@openvtc/trust-tasks 0.22.3 → 0.22.5

package/dist/vtc/schemas/accepts/list/0.2/payload.js

@@ -0,0 +1,759 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/schemas/accepts/list/0.2/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/schemas/accepts/list/0.2";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/schemas/accepts/list/0.2#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/vtc/schemas/accepts/list/0.2",
+    "title": "VTC Schemas — Accepts — List — payload",
+    "description": "Page through the community's Accepts criteria. The outer document members are owned by the framework — SPEC §6.3.",
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+        "cursor": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 1024,
+            "description": "Opaque continuation token from a previous page's `nextCursor`."
+        },
+        "limit": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 50,
+            "description": "Page size. The community chooses when absent."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTC Schemas — Accepts — List — response payload",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "items"
+            ],
+            "properties": {
+                "items": {
+                    "type": "array",
+                    "maxItems": 50,
+                    "items": {
+                        "$ref": "#/$defs/AcceptsCriterion"
+                    }
+                },
+                "nextCursor": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 1024,
+                    "description": "Present when more criteria remain; pass it as `cursor`."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "AcceptsCriterion": {
+            "title": "AcceptsCriterion",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "admission",
+                "createdAt",
+                "createdByDid"
+            ],
+            "dependentRequired": {
+                "query": [
+                    "credentialIssuers"
+                ],
+                "credentialIssuers": [
+                    "query"
+                ]
+            },
+            "description": "One way into the community: what an applicant must present, and how a submission that presents it is decided. Every requirement it states must be met; requirements it does not state are not requirements. A criterion stating none is met by every submission. A community's criteria are alternatives: a submission is decided under the one it names. What vtc/join-requests/manifest/0.3 publishes to applicants as a `Criterion` is derived from this.",
+            "properties": {
+                "id": {
+                    "$ref": "#/$defs/AcceptsCriterionId"
+                },
+                "admission": {
+                    "$ref": "#/$defs/Admission"
+                },
+                "query": {
+                    "$ref": "#/$defs/DcqlQuery",
+                    "description": "The credentials an applicant must present, as a DCQL query. Absent: the criterion requires no credential."
+                },
+                "credentialIssuers": {
+                    "$ref": "#/$defs/CredentialIssuers",
+                    "description": "Whose credentials meet `query`. Present exactly when `query` is."
+                },
+                "invitationRequired": {
+                    "type": "boolean",
+                    "description": "True: a submission meets the criterion only when it carries a valid, unconsumed invitation credential this community issued to the applicant. Absent or false: an invitation plays no part in meeting this criterion (another criterion may still require one)."
+                },
+                "description": {
+                    "$ref": "#/$defs/CriterionDescription"
+                },
+                "vetting": {
+                    "$ref": "#/$defs/VettingRequirements"
+                },
+                "createdAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When this criterion was last registered. Registering an existing id replaces it."
+                },
+                "createdByDid": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048,
+                    "description": "The administrator who last registered the criterion."
+                }
+            }
+        },
+        "VettingRequirements": {
+            "title": "VettingRequirements",
+            "type": "object",
+            "additionalProperties": true,
+            "required": [
+                "version",
+                "statementType",
+                "minStatements",
+                "acceptedMethods",
+                "eligibleVetters"
+            ],
+            "description": "What identity-vetting evidence a criterion needs, beyond what a presentation-definition can express: distinct eligible vetters, per-method floors, independence caps. Every number is the community's own policy. This schema supplies no defaults — an absent optional member means the community imposes no constraint of that kind, never that some protocol value applies. Deliberately open: a consumer MUST ignore members it does not recognise, so a community publishing a newer shape does not make an older client unable to read the rest. Durations: `maxStatementAge` — a statement older than this at decision time does not count (absent: no limit beyond the statement's own validity); `decisionSla` — how long after submission the community undertakes to decide, including on a referred application; `requirementsGrace` — how long an application started under an earlier `requirementsDigest` is still evaluated under that version.",
+            "properties": {
+                "version": {
+                    "type": "string",
+                    "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$",
+                    "description": "Version of this requirements object's shape. `0.1` for the members defined here."
