@openvtc/trust-tasks 0.21.3 → 0.21.5

package/dist/git-ns/view/0.5/payload.d.ts

@@ -0,0 +1,1722 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/git-ns/view/0.5/payload.schema.json
+ */
+import type { Bootstrap, BreakGlass, Did_GitNsV0_3 as Did, DriftItem, Ext, ForgeAccount, ForgeHost, ForgeId, GitNamespace, NamespaceId, RepoResource, RepoSummary_GitNsV0_3 as RepoSummary, RepoVisibility, Resource, Right, RightRecord_GitNsV0_4 as RightRecord, Segment, Sync } from "../../../_shared/components.js";
+/**
+ * A member reads the namespaces, repositories and rights they are entitled to see, optionally narrowed to one resource, together with the forge accounts linked to their own DID. An administrator may instead ask for everything in the namespaces they administer, and either may narrow the rights to break-glass records.
+ */
+export interface GitNamespacesViewPayload {
+    /**
+     * Narrow the answer to this resource and everything inside it. Absent: everything the caller may see.
+     */
+    resource?: Resource;
+    /**
+     * `member` (the default) — what the caller may see through their own git rights, exactly as in 0.4. `administrator` — everything in the namespaces the caller administers (every namespace, for a holder of the community-administrator capability; those they hold `git.ns.admin` on, for anyone else), reasons included. Refused with `git-ns/view:notAdministrator` when the caller administers no namespace within `resource`. Absent means `"member"`; this carries no schema-level default, so a producer that omits it is not normalised into sending it.
+     */
+    scope?: "member" | "administrator";
+    /**
+     * `true` narrows `rights` to the records carrying `breakGlass` — ratified ones included — and `namespaces` and `repos` to those that contain such a record. `false` or absent: no narrowing. Absent means `false`; this carries no schema-level default, so a producer that omits it is not normalised into sending it.
+     */
+    breakGlass?: boolean;
+    ext?: Ext;
+}
+/**
+ * What the caller may see — or, with `scope: administrator`, everything in the namespaces they administer — and the caller's own linked forge accounts.
+ */
+export interface GitNamespacesViewResponsePayload {
+    /**
+     * Namespaces bound to this VTC that contain, or are contained by, `resource`. With `scope: administrator`, only those the caller administers. With `breakGlass: true`, only those containing a returned record.
+     */
+    namespaces: GitNamespace[];
+    /**
+     * Repositories within `resource`. `unmanaged` repositories are included only for callers holding `git.ns.admin` over them, or with `scope: administrator`. With `breakGlass: true`, only those carrying a returned record.
+     */
+    repos: RepoSummary[];
+    /**
+     * Rights within `resource` the caller may see: always the caller's own; every right on a resource the caller owns or administers; every unratified break-glass record in a namespace they administer or on a resource they own. With `scope: administrator`, every recorded right in the namespaces the caller administers. `reason` is omitted except on resources the caller owns or administers. With `breakGlass: true`, only records carrying `breakGlass`.
+     */
+    rights: RightRecord[];
+    /**
+     * The forge accounts linked to the caller's own DID — never another member's — at most one per forge. With `resource`, only the account on that resource's forge. Empty when the caller has linked none.
+     */
+    accounts: LinkedAccount[];
+    ext?: Ext;
+}
+/**
+ * A forge account linked to the caller's DID with git-ns/account/link, and when the link completed.
+ */
+export interface LinkedAccount {
+    /**
+     * The linked account. `id` is authoritative; `login` is as the forge last reported it.
+     */
+    account: ForgeAccount;
+    /**
+     * When the link completed: when the VTC recorded the account against the caller's DID.
+     */
+    linkedAt: string;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Bootstrap, BreakGlass, Did, DriftItem, Ext, ForgeAccount, ForgeHost, ForgeId, GitNamespace, NamespaceId, RepoResource, RepoSummary, RepoVisibility, Resource, Right, RightRecord, Segment, Sync };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/git-ns/view/0.5";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = GitNamespacesViewPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/git-ns/view/0.5#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = GitNamespacesViewResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/git-ns/view/0.5";
+    readonly title: "Git Namespaces — View — payload";
+    readonly description: "A member reads the namespaces, repositories and rights they are entitled to see, optionally narrowed to one resource, together with the forge accounts linked to their own DID. An administrator may instead ask for everything in the namespaces they administer, and either may narrow the rights to break-glass records.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly [];
+    readonly properties: {
+        readonly resource: {
+            readonly $ref: "#/$defs/Resource";
+            readonly description: "Narrow the answer to this resource and everything inside it. Absent: everything the caller may see.";
+        };
+        readonly scope: {
+            readonly type: "string";
+            readonly enum: readonly ["member", "administrator"];
+            readonly description: "`member` (the default) — what the caller may see through their own git rights, exactly as in 0.4. `administrator` — everything in the namespaces the caller administers (every namespace, for a holder of the community-administrator capability; those they hold `git.ns.admin` on, for anyone else), reasons included. Refused with `git-ns/view:notAdministrator` when the caller administers no namespace within `resource`. Absent means `\"member\"`; this carries no schema-level default, so a producer that omits it is not normalised into sending it.";
+        };
+        readonly breakGlass: {
+            readonly type: "boolean";
+            readonly description: "`true` narrows `rights` to the records carrying `breakGlass` — ratified ones included — and `namespaces` and `repos` to those that contain such a record. `false` or absent: no narrowing. Absent means `false`; this carries no schema-level default, so a producer that omits it is not normalised into sending it.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly LinkedAccount: {
+            readonly title: "LinkedAccount";
+            readonly description: "A forge account linked to the caller's DID with git-ns/account/link, and when the link completed.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["account", "linkedAt"];
+            readonly properties: {
+                readonly account: {
+                    readonly $ref: "#/$defs/ForgeAccount";
+                    readonly description: "The linked account. `id` is authoritative; `login` is as the forge last reported it.";
+                };
+                readonly linkedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the link completed: when the VTC recorded the account against the caller's DID.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — View — response payload";
+            readonly description: "What the caller may see — or, with `scope: administrator`, everything in the namespaces they administer — and the caller's own linked forge accounts.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["namespaces", "repos", "rights", "accounts"];
+            readonly properties: {
+                readonly namespaces: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/GitNamespace";
+                    };
+                    readonly description: "Namespaces bound to this VTC that contain, or are contained by, `resource`. With `scope: administrator`, only those the caller administers. With `breakGlass: true`, only those containing a returned record.";
+                };
+                readonly repos: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/RepoSummary";
+                    };
+                    readonly description: "Repositories within `resource`. `unmanaged` repositories are included only for callers holding `git.ns.admin` over them, or with `scope: administrator`. With `breakGlass: true`, only those carrying a returned record.";
+                };
+                readonly rights: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/RightRecord";
+                    };
+                    readonly description: "Rights within `resource` the caller may see: always the caller's own; every right on a resource the caller owns or administers; every unratified break-glass record in a namespace they administer or on a resource they own. With `scope: administrator`, every recorded right in the namespaces the caller administers. `reason` is omitted except on resources the caller owns or administers. With `breakGlass: true`, only records carrying `breakGlass`.";
+                };
+                readonly accounts: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/LinkedAccount";
+                    };
+                    readonly description: "The forge accounts linked to the caller's own DID — never another member's — at most one per forge. With `resource`, only the account on that resource's forge. Empty when the caller has linked none.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RightRecord: {
+            readonly title: "RightRecord";
+            readonly description: "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "right", "resource", "grantedBy", "grantedAt"];
