@openvtc/trust-tasks 0.21.13 → 0.21.15

package/dist/git-ns/right/list/0.1/payload.d.ts

@@ -0,0 +1,773 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/git-ns/right/list/0.1/payload.schema.json
+ */
+import type { AdminRightRow, BreakGlass, Did_GitNsV0_3 as Did, Ext, Resource, Right, RightOrigin } from "../../../../_shared/components.js";
+/**
+ * A community administrator enumerates every git right the VTC knows of, recorded and role-derived alike, across every namespace. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface GitNamespacesListRightsPayload {
+    /**
+     * Only rights on this resource or inside it. Absent: every resource.
+     */
+    resource?: Resource;
+    /**
+     * Only rights held by this DID. Absent: every subject.
+     */
+    subject?: Did;
+    /**
+     * Opaque continuation token from a previous response's `nextCursor`. A consumer supplying a `cursor` MUST NOT also change `resource` or `subject` from the request that produced it — start a fresh query instead.
+     */
+    cursor?: string;
+    /**
+     * Maximum rows to return in this page. A VTC clamps to 1..=500 (default 100).
+     */
+    limit?: number;
+    ext?: Ext;
+}
+/**
+ * The matching rows, ordered by resource then subject.
+ */
+export interface GitNamespacesListRightsResponsePayload {
+    /**
+     * Rows matching `resource` and `subject`, ordered by `resource` then `subject`. A break-glass record waiting out a policy delay is included — it is exactly the one other administrators have a window to revoke.
+     */
+    rights: AdminRightRow[];
+    /**
+     * Continuation token for the next page, or `null` when this is the last.
+     */
+    nextCursor?: string | null;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AdminRightRow, BreakGlass, Did, Ext, Resource, Right, RightOrigin };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/git-ns/right/list/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = GitNamespacesListRightsPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/git-ns/right/list/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = GitNamespacesListRightsResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/git-ns/right/list/0.1";
+    readonly title: "Git Namespaces — List Rights — payload";
+    readonly description: "A community administrator enumerates every git right the VTC knows of, recorded and role-derived alike, across every namespace. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly properties: {
+        readonly resource: {
+            readonly $ref: "#/$defs/Resource";
+            readonly description: "Only rights on this resource or inside it. Absent: every resource.";
+        };
+        readonly subject: {
+            readonly $ref: "#/$defs/Did";
+            readonly description: "Only rights held by this DID. Absent: every subject.";
+        };
+        readonly cursor: {
+            readonly type: "string";
+            readonly description: "Opaque continuation token from a previous response's `nextCursor`. A consumer supplying a `cursor` MUST NOT also change `resource` or `subject` from the request that produced it — start a fresh query instead.";
+        };
+        readonly limit: {
+            readonly type: "integer";
+            readonly minimum: 1;
+            readonly maximum: 500;
+            readonly description: "Maximum rows to return in this page. A VTC clamps to 1..=500 (default 100).";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — List Rights — response payload";
+            readonly description: "The matching rows, ordered by resource then subject.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["rights"];
+            readonly properties: {
+                readonly rights: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/AdminRightRow";
+                    };
+                    readonly description: "Rows matching `resource` and `subject`, ordered by `resource` then `subject`. A break-glass record waiting out a policy delay is included — it is exactly the one other administrators have a window to revoke.";
+                };
+                readonly nextCursor: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "Continuation token for the next page, or `null` when this is the last.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AdminRightRow: {
+            readonly title: "AdminRightRow";
+            readonly description: "One right as the administrator's rights console shows it: a recorded `RightRecord` restated with the membership facts an administrator needs (`subjectMember`, `granterDeparted`), or a role-derived grant that carries no record. `git-ns/right/list` and `git-ns/right/issued-by-departed` are its only producers.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "right", "resource", "origin", "subjectMember", "granterDeparted"];
+            readonly properties: {
+                readonly subject: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who holds the right.";
+                };
+                readonly right: {
+                    readonly $ref: "#/$defs/Right";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/Resource";
+                };
+                readonly origin: {
+                    readonly $ref: "#/$defs/RightOrigin";
+                };
+                readonly grantedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who caused the right (see `RightRecord.grantedBy`). Present exactly when `origin` is `recorded`; a role-derived grant is published by the hook relay from configuration, not by an actor.";
+                };
+                readonly grantedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Present exactly when `origin` is `recorded`.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right lapses. Absent: no expiry, or `origin` is `roleDerived` (a role-derived grant never expires on its own — it is withdrawn by editing `[hooks.git-trust] grant_on_role`).";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The granter's free-text reason, restated from the `RightRecord`. Absent when `origin` is `roleDerived`, or the record carries none.";
+                };
+                readonly subjectMember: {
+                    readonly type: "boolean";
+                    readonly description: "Whether `subject` is a current member of the community. `false` marks a right held by someone who has since left, or by an external signer the community never enrolled.";
+                };
+                readonly granterDeparted: {
+                    readonly type: "boolean";
+                    readonly description: "Whether `grantedBy` was a member at the time of the grant and has since left. Always `false` when `origin` is `roleDerived`, or when the record's granter was never itself a member (the VTC's own DID, for a right it derives from configuration).";
+                };
+                readonly breakGlass: {
+                    readonly $ref: "#/$defs/BreakGlass";
