@openvtc/trust-tasks 0.21.13 → 0.21.15

package/dist/git-ns/projection/show/0.1/payload.d.ts

@@ -0,0 +1,705 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/git-ns/projection/show/0.1/payload.schema.json
+ */
+import type { Did_GitNsV0_3 as Did, Ext, Resource, Right } from "../../../../_shared/components.js";
+/**
+ * A community administrator reads what the VTC has published (and what it still owes) to the Trust Registry for its git namespaces. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface GitNamespacesShowTrustRegistryProjectionPayload {
+    /**
+     * Only published records on this resource or inside it. Absent: every resource.
+     */
+    resource?: Resource;
+    /**
+     * Opaque continuation token from a previous response's `nextCursor`. A consumer supplying a `cursor` MUST NOT also change `resource` from the request that produced it — start a fresh query instead.
+     */
+    cursor?: string;
+    /**
+     * Maximum published records to return in this page. A VTC clamps to 1..=500 (default 100).
+     */
+    limit?: number;
+    ext?: Ext;
+}
+/**
+ * What is published, and how far it is from what the VTC's records currently call for.
+ */
+export interface GitNamespacesShowTrustRegistryProjectionResponsePayload {
+    /**
+     * Whether this VTC can publish at all — a Trust Registry and its own publishing DID are configured. `false`: `published` is only what was last published before publishing was unconfigured, and `pendingChanges` still counts against the VTC's current records.
+     */
+    registryConfigured: boolean;
+    /**
+     * Records matching `resource`, as the VTC's own mirror of what it last published, ordered by `resource` then `action` then `entity`.
+     */
+    published: PublishedRow[];
+    /**
+     * Continuation token for the next page of `published`, or `null` when this is the last.
+     */
+    nextCursor?: string | null;
+    /**
+     * How many records the next reconciliation pass will add, remove or replace to bring the registry into line with the VTC's current rights — across the whole VTC, regardless of `resource` or paging. Zero means the registry already matches.
+     */
+    pendingChanges: number;
+    ext?: Ext;
+}
+/**
+ * One record the VTC has published to the Trust Registry.
+ */
+export interface PublishedRow {
+    /**
+     * The DID the record is about — the right's subject.
+     */
+    entity: Did;
+    /**
+     * The TRQP action the record is published under.
+     */
+    action: Right;
+    resource: Resource;
+    context: Context;
+    /**
+     * When the VTC last wrote this record to the registry.
+     */
+    publishedAt: string;
+}
+/**
+ * The record's context as published: what the TRQP record has no member of its own for. Not itself governed by this specification — it is the projector's internal shape, carried through unchanged, and a consumer MUST treat unrecognised members as opaque rather than failing on them.
+ */
+export interface Context {
+    /**
+     * The Trust Task type URI the record was published under — this specification's framework constant for a recorded or implied right, or the fixed `git-trust/grant/0.1` URI for a role-derived one.
+     */
+    framework: string;
+    /**
+     * Present, and always `roleDerived`, exactly for a v0.1 `[hooks.git-trust] grant_on_role` tuple. Absent for a tuple sourced from a recorded or implied right.
+     */
+    origin?: "roleDerived";
+    /**
+     * When the underlying right took effect. Absent for a role-derived tuple, which has no grant time of its own.
+     */
+    activeFrom?: string;
+    /**
+     * When the underlying right expires. Absent: no expiry, or the longest of two merged sources' expiries once neither is absent.
+     */
+    activeTo?: string;
+    /**
+     * Present when this tuple publishes a right implied by another recorded right (a repository's `git.commit.sign` implied by its `git.repo.own`, or a namespace's implied rights). Names the right that implies it.