+            readonly properties: {
+                readonly subject: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.";
+                };
+                readonly right: {
+                    readonly $ref: "#/$defs/Right";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/Resource";
+                };
+                readonly grantedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.";
+                };
+                readonly grantedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right lapses. Absent: no expiry.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.";
+                };
+                readonly breakGlass: {
+                    readonly $ref: "#/$defs/BreakGlass";
+                    readonly description: "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.";
+                };
+            };
+        };
+        readonly BreakGlass: {
+            readonly title: "BreakGlass";
+            readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["by", "at", "justification"];
+            readonly properties: {
+                readonly by: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                };
+                readonly at: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the VTC recorded the break-glass.";
+                };
+                readonly justification: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly pattern: "\\S";
+                    readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                };
+                readonly effectiveAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                };
+                readonly ratifiedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                };
+                readonly ratifiedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                };
+            };
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+        };
+        readonly Resource: {
+            readonly title: "Resource";
+            readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+        readonly RepoSummary: {
+            readonly title: "RepoSummary";
+            readonly description: "One repository as the VTC records it.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["resource", "visibility", "state", "owners", "bootstrap", "sync"];
+            readonly properties: {
+                readonly resource: {
+                    readonly $ref: "#/$defs/RepoResource";
+                };
+                readonly forgeId: {
+                    readonly $ref: "#/$defs/ForgeId";
+                    readonly description: "The forge's repository id. Absent until the forge has confirmed the repository exists (a `pendingCreate` repository, or one adopted in bridge mode before the first inspection).";
+                };
+                readonly visibility: {
+                    readonly $ref: "#/$defs/RepoVisibility";
+                };
+                readonly state: {
+                    readonly type: "string";
+                    readonly enum: readonly ["pendingCreate", "active", "archived", "detached", "orphaned", "unmanaged"];
+                    readonly description: "`pendingCreate` — the name is reserved and the repository is not yet confirmed on the forge. `active` — managed. `archived` — archived through git-ns/repo/archive; commit rights on it are revoked. `detached` — no longer governed: its namespace was unbound, or it moved outside the namespace. `orphaned` — its last owner left the community and ownership passed to the namespace admins, who have not yet named a new owner. `unmanaged` — it exists on the forge inside a bound namespace but was never created or adopted through the VTC.";
+                };
+                readonly owners: {
+                    readonly type: "array";
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/Did";
+                    };
+                    readonly description: "The DIDs holding `git.repo.own` on this repository by an explicit grant. Empty only for an `unmanaged` repository, and for an `orphaned` one whose ownership rests with the namespace admins by implication.";
+                };
+                readonly bootstrap: {
+                    readonly $ref: "#/$defs/Bootstrap";
+                };
+                readonly sync: {
+                    readonly $ref: "#/$defs/Sync";
+                };
+            };
+        };
+        readonly Sync: {
+            readonly title: "Sync";
+            readonly description: "How the forge compares with the VTC's projection for one repository.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["state", "drift"];
+            readonly properties: {
+                readonly state: {
+                    readonly type: "string";
+                    readonly enum: readonly ["inSync", "drift", "pending", "unchecked"];
+                    readonly description: "`inSync` — the last comparison found no drift. `drift` — it found some, listed in `drift`. `pending` — a change has been sent to the forge and not yet confirmed. `unchecked` — nothing compares this repository (a manual-mode namespace).";
+                };
+                readonly checkedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the forge was last compared. Absent if never.";
+                };
+                readonly drift: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DriftItem";
+                    };
+                    readonly description: "Outstanding drift. Empty unless `state` is `drift`.";
+                };
+            };
+        };
+        readonly DriftItem: {
+            readonly title: "DriftItem";
+            readonly description: "One difference between the forge's observed state and the VTC's projection of a repository.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "resource"];
+            readonly properties: {
+                readonly type: {
+                    readonly type: "string";
+                    readonly enum: readonly ["roleAdded", "roleRemoved", "roleChanged", "requiredCheckMissing", "protectionWeakened", "bootstrapMissing"];
+                    readonly description: "`roleAdded` — someone holds a forge role the projection does not give them. `roleRemoved` — a projected role is missing. `roleChanged` — a projected role is present at another level. `requiredCheckMissing` — the verify-trust check is no longer required. `protectionWeakened` — branch protection or a ruleset is weaker than the projection in another way (force-push allowed, bypass actors added). `bootstrapMissing` — a bootstrap file or variable is gone.";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/RepoResource";
+                };
+                readonly account: {
+                    readonly $ref: "#/$defs/ForgeAccount";
+                    readonly description: "Whose role differs, for the three role types.";
+                };
+                readonly observed: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "What the forge shows, in the forge's own vocabulary (a role name such as `maintain`, a setting name). Absent when nothing is there.";
+                };
+                readonly expected: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "What the projection calls for, in the forge's own vocabulary. Absent when the projection calls for nothing.";
+                };
+            };
+        };
+        readonly ForgeAccount: {
+            readonly title: "ForgeAccount";
+            readonly description: "A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["forge", "id", "login"];
+            readonly properties: {
+                readonly forge: {
+                    readonly $ref: "#/$defs/ForgeHost";
+                };
+                readonly id: {
+                    readonly $ref: "#/$defs/ForgeId";
+                };
+                readonly login: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 100;
+                    readonly description: "The account's current login, as the forge reported it when last seen. Display only.";
+                };
+            };
+        };
+        readonly ForgeId: {
+            readonly title: "ForgeId";
+            readonly description: "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+        };
+        readonly ForgeHost: {
+            readonly title: "ForgeHost";
+            readonly description: "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.";
+            readonly type: "string";
+            readonly minLength: 3;
+            readonly maxLength: 253;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$";
+        };
+        readonly RepoResource: {
+            readonly title: "RepoResource";
+            readonly description: "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$";
+        };
+        readonly Bootstrap: {
+            readonly title: "Bootstrap";
+            readonly description: "Whether each step that turns commit trust on for a repository is in place, as last reported. A step that this forge's plan does not need reads `true`.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["workflow", "keyring", "variables", "requiredCheck"];
+            readonly properties: {
+                readonly workflow: {
+                    readonly type: "boolean";
+                    readonly description: "The verify-trust check runs on the repository's pull requests — from a workflow committed to it, or, where the forge supports it, required on it from the namespace's own bridge-managed workflow repository at a pinned commit.";
+                };
+                readonly keyring: {
