@openvtc/trust-tasks 0.21.3 → 0.21.5

package/dist/git-ns/view/0.5/payload.js

@@ -0,0 +1,1024 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/git-ns/view/0.5/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/git-ns/view/0.5";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/git-ns/view/0.5#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/git-ns/view/0.5",
+    "title": "Git Namespaces — View — payload",
+    "description": "A member reads the namespaces, repositories and rights they are entitled to see, optionally narrowed to one resource, together with the forge accounts linked to their own DID. An administrator may instead ask for everything in the namespaces they administer, and either may narrow the rights to break-glass records.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [],
+    "properties": {
+        "resource": {
+            "$ref": "#/$defs/Resource",
+            "description": "Narrow the answer to this resource and everything inside it. Absent: everything the caller may see."
+        },
+        "scope": {
+            "type": "string",
+            "enum": [
+                "member",
+                "administrator"
+            ],
+            "description": "`member` (the default) — what the caller may see through their own git rights, exactly as in 0.4. `administrator` — everything in the namespaces the caller administers (every namespace, for a holder of the community-administrator capability; those they hold `git.ns.admin` on, for anyone else), reasons included. Refused with `git-ns/view:notAdministrator` when the caller administers no namespace within `resource`. Absent means `\"member\"`; this carries no schema-level default, so a producer that omits it is not normalised into sending it."
+        },
+        "breakGlass": {
+            "type": "boolean",
+            "description": "`true` narrows `rights` to the records carrying `breakGlass` — ratified ones included — and `namespaces` and `repos` to those that contain such a record. `false` or absent: no narrowing. Absent means `false`; this carries no schema-level default, so a producer that omits it is not normalised into sending it."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "LinkedAccount": {
+            "title": "LinkedAccount",
+            "description": "A forge account linked to the caller's DID with git-ns/account/link, and when the link completed.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "account",
+                "linkedAt"
+            ],
+            "properties": {
+                "account": {
+                    "$ref": "#/$defs/ForgeAccount",
+                    "description": "The linked account. `id` is authoritative; `login` is as the forge last reported it."
+                },
+                "linkedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the link completed: when the VTC recorded the account against the caller's DID."
+                }
+            }
+        },
+        "Response": {
+            "$anchor": "response",
+            "title": "Git Namespaces — View — response payload",
+            "description": "What the caller may see — or, with `scope: administrator`, everything in the namespaces they administer — and the caller's own linked forge accounts.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "namespaces",
+                "repos",
+                "rights",
+                "accounts"
+            ],
+            "properties": {
+                "namespaces": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/GitNamespace"
+                    },
+                    "description": "Namespaces bound to this VTC that contain, or are contained by, `resource`. With `scope: administrator`, only those the caller administers. With `breakGlass: true`, only those containing a returned record."
+                },
+                "repos": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/RepoSummary"
+                    },
+                    "description": "Repositories within `resource`. `unmanaged` repositories are included only for callers holding `git.ns.admin` over them, or with `scope: administrator`. With `breakGlass: true`, only those carrying a returned record."
+                },
+                "rights": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/RightRecord"
+                    },
+                    "description": "Rights within `resource` the caller may see: always the caller's own; every right on a resource the caller owns or administers; every unratified break-glass record in a namespace they administer or on a resource they own. With `scope: administrator`, every recorded right in the namespaces the caller administers. `reason` is omitted except on resources the caller owns or administers. With `breakGlass: true`, only records carrying `breakGlass`."
+                },
+                "accounts": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/LinkedAccount"
+                    },
+                    "description": "The forge accounts linked to the caller's own DID — never another member's — at most one per forge. With `resource`, only the account on that resource's forge. Empty when the caller has linked none."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "RightRecord": {
+            "title": "RightRecord",
+            "description": "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "subject",
+                "right",
+                "resource",
+                "grantedBy",
+                "grantedAt"
+            ],
+            "properties": {
+                "subject": {
+                    "$ref": "#/$defs/Did",
+                    "description": "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts."
+                },
+                "right": {
+                    "$ref": "#/$defs/Right"
+                },
+                "resource": {
+                    "$ref": "#/$defs/Resource"
+                },
+                "grantedBy": {
+                    "$ref": "#/$defs/Did",
+                    "description": "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration."
+                },
+                "grantedAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the right lapses. Absent: no expiry."
