@openvtc/trust-tasks 0.21.12 → 0.21.14

package/dist/git-ns/right/issued-by-departed/0.1/payload.d.ts

@@ -0,0 +1,862 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/git-ns/right/issued-by-departed/0.1/payload.schema.json
+ */
+import type { AdminRightRow, BreakGlass, Did_GitNsV0_3 as Did, Ext, Resource, Right, RightOrigin } from "../../../../_shared/components.js";
+/**
+ * A community administrator lists the recorded rights whose granter has since left the community, grouped by granter. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface GitNamespacesRightsIssuedByDepartedMembersPayload {
+    /**
+     * Opaque continuation token from a previous response's `nextCursor`.
+     */
+    cursor?: string;
+    /**
+     * Maximum granters to return in this page. A VTC clamps to 1..=500 (default 100).
+     */
+    limit?: number;
+    ext?: Ext;
+}
+/**
+ * Rights grouped by their departed granter, ordered by the granter's DID.
+ */
+export interface GitNamespacesRightsIssuedByDepartedMembersResponsePayload {
+    /**
+     * The community's active `cascade_on_departure` policy setting. `true` means a departure revokes these rights automatically and this list is normally empty; `false` means they stay, for an administrator to review and act on individually.
+     */
+    cascadeOnDeparture: boolean;
+    /**
+     * Departed granters with at least one surviving right they issued, ordered by `granter`.
+     */
+    granters: DepartedGranter[];
+    /**
+     * Continuation token for the next page of granters, or `null` when this is the last.
+     */
+    nextCursor?: string | null;
+    ext?: Ext;
+}
+/**
+ * The rights one departed member issued while they were still a member.
+ */
+export interface DepartedGranter {
+    /**
+     * The member who granted these rights and has since left the community.
+     */
+    granter: Did;
+    /**
+     * The rights `granter` issued, still live or awaiting a break-glass ratification. Every row's `origin` is `recorded` and `granterDeparted` is `true` — a role-derived grant has no granter and never appears here.
+     */
+    rights: AdminRightRow[];
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AdminRightRow, BreakGlass, Did, Ext, Resource, Right, RightOrigin };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/git-ns/right/issued-by-departed/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = GitNamespacesRightsIssuedByDepartedMembersPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/git-ns/right/issued-by-departed/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = GitNamespacesRightsIssuedByDepartedMembersResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/git-ns/right/issued-by-departed/0.1";
+    readonly title: "Git Namespaces — Rights Issued By Departed Members — payload";
+    readonly description: "A community administrator lists the recorded rights whose granter has since left the community, grouped by granter. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly properties: {
+        readonly cursor: {
+            readonly type: "string";
+            readonly description: "Opaque continuation token from a previous response's `nextCursor`.";
+        };
+        readonly limit: {
+            readonly type: "integer";
+            readonly minimum: 1;
+            readonly maximum: 500;
+            readonly description: "Maximum granters to return in this page. A VTC clamps to 1..=500 (default 100).";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly DepartedGranter: {
+            readonly title: "DepartedGranter";
+            readonly description: "The rights one departed member issued while they were still a member.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["granter", "rights"];
+            readonly properties: {
+                readonly granter: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The member who granted these rights and has since left the community.";
+                };
+                readonly rights: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/AdminRightRow";
+                    };
+                    readonly description: "The rights `granter` issued, still live or awaiting a break-glass ratification. Every row's `origin` is `recorded` and `granterDeparted` is `true` — a role-derived grant has no granter and never appears here.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — Rights Issued By Departed Members — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["cascadeOnDeparture", "granters"];
+            readonly description: "Rights grouped by their departed granter, ordered by the granter's DID.";
+            readonly properties: {
+                readonly cascadeOnDeparture: {
+                    readonly type: "boolean";
+                    readonly description: "The community's active `cascade_on_departure` policy setting. `true` means a departure revokes these rights automatically and this list is normally empty; `false` means they stay, for an administrator to review and act on individually.";
+                };
+                readonly granters: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DepartedGranter";
+                    };
+                    readonly description: "Departed granters with at least one surviving right they issued, ordered by `granter`.";
+                };
+                readonly nextCursor: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "Continuation token for the next page of granters, or `null` when this is the last.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AdminRightRow: {
+            readonly title: "AdminRightRow";
+            readonly description: "One right as the administrator's rights console shows it: a recorded `RightRecord` restated with the membership facts an administrator needs (`subjectMember`, `granterDeparted`), or a role-derived grant that carries no record. `git-ns/right/list` and `git-ns/right/issued-by-departed` are its only producers.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "right", "resource", "origin", "subjectMember", "granterDeparted"];
+            readonly properties: {
+                readonly subject: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who holds the right.";
+                };
+                readonly right: {
+                    readonly $ref: "#/$defs/Right";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/Resource";
+                };
+                readonly origin: {
+                    readonly $ref: "#/$defs/RightOrigin";
+                };