+                    readonly type: "boolean";
+                    readonly description: "The exempt platform keyring for forge-signed merge commits is committed, or the forge's plan does not need one.";
+                };
+                readonly variables: {
+                    readonly type: "boolean";
+                    readonly description: "The repository names the Trust Registry and this VTC as its trust anchors.";
+                };
+                readonly requiredCheck: {
+                    readonly type: "boolean";
+                    readonly description: "The forge refuses to merge into the default branch unless the verify-trust check passes, with no bypass, and a pull request cannot change what that check runs: an organisation-required workflow, code-owner review of workflow files, or protected workflow paths, as the forge allows.";
+                };
+            };
+        };
+        readonly RepoVisibility: {
+            readonly title: "RepoVisibility";
+            readonly type: "string";
+            readonly enum: readonly ["public", "private"];
+            readonly description: "Repository visibility on the forge.";
+        };
+        readonly GitNamespace: {
+            readonly title: "GitNamespace";
+            readonly description: "The VTC's binding to one owner on one forge.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "forge", "owner", "mode", "state"];
+            readonly properties: {
+                readonly id: {
+                    readonly $ref: "#/$defs/NamespaceId";
+                };
+                readonly forge: {
+                    readonly $ref: "#/$defs/ForgeHost";
+                };
+                readonly owner: {
+                    readonly $ref: "#/$defs/Segment";
+                    readonly description: "The organisation or user on the forge, lowercased.";
+                };
+                readonly kind: {
+                    readonly type: "string";
+                    readonly enum: readonly ["organization", "user"];
+                    readonly description: "Whether the owner is an organisation or a personal account, as the forge reports it. Present once known: a bridge-mode namespace learns it when binding completes, and a manual-mode namespace MAY never learn it.";
+                };
+                readonly mode: {
+                    readonly type: "string";
+                    readonly enum: readonly ["bridge", "manual"];
+                    readonly description: "`bridge` — a bridge service acts on the forge for this namespace (creates repositories, projects roles, reports drift). `manual` — no automation; people with forge access carry out the steps the VTC names, and the VTC governs the rights alone.";
+                };
+                readonly state: {
+                    readonly type: "string";
+                    readonly enum: readonly ["pending", "bound"];
+                    readonly description: "`pending` — binding has started and the forge-side proof has not arrived yet. `bound` — the VTC governs rights under this namespace.";
+                };
+            };
+        };
+        readonly Segment: {
+            readonly title: "Segment";
+            readonly description: "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 100;
+            readonly pattern: "^[a-z0-9_-][a-z0-9._-]*$";
+        };
+        readonly NamespaceId: {
+            readonly title: "NamespaceId";
+            readonly description: "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly LinkedAccount: {
+            readonly title: "LinkedAccount";
+            readonly description: "A forge account linked to the caller's DID with git-ns/account/link, and when the link completed.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["account", "linkedAt"];
+            readonly properties: {
+                readonly account: {
+                    readonly $ref: "#/$defs/ForgeAccount";
+                    readonly description: "The linked account. `id` is authoritative; `login` is as the forge last reported it.";
+                };
+                readonly linkedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the link completed: when the VTC recorded the account against the caller's DID.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Git Namespaces — View — response payload";
+            readonly description: "What the caller may see — or, with `scope: administrator`, everything in the namespaces they administer — and the caller's own linked forge accounts.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["namespaces", "repos", "rights", "accounts"];
+            readonly properties: {
+                readonly namespaces: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/GitNamespace";
+                    };
+                    readonly description: "Namespaces bound to this VTC that contain, or are contained by, `resource`. With `scope: administrator`, only those the caller administers. With `breakGlass: true`, only those containing a returned record.";
+                };
+                readonly repos: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/RepoSummary";
+                    };
+                    readonly description: "Repositories within `resource`. `unmanaged` repositories are included only for callers holding `git.ns.admin` over them, or with `scope: administrator`. With `breakGlass: true`, only those carrying a returned record.";
+                };
+                readonly rights: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/RightRecord";
+                    };
+                    readonly description: "Rights within `resource` the caller may see: always the caller's own; every right on a resource the caller owns or administers; every unratified break-glass record in a namespace they administer or on a resource they own. With `scope: administrator`, every recorded right in the namespaces the caller administers. `reason` is omitted except on resources the caller owns or administers. With `breakGlass: true`, only records carrying `breakGlass`.";
+                };
+                readonly accounts: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/LinkedAccount";
+                    };
+                    readonly description: "The forge accounts linked to the caller's own DID — never another member's — at most one per forge. With `resource`, only the account on that resource's forge. Empty when the caller has linked none.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RightRecord: {
+            readonly title: "RightRecord";
+            readonly description: "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "right", "resource", "grantedBy", "grantedAt"];
+            readonly properties: {
+                readonly subject: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.";
+                };
+                readonly right: {
+                    readonly $ref: "#/$defs/Right";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/Resource";
+                };
+                readonly grantedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.";
+                };
+                readonly grantedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right lapses. Absent: no expiry.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.";
+                };
+                readonly breakGlass: {
+                    readonly $ref: "#/$defs/BreakGlass";
+                    readonly description: "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.";
+                };
+            };
+        };
+        readonly BreakGlass: {
+            readonly title: "BreakGlass";
+            readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["by", "at", "justification"];
+            readonly properties: {
+                readonly by: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                };
+                readonly at: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the VTC recorded the break-glass.";
+                };
+                readonly justification: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly pattern: "\\S";
+                    readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                };
+                readonly effectiveAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                };
+                readonly ratifiedBy: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                };
+                readonly ratifiedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                };
+            };
+        };
+        readonly Did: {
+            readonly title: "Did";
+            readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+        };
+        readonly Resource: {
+            readonly title: "Resource";
+            readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+        };
+        readonly Right: {
+            readonly title: "Right";
+            readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+            readonly type: "string";
+            readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+        };
+        readonly RepoSummary: {
+            readonly title: "RepoSummary";
+            readonly description: "One repository as the VTC records it.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["resource", "visibility", "state", "owners", "bootstrap", "sync"];
+            readonly properties: {
+                readonly resource: {
+                    readonly $ref: "#/$defs/RepoResource";
+                };
+                readonly forgeId: {
+                    readonly $ref: "#/$defs/ForgeId";