+                    readonly description: "Present exactly when `origin` is `recorded` and the record carries `breakGlass` — see `RightRecord.breakGlass`. Absent for a role-derived grant, which cannot be self-granted through break-glass.";
+                };
+            };
+        };
+        readonly BreakGlass: {
+            readonly title: "BreakGlass";
+            readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["by", "at", "justification"];
+            readonly properties: {
+                readonly by: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                };
+                readonly at: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the VTC recorded the break-glass.";
+                };
+                readonly justification: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly pattern: "\\S";
+                    readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                };
+                readonly effectiveAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                };
+                readonly ratifiedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                };
+                readonly ratifiedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                };
+            };
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+        };
+        readonly RightOrigin: {
+            readonly title: "RightOrigin";
+            readonly description: "Where a right an administrator sees came from. `recorded` — a `git-ns/*` record, governed by the rights model and returned nowhere the subject cannot eventually see it through `git-ns/view`. `roleDerived` — a v0.1 `[hooks.git-trust] grant_on_role` grant: published by the hook relay from the community's own role configuration, never written by any `git-ns/*` task, and not itself a `RightRecord` — it has no `grantedAt`, no `expiresAt` and no `reason`, only a subject, a right and a resource.";
+            readonly type: "string";
+            readonly enum: readonly ["recorded", "roleDerived"];
+        };
+        readonly Resource: {
+            readonly title: "Resource";
+            readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — List Rights — response payload";
+            readonly description: "The matching rows, ordered by resource then subject.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["rights"];
+            readonly properties: {
+                readonly rights: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/AdminRightRow";
+                    };
+                    readonly description: "Rows matching `resource` and `subject`, ordered by `resource` then `subject`. A break-glass record waiting out a policy delay is included — it is exactly the one other administrators have a window to revoke.";
+                };
+                readonly nextCursor: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "Continuation token for the next page, or `null` when this is the last.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AdminRightRow: {
+            readonly title: "AdminRightRow";
+            readonly description: "One right as the administrator's rights console shows it: a recorded `RightRecord` restated with the membership facts an administrator needs (`subjectMember`, `granterDeparted`), or a role-derived grant that carries no record. `git-ns/right/list` and `git-ns/right/issued-by-departed` are its only producers.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "right", "resource", "origin", "subjectMember", "granterDeparted"];
+            readonly properties: {
+                readonly subject: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who holds the right.";
+                };
+                readonly right: {
+                    readonly $ref: "#/$defs/Right";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/Resource";
+                };
+                readonly origin: {
+                    readonly $ref: "#/$defs/RightOrigin";
+                };
+                readonly grantedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who caused the right (see `RightRecord.grantedBy`). Present exactly when `origin` is `recorded`; a role-derived grant is published by the hook relay from configuration, not by an actor.";
+                };
+                readonly grantedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Present exactly when `origin` is `recorded`.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right lapses. Absent: no expiry, or `origin` is `roleDerived` (a role-derived grant never expires on its own — it is withdrawn by editing `[hooks.git-trust] grant_on_role`).";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The granter's free-text reason, restated from the `RightRecord`. Absent when `origin` is `roleDerived`, or the record carries none.";
+                };
+                readonly subjectMember: {
+                    readonly type: "boolean";
+                    readonly description: "Whether `subject` is a current member of the community. `false` marks a right held by someone who has since left, or by an external signer the community never enrolled.";
+                };
+                readonly granterDeparted: {
+                    readonly type: "boolean";
+                    readonly description: "Whether `grantedBy` was a member at the time of the grant and has since left. Always `false` when `origin` is `roleDerived`, or when the record's granter was never itself a member (the VTC's own DID, for a right it derives from configuration).";
+                };
+                readonly breakGlass: {
+                    readonly $ref: "#/$defs/BreakGlass";
+                    readonly description: "Present exactly when `origin` is `recorded` and the record carries `breakGlass` — see `RightRecord.breakGlass`. Absent for a role-derived grant, which cannot be self-granted through break-glass.";
+                };
+            };
+        };
+        readonly BreakGlass: {
+            readonly title: "BreakGlass";
+            readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["by", "at", "justification"];
+            readonly properties: {
+                readonly by: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                };
+                readonly at: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the VTC recorded the break-glass.";
+                };
+                readonly justification: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly pattern: "\\S";
+                    readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                };
+                readonly effectiveAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                };
+                readonly ratifiedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                };
+                readonly ratifiedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                };
+            };
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+        };
+        readonly RightOrigin: {