+                readonly grantedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who caused the right (see `RightRecord.grantedBy`). Present exactly when `origin` is `recorded`; a role-derived grant is published by the hook relay from configuration, not by an actor.";
+                };
+                readonly grantedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Present exactly when `origin` is `recorded`.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right lapses. Absent: no expiry, or `origin` is `roleDerived` (a role-derived grant never expires on its own — it is withdrawn by editing `[hooks.git-trust] grant_on_role`).";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The granter's free-text reason, restated from the `RightRecord`. Absent when `origin` is `roleDerived`, or the record carries none.";
+                };
+                readonly subjectMember: {
+                    readonly type: "boolean";
+                    readonly description: "Whether `subject` is a current member of the community. `false` marks a right held by someone who has since left, or by an external signer the community never enrolled.";
+                };
+                readonly granterDeparted: {
+                    readonly type: "boolean";
+                    readonly description: "Whether `grantedBy` was a member at the time of the grant and has since left. Always `false` when `origin` is `roleDerived`, or when the record's granter was never itself a member (the VTC's own DID, for a right it derives from configuration).";
+                };
+                readonly breakGlass: {
+                    readonly $ref: "#/$defs/BreakGlass";
+                    readonly description: "Present exactly when `origin` is `recorded` and the record carries `breakGlass` — see `RightRecord.breakGlass`. Absent for a role-derived grant, which cannot be self-granted through break-glass.";
+                };
+            };
+        };
+        readonly BreakGlass: {
+            readonly title: "BreakGlass";
+            readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["by", "at", "justification"];
+            readonly properties: {
+                readonly by: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                };
+                readonly at: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the VTC recorded the break-glass.";
+                };
+                readonly justification: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly pattern: "\\S";
+                    readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                };
+                readonly effectiveAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                };
+                readonly ratifiedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                };
+                readonly ratifiedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                };
+            };
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+        };
+        readonly RightOrigin: {
+            readonly title: "RightOrigin";
+            readonly description: "Where a right an administrator sees came from. `recorded` — a `git-ns/*` record, governed by the rights model and returned nowhere the subject cannot eventually see it through `git-ns/view`. `roleDerived` — a v0.1 `[hooks.git-trust] grant_on_role` grant: published by the hook relay from the community's own role configuration, never written by any `git-ns/*` task, and not itself a `RightRecord` — it has no `grantedAt`, no `expiresAt` and no `reason`, only a subject, a right and a resource.";
+            readonly type: "string";
+            readonly enum: readonly ["recorded", "roleDerived"];
+        };
+        readonly Resource: {
+            readonly title: "Resource";
+            readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly DepartedGranter: {
+            readonly title: "DepartedGranter";
+            readonly description: "The rights one departed member issued while they were still a member.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["granter", "rights"];
+            readonly properties: {
+                readonly granter: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The member who granted these rights and has since left the community.";
+                };
+                readonly rights: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/AdminRightRow";
+                    };
+                    readonly description: "The rights `granter` issued, still live or awaiting a break-glass ratification. Every row's `origin` is `recorded` and `granterDeparted` is `true` — a role-derived grant has no granter and never appears here.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — Rights Issued By Departed Members — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["cascadeOnDeparture", "granters"];
+            readonly description: "Rights grouped by their departed granter, ordered by the granter's DID.";
+            readonly properties: {
+                readonly cascadeOnDeparture: {
+                    readonly type: "boolean";
+                    readonly description: "The community's active `cascade_on_departure` policy setting. `true` means a departure revokes these rights automatically and this list is normally empty; `false` means they stay, for an administrator to review and act on individually.";
+                };
+                readonly granters: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DepartedGranter";
+                    };
+                    readonly description: "Departed granters with at least one surviving right they issued, ordered by `granter`.";
+                };
+                readonly nextCursor: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "Continuation token for the next page of granters, or `null` when this is the last.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AdminRightRow: {
+            readonly title: "AdminRightRow";
+            readonly description: "One right as the administrator's rights console shows it: a recorded `RightRecord` restated with the membership facts an administrator needs (`subjectMember`, `granterDeparted`), or a role-derived grant that carries no record. `git-ns/right/list` and `git-ns/right/issued-by-departed` are its only producers.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "right", "resource", "origin", "subjectMember", "granterDeparted"];
+            readonly properties: {
