@openvtc/trust-tasks 0.20.8 → 0.21.0

package/dist/git-ns/right/ratify/0.1/payload.d.ts

@@ -0,0 +1,702 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/git-ns/right/ratify/0.1/payload.schema.json
+ */
+import type { BreakGlass, Did_GitNsV0_3 as Did, ElevatedRight, Ext, Resource, Right, RightRecord_GitNsV0_4 as RightRecord } from "../../../../_shared/components.js";
+/**
+ * An administrator other than its subject ratifies one unratified break-glass record, turning it into an ordinary grant: it stops being flagged, and starts counting toward the last-owner and last-admin invariants.
+ */
+export interface GitNamespacesRatifyBreakGlassPayload {
+    /**
+     * Who broke the glass: the record's subject.
+     */
+    subject: Did;
+    right: ElevatedRight;
+    /**
+     * The resource exactly as recorded.
+     */
+    resource: Resource;
+    /**
+     * The record's `breakGlass.at`, as the ratifier read it. Binds the ratification to the one break-glass the ratifier read and judged, so that it cannot ratify a later one — made after that one was revoked, with a different justification — by the same subject for the same right.
+     */
+    breakGlassAt: string;
+    /**
+     * Why, in the ratifier's words. Kept in the audit record and carried in the notice; shown to the same people as the justification.
+     */
+    statement?: string;
+    ext?: Ext;
+}
+/**
+ * The ratified record.
+ */
+export interface GitNamespacesRatifyBreakGlassResponsePayload {
+    /**
+     * The record, now carrying `breakGlass.ratifiedBy` and `breakGlass.ratifiedAt`.
+     */
+    right: RightRecord;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { BreakGlass, Did, ElevatedRight, Ext, Resource, Right, RightRecord };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/git-ns/right/ratify/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = GitNamespacesRatifyBreakGlassPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/git-ns/right/ratify/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = GitNamespacesRatifyBreakGlassResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/git-ns/right/ratify/0.1";
+    readonly title: "Git Namespaces — Ratify Break-Glass — payload";
+    readonly description: "An administrator other than its subject ratifies one unratified break-glass record, turning it into an ordinary grant: it stops being flagged, and starts counting toward the last-owner and last-admin invariants.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["subject", "right", "resource", "breakGlassAt"];
+    readonly properties: {
+        readonly subject: {
+            readonly $ref: "#/$defs/Did";
+            readonly description: "Who broke the glass: the record's subject.";
+        };
+        readonly right: {
+            readonly $ref: "#/$defs/ElevatedRight";
+        };
+        readonly resource: {
+            readonly $ref: "#/$defs/Resource";
+            readonly description: "The resource exactly as recorded.";
+        };
+        readonly breakGlassAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly description: "The record's `breakGlass.at`, as the ratifier read it. Binds the ratification to the one break-glass the ratifier read and judged, so that it cannot ratify a later one — made after that one was revoked, with a different justification — by the same subject for the same right.";
+        };
+        readonly statement: {
+            readonly type: "string";
+            readonly maxLength: 1024;
+            readonly description: "Why, in the ratifier's words. Kept in the audit record and carried in the notice; shown to the same people as the justification.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — Ratify Break-Glass — response payload";
+            readonly description: "The ratified record.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["right"];
+            readonly properties: {
+                readonly right: {
+                    readonly $ref: "#/$defs/RightRecord";
+                    readonly description: "The record, now carrying `breakGlass.ratifiedBy` and `breakGlass.ratifiedAt`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RightRecord: {
+            readonly title: "RightRecord";
+            readonly description: "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "right", "resource", "grantedBy", "grantedAt"];
+            readonly properties: {
+                readonly subject: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.";
+                };
+                readonly right: {
+                    readonly $ref: "#/$defs/Right";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/Resource";
+                };
+                readonly grantedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.";
+                };
+                readonly grantedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right lapses. Absent: no expiry.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.";
+                };
+                readonly breakGlass: {
+                    readonly $ref: "#/$defs/BreakGlass";
+                    readonly description: "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.";
+                };
+            };
+        };
+        readonly BreakGlass: {
+            readonly title: "BreakGlass";
+            readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["by", "at", "justification"];
+            readonly properties: {
+                readonly by: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                };
+                readonly at: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the VTC recorded the break-glass.";
+                };
+                readonly justification: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly pattern: "\\S";
+                    readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                };
+                readonly effectiveAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                };
+                readonly ratifiedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                };
+                readonly ratifiedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                };
+            };
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+        };
+        readonly Resource: {
+            readonly title: "Resource";
+            readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+        readonly ElevatedRight: {
+            readonly title: "ElevatedRight";
