    };
+                    readonly effectiveAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                    };
+                    readonly ratifiedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                    };
+                    readonly ratifiedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                    };
+                };
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+            };
+            readonly Resource: {
+                readonly title: "Resource";
+                readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+            readonly ElevatedRight: {
+                readonly title: "ElevatedRight";
+                readonly description: "The three rights that carry authority over other people's rights: `git.ns.admin`, `git.repo.create` (which makes its holder the owner of every repository they create) and `git.repo.own`. Separation of duties applies to these: nobody grants one to themselves through git-ns/right/grant, or records one for themselves through any other task that grants on the actor's own authority. The explicit self-grant is git-ns/right/break-glass. `git.repo.maintain` and `git.commit.sign` are not elevated.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own"];
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/right/break-glass/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — Break Glass — response payload";
+                readonly description: "The recorded right, carrying its `breakGlass` flag.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["right"];
+                readonly properties: {
+                    readonly right: {
+                        readonly $ref: "#/$defs/RightRecord";
+                        readonly description: "The recorded right — newly recorded with `breakGlass`, or the live record the actor already held, returned unchanged.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RightRecord: {
+                readonly title: "RightRecord";
+                readonly description: "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "right", "resource", "grantedBy", "grantedAt"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.";
+                    };
+                    readonly right: {
+                        readonly $ref: "#/$defs/Right";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/Resource";
+                    };
+                    readonly grantedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.";
+                    };
+                    readonly grantedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right lapses. Absent: no expiry.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.";
+                    };
+                    readonly breakGlass: {
+                        readonly $ref: "#/$defs/BreakGlass";
+                        readonly description: "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.";
+                    };
+                };
+            };
+            readonly BreakGlass: {
+                readonly title: "BreakGlass";
+                readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["by", "at", "justification"];
+                readonly properties: {
+                    readonly by: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                    };
+                    readonly at: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the VTC recorded the break-glass.";
+                    };
+                    readonly justification: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly pattern: "\\S";
+                        readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                    };
+                    readonly effectiveAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                    };
+                    readonly ratifiedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                    };
+                    readonly ratifiedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                    };
+                };
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+            };
+            readonly Resource: {
+                readonly title: "Resource";
+                readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+            readonly ElevatedRight: {
+                readonly title: "ElevatedRight";
+                readonly description: "The three rights that carry authority over other people's rights: `git.ns.admin`, `git.repo.create` (which makes its holder the owner of every repository they create) and `git.repo.own`. Separation of duties applies to these: nobody grants one to themselves through git-ns/right/grant, or records one for themselves through any other task that grants on the actor's own authority. The explicit self-grant is git-ns/right/break-glass. `git.repo.maintain` and `git.commit.sign` are not elevated.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own"];
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map