+                readonly subject: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who holds the right.";
+                };
+                readonly right: {
+                    readonly $ref: "#/$defs/Right";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/Resource";
+                };
+                readonly origin: {
+                    readonly $ref: "#/$defs/RightOrigin";
+                };
+                readonly grantedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who caused the right (see `RightRecord.grantedBy`). Present exactly when `origin` is `recorded`; a role-derived grant is published by the hook relay from configuration, not by an actor.";
+                };
+                readonly grantedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Present exactly when `origin` is `recorded`.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right lapses. Absent: no expiry, or `origin` is `roleDerived` (a role-derived grant never expires on its own — it is withdrawn by editing `[hooks.git-trust] grant_on_role`).";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The granter's free-text reason, restated from the `RightRecord`. Absent when `origin` is `roleDerived`, or the record carries none.";
+                };
+                readonly subjectMember: {
+                    readonly type: "boolean";
+                    readonly description: "Whether `subject` is a current member of the community. `false` marks a right held by someone who has since left, or by an external signer the community never enrolled.";
+                };
+                readonly granterDeparted: {
+                    readonly type: "boolean";
+                    readonly description: "Whether `grantedBy` was a member at the time of the grant and has since left. Always `false` when `origin` is `roleDerived`, or when the record's granter was never itself a member (the VTC's own DID, for a right it derives from configuration).";
+                };
+                readonly breakGlass: {
+                    readonly $ref: "#/$defs/BreakGlass";
+                    readonly description: "Present exactly when `origin` is `recorded` and the record carries `breakGlass` — see `RightRecord.breakGlass`. Absent for a role-derived grant, which cannot be self-granted through break-glass.";
+                };
+            };
+        };
+        readonly BreakGlass: {
+            readonly title: "BreakGlass";
+            readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["by", "at", "justification"];
+            readonly properties: {
+                readonly by: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                };
+                readonly at: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the VTC recorded the break-glass.";
+                };
+                readonly justification: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly pattern: "\\S";
+                    readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                };
+                readonly effectiveAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                };
+                readonly ratifiedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                };
+                readonly ratifiedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                };
+            };
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+        };
+        readonly RightOrigin: {
+            readonly title: "RightOrigin";
+            readonly description: "Where a right an administrator sees came from. `recorded` — a `git-ns/*` record, governed by the rights model and returned nowhere the subject cannot eventually see it through `git-ns/view`. `roleDerived` — a v0.1 `[hooks.git-trust] grant_on_role` grant: published by the hook relay from the community's own role configuration, never written by any `git-ns/*` task, and not itself a `RightRecord` — it has no `grantedAt`, no `expiresAt` and no `reason`, only a subject, a right and a resource.";
+            readonly type: "string";
+            readonly enum: readonly ["recorded", "roleDerived"];
+        };
+        readonly Resource: {
+            readonly title: "Resource";
+            readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/right/issued-by-departed/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/git-ns/right/issued-by-departed/0.1";
+        readonly title: "Git Namespaces — Rights Issued By Departed Members — payload";
+        readonly description: "A community administrator lists the recorded rights whose granter has since left the community, grouped by granter. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly properties: {
+            readonly cursor: {
+                readonly type: "string";
+                readonly description: "Opaque continuation token from a previous response's `nextCursor`.";
+            };
+            readonly limit: {
+                readonly type: "integer";
+                readonly minimum: 1;
+                readonly maximum: 500;
+                readonly description: "Maximum granters to return in this page. A VTC clamps to 1..=500 (default 100).";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly DepartedGranter: {
+                readonly title: "DepartedGranter";
+                readonly description: "The rights one departed member issued while they were still a member.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["granter", "rights"];
+                readonly properties: {
+                    readonly granter: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The member who granted these rights and has since left the community.";
+                    };
+                    readonly rights: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/AdminRightRow";
+                        };
+                        readonly description: "The rights `granter` issued, still live or awaiting a break-glass ratification. Every row's `origin` is `recorded` and `granterDeparted` is `true` — a role-derived grant has no granter and never appears here.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — Rights Issued By Departed Members — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["cascadeOnDeparture", "granters"];
+                readonly description: "Rights grouped by their departed granter, ordered by the granter's DID.";
+                readonly properties: {
+                    readonly cascadeOnDeparture: {
+                        readonly type: "boolean";