+     */
+    impliedBy?: Right;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Did, Ext, Resource, Right };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/git-ns/projection/show/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = GitNamespacesShowTrustRegistryProjectionPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/git-ns/projection/show/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = GitNamespacesShowTrustRegistryProjectionResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/git-ns/projection/show/0.1";
+    readonly title: "Git Namespaces — Show Trust Registry Projection — payload";
+    readonly description: "A community administrator reads what the VTC has published (and what it still owes) to the Trust Registry for its git namespaces. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly properties: {
+        readonly resource: {
+            readonly $ref: "#/$defs/Resource";
+            readonly description: "Only published records on this resource or inside it. Absent: every resource.";
+        };
+        readonly cursor: {
+            readonly type: "string";
+            readonly description: "Opaque continuation token from a previous response's `nextCursor`. A consumer supplying a `cursor` MUST NOT also change `resource` from the request that produced it — start a fresh query instead.";
+        };
+        readonly limit: {
+            readonly type: "integer";
+            readonly minimum: 1;
+            readonly maximum: 500;
+            readonly description: "Maximum published records to return in this page. A VTC clamps to 1..=500 (default 100).";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Context: {
+            readonly title: "Context";
+            readonly description: "The record's context as published: what the TRQP record has no member of its own for. Not itself governed by this specification — it is the projector's internal shape, carried through unchanged, and a consumer MUST treat unrecognised members as opaque rather than failing on them.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["framework"];
+            readonly properties: {
+                readonly framework: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "The Trust Task type URI the record was published under — this specification's framework constant for a recorded or implied right, or the fixed `git-trust/grant/0.1` URI for a role-derived one.";
+                };
+                readonly origin: {
+                    readonly type: "string";
+                    readonly enum: readonly ["roleDerived"];
+                    readonly description: "Present, and always `roleDerived`, exactly for a v0.1 `[hooks.git-trust] grant_on_role` tuple. Absent for a tuple sourced from a recorded or implied right.";
+                };
+                readonly activeFrom: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the underlying right took effect. Absent for a role-derived tuple, which has no grant time of its own.";
+                };
+                readonly activeTo: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the underlying right expires. Absent: no expiry, or the longest of two merged sources' expiries once neither is absent.";
+                };
+                readonly impliedBy: {
+                    readonly $ref: "#/$defs/Right";
+                    readonly description: "Present when this tuple publishes a right implied by another recorded right (a repository's `git.commit.sign` implied by its `git.repo.own`, or a namespace's implied rights). Names the right that implies it.";
+                };
+            };
+        };
+        readonly PublishedRow: {
+            readonly title: "PublishedRow";
+            readonly description: "One record the VTC has published to the Trust Registry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["entity", "action", "resource", "context", "publishedAt"];
+            readonly properties: {
+                readonly entity: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The DID the record is about — the right's subject.";
+                };
+                readonly action: {
+                    readonly $ref: "#/$defs/Right";
+                    readonly description: "The TRQP action the record is published under.";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/Resource";
+                };
+                readonly context: {
+                    readonly $ref: "#/$defs/Context";
+                };
+                readonly publishedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the VTC last wrote this record to the registry.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — Show Trust Registry Projection — response payload";
+            readonly description: "What is published, and how far it is from what the VTC's records currently call for.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["registryConfigured", "published", "pendingChanges"];
+            readonly properties: {
+                readonly registryConfigured: {
+                    readonly type: "boolean";
+                    readonly description: "Whether this VTC can publish at all — a Trust Registry and its own publishing DID are configured. `false`: `published` is only what was last published before publishing was unconfigured, and `pendingChanges` still counts against the VTC's current records.";
+                };
+                readonly published: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/PublishedRow";
+                    };
+                    readonly description: "Records matching `resource`, as the VTC's own mirror of what it last published, ordered by `resource` then `action` then `entity`.";
+                };
+                readonly nextCursor: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "Continuation token for the next page of `published`, or `null` when this is the last.";
+                };
+                readonly pendingChanges: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "How many records the next reconciliation pass will add, remove or replace to bring the registry into line with the VTC's current rights — across the whole VTC, regardless of `resource` or paging. Zero means the registry already matches.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Resource: {
+            readonly title: "Resource";
+            readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Context: {
+            readonly title: "Context";
+            readonly description: "The record's context as published: what the TRQP record has no member of its own for. Not itself governed by this specification — it is the projector's internal shape, carried through unchanged, and a consumer MUST treat unrecognised members as opaque rather than failing on them.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["framework"];
+            readonly properties: {
+                readonly framework: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "The Trust Task type URI the record was published under — this specification's framework constant for a recorded or implied right, or the fixed `git-trust/grant/0.1` URI for a role-derived one.";
+                };
+                readonly origin: {
+                    readonly type: "string";
+                    readonly enum: readonly ["roleDerived"];
+                    readonly description: "Present, and always `roleDerived`, exactly for a v0.1 `[hooks.git-trust] grant_on_role` tuple. Absent for a tuple sourced from a recorded or implied right.";