+                },
+                "reason": {
+                    "type": "string",
+                    "maxLength": 1024,
+                    "description": "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it."
+                },
+                "breakGlass": {
+                    "$ref": "#/$defs/BreakGlass",
+                    "description": "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record."
+                }
+            }
+        },
+        "BreakGlass": {
+            "title": "BreakGlass",
+            "description": "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "by",
+                "at",
+                "justification"
+            ],
+            "properties": {
+                "by": {
+                    "$ref": "#/$defs/Did",
+                    "description": "Who broke the glass: always the record's `subject`, restated so the flag reads on its own."
+                },
+                "at": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the VTC recorded the break-glass."
+                },
+                "justification": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 2048,
+                    "pattern": "\\S",
+                    "description": "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published."
+                },
+                "effectiveAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so."
+                },
+                "ratifiedBy": {
+                    "$ref": "#/$defs/Did",
+                    "description": "The administrator who ratified the record — never its subject. Absent while unratified."
+                },
+                "ratifiedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When it was ratified. Present exactly when `ratifiedBy` is."
+                }
+            }
+        },
+        "Did": {
+            "title": "Did",
+            "description": "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.",
+            "type": "string",
+            "maxLength": 2048,
+            "pattern": "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$"
+        },
+        "Resource": {
+            "title": "Resource",
+            "description": "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.",
+            "type": "string",
+            "maxLength": 455,
+            "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$"
+        },
+        "Right": {
+            "title": "Right",
+            "description": "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.",
+            "type": "string",
+            "enum": [
+                "git.ns.admin",
+                "git.repo.create",
+                "git.repo.own",
+                "git.repo.maintain",
+                "git.commit.sign"
+            ]
+        },
+        "RepoSummary": {
+            "title": "RepoSummary",
+            "description": "One repository as the VTC records it.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "resource",
+                "visibility",
+                "state",
+                "owners",
+                "bootstrap",
+                "sync"
+            ],
+            "properties": {
+                "resource": {
+                    "$ref": "#/$defs/RepoResource"
+                },
+                "forgeId": {
+                    "$ref": "#/$defs/ForgeId",
+                    "description": "The forge's repository id. Absent until the forge has confirmed the repository exists (a `pendingCreate` repository, or one adopted in bridge mode before the first inspection)."
+                },
+                "visibility": {
+                    "$ref": "#/$defs/RepoVisibility"
+                },
+                "state": {
+                    "type": "string",
+                    "enum": [
+                        "pendingCreate",
+                        "active",
+                        "archived",
+                        "detached",
+                        "orphaned",
+                        "unmanaged"
+                    ],
+                    "description": "`pendingCreate` — the name is reserved and the repository is not yet confirmed on the forge. `active` — managed. `archived` — archived through git-ns/repo/archive; commit rights on it are revoked. `detached` — no longer governed: its namespace was unbound, or it moved outside the namespace. `orphaned` — its last owner left the community and ownership passed to the namespace admins, who have not yet named a new owner. `unmanaged` — it exists on the forge inside a bound namespace but was never created or adopted through the VTC."
+                },
+                "owners": {
+                    "type": "array",
+                    "uniqueItems": true,
+                    "items": {
+                        "$ref": "#/$defs/Did"
+                    },
+                    "description": "The DIDs holding `git.repo.own` on this repository by an explicit grant. Empty only for an `unmanaged` repository, and for an `orphaned` one whose ownership rests with the namespace admins by implication."
+                },
+                "bootstrap": {
+                    "$ref": "#/$defs/Bootstrap"
+                },
+                "sync": {
+                    "$ref": "#/$defs/Sync"
+                }
+            }
+        },
+        "Sync": {
+            "title": "Sync",
+            "description": "How the forge compares with the VTC's projection for one repository.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "state",
+                "drift"
+            ],
+            "properties": {
+                "state": {
+                    "type": "string",
+                    "enum": [
+                        "inSync",
+                        "drift",
+                        "pending",
+                        "unchecked"
+                    ],
+                    "description": "`inSync` — the last comparison found no drift. `drift` — it found some, listed in `drift`. `pending` — a change has been sent to the forge and not yet confirmed. `unchecked` — nothing compares this repository (a manual-mode namespace)."
+                },
+                "checkedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the forge was last compared. Absent if never."
+                },
+                "drift": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/DriftItem"
+                    },
+                    "description": "Outstanding drift. Empty unless `state` is `drift`."