+                    readonly description: "The forge's repository id. Absent until the forge has confirmed the repository exists (a `pendingCreate` repository, or one adopted in bridge mode before the first inspection).";
+                };
+                readonly visibility: {
+                    readonly $ref: "#/$defs/RepoVisibility";
+                };
+                readonly state: {
+                    readonly type: "string";
+                    readonly enum: readonly ["pendingCreate", "active", "archived", "detached", "orphaned", "unmanaged"];
+                    readonly description: "`pendingCreate` — the name is reserved and the repository is not yet confirmed on the forge. `active` — managed. `archived` — archived through git-ns/repo/archive; commit rights on it are revoked. `detached` — no longer governed: its namespace was unbound, or it moved outside the namespace. `orphaned` — its last owner left the community and ownership passed to the namespace admins, who have not yet named a new owner. `unmanaged` — it exists on the forge inside a bound namespace but was never created or adopted through the VTC.";
+                };
+                readonly owners: {
+                    readonly type: "array";
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/Did";
+                    };
+                    readonly description: "The DIDs holding `git.repo.own` on this repository by an explicit grant. Empty only for an `unmanaged` repository, and for an `orphaned` one whose ownership rests with the namespace admins by implication.";
+                };
+                readonly bootstrap: {
+                    readonly $ref: "#/$defs/Bootstrap";
+                };
+                readonly sync: {
+                    readonly $ref: "#/$defs/Sync";
+                };
+            };
+        };
+        readonly Sync: {
+            readonly title: "Sync";
+            readonly description: "How the forge compares with the VTC's projection for one repository.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["state", "drift"];
+            readonly properties: {
+                readonly state: {
+                    readonly type: "string";
+                    readonly enum: readonly ["inSync", "drift", "pending", "unchecked"];
+                    readonly description: "`inSync` — the last comparison found no drift. `drift` — it found some, listed in `drift`. `pending` — a change has been sent to the forge and not yet confirmed. `unchecked` — nothing compares this repository (a manual-mode namespace).";
+                };
+                readonly checkedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the forge was last compared. Absent if never.";
+                };
+                readonly drift: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DriftItem";
+                    };
+                    readonly description: "Outstanding drift. Empty unless `state` is `drift`.";
+                };
+            };
+        };
+        readonly DriftItem: {
+            readonly title: "DriftItem";
+            readonly description: "One difference between the forge's observed state and the VTC's projection of a repository.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "resource"];
+            readonly properties: {
+                readonly type: {
+                    readonly type: "string";
+                    readonly enum: readonly ["roleAdded", "roleRemoved", "roleChanged", "requiredCheckMissing", "protectionWeakened", "bootstrapMissing"];
+                    readonly description: "`roleAdded` — someone holds a forge role the projection does not give them. `roleRemoved` — a projected role is missing. `roleChanged` — a projected role is present at another level. `requiredCheckMissing` — the verify-trust check is no longer required. `protectionWeakened` — branch protection or a ruleset is weaker than the projection in another way (force-push allowed, bypass actors added). `bootstrapMissing` — a bootstrap file or variable is gone.";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/RepoResource";
+                };
+                readonly account: {
+                    readonly $ref: "#/$defs/ForgeAccount";
+                    readonly description: "Whose role differs, for the three role types.";
+                };
+                readonly observed: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "What the forge shows, in the forge's own vocabulary (a role name such as `maintain`, a setting name). Absent when nothing is there.";
+                };
+                readonly expected: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "What the projection calls for, in the forge's own vocabulary. Absent when the projection calls for nothing.";
+                };
+            };
+        };
+        readonly ForgeAccount: {
+            readonly title: "ForgeAccount";
+            readonly description: "A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["forge", "id", "login"];
+            readonly properties: {
+                readonly forge: {
+                    readonly $ref: "#/$defs/ForgeHost";
+                };
+                readonly id: {
+                    readonly $ref: "#/$defs/ForgeId";
+                };
+                readonly login: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 100;
+                    readonly description: "The account's current login, as the forge reported it when last seen. Display only.";
+                };
+            };
+        };
+        readonly ForgeId: {
+            readonly title: "ForgeId";
+            readonly description: "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+        };
+        readonly ForgeHost: {
+            readonly title: "ForgeHost";
+            readonly description: "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.";
+            readonly type: "string";
+            readonly minLength: 3;
+            readonly maxLength: 253;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$";
+        };
+        readonly RepoResource: {
+            readonly title: "RepoResource";
+            readonly description: "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.";
+            readonly type: "string";
+            readonly maxLength: 455;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$";
+        };
+        readonly Bootstrap: {
+            readonly title: "Bootstrap";
+            readonly description: "Whether each step that turns commit trust on for a repository is in place, as last reported. A step that this forge's plan does not need reads `true`.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["workflow", "keyring", "variables", "requiredCheck"];
+            readonly properties: {
+                readonly workflow: {
+                    readonly type: "boolean";
+                    readonly description: "The verify-trust check runs on the repository's pull requests — from a workflow committed to it, or, where the forge supports it, required on it from the namespace's own bridge-managed workflow repository at a pinned commit.";
+                };
+                readonly keyring: {
+                    readonly type: "boolean";
+                    readonly description: "The exempt platform keyring for forge-signed merge commits is committed, or the forge's plan does not need one.";
+                };
+                readonly variables: {
+                    readonly type: "boolean";
+                    readonly description: "The repository names the Trust Registry and this VTC as its trust anchors.";
+                };
+                readonly requiredCheck: {
+                    readonly type: "boolean";
+                    readonly description: "The forge refuses to merge into the default branch unless the verify-trust check passes, with no bypass, and a pull request cannot change what that check runs: an organisation-required workflow, code-owner review of workflow files, or protected workflow paths, as the forge allows.";
+                };
+            };
+        };
+        readonly RepoVisibility: {
+            readonly title: "RepoVisibility";
+            readonly type: "string";
+            readonly enum: readonly ["public", "private"];
+            readonly description: "Repository visibility on the forge.";
+        };
+        readonly GitNamespace: {
+            readonly title: "GitNamespace";
+            readonly description: "The VTC's binding to one owner on one forge.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "forge", "owner", "mode", "state"];
+            readonly properties: {
+                readonly id: {
+                    readonly $ref: "#/$defs/NamespaceId";
+                };
+                readonly forge: {
+                    readonly $ref: "#/$defs/ForgeHost";
+                };
+                readonly owner: {
+                    readonly $ref: "#/$defs/Segment";
+                    readonly description: "The organisation or user on the forge, lowercased.";
+                };
+                readonly kind: {
+                    readonly type: "string";
+                    readonly enum: readonly ["organization", "user"];
+                    readonly description: "Whether the owner is an organisation or a personal account, as the forge reports it. Present once known: a bridge-mode namespace learns it when binding completes, and a manual-mode namespace MAY never learn it.";
+                };
+                readonly mode: {
+                    readonly type: "string";
+                    readonly enum: readonly ["bridge", "manual"];