+            readonly description: "The three rights that carry authority over other people's rights: `git.ns.admin`, `git.repo.create` (which makes its holder the owner of every repository they create) and `git.repo.own`. Separation of duties applies to these: nobody grants one to themselves through git-ns/right/grant, or records one for themselves through any other task that grants on the actor's own authority. The explicit self-grant is git-ns/right/break-glass. `git.repo.maintain` and `git.commit.sign` are not elevated.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own"];
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — Ratify Break-Glass — response payload";
+            readonly description: "The ratified record.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["right"];
+            readonly properties: {
+                readonly right: {
+                    readonly $ref: "#/$defs/RightRecord";
+                    readonly description: "The record, now carrying `breakGlass.ratifiedBy` and `breakGlass.ratifiedAt`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RightRecord: {
+            readonly title: "RightRecord";
+            readonly description: "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "right", "resource", "grantedBy", "grantedAt"];
+            readonly properties: {
+                readonly subject: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.";
+                };
+                readonly right: {
+                    readonly $ref: "#/$defs/Right";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/Resource";
+                };
+                readonly grantedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.";
+                };
+                readonly grantedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right lapses. Absent: no expiry.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.";
+                };
+                readonly breakGlass: {
+                    readonly $ref: "#/$defs/BreakGlass";
+                    readonly description: "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.";
+                };
+            };
+        };
+        readonly BreakGlass: {
+            readonly title: "BreakGlass";
+            readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["by", "at", "justification"];
+            readonly properties: {
+                readonly by: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                };
+                readonly at: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the VTC recorded the break-glass.";
+                };
+                readonly justification: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly pattern: "\\S";
+                    readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                };
+                readonly effectiveAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                };
+                readonly ratifiedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                };
+                readonly ratifiedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                };
+            };
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+        };
+        readonly Resource: {
+            readonly title: "Resource";
+            readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+        readonly ElevatedRight: {
+            readonly title: "ElevatedRight";
+            readonly description: "The three rights that carry authority over other people's rights: `git.ns.admin`, `git.repo.create` (which makes its holder the owner of every repository they create) and `git.repo.own`. Separation of duties applies to these: nobody grants one to themselves through git-ns/right/grant, or records one for themselves through any other task that grants on the actor's own authority. The explicit self-grant is git-ns/right/break-glass. `git.repo.maintain` and `git.commit.sign` are not elevated.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own"];
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/right/ratify/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/git-ns/right/ratify/0.1";
+        readonly title: "Git Namespaces — Ratify Break-Glass — payload";
+        readonly description: "An administrator other than its subject ratifies one unratified break-glass record, turning it into an ordinary grant: it stops being flagged, and starts counting toward the last-owner and last-admin invariants.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["subject", "right", "resource", "breakGlassAt"];
+        readonly properties: {
+            readonly subject: {
+                readonly $ref: "#/$defs/Did";
+                readonly description: "Who broke the glass: the record's subject.";
+            };
+            readonly right: {
+                readonly $ref: "#/$defs/ElevatedRight";
+            };
+            readonly resource: {
+                readonly $ref: "#/$defs/Resource";
+                readonly description: "The resource exactly as recorded.";
+            };
+            readonly breakGlassAt: {
+                readonly type: "string";
+                readonly format: "date-time";
+                readonly description: "The record's `breakGlass.at`, as the ratifier read it. Binds the ratification to the one break-glass the ratifier read and judged, so that it cannot ratify a later one — made after that one was revoked, with a different justification — by the same subject for the same right.";
+            };
+            readonly statement: {
+                readonly type: "string";
+                readonly maxLength: 1024;
+                readonly description: "Why, in the ratifier's words. Kept in the audit record and carried in the notice; shown to the same people as the justification.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — Ratify Break-Glass — response payload";
+                readonly description: "The ratified record.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["right"];
+                readonly properties: {
+                    readonly right: {
+                        readonly $ref: "#/$defs/RightRecord";
+                        readonly description: "The record, now carrying `breakGlass.ratifiedBy` and `breakGlass.ratifiedAt`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RightRecord: {
+                readonly title: "RightRecord";
+                readonly description: "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "right", "resource", "grantedBy", "grantedAt"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.";