+                }
+            }
+        },
+        "DriftItem": {
+            "title": "DriftItem",
+            "description": "One difference between the forge's observed state and the VTC's projection of a repository.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "type",
+                "resource"
+            ],
+            "properties": {
+                "type": {
+                    "type": "string",
+                    "enum": [
+                        "roleAdded",
+                        "roleRemoved",
+                        "roleChanged",
+                        "requiredCheckMissing",
+                        "protectionWeakened",
+                        "bootstrapMissing"
+                    ],
+                    "description": "`roleAdded` — someone holds a forge role the projection does not give them. `roleRemoved` — a projected role is missing. `roleChanged` — a projected role is present at another level. `requiredCheckMissing` — the verify-trust check is no longer required. `protectionWeakened` — branch protection or a ruleset is weaker than the projection in another way (force-push allowed, bypass actors added). `bootstrapMissing` — a bootstrap file or variable is gone."
+                },
+                "resource": {
+                    "$ref": "#/$defs/RepoResource"
+                },
+                "account": {
+                    "$ref": "#/$defs/ForgeAccount",
+                    "description": "Whose role differs, for the three role types."
+                },
+                "observed": {
+                    "type": "string",
+                    "maxLength": 256,
+                    "description": "What the forge shows, in the forge's own vocabulary (a role name such as `maintain`, a setting name). Absent when nothing is there."
+                },
+                "expected": {
+                    "type": "string",
+                    "maxLength": 256,
+                    "description": "What the projection calls for, in the forge's own vocabulary. Absent when the projection calls for nothing."
+                }
+            }
+        },
+        "ForgeAccount": {
+            "title": "ForgeAccount",
+            "description": "A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "forge",
+                "id",
+                "login"
+            ],
+            "properties": {
+                "forge": {
+                    "$ref": "#/$defs/ForgeHost"
+                },
+                "id": {
+                    "$ref": "#/$defs/ForgeId"
+                },
+                "login": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 100,
+                    "description": "The account's current login, as the forge reported it when last seen. Display only."
+                }
+            }
+        },
+        "ForgeId": {
+            "title": "ForgeId",
+            "description": "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64
+        },
+        "ForgeHost": {
+            "title": "ForgeHost",
+            "description": "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.",
+            "type": "string",
+            "minLength": 3,
+            "maxLength": 253,
+            "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$"
+        },
+        "RepoResource": {
+            "title": "RepoResource",
+            "description": "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.",
+            "type": "string",
+            "maxLength": 455,
+            "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$"
+        },
+        "Bootstrap": {
+            "title": "Bootstrap",
+            "description": "Whether each step that turns commit trust on for a repository is in place, as last reported. A step that this forge's plan does not need reads `true`.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "workflow",
+                "keyring",
+                "variables",
+                "requiredCheck"
+            ],
+            "properties": {
+                "workflow": {
+                    "type": "boolean",
+                    "description": "The verify-trust check runs on the repository's pull requests — from a workflow committed to it, or, where the forge supports it, required on it from the namespace's own bridge-managed workflow repository at a pinned commit."
+                },
+                "keyring": {
+                    "type": "boolean",
+                    "description": "The exempt platform keyring for forge-signed merge commits is committed, or the forge's plan does not need one."
+                },
+                "variables": {
+                    "type": "boolean",
+                    "description": "The repository names the Trust Registry and this VTC as its trust anchors."
+                },
+                "requiredCheck": {
+                    "type": "boolean",
+                    "description": "The forge refuses to merge into the default branch unless the verify-trust check passes, with no bypass, and a pull request cannot change what that check runs: an organisation-required workflow, code-owner review of workflow files, or protected workflow paths, as the forge allows."
+                }
+            }
+        },
+        "RepoVisibility": {
+            "title": "RepoVisibility",
+            "type": "string",
+            "enum": [
+                "public",
+                "private"
+            ],
+            "description": "Repository visibility on the forge."
+        },
+        "GitNamespace": {
+            "title": "GitNamespace",
+            "description": "The VTC's binding to one owner on one forge.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "forge",
+                "owner",
+                "mode",
+                "state"
+            ],
+            "properties": {
+                "id": {
+                    "$ref": "#/$defs/NamespaceId"
+                },
+                "forge": {
+                    "$ref": "#/$defs/ForgeHost"
+                },
+                "owner": {
+                    "$ref": "#/$defs/Segment",
+                    "description": "The organisation or user on the forge, lowercased."