+                    readonly description: "`bridge` — a bridge service acts on the forge for this namespace (creates repositories, projects roles, reports drift). `manual` — no automation; people with forge access carry out the steps the VTC names, and the VTC governs the rights alone.";
+                };
+                readonly state: {
+                    readonly type: "string";
+                    readonly enum: readonly ["pending", "bound"];
+                    readonly description: "`pending` — binding has started and the forge-side proof has not arrived yet. `bound` — the VTC governs rights under this namespace.";
+                };
+            };
+        };
+        readonly Segment: {
+            readonly title: "Segment";
+            readonly description: "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 100;
+            readonly pattern: "^[a-z0-9_-][a-z0-9._-]*$";
+        };
+        readonly NamespaceId: {
+            readonly title: "NamespaceId";
+            readonly description: "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/view/0.5";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/git-ns/view/0.5";
+        readonly title: "Git Namespaces — View — payload";
+        readonly description: "A member reads the namespaces, repositories and rights they are entitled to see, optionally narrowed to one resource, together with the forge accounts linked to their own DID. An administrator may instead ask for everything in the namespaces they administer, and either may narrow the rights to break-glass records.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly [];
+        readonly properties: {
+            readonly resource: {
+                readonly $ref: "#/$defs/Resource";
+                readonly description: "Narrow the answer to this resource and everything inside it. Absent: everything the caller may see.";
+            };
+            readonly scope: {
+                readonly type: "string";
+                readonly enum: readonly ["member", "administrator"];
+                readonly description: "`member` (the default) — what the caller may see through their own git rights, exactly as in 0.4. `administrator` — everything in the namespaces the caller administers (every namespace, for a holder of the community-administrator capability; those they hold `git.ns.admin` on, for anyone else), reasons included. Refused with `git-ns/view:notAdministrator` when the caller administers no namespace within `resource`. Absent means `\"member\"`; this carries no schema-level default, so a producer that omits it is not normalised into sending it.";
+            };
+            readonly breakGlass: {
+                readonly type: "boolean";
+                readonly description: "`true` narrows `rights` to the records carrying `breakGlass` — ratified ones included — and `namespaces` and `repos` to those that contain such a record. `false` or absent: no narrowing. Absent means `false`; this carries no schema-level default, so a producer that omits it is not normalised into sending it.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly LinkedAccount: {
+                readonly title: "LinkedAccount";
+                readonly description: "A forge account linked to the caller's DID with git-ns/account/link, and when the link completed.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["account", "linkedAt"];
+                readonly properties: {
+                    readonly account: {
+                        readonly $ref: "#/$defs/ForgeAccount";
+                        readonly description: "The linked account. `id` is authoritative; `login` is as the forge last reported it.";
+                    };
+                    readonly linkedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the link completed: when the VTC recorded the account against the caller's DID.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — View — response payload";
+                readonly description: "What the caller may see — or, with `scope: administrator`, everything in the namespaces they administer — and the caller's own linked forge accounts.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["namespaces", "repos", "rights", "accounts"];
+                readonly properties: {
+                    readonly namespaces: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/GitNamespace";
+                        };
+                        readonly description: "Namespaces bound to this VTC that contain, or are contained by, `resource`. With `scope: administrator`, only those the caller administers. With `breakGlass: true`, only those containing a returned record.";
+                    };
+                    readonly repos: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/RepoSummary";
+                        };
+                        readonly description: "Repositories within `resource`. `unmanaged` repositories are included only for callers holding `git.ns.admin` over them, or with `scope: administrator`. With `breakGlass: true`, only those carrying a returned record.";
+                    };
+                    readonly rights: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/RightRecord";
+                        };
+                        readonly description: "Rights within `resource` the caller may see: always the caller's own; every right on a resource the caller owns or administers; every unratified break-glass record in a namespace they administer or on a resource they own. With `scope: administrator`, every recorded right in the namespaces the caller administers. `reason` is omitted except on resources the caller owns or administers. With `breakGlass: true`, only records carrying `breakGlass`.";
+                    };
+                    readonly accounts: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/LinkedAccount";
+                        };
+                        readonly description: "The forge accounts linked to the caller's own DID — never another member's — at most one per forge. With `resource`, only the account on that resource's forge. Empty when the caller has linked none.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RightRecord: {
+                readonly title: "RightRecord";
+                readonly description: "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "right", "resource", "grantedBy", "grantedAt"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.";
+                    };
+                    readonly right: {
+                        readonly $ref: "#/$defs/Right";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/Resource";
+                    };
+                    readonly grantedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.";
+                    };
+                    readonly grantedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right lapses. Absent: no expiry.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.";
+                    };
+                    readonly breakGlass: {
+                        readonly $ref: "#/$defs/BreakGlass";
+                        readonly description: "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.";
+                    };
+                };
+            };
+            readonly BreakGlass: {
+                readonly title: "BreakGlass";
+                readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["by", "at", "justification"];
+                readonly properties: {
+                    readonly by: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                    };
+                    readonly at: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the VTC recorded the break-glass.";
+                    };
+                    readonly justification: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly pattern: "\\S";
+                        readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                    };
+                    readonly effectiveAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                    };
+                    readonly ratifiedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                    };
+                    readonly ratifiedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                    };
+                };
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+            };
+            readonly Resource: {
+                readonly title: "Resource";
+                readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+            readonly RepoSummary: {
+                readonly title: "RepoSummary";
+                readonly description: "One repository as the VTC records it.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["resource", "visibility", "state", "owners", "bootstrap", "sync"];
+                readonly properties: {
+                    readonly resource: {
+                        readonly $ref: "#/$defs/RepoResource";
+                    };
+                    readonly forgeId: {
+                        readonly $ref: "#/$defs/ForgeId";
+                        readonly description: "The forge's repository id. Absent until the forge has confirmed the repository exists (a `pendingCreate` repository, or one adopted in bridge mode before the first inspection).";
+                    };
+                    readonly visibility: {
+                        readonly $ref: "#/$defs/RepoVisibility";
+                    };
+                    readonly state: {
+                        readonly type: "string";
+                        readonly enum: readonly ["pendingCreate", "active", "archived", "detached", "orphaned", "unmanaged"];