+                };
+                readonly activeFrom: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the underlying right took effect. Absent for a role-derived tuple, which has no grant time of its own.";
+                };
+                readonly activeTo: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the underlying right expires. Absent: no expiry, or the longest of two merged sources' expiries once neither is absent.";
+                };
+                readonly impliedBy: {
+                    readonly $ref: "#/$defs/Right";
+                    readonly description: "Present when this tuple publishes a right implied by another recorded right (a repository's `git.commit.sign` implied by its `git.repo.own`, or a namespace's implied rights). Names the right that implies it.";
+                };
+            };
+        };
+        readonly PublishedRow: {
+            readonly title: "PublishedRow";
+            readonly description: "One record the VTC has published to the Trust Registry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["entity", "action", "resource", "context", "publishedAt"];
+            readonly properties: {
+                readonly entity: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The DID the record is about — the right's subject.";
+                };
+                readonly action: {
+                    readonly $ref: "#/$defs/Right";
+                    readonly description: "The TRQP action the record is published under.";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/Resource";
+                };
+                readonly context: {
+                    readonly $ref: "#/$defs/Context";
+                };
+                readonly publishedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the VTC last wrote this record to the registry.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — Show Trust Registry Projection — response payload";
+            readonly description: "What is published, and how far it is from what the VTC's records currently call for.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["registryConfigured", "published", "pendingChanges"];
+            readonly properties: {
+                readonly registryConfigured: {
+                    readonly type: "boolean";
+                    readonly description: "Whether this VTC can publish at all — a Trust Registry and its own publishing DID are configured. `false`: `published` is only what was last published before publishing was unconfigured, and `pendingChanges` still counts against the VTC's current records.";
+                };
+                readonly published: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/PublishedRow";
+                    };
+                    readonly description: "Records matching `resource`, as the VTC's own mirror of what it last published, ordered by `resource` then `action` then `entity`.";
+                };
+                readonly nextCursor: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "Continuation token for the next page of `published`, or `null` when this is the last.";
+                };
+                readonly pendingChanges: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "How many records the next reconciliation pass will add, remove or replace to bring the registry into line with the VTC's current rights — across the whole VTC, regardless of `resource` or paging. Zero means the registry already matches.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Resource: {
+            readonly title: "Resource";
+            readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/projection/show/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/git-ns/projection/show/0.1";
+        readonly title: "Git Namespaces — Show Trust Registry Projection — payload";
+        readonly description: "A community administrator reads what the VTC has published (and what it still owes) to the Trust Registry for its git namespaces. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly properties: {
+            readonly resource: {
+                readonly $ref: "#/$defs/Resource";
+                readonly description: "Only published records on this resource or inside it. Absent: every resource.";
+            };
+            readonly cursor: {
+                readonly type: "string";
+                readonly description: "Opaque continuation token from a previous response's `nextCursor`. A consumer supplying a `cursor` MUST NOT also change `resource` from the request that produced it — start a fresh query instead.";
+            };
+            readonly limit: {
+                readonly type: "integer";
+                readonly minimum: 1;
+                readonly maximum: 500;
+                readonly description: "Maximum published records to return in this page. A VTC clamps to 1..=500 (default 100).";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Context: {
+                readonly title: "Context";
+                readonly description: "The record's context as published: what the TRQP record has no member of its own for. Not itself governed by this specification — it is the projector's internal shape, carried through unchanged, and a consumer MUST treat unrecognised members as opaque rather than failing on them.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["framework"];
+                readonly properties: {
+                    readonly framework: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "The Trust Task type URI the record was published under — this specification's framework constant for a recorded or implied right, or the fixed `git-trust/grant/0.1` URI for a role-derived one.";
+                    };
+                    readonly origin: {
+                        readonly type: "string";
+                        readonly enum: readonly ["roleDerived"];
+                        readonly description: "Present, and always `roleDerived`, exactly for a v0.1 `[hooks.git-trust] grant_on_role` tuple. Absent for a tuple sourced from a recorded or implied right.";
+                    };
+                    readonly activeFrom: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the underlying right took effect. Absent for a role-derived tuple, which has no grant time of its own.";
+                    };
+                    readonly activeTo: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the underlying right expires. Absent: no expiry, or the longest of two merged sources' expiries once neither is absent.";
+                    };
+                    readonly impliedBy: {
+                        readonly $ref: "#/$defs/Right";
+                        readonly description: "Present when this tuple publishes a right implied by another recorded right (a repository's `git.commit.sign` implied by its `git.repo.own`, or a namespace's implied rights). Names the right that implies it.";
+                    };
+                };
+            };
+            readonly PublishedRow: {
+                readonly title: "PublishedRow";
+                readonly description: "One record the VTC has published to the Trust Registry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["entity", "action", "resource", "context", "publishedAt"];
+                readonly properties: {
+                    readonly entity: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The DID the record is about — the right's subject.";