+                },
+                "kind": {
+                    "type": "string",
+                    "enum": [
+                        "organization",
+                        "user"
+                    ],
+                    "description": "Whether the owner is an organisation or a personal account, as the forge reports it. Present once known: a bridge-mode namespace learns it when binding completes, and a manual-mode namespace MAY never learn it."
+                },
+                "mode": {
+                    "type": "string",
+                    "enum": [
+                        "bridge",
+                        "manual"
+                    ],
+                    "description": "`bridge` — a bridge service acts on the forge for this namespace (creates repositories, projects roles, reports drift). `manual` — no automation; people with forge access carry out the steps the VTC names, and the VTC governs the rights alone."
+                },
+                "state": {
+                    "type": "string",
+                    "enum": [
+                        "pending",
+                        "bound"
+                    ],
+                    "description": "`pending` — binding has started and the forge-side proof has not arrived yet. `bound` — the VTC governs rights under this namespace."
+                }
+            }
+        },
+        "Segment": {
+            "title": "Segment",
+            "description": "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 100,
+            "pattern": "^[a-z0-9_-][a-z0-9._-]*$"
+        },
+        "NamespaceId": {
+            "title": "NamespaceId",
+            "description": "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "LinkedAccount": {
+            "title": "LinkedAccount",
+            "description": "A forge account linked to the caller's DID with git-ns/account/link, and when the link completed.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "account",
+                "linkedAt"
+            ],
+            "properties": {
+                "account": {
+                    "$ref": "#/$defs/ForgeAccount",
+                    "description": "The linked account. `id` is authoritative; `login` is as the forge last reported it."
+                },
+                "linkedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the link completed: when the VTC recorded the account against the caller's DID."
+                }
+            }
+        },
+        "Response": {
+            "$anchor": "response",
+            "title": "Git Namespaces — View — response payload",
+            "description": "What the caller may see — or, with `scope: administrator`, everything in the namespaces they administer — and the caller's own linked forge accounts.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "namespaces",
+                "repos",
+                "rights",
+                "accounts"
+            ],
+            "properties": {
+                "namespaces": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/GitNamespace"
+                    },
+                    "description": "Namespaces bound to this VTC that contain, or are contained by, `resource`. With `scope: administrator`, only those the caller administers. With `breakGlass: true`, only those containing a returned record."
+                },
+                "repos": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/RepoSummary"
+                    },
+                    "description": "Repositories within `resource`. `unmanaged` repositories are included only for callers holding `git.ns.admin` over them, or with `scope: administrator`. With `breakGlass: true`, only those carrying a returned record."
+                },
+                "rights": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/RightRecord"
+                    },
+                    "description": "Rights within `resource` the caller may see: always the caller's own; every right on a resource the caller owns or administers; every unratified break-glass record in a namespace they administer or on a resource they own. With `scope: administrator`, every recorded right in the namespaces the caller administers. `reason` is omitted except on resources the caller owns or administers. With `breakGlass: true`, only records carrying `breakGlass`."
+                },
+                "accounts": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/LinkedAccount"
+                    },
+                    "description": "The forge accounts linked to the caller's own DID — never another member's — at most one per forge. With `resource`, only the account on that resource's forge. Empty when the caller has linked none."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "RightRecord": {
+            "title": "RightRecord",
+            "description": "One recorded right. Implied rights (§4.2 of the rights model: `own` implies `maintain` implies `commit.sign` on the same resource; `ns.admin` implies `repo.create` and `own` across its namespace) are not records and never appear as RightRecords. A record carrying `breakGlass` was given by its subject to themselves through git-ns/right/break-glass; it is a real right, published like any other, and is shown with that flag on every surface that shows the record.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "subject",
+                "right",
+                "resource",
+                "grantedBy",
+                "grantedAt"
+            ],
+            "properties": {
+                "subject": {
+                    "$ref": "#/$defs/Did",
+                    "description": "Who holds the right. For `git.commit.sign` this is the DID whose commit signatures the CI check accepts."