+                        readonly description: "The community's active `cascade_on_departure` policy setting. `true` means a departure revokes these rights automatically and this list is normally empty; `false` means they stay, for an administrator to review and act on individually.";
+                    };
+                    readonly granters: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DepartedGranter";
+                        };
+                        readonly description: "Departed granters with at least one surviving right they issued, ordered by `granter`.";
+                    };
+                    readonly nextCursor: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "Continuation token for the next page of granters, or `null` when this is the last.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AdminRightRow: {
+                readonly title: "AdminRightRow";
+                readonly description: "One right as the administrator's rights console shows it: a recorded `RightRecord` restated with the membership facts an administrator needs (`subjectMember`, `granterDeparted`), or a role-derived grant that carries no record. `git-ns/right/list` and `git-ns/right/issued-by-departed` are its only producers.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "right", "resource", "origin", "subjectMember", "granterDeparted"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who holds the right.";
+                    };
+                    readonly right: {
+                        readonly $ref: "#/$defs/Right";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/Resource";
+                    };
+                    readonly origin: {
+                        readonly $ref: "#/$defs/RightOrigin";
+                    };
+                    readonly grantedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who caused the right (see `RightRecord.grantedBy`). Present exactly when `origin` is `recorded`; a role-derived grant is published by the hook relay from configuration, not by an actor.";
+                    };
+                    readonly grantedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Present exactly when `origin` is `recorded`.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right lapses. Absent: no expiry, or `origin` is `roleDerived` (a role-derived grant never expires on its own — it is withdrawn by editing `[hooks.git-trust] grant_on_role`).";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The granter's free-text reason, restated from the `RightRecord`. Absent when `origin` is `roleDerived`, or the record carries none.";
+                    };
+                    readonly subjectMember: {
+                        readonly type: "boolean";
+                        readonly description: "Whether `subject` is a current member of the community. `false` marks a right held by someone who has since left, or by an external signer the community never enrolled.";
+                    };
+                    readonly granterDeparted: {
+                        readonly type: "boolean";
+                        readonly description: "Whether `grantedBy` was a member at the time of the grant and has since left. Always `false` when `origin` is `roleDerived`, or when the record's granter was never itself a member (the VTC's own DID, for a right it derives from configuration).";
+                    };
+                    readonly breakGlass: {
+                        readonly $ref: "#/$defs/BreakGlass";
+                        readonly description: "Present exactly when `origin` is `recorded` and the record carries `breakGlass` — see `RightRecord.breakGlass`. Absent for a role-derived grant, which cannot be self-granted through break-glass.";
+                    };
+                };
+            };
+            readonly BreakGlass: {
+                readonly title: "BreakGlass";
+                readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["by", "at", "justification"];
+                readonly properties: {
+                    readonly by: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                    };
+                    readonly at: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the VTC recorded the break-glass.";
+                    };
+                    readonly justification: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly pattern: "\\S";
+                        readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                    };
+                    readonly effectiveAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                    };
+                    readonly ratifiedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                    };
+                    readonly ratifiedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                    };
+                };
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+            };
+            readonly RightOrigin: {
+                readonly title: "RightOrigin";
+                readonly description: "Where a right an administrator sees came from. `recorded` — a `git-ns/*` record, governed by the rights model and returned nowhere the subject cannot eventually see it through `git-ns/view`. `roleDerived` — a v0.1 `[hooks.git-trust] grant_on_role` grant: published by the hook relay from the community's own role configuration, never written by any `git-ns/*` task, and not itself a `RightRecord` — it has no `grantedAt`, no `expiresAt` and no `reason`, only a subject, a right and a resource.";
+                readonly type: "string";
+                readonly enum: readonly ["recorded", "roleDerived"];
+            };
+            readonly Resource: {
+                readonly title: "Resource";
+                readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/right/issued-by-departed/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly DepartedGranter: {
+                readonly title: "DepartedGranter";
+                readonly description: "The rights one departed member issued while they were still a member.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["granter", "rights"];
+                readonly properties: {
+                    readonly granter: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The member who granted these rights and has since left the community.";
+                    };
+                    readonly rights: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/AdminRightRow";
+                        };