+                        readonly description: "`pendingCreate` — the name is reserved and the repository is not yet confirmed on the forge. `active` — managed. `archived` — archived through git-ns/repo/archive; commit rights on it are revoked. `detached` — no longer governed: its namespace was unbound, or it moved outside the namespace. `orphaned` — its last owner left the community and ownership passed to the namespace admins, who have not yet named a new owner. `unmanaged` — it exists on the forge inside a bound namespace but was never created or adopted through the VTC.";
+                    };
+                    readonly owners: {
+                        readonly type: "array";
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/Did";
+                        };
+                        readonly description: "The DIDs holding `git.repo.own` on this repository by an explicit grant. Empty only for an `unmanaged` repository, and for an `orphaned` one whose ownership rests with the namespace admins by implication.";
+                    };
+                    readonly bootstrap: {
+                        readonly $ref: "#/$defs/Bootstrap";
+                    };
+                    readonly sync: {
+                        readonly $ref: "#/$defs/Sync";
+                    };
+                };
+            };
+            readonly Sync: {
+                readonly title: "Sync";
+                readonly description: "How the forge compares with the VTC's projection for one repository.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["state", "drift"];
+                readonly properties: {
+                    readonly state: {
+                        readonly type: "string";
+                        readonly enum: readonly ["inSync", "drift", "pending", "unchecked"];
+                        readonly description: "`inSync` — the last comparison found no drift. `drift` — it found some, listed in `drift`. `pending` — a change has been sent to the forge and not yet confirmed. `unchecked` — nothing compares this repository (a manual-mode namespace).";
+                    };
+                    readonly checkedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the forge was last compared. Absent if never.";
+                    };
+                    readonly drift: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DriftItem";
+                        };
+                        readonly description: "Outstanding drift. Empty unless `state` is `drift`.";
+                    };
+                };
+            };
+            readonly DriftItem: {
+                readonly title: "DriftItem";
+                readonly description: "One difference between the forge's observed state and the VTC's projection of a repository.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "resource"];
+                readonly properties: {
+                    readonly type: {
+                        readonly type: "string";
+                        readonly enum: readonly ["roleAdded", "roleRemoved", "roleChanged", "requiredCheckMissing", "protectionWeakened", "bootstrapMissing"];
+                        readonly description: "`roleAdded` — someone holds a forge role the projection does not give them. `roleRemoved` — a projected role is missing. `roleChanged` — a projected role is present at another level. `requiredCheckMissing` — the verify-trust check is no longer required. `protectionWeakened` — branch protection or a ruleset is weaker than the projection in another way (force-push allowed, bypass actors added). `bootstrapMissing` — a bootstrap file or variable is gone.";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/RepoResource";
+                    };
+                    readonly account: {
+                        readonly $ref: "#/$defs/ForgeAccount";
+                        readonly description: "Whose role differs, for the three role types.";
+                    };
+                    readonly observed: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "What the forge shows, in the forge's own vocabulary (a role name such as `maintain`, a setting name). Absent when nothing is there.";
+                    };
+                    readonly expected: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "What the projection calls for, in the forge's own vocabulary. Absent when the projection calls for nothing.";
+                    };
+                };
+            };
+            readonly ForgeAccount: {
+                readonly title: "ForgeAccount";
+                readonly description: "A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["forge", "id", "login"];
+                readonly properties: {
+                    readonly forge: {
+                        readonly $ref: "#/$defs/ForgeHost";
+                    };
+                    readonly id: {
+                        readonly $ref: "#/$defs/ForgeId";
+                    };
+                    readonly login: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 100;
+                        readonly description: "The account's current login, as the forge reported it when last seen. Display only.";
+                    };
+                };
+            };
+            readonly ForgeId: {
+                readonly title: "ForgeId";
+                readonly description: "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+            };
+            readonly ForgeHost: {
+                readonly title: "ForgeHost";
+                readonly description: "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.";
+                readonly type: "string";
+                readonly minLength: 3;
+                readonly maxLength: 253;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$";
+            };
+            readonly RepoResource: {
+                readonly title: "RepoResource";
+                readonly description: "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$";
+            };
+            readonly Bootstrap: {
+                readonly title: "Bootstrap";
+                readonly description: "Whether each step that turns commit trust on for a repository is in place, as last reported. A step that this forge's plan does not need reads `true`.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["workflow", "keyring", "variables", "requiredCheck"];
+                readonly properties: {
+                    readonly workflow: {
+                        readonly type: "boolean";
+                        readonly description: "The verify-trust check runs on the repository's pull requests — from a workflow committed to it, or, where the forge supports it, required on it from the namespace's own bridge-managed workflow repository at a pinned commit.";
+                    };
+                    readonly keyring: {
+                        readonly type: "boolean";
+                        readonly description: "The exempt platform keyring for forge-signed merge commits is committed, or the forge's plan does not need one.";
+                    };
+                    readonly variables: {
+                        readonly type: "boolean";
+                        readonly description: "The repository names the Trust Registry and this VTC as its trust anchors.";
+                    };
+                    readonly requiredCheck: {
+                        readonly type: "boolean";
+                        readonly description: "The forge refuses to merge into the default branch unless the verify-trust check passes, with no bypass, and a pull request cannot change what that check runs: an organisation-required workflow, code-owner review of workflow files, or protected workflow paths, as the forge allows.";
+                    };
+                };
+            };
+            readonly RepoVisibility: {
+                readonly title: "RepoVisibility";
+                readonly type: "string";
+                readonly enum: readonly ["public", "private"];
+                readonly description: "Repository visibility on the forge.";
+            };
+            readonly GitNamespace: {
+                readonly title: "GitNamespace";
+                readonly description: "The VTC's binding to one owner on one forge.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "forge", "owner", "mode", "state"];
+                readonly properties: {
+                    readonly id: {
+                        readonly $ref: "#/$defs/NamespaceId";
+                    };
+                    readonly forge: {
+                        readonly $ref: "#/$defs/ForgeHost";
+                    };
+                    readonly owner: {
+                        readonly $ref: "#/$defs/Segment";
+                        readonly description: "The organisation or user on the forge, lowercased.";
+                    };
+                    readonly kind: {
+                        readonly type: "string";
+                        readonly enum: readonly ["organization", "user"];
+                        readonly description: "Whether the owner is an organisation or a personal account, as the forge reports it. Present once known: a bridge-mode namespace learns it when binding completes, and a manual-mode namespace MAY never learn it.";
+                    };
+                    readonly mode: {
+                        readonly type: "string";
+                        readonly enum: readonly ["bridge", "manual"];