+                },
+                "right": {
+                    "$ref": "#/$defs/Right"
+                },
+                "resource": {
+                    "$ref": "#/$defs/Resource"
+                },
+                "grantedBy": {
+                    "$ref": "#/$defs/Did",
+                    "description": "The actor whose task caused the right: the granter, the creator of a repository (for its first `own`), the adopting admin, the transferring owner, or the binding admin (for the first `git.ns.admin`). The VTC's own DID for a right it derives from its configuration."
+                },
+                "grantedAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the right lapses. Absent: no expiry."
+                },
+                "reason": {
+                    "type": "string",
+                    "maxLength": 1024,
+                    "description": "The granter's free-text reason. Disclosed only to holders of `git.repo.own` on the resource and of `git.ns.admin` over it."
+                },
+                "breakGlass": {
+                    "$ref": "#/$defs/BreakGlass",
+                    "description": "Present exactly when the subject gave themselves this right through git-ns/right/break-glass. Absent for every other record."
+                }
+            }
+        },
+        "BreakGlass": {
+            "title": "BreakGlass",
+            "description": "How a self-granted right came to be, and whether another administrator has since ratified it. A record whose `breakGlass` has no `ratifiedBy` is **unratified**: it is live and published like any other right, it does not count toward the last-owner or last-admin invariants, and any community administrator or namespace admin of its namespace may revoke it. Ratification (git-ns/right/ratify) sets `ratifiedBy` and `ratifiedAt`; from then on the record is an ordinary grant, and `breakGlass` stays as its history. Never published to the Trust Registry.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "by",
+                "at",
+                "justification"
+            ],
+            "properties": {
+                "by": {
+                    "$ref": "#/$defs/Did",
+                    "description": "Who broke the glass: always the record's `subject`, restated so the flag reads on its own."
+                },
+                "at": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the VTC recorded the break-glass."
+                },
+                "justification": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 2048,
+                    "pattern": "\\S",
+                    "description": "The actor's statement of why nobody else could grant this right. Shown to every community administrator, every namespace admin of the namespace and every owner of the resource; kept in the audit record; never published."
+                },
+                "effectiveAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the right takes effect, where the community's policy imposed a delay. Absent: it took effect at `at`. Until this instant the record confers nothing and is not published, and any administrator who may revoke it may do so."
+                },
+                "ratifiedBy": {
+                    "$ref": "#/$defs/Did",
+                    "description": "The administrator who ratified the record — never its subject. Absent while unratified."
+                },
+                "ratifiedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When it was ratified. Present exactly when `ratifiedBy` is."
+                }
+            }
+        },
+        "Did": {
+            "title": "Did",
+            "description": "A bare DID in the W3C DID Core syntax (§3.1): `did:`, a method name of lowercase letters and digits, `:`, and a method-specific id of colon-separated segments drawn from `A-Z a-z 0-9 . - _` and percent-encoded octets, the last segment non-empty. A DID URL is not a DID: no path, query or fragment (`/`, `?`, `#`), so a verification-method id such as `did:key:z6Mk…#z6Mk…` is refused. Compared by exact string equality — no case folding or percent-decoding. A consumer MUST still treat the value as data: the pattern keeps shell metacharacters, whitespace and quotes out of the wire form, but it does not make a DID safe to splice into a command or markup.",
+            "type": "string",
+            "maxLength": 2048,
+            "pattern": "^did:[a-z0-9]+:(?:(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*(?:[A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$"
+        },
+        "Resource": {
+            "title": "Resource",
+            "description": "A forge-qualified resource: `<forge-host>/<owner>` for a namespace, or `<forge-host>/<owner>/<repo>` for one repository, all lowercase — `github.com/acme`, `github.com/acme/widgets`, `codeberg.org/acme`. The forge is never implied: `acme/widgets` alone is not a resource. Containment is by whole segment: `github.com/acme` contains `github.com/acme/widgets` and does not contain `github.com/acme-labs/x` or `codeberg.org/acme/widgets`.",
+            "type": "string",
+            "maxLength": 455,
+            "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+(?:/[a-z0-9_-][a-z0-9._-]{0,99}){1,2}$"
+        },
+        "Right": {
+            "title": "Right",
+            "description": "One of the five git rights. Each string is also the TRQP `action` the VTC publishes the right under in its Trust Registry, so it is carried verbatim. `git.ns.admin` and `git.repo.create` apply to a namespace resource; `git.repo.own` and `git.repo.maintain` to a repository resource; `git.commit.sign` to either.",
+            "type": "string",
+            "enum": [
+                "git.ns.admin",
+                "git.repo.create",
+                "git.repo.own",
+                "git.repo.maintain",
+                "git.commit.sign"
+            ]
+        },
+        "RepoSummary": {
+            "title": "RepoSummary",
+            "description": "One repository as the VTC records it.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "resource",
+                "visibility",
+                "state",
+                "owners",
+                "bootstrap",
+                "sync"
+            ],
+            "properties": {
+                "resource": {
+                    "$ref": "#/$defs/RepoResource"
+                },
+                "forgeId": {
+                    "$ref": "#/$defs/ForgeId",
+                    "description": "The forge's repository id. Absent until the forge has confirmed the repository exists (a `pendingCreate` repository, or one adopted in bridge mode before the first inspection)."