+            readonly title: "RightOrigin";
+            readonly description: "Where a right an administrator sees came from. `recorded` — a `git-ns/*` record, governed by the rights model and returned nowhere the subject cannot eventually see it through `git-ns/view`. `roleDerived` — a v0.1 `[hooks.git-trust] grant_on_role` grant: published by the hook relay from the community's own role configuration, never written by any `git-ns/*` task, and not itself a `RightRecord` — it has no `grantedAt`, no `expiresAt` and no `reason`, only a subject, a right and a resource.";
+            readonly type: "string";
+            readonly enum: readonly ["recorded", "roleDerived"];
+        };
+        readonly Resource: {
+            readonly title: "Resource";
+            readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/right/list/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/git-ns/right/list/0.1";
+        readonly title: "Git Namespaces — List Rights — payload";
+        readonly description: "A community administrator enumerates every git right the VTC knows of, recorded and role-derived alike, across every namespace. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly properties: {
+            readonly resource: {
+                readonly $ref: "#/$defs/Resource";
+                readonly description: "Only rights on this resource or inside it. Absent: every resource.";
+            };
+            readonly subject: {
+                readonly $ref: "#/$defs/Did";
+                readonly description: "Only rights held by this DID. Absent: every subject.";
+            };
+            readonly cursor: {
+                readonly type: "string";
+                readonly description: "Opaque continuation token from a previous response's `nextCursor`. A consumer supplying a `cursor` MUST NOT also change `resource` or `subject` from the request that produced it — start a fresh query instead.";
+            };
+            readonly limit: {
+                readonly type: "integer";
+                readonly minimum: 1;
+                readonly maximum: 500;
+                readonly description: "Maximum rows to return in this page. A VTC clamps to 1..=500 (default 100).";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — List Rights — response payload";
+                readonly description: "The matching rows, ordered by resource then subject.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["rights"];
+                readonly properties: {
+                    readonly rights: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/AdminRightRow";
+                        };
+                        readonly description: "Rows matching `resource` and `subject`, ordered by `resource` then `subject`. A break-glass record waiting out a policy delay is included — it is exactly the one other administrators have a window to revoke.";
+                    };
+                    readonly nextCursor: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "Continuation token for the next page, or `null` when this is the last.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AdminRightRow: {
+                readonly title: "AdminRightRow";
+                readonly description: "One right as the administrator's rights console shows it: a recorded `RightRecord` restated with the membership facts an administrator needs (`subjectMember`, `granterDeparted`), or a role-derived grant that carries no record. `git-ns/right/list` and `git-ns/right/issued-by-departed` are its only producers.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "right", "resource", "origin", "subjectMember", "granterDeparted"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who holds the right.";
+                    };
+                    readonly right: {
+                        readonly $ref: "#/$defs/Right";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/Resource";
+                    };
+                    readonly origin: {
+                        readonly $ref: "#/$defs/RightOrigin";
+                    };
+                    readonly grantedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who caused the right (see `RightRecord.grantedBy`). Present exactly when `origin` is `recorded`; a role-derived grant is published by the hook relay from configuration, not by an actor.";
+                    };
+                    readonly grantedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Present exactly when `origin` is `recorded`.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right lapses. Absent: no expiry, or `origin` is `roleDerived` (a role-derived grant never expires on its own — it is withdrawn by editing `[hooks.git-trust] grant_on_role`).";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The granter's free-text reason, restated from the `RightRecord`. Absent when `origin` is `roleDerived`, or the record carries none.";
+                    };
+                    readonly subjectMember: {
+                        readonly type: "boolean";
+                        readonly description: "Whether `subject` is a current member of the community. `false` marks a right held by someone who has since left, or by an external signer the community never enrolled.";
+                    };
+                    readonly granterDeparted: {
+                        readonly type: "boolean";
+                        readonly description: "Whether `grantedBy` was a member at the time of the grant and has since left. Always `false` when `origin` is `roleDerived`, or when the record's granter was never itself a member (the VTC's own DID, for a right it derives from configuration).";
+                    };
+                    readonly breakGlass: {
+                        readonly $ref: "#/$defs/BreakGlass";
+                        readonly description: "Present exactly when `origin` is `recorded` and the record carries `breakGlass` — see `RightRecord.breakGlass`. Absent for a role-derived grant, which cannot be self-granted through break-glass.";
+                    };
+                };
+            };
+            readonly BreakGlass: {
+                readonly title: "BreakGlass";
+                readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["by", "at", "justification"];
+                readonly properties: {
+                    readonly by: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                    };
+                    readonly at: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the VTC recorded the break-glass.";
+                    };
+                    readonly justification: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly pattern: "\\S";
+                        readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                    };
+                    readonly effectiveAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                    };
+                    readonly ratifiedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                    };