+                        readonly description: "`bridge` — a bridge service acts on the forge for this namespace (creates repositories, projects roles, reports drift). `manual` — no automation; people with forge access carry out the steps the VTC names, and the VTC governs the rights alone.";
+                    };
+                    readonly state: {
+                        readonly type: "string";
+                        readonly enum: readonly ["pending", "bound"];
+                        readonly description: "`pending` — binding has started and the forge-side proof has not arrived yet. `bound` — the VTC governs rights under this namespace.";
+                    };
+                };
+            };
+            readonly Segment: {
+                readonly title: "Segment";
+                readonly description: "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 100;
+                readonly pattern: "^[a-z0-9_-][a-z0-9._-]*$";
+            };
+            readonly NamespaceId: {
+                readonly title: "NamespaceId";
+                readonly description: "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/git-ns/view/0.5#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly LinkedAccount: {
+                readonly title: "LinkedAccount";
+                readonly description: "A forge account linked to the caller's DID with git-ns/account/link, and when the link completed.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["account", "linkedAt"];
+                readonly properties: {
+                    readonly account: {
+                        readonly $ref: "#/$defs/ForgeAccount";
+                        readonly description: "The linked account. `id` is authoritative; `login` is as the forge last reported it.";
+                    };
+                    readonly linkedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the link completed: when the VTC recorded the account against the caller's DID.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Git Namespaces — View — response payload";
+                readonly description: "What the caller may see — or, with `scope: administrator`, everything in the namespaces they administer — and the caller's own linked forge accounts.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["namespaces", "repos", "rights", "accounts"];
+                readonly properties: {
+                    readonly namespaces: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/GitNamespace";
+                        };
+                        readonly description: "Namespaces bound to this VTC that contain, or are contained by, `resource`. With `scope: administrator`, only those the caller administers. With `breakGlass: true`, only those containing a returned record.";
+                    };
+                    readonly repos: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/RepoSummary";
+                        };
+                        readonly description: "Repositories within `resource`. `unmanaged` repositories are included only for callers holding `git.ns.admin` over them, or with `scope: administrator`. With `breakGlass: true`, only those carrying a returned record.";
+                    };
+                    readonly rights: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/RightRecord";
+                        };
+                        readonly description: "Rights within `resource` the caller may see: always the caller's own; every right on a resource the caller owns or administers; every unratified break-glass record in a namespace they administer or on a resource they own. With `scope: administrator`, every recorded right in the namespaces the caller administers. `reason` is omitted except on resources the caller owns or administers. With `breakGlass: true`, only records carrying `breakGlass`.";
+                    };
+                    readonly accounts: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/LinkedAccount";
+                        };
+                        readonly description: "The forge accounts linked to the caller's own DID — never another member's — at most one per forge. With `resource`, only the account on that resource's forge. Empty when the caller has linked none.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RightRecord: {
+                readonly title: "RightRecord";
+                readonly description: "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "right", "resource", "grantedBy", "grantedAt"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts.";
+                    };
+                    readonly right: {
+                        readonly $ref: "#/$defs/Right";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/Resource";
+                    };
+                    readonly grantedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration.";
+                    };
+                    readonly grantedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right lapses. Absent: no expiry.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it.";
+                    };
+                    readonly breakGlass: {
+                        readonly $ref: "#/$defs/BreakGlass";
+                        readonly description: "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record.";
+                    };
+                };
+            };
+            readonly BreakGlass: {
+                readonly title: "BreakGlass";
+                readonly description: "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["by", "at", "justification"];
+                readonly properties: {
+                    readonly by: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "Who broke the glass: always the record's `subject`, restated so the flag reads on its own.";
+                    };
+                    readonly at: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the VTC recorded the break-glass.";
+                    };
+                    readonly justification: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly pattern: "\\S";
+                        readonly description: "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published.";
+                    };
+                    readonly effectiveAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so.";
+                    };
+                    readonly ratifiedBy: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The administrator who ratified the record — never its subject. Absent while unratified.";
+                    };
+                    readonly ratifiedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When it was ratified. Present exactly when `ratifiedBy` is.";
+                    };
+                };
+            };
+            readonly Did: {
+                readonly title: "Did";
+                readonly description: "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$";
+            };
+            readonly Resource: {
+                readonly title: "Resource";
+                readonly description: "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$";
+            };
+            readonly Right: {
+                readonly title: "Right";
+                readonly description: "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.";
+                readonly type: "string";
+                readonly enum: readonly ["git.ns.admin", "git.repo.create", "git.repo.own", "git.repo.maintain", "git.commit.sign"];
+            };
+            readonly RepoSummary: {
+                readonly title: "RepoSummary";
+                readonly description: "One repository as the VTC records it.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["resource", "visibility", "state", "owners", "bootstrap", "sync"];
+                readonly properties: {
+                    readonly resource: {
+                        readonly $ref: "#/$defs/RepoResource";
+                    };
+                    readonly forgeId: {
+                        readonly $ref: "#/$defs/ForgeId";
+                        readonly description: "The forge's repository id. Absent until the forge has confirmed the repository exists (a `pendingCreate` repository, or one adopted in bridge mode before the first inspection).";
+                    };
+                    readonly visibility: {
+                        readonly $ref: "#/$defs/RepoVisibility";
+                    };
+                    readonly state: {
+                        readonly type: "string";
+                        readonly enum: readonly ["pendingCreate", "active", "archived", "detached", "orphaned", "unmanaged"];
+                        readonly description: "`pendingCreate` — the name is reserved and the repository is not yet confirmed on the forge. `active` — managed. `archived` — archived through git-ns/repo/archive; commit rights on it are revoked. `detached` — no longer governed: its namespace was unbound, or it moved outside the namespace. `orphaned` — its last owner left the community and ownership passed to the namespace admins, who have not yet named a new owner. `unmanaged` — it exists on the forge inside a bound namespace but was never created or adopted through the VTC.";
+                    };
+                    readonly owners: {
+                        readonly type: "array";
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/Did";
+                        };
+                        readonly description: "The DIDs holding `git.repo.own` on this repository by an explicit grant. Empty only for an `unmanaged` repository, and for an `orphaned` one whose ownership rests with the namespace admins by implication.";
+                    };
+                    readonly bootstrap: {