+                },
+                "visibility": {
+                    "$ref": "#/$defs/RepoVisibility"
+                },
+                "state": {
+                    "type": "string",
+                    "enum": [
+                        "pendingCreate",
+                        "active",
+                        "archived",
+                        "detached",
+                        "orphaned",
+                        "unmanaged"
+                    ],
+                    "description": "`pendingCreate` — the name is reserved and the repository is not yet confirmed on the forge. `active` — managed. `archived` — archived through git-ns/repo/archive; commit rights on it are revoked. `detached` — no longer governed: its namespace was unbound, or it moved outside the namespace. `orphaned` — its last owner left the community and ownership passed to the namespace admins, who have not yet named a new owner. `unmanaged` — it exists on the forge inside a bound namespace but was never created or adopted through the VTC."
+                },
+                "owners": {
+                    "type": "array",
+                    "uniqueItems": true,
+                    "items": {
+                        "$ref": "#/$defs/Did"
+                    },
+                    "description": "The DIDs holding `git.repo.own` on this repository by an explicit grant. Empty only for an `unmanaged` repository, and for an `orphaned` one whose ownership rests with the namespace admins by implication."
+                },
+                "bootstrap": {
+                    "$ref": "#/$defs/Bootstrap"
+                },
+                "sync": {
+                    "$ref": "#/$defs/Sync"
+                }
+            }
+        },
+        "Sync": {
+            "title": "Sync",
+            "description": "How the forge compares with the VTC's projection for one repository.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "state",
+                "drift"
+            ],
+            "properties": {
+                "state": {
+                    "type": "string",
+                    "enum": [
+                        "inSync",
+                        "drift",
+                        "pending",
+                        "unchecked"
+                    ],
+                    "description": "`inSync` — the last comparison found no drift. `drift` — it found some, listed in `drift`. `pending` — a change has been sent to the forge and not yet confirmed. `unchecked` — nothing compares this repository (a manual-mode namespace)."
+                },
+                "checkedAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the forge was last compared. Absent if never."
+                },
+                "drift": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/DriftItem"
+                    },
+                    "description": "Outstanding drift. Empty unless `state` is `drift`."
+                }
+            }
+        },
+        "DriftItem": {
+            "title": "DriftItem",
+            "description": "One difference between the forge's observed state and the VTC's projection of a repository.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "type",
+                "resource"
+            ],
+            "properties": {
+                "type": {
+                    "type": "string",
+                    "enum": [
+                        "roleAdded",
+                        "roleRemoved",
+                        "roleChanged",
+                        "requiredCheckMissing",
+                        "protectionWeakened",
+                        "bootstrapMissing"
+                    ],
+                    "description": "`roleAdded` — someone holds a forge role the projection does not give them. `roleRemoved` — a projected role is missing. `roleChanged` — a projected role is present at another level. `requiredCheckMissing` — the verify-trust check is no longer required. `protectionWeakened` — branch protection or a ruleset is weaker than the projection in another way (force-push allowed, bypass actors added). `bootstrapMissing` — a bootstrap file or variable is gone."
+                },
+                "resource": {
+                    "$ref": "#/$defs/RepoResource"
+                },
+                "account": {
+                    "$ref": "#/$defs/ForgeAccount",
+                    "description": "Whose role differs, for the three role types."
+                },
+                "observed": {
+                    "type": "string",
+                    "maxLength": 256,
+                    "description": "What the forge shows, in the forge's own vocabulary (a role name such as `maintain`, a setting name). Absent when nothing is there."