+                    };
+                    readonly action: {
+                        readonly $ref: "#/$defs/Right";
+                        readonly description: "The TRQP action the record is published under.";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/Resource";
+                    };
+                    readonly context: {
+                        readonly $ref: "#/$defs/Context";
+                    };
+                    readonly publishedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the VTC last wrote this record to the registry.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — Show Trust Registry Projection — response payload";
+                readonly description: "What is published, and how far it is from what the VTC's records currently call for.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["registryConfigured", "published", "pendingChanges"];
+                readonly properties: {
+                    readonly registryConfigured: {
+                        readonly type: "boolean";
+                        readonly description: "Whether this VTC can publish at all — a Trust Registry and its own publishing DID are configured. `false`: `published` is only what was last published before publishing was unconfigured, and `pendingChanges` still counts against the VTC's current records.";
+                    };
+                    readonly published: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/PublishedRow";
+                        };
+                        readonly description: "Records matching `resource`, as the VTC's own mirror of what it last published, ordered by `resource` then `action` then `entity`.";
+                    };
+                    readonly nextCursor: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "Continuation token for the next page of `published`, or `null` when this is the last.";
+                    };
+                    readonly pendingChanges: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "How many records the next reconciliation pass will add, remove or replace to bring the registry into line with the VTC's current rights — across the whole VTC, regardless of `resource` or paging. Zero means the registry already matches.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Resource: {
+                readonly title: "Resource";
+                readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/projection/show/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Context: {
+                readonly title: "Context";
+                readonly description: "The record's context as published: what the TRQP record has no member of its own for. Not itself governed by this specification — it is the projector's internal shape, carried through unchanged, and a consumer MUST treat unrecognised members as opaque rather than failing on them.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["framework"];
+                readonly properties: {
+                    readonly framework: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "The Trust Task type URI the record was published under — this specification's framework constant for a recorded or implied right, or the fixed `git-trust/grant/0.1` URI for a role-derived one.";
+                    };
+                    readonly origin: {
+                        readonly type: "string";
+                        readonly enum: readonly ["roleDerived"];
+                        readonly description: "Present, and always `roleDerived`, exactly for a v0.1 `[hooks.git-trust] grant_on_role` tuple. Absent for a tuple sourced from a recorded or implied right.";
+                    };
+                    readonly activeFrom: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the underlying right took effect. Absent for a role-derived tuple, which has no grant time of its own.";
+                    };
+                    readonly activeTo: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the underlying right expires. Absent: no expiry, or the longest of two merged sources' expiries once neither is absent.";
+                    };
+                    readonly impliedBy: {
+                        readonly $ref: "#/$defs/Right";
+                        readonly description: "Present when this tuple publishes a right implied by another recorded right (a repository's `git.commit.sign` implied by its `git.repo.own`, or a namespace's implied rights). Names the right that implies it.";
+                    };
+                };
+            };
+            readonly PublishedRow: {
+                readonly title: "PublishedRow";
+                readonly description: "One record the VTC has published to the Trust Registry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["entity", "action", "resource", "context", "publishedAt"];
+                readonly properties: {
+                    readonly entity: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The DID the record is about — the right's subject.";
+                    };
+                    readonly action: {
+                        readonly $ref: "#/$defs/Right";
+                        readonly description: "The TRQP action the record is published under.";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/Resource";
+                    };
+                    readonly context: {
+                        readonly $ref: "#/$defs/Context";
+                    };
+                    readonly publishedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the VTC last wrote this record to the registry.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — Show Trust Registry Projection — response payload";
+                readonly description: "What is published, and how far it is from what the VTC's records currently call for.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["registryConfigured", "published", "pendingChanges"];
+                readonly properties: {
+                    readonly registryConfigured: {
+                        readonly type: "boolean";
+                        readonly description: "Whether this VTC can publish at all — a Trust Registry and its own publishing DID are configured. `false`: `published` is only what was last published before publishing was unconfigured, and `pendingChanges` still counts against the VTC's current records.";
+                    };
+                    readonly published: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/PublishedRow";
+                        };
+                        readonly description: "Records matching `resource`, as the VTC's own mirror of what it last published, ordered by `resource` then `action` then `entity`.";
+                    };
+                    readonly nextCursor: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "Continuation token for the next page of `published`, or `null` when this is the last.";
+                    };
+                    readonly pendingChanges: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "How many records the next reconciliation pass will add, remove or replace to bring the registry into line with the VTC's current rights — across the whole VTC, regardless of `resource` or paging. Zero means the registry already matches.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Resource: {
+                readonly title: "Resource";
+                readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map