+                    readonly ratifiedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                    };
+                };
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+            };
+            readonly RightOrigin: {
+                readonly title: "RightOrigin";
+                readonly description: "Where a right an administrator sees came from. `recorded` — a `git-ns/*` record, governed by the rights model and returned nowhere the subject cannot eventually see it through `git-ns/view`. `roleDerived` — a v0.1 `[hooks.git-trust] grant_on_role` grant: published by the hook relay from the community's own role configuration, never written by any `git-ns/*` task, and not itself a `RightRecord` — it has no `grantedAt`, no `expiresAt` and no `reason`, only a subject, a right and a resource.";
+                readonly type: "string";
+                readonly enum: readonly ["recorded", "roleDerived"];
+            };
+            readonly Resource: {
+                readonly title: "Resource";
+                readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/right/list/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — List Rights — response payload";
+                readonly description: "The matching rows, ordered by resource then subject.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["rights"];
+                readonly properties: {
+                    readonly rights: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/AdminRightRow";
+                        };
+                        readonly description: "Rows matching `resource` and `subject`, ordered by `resource` then `subject`. A break-glass record waiting out a policy delay is included — it is exactly the one other administrators have a window to revoke.";
+                    };
+                    readonly nextCursor: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "Continuation token for the next page, or `null` when this is the last.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AdminRightRow: {
+                readonly title: "AdminRightRow";
+                readonly description: "One right as the administrator's rights console shows it: a recorded `RightRecord` restated with the membership facts an administrator needs (`subjectMember`, `granterDeparted`), or a role-derived grant that carries no record. `git-ns/right/list` and `git-ns/right/issued-by-departed` are its only producers.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "right", "resource", "origin", "subjectMember", "granterDeparted"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who holds the right.";
+                    };
+                    readonly right: {
+                        readonly $ref: "#/$defs/Right";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/Resource";
+                    };
+                    readonly origin: {
+                        readonly $ref: "#/$defs/RightOrigin";
+                    };
+                    readonly grantedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who caused the right (see `RightRecord.grantedBy`). Present exactly when `origin` is `recorded`; a role-derived grant is published by the hook relay from configuration, not by an actor.";
+                    };
+                    readonly grantedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Present exactly when `origin` is `recorded`.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right lapses. Absent: no expiry, or `origin` is `roleDerived` (a role-derived grant never expires on its own — it is withdrawn by editing `[hooks.git-trust] grant_on_role`).";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The granter's free-text reason, restated from the `RightRecord`. Absent when `origin` is `roleDerived`, or the record carries none.";
+                    };
+                    readonly subjectMember: {
+                        readonly type: "boolean";
+                        readonly description: "Whether `subject` is a current member of the community. `false` marks a right held by someone who has since left, or by an external signer the community never enrolled.";
+                    };
+                    readonly granterDeparted: {
+                        readonly type: "boolean";
+                        readonly description: "Whether `grantedBy` was a member at the time of the grant and has since left. Always `false` when `origin` is `roleDerived`, or when the record's granter was never itself a member (the VTC's own DID, for a right it derives from configuration).";
+                    };
+                    readonly breakGlass: {
+                        readonly $ref: "#/$defs/BreakGlass";
+                        readonly description: "Present exactly when `origin` is `recorded` and the record carries `breakGlass` — see `RightRecord.breakGlass`. Absent for a role-derived grant, which cannot be self-granted through break-glass.";
+                    };
+                };
+            };
+            readonly BreakGlass: {
+                readonly title: "BreakGlass";
+                readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["by", "at", "justification"];
+                readonly properties: {
+                    readonly by: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                    };
+                    readonly at: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the VTC recorded the break-glass.";
+                    };
+                    readonly justification: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly pattern: "\\S";
+                        readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                    };
+                    readonly effectiveAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                    };
+                    readonly ratifiedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                    };
+                    readonly ratifiedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                    };
+                };
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+            };
+            readonly RightOrigin: {
+                readonly title: "RightOrigin";
+                readonly description: "Where a right an administrator sees came from. `recorded` — a `git-ns/*` record, governed by the rights model and returned nowhere the subject cannot eventually see it through `git-ns/view`. `roleDerived` — a v0.1 `[hooks.git-trust] grant_on_role` grant: published by the hook relay from the community's own role configuration, never written by any `git-ns/*` task, and not itself a `RightRecord` — it has no `grantedAt`, no `expiresAt` and no `reason`, only a subject, a right and a resource.";
+                readonly type: "string";
+                readonly enum: readonly ["recorded", "roleDerived"];
+            };
+            readonly Resource: {
+                readonly title: "Resource";
+                readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map