+                    };
+                    readonly right: {
+                        readonly $ref: "#/$defs/Right";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/Resource";
+                    };
+                    readonly grantedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.";
+                    };
+                    readonly grantedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right lapses. Absent: no expiry.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.";
+                    };
+                    readonly breakGlass: {
+                        readonly $ref: "#/$defs/BreakGlass";
+                        readonly description: "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.";
+                    };
+                };
+            };
+            readonly BreakGlass: {
+                readonly title: "BreakGlass";
+                readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["by", "at", "justification"];
+                readonly properties: {
+                    readonly by: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                    };
+                    readonly at: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the VTC recorded the break-glass.";
+                    };
+                    readonly justification: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly pattern: "\\S";
+                        readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                    };
+                    readonly effectiveAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                    };
+                    readonly ratifiedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                    };
+                    readonly ratifiedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                    };
+                };
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+            };
+            readonly Resource: {
+                readonly title: "Resource";
+                readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+            readonly ElevatedRight: {
+                readonly title: "ElevatedRight";
+                readonly description: "The three rights that carry authority over other people's rights: `git.ns.admin`, `git.repo.create` (which makes its holder the owner of every repository they create) and `git.repo.own`. Separation of duties applies to these: nobody grants one to themselves through git-ns/right/grant, or records one for themselves through any other task that grants on the actor's own authority. The explicit self-grant is git-ns/right/break-glass. `git.repo.maintain` and `git.commit.sign` are not elevated.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own"];
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/right/ratify/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — Ratify Break-Glass — response payload";
+                readonly description: "The ratified record.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["right"];
+                readonly properties: {
+                    readonly right: {
+                        readonly $ref: "#/$defs/RightRecord";
+                        readonly description: "The record, now carrying `breakGlass.ratifiedBy` and `breakGlass.ratifiedAt`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RightRecord: {
+                readonly title: "RightRecord";
+                readonly description: "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "right", "resource", "grantedBy", "grantedAt"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.";
+                    };
+                    readonly right: {
+                        readonly $ref: "#/$defs/Right";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/Resource";
+                    };
+                    readonly grantedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.";
+                    };
+                    readonly grantedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right lapses. Absent: no expiry.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.";
+                    };
+                    readonly breakGlass: {
+                        readonly $ref: "#/$defs/BreakGlass";
+                        readonly description: "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.";
+                    };
+                };
+            };
+            readonly BreakGlass: {
+                readonly title: "BreakGlass";
+                readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["by", "at", "justification"];
+                readonly properties: {
+                    readonly by: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                    };
+                    readonly at: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the VTC recorded the break-glass.";
+                    };
+                    readonly justification: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly pattern: "\\S";
+                        readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                    };
+                    readonly effectiveAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                    };
+                    readonly ratifiedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                    };
+                    readonly ratifiedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                    };
+                };
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+            };
+            readonly Resource: {
+                readonly title: "Resource";
+                readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+            readonly ElevatedRight: {
+                readonly title: "ElevatedRight";
+                readonly description: "The three rights that carry authority over other people's rights: `git.ns.admin`, `git.repo.create` (which makes its holder the owner of every repository they create) and `git.repo.own`. Separation of duties applies to these: nobody grants one to themselves through git-ns/right/grant, or records one for themselves through any other task that grants on the actor's own authority. The explicit self-grant is git-ns/right/break-glass. `git.repo.maintain` and `git.commit.sign` are not elevated.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own"];
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map