+                        readonly description: "The rights `granter` issued, still live or awaiting a break-glass ratification. Every row's `origin` is `recorded` and `granterDeparted` is `true` — a role-derived grant has no granter and never appears here.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — Rights Issued By Departed Members — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["cascadeOnDeparture", "granters"];
+                readonly description: "Rights grouped by their departed granter, ordered by the granter's DID.";
+                readonly properties: {
+                    readonly cascadeOnDeparture: {
+                        readonly type: "boolean";
+                        readonly description: "The community's active `cascade_on_departure` policy setting. `true` means a departure revokes these rights automatically and this list is normally empty; `false` means they stay, for an administrator to review and act on individually.";
+                    };
+                    readonly granters: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DepartedGranter";
+                        };
+                        readonly description: "Departed granters with at least one surviving right they issued, ordered by `granter`.";
+                    };
+                    readonly nextCursor: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "Continuation token for the next page of granters, or `null` when this is the last.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AdminRightRow: {
+                readonly title: "AdminRightRow";
+                readonly description: "One right as the administrator's rights console shows it: a recorded `RightRecord` restated with the membership facts an administrator needs (`subjectMember`, `granterDeparted`), or a role-derived grant that carries no record. `git-ns/right/list` and `git-ns/right/issued-by-departed` are its only producers.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "right", "resource", "origin", "subjectMember", "granterDeparted"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who holds the right.";
+                    };
+                    readonly right: {
+                        readonly $ref: "#/$defs/Right";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/Resource";
+                    };
+                    readonly origin: {
+                        readonly $ref: "#/$defs/RightOrigin";
+                    };
+                    readonly grantedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who caused the right (see `RightRecord.grantedBy`). Present exactly when `origin` is `recorded`; a role-derived grant is published by the hook relay from configuration, not by an actor.";
+                    };
+                    readonly grantedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Present exactly when `origin` is `recorded`.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right lapses. Absent: no expiry, or `origin` is `roleDerived` (a role-derived grant never expires on its own — it is withdrawn by editing `[hooks.git-trust] grant_on_role`).";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The granter's free-text reason, restated from the `RightRecord`. Absent when `origin` is `roleDerived`, or the record carries none.";
+                    };
+                    readonly subjectMember: {
+                        readonly type: "boolean";
+                        readonly description: "Whether `subject` is a current member of the community. `false` marks a right held by someone who has since left, or by an external signer the community never enrolled.";
+                    };
+                    readonly granterDeparted: {
+                        readonly type: "boolean";
+                        readonly description: "Whether `grantedBy` was a member at the time of the grant and has since left. Always `false` when `origin` is `roleDerived`, or when the record's granter was never itself a member (the VTC's own DID, for a right it derives from configuration).";
+                    };
+                    readonly breakGlass: {
+                        readonly $ref: "#/$defs/BreakGlass";
+                        readonly description: "Present exactly when `origin` is `recorded` and the record carries `breakGlass` — see `RightRecord.breakGlass`. Absent for a role-derived grant, which cannot be self-granted through break-glass.";
+                    };
+                };
+            };
+            readonly BreakGlass: {
+                readonly title: "BreakGlass";
+                readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["by", "at", "justification"];
+                readonly properties: {
+                    readonly by: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                    };
+                    readonly at: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the VTC recorded the break-glass.";
+                    };
+                    readonly justification: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly pattern: "\\S";
+                        readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                    };
+                    readonly effectiveAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                    };
+                    readonly ratifiedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                    };
+                    readonly ratifiedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                    };
+                };
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+            };
+            readonly RightOrigin: {
+                readonly title: "RightOrigin";
+                readonly description: "Where a right an administrator sees came from. `recorded` — a `git-ns/*` record, governed by the rights model and returned nowhere the subject cannot eventually see it through `git-ns/view`. `roleDerived` — a v0.1 `[hooks.git-trust] grant_on_role` grant: published by the hook relay from the community's own role configuration, never written by any `git-ns/*` task, and not itself a `RightRecord` — it has no `grantedAt`, no `expiresAt` and no `reason`, only a subject, a right and a resource.";
+                readonly type: "string";
+                readonly enum: readonly ["recorded", "roleDerived"];
+            };
+            readonly Resource: {
+                readonly title: "Resource";
+                readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map