+                },
+                "expected": {
+                    "type": "string",
+                    "maxLength": 256,
+                    "description": "What the projection calls for, in the forge's own vocabulary. Absent when the projection calls for nothing."
+                }
+            }
+        },
+        "ForgeAccount": {
+            "title": "ForgeAccount",
+            "description": "A person's account on one forge. `id` is authoritative; `login` is for display only, because logins can be renamed and re-registered.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "forge",
+                "id",
+                "login"
+            ],
+            "properties": {
+                "forge": {
+                    "$ref": "#/$defs/ForgeHost"
+                },
+                "id": {
+                    "$ref": "#/$defs/ForgeId"
+                },
+                "login": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 100,
+                    "description": "The account's current login, as the forge reported it when last seen. Display only."
+                }
+            }
+        },
+        "ForgeId": {
+            "title": "ForgeId",
+            "description": "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64
+        },
+        "ForgeHost": {
+            "title": "ForgeHost",
+            "description": "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.",
+            "type": "string",
+            "minLength": 3,
+            "maxLength": 253,
+            "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$"
+        },
+        "RepoResource": {
+            "title": "RepoResource",
+            "description": "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.",
+            "type": "string",
+            "maxLength": 455,
+            "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$"
+        },
+        "Bootstrap": {
+            "title": "Bootstrap",
+            "description": "Whether each step that turns commit trust on for a repository is in place, as last reported. A step that this forge's plan does not need reads `true`.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "workflow",
+                "keyring",
+                "variables",
+                "requiredCheck"
+            ],
+            "properties": {
+                "workflow": {
+                    "type": "boolean",
+                    "description": "The verify-trust check runs on the repository's pull requests — from a workflow committed to it, or, where the forge supports it, required on it from the namespace's own bridge-managed workflow repository at a pinned commit."
+                },
+                "keyring": {
+                    "type": "boolean",
+                    "description": "The exempt platform keyring for forge-signed merge commits is committed, or the forge's plan does not need one."
+                },
+                "variables": {
+                    "type": "boolean",
+                    "description": "The repository names the Trust Registry and this VTC as its trust anchors."
+                },
+                "requiredCheck": {
+                    "type": "boolean",
+                    "description": "The forge refuses to merge into the default branch unless the verify-trust check passes, with no bypass, and a pull request cannot change what that check runs: an organisation-required workflow, code-owner review of workflow files, or protected workflow paths, as the forge allows."
+                }
+            }
+        },
+        "RepoVisibility": {
+            "title": "RepoVisibility",
+            "type": "string",
+            "enum": [
+                "public",
+                "private"
+            ],
+            "description": "Repository visibility on the forge."
+        },
+        "GitNamespace": {
+            "title": "GitNamespace",
+            "description": "The VTC's binding to one owner on one forge.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "forge",
+                "owner",
+                "mode",
+                "state"
+            ],
+            "properties": {
+                "id": {
+                    "$ref": "#/$defs/NamespaceId"
+                },
+                "forge": {
+                    "$ref": "#/$defs/ForgeHost"
+                },
+                "owner": {
+                    "$ref": "#/$defs/Segment",
+                    "description": "The organisation or user on the forge, lowercased."
+                },
+                "kind": {
+                    "type": "string",
+                    "enum": [
+                        "organization",
+                        "user"
+                    ],
+                    "description": "Whether the owner is an organisation or a personal account, as the forge reports it. Present once known: a bridge-mode namespace learns it when binding completes, and a manual-mode namespace MAY never learn it."
+                },
+                "mode": {
+                    "type": "string",
+                    "enum": [
+                        "bridge",
+                        "manual"
+                    ],
+                    "description": "`bridge` — a bridge service acts on the forge for this namespace (creates repositories, projects roles, reports drift). `manual` — no automation; people with forge access carry out the steps the VTC names, and the VTC governs the rights alone."
+                },
+                "state": {
+                    "type": "string",
+                    "enum": [
+                        "pending",
+                        "bound"
+                    ],
+                    "description": "`pending` — binding has started and the forge-side proof has not arrived yet. `bound` — the VTC governs rights under this namespace."
+                }
+            }
+        },
+        "Segment": {
+            "title": "Segment",
+            "description": "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 100,
+            "pattern": "^[a-z0-9_-][a-z0-9._-]*$"
+        },
+        "NamespaceId": {
+            "title": "NamespaceId",
+            "description": "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: false,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: false,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map