+                        readonly $ref: "#/$defs/Bootstrap";
+                    };
+                    readonly sync: {
+                        readonly $ref: "#/$defs/Sync";
+                    };
+                };
+            };
+            readonly Sync: {
+                readonly title: "Sync";
+                readonly description: "How the forge compares with the VTC's projection for one repository.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["state", "drift"];
+                readonly properties: {
+                    readonly state: {
+                        readonly type: "string";
+                        readonly enum: readonly ["inSync", "drift", "pending", "unchecked"];
+                        readonly description: "`inSync` — the last comparison found no drift. `drift` — it found some, listed in `drift`. `pending` — a change has been sent to the forge and not yet confirmed. `unchecked` — nothing compares this repository (a manual-mode namespace).";
+                    };
+                    readonly checkedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the forge was last compared. Absent if never.";
+                    };
+                    readonly drift: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DriftItem";
+                        };
+                        readonly description: "Outstanding drift. Empty unless `state` is `drift`.";
+                    };
+                };
+            };
+            readonly DriftItem: {
+                readonly title: "DriftItem";
+                readonly description: "One difference between the forge's observed state and the VTC's projection of a repository.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "resource"];
+                readonly properties: {
+                    readonly type: {
+                        readonly type: "string";
+                        readonly enum: readonly ["roleAdded", "roleRemoved", "roleChanged", "requiredCheckMissing", "protectionWeakened", "bootstrapMissing"];
+                        readonly description: "`roleAdded` — someone holds a forge role the projection does not give them. `roleRemoved` — a projected role is missing. `roleChanged` — a projected role is present at another level. `requiredCheckMissing` — the verify-trust check is no longer required. `protectionWeakened` — branch protection or a ruleset is weaker than the projection in another way (force-push allowed, bypass actors added). `bootstrapMissing` — a bootstrap file or variable is gone.";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/RepoResource";
+                    };
+                    readonly account: {
+                        readonly $ref: "#/$defs/ForgeAccount";
+                        readonly description: "Whose role differs, for the three role types.";
+                    };
+                    readonly observed: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "What the forge shows, in the forge's own vocabulary (a role name such as `maintain`, a setting name). Absent when nothing is there.";
+                    };
+                    readonly expected: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "What the projection calls for, in the forge's own vocabulary. Absent when the projection calls for nothing.";
+                    };
+                };
+            };
+            readonly ForgeAccount: {
+                readonly title: "ForgeAccount";
+                readonly description: "A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["forge", "id", "login"];
+                readonly properties: {
+                    readonly forge: {
+                        readonly $ref: "#/$defs/ForgeHost";
+                    };
+                    readonly id: {
+                        readonly $ref: "#/$defs/ForgeId";
+                    };
+                    readonly login: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 100;
+                        readonly description: "The account's current login, as the forge reported it when last seen. Display only.";
+                    };
+                };
+            };
+            readonly ForgeId: {
+                readonly title: "ForgeId";
+                readonly description: "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+            };
+            readonly ForgeHost: {
+                readonly title: "ForgeHost";
+                readonly description: "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.";
+                readonly type: "string";
+                readonly minLength: 3;
+                readonly maxLength: 253;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$";
+            };
+            readonly RepoResource: {
+                readonly title: "RepoResource";
+                readonly description: "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.";
+                readonly type: "string";
+                readonly maxLength: 455;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$";
+            };
+            readonly Bootstrap: {
+                readonly title: "Bootstrap";
+                readonly description: "Whether each step that turns commit trust on for a repository is in place, as last reported. A step that this forge's plan does not need reads `true`.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["workflow", "keyring", "variables", "requiredCheck"];
+                readonly properties: {
+                    readonly workflow: {
+                        readonly type: "boolean";
+                        readonly description: "The verify-trust check runs on the repository's pull requests — from a workflow committed to it, or, where the forge supports it, required on it from the namespace's own bridge-managed workflow repository at a pinned commit.";
+                    };
+                    readonly keyring: {
+                        readonly type: "boolean";
+                        readonly description: "The exempt platform keyring for forge-signed merge commits is committed, or the forge's plan does not need one.";
+                    };
+                    readonly variables: {
+                        readonly type: "boolean";
+                        readonly description: "The repository names the Trust Registry and this VTC as its trust anchors.";
+                    };
+                    readonly requiredCheck: {
+                        readonly type: "boolean";
+                        readonly description: "The forge refuses to merge into the default branch unless the verify-trust check passes, with no bypass, and a pull request cannot change what that check runs: an organisation-required workflow, code-owner review of workflow files, or protected workflow paths, as the forge allows.";
+                    };
+                };
+            };
+            readonly RepoVisibility: {
+                readonly title: "RepoVisibility";
+                readonly type: "string";
+                readonly enum: readonly ["public", "private"];
+                readonly description: "Repository visibility on the forge.";
+            };
+            readonly GitNamespace: {
+                readonly title: "GitNamespace";
+                readonly description: "The VTC's binding to one owner on one forge.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "forge", "owner", "mode", "state"];
+                readonly properties: {
+                    readonly id: {
+                        readonly $ref: "#/$defs/NamespaceId";
+                    };
+                    readonly forge: {
+                        readonly $ref: "#/$defs/ForgeHost";
+                    };
+                    readonly owner: {
+                        readonly $ref: "#/$defs/Segment";
+                        readonly description: "The organisation or user on the forge, lowercased.";
+                    };
+                    readonly kind: {
+                        readonly type: "string";
+                        readonly enum: readonly ["organization", "user"];
+                        readonly description: "Whether the owner is an organisation or a personal account, as the forge reports it. Present once known: a bridge-mode namespace learns it when binding completes, and a manual-mode namespace MAY never learn it.";
+                    };
+                    readonly mode: {
+                        readonly type: "string";
+                        readonly enum: readonly ["bridge", "manual"];
+                        readonly description: "`bridge` — a bridge service acts on the forge for this namespace (creates repositories, projects roles, reports drift). `manual` — no automation; people with forge access carry out the steps the VTC names, and the VTC governs the rights alone.";
+                    };
+                    readonly state: {
+                        readonly type: "string";
+                        readonly enum: readonly ["pending", "bound"];
+                        readonly description: "`pending` — binding has started and the forge-side proof has not arrived yet. `bound` — the VTC governs rights under this namespace.";
+                    };
+                };
+            };
+            readonly Segment: {
+                readonly title: "Segment";
+                readonly description: "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 100;
+                readonly pattern: "^[a-z0-9_-][a-z0-9._-]*$";
+            };
+            readonly NamespaceId: {
+                readonly title: "NamespaceId";
+                readonly description: "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map