+                },
+                "statementType": {
+                    "type": "string",
+                    "format": "uri",
+                    "minLength": 1,
+                    "maxLength": 512,
+                    "description": "The predicate IRI a counted vetting statement carries in `credentialSubject.predicate` — `https://registry.trustoverip.org/dtg/vsc/vetted/1`, the DTG VSC registry's identity-vetting predicate, or a predicate in a namespace the community controls — registered as one the community accepts via vtc/endorsement-types/register. A statement under any other predicate does not count."
+                },
+                "minStatements": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "description": "How many counted statements are needed, counting each vetter once however many DIDs they hold."
+                },
+                "minByMethod": {
+                    "type": "object",
+                    "propertyNames": {
+                        "$ref": "#/$defs/VettingMethod"
+                    },
+                    "additionalProperties": {
+                        "type": "integer",
+                        "minimum": 0
+                    },
+                    "description": "Per-method floors within `minStatements` — e.g. `{ \"inPerson\": 1 }`. Every method named MUST also be in `acceptedMethods`. Absent: no method floor."
+                },
+                "acceptedMethods": {
+                    "type": "array",
+                    "minItems": 1,
+                    "uniqueItems": true,
+                    "items": {
+                        "$ref": "#/$defs/VettingMethod"
+                    },
+                    "description": "Methods whose statements count at all."
+                },
+                "acceptedDocumentClasses": {
+                    "type": "array",
+                    "minItems": 1,
+                    "uniqueItems": true,
+                    "items": {
+                        "$ref": "#/$defs/VettingDocumentation"
+                    },
+                    "description": "Documentation a statement must have relied on in order to count. Absent — the expected case — means each vetter decides what documentation they accept, including none for prior acquaintance, and the community counts what they attest."
+                },
+                "requiredClaims": {
+                    "type": "array",
+                    "uniqueItems": true,
+                    "items": {
+                        "$ref": "#/$defs/ClaimType"
+                    },
+                    "description": "Claim types the applicant's Vetting Card must carry, which the identity commitment is computed over, and which a counted statement must list as verified. Absent: none."
+                },
+                "optionalClaims": {
+                    "type": "array",
+                    "uniqueItems": true,
+                    "items": {
+                        "$ref": "#/$defs/ClaimType"
+                    },
+                    "description": "Claim types an applicant MAY add to the card and a vetter MAY verify. They never affect whether a statement counts."
+                },
+                "maxStatementAge": {
+                    "$ref": "#/$defs/Duration"
+                },
+                "eligibleVetters": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "role"
+                    ],
+                    "properties": {
+                        "role": {
+                            "type": "string",
+                            "minLength": 1,
+                            "maxLength": 128,
+                            "pattern": "^[a-zA-Z][a-zA-Z0-9_-]*$",
+                            "description": "The role a statement's issuer must hold, matched as the action `role:<role>` in a Verifiable Authority Credential (`AuthorityCredential`) the community issued to that issuer, whose `authority.scope` is the community's DID (see `vtc/vetting/vetters/grant/0.1`). A statement counts only if its issuer holds such a credential."
+                        }
+                    },
+                    "description": "How a vetter's eligibility is established."
+                },
+                "independence": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "properties": {
+                        "maxByDeclaredRelationship": {
+                            "type": "object",
+                            "propertyNames": {
+                                "$ref": "#/$defs/VettingRelationship"
+                            },
+                            "additionalProperties": {
+                                "type": "integer",
+                                "minimum": 0
+                            },
+                            "description": "The most counted statements that may come from vetters declaring each relationship — e.g. `{ \"family\": 0 }`."
+                        },
+                        "requireConsistentIdentityCommitment": {
+                            "type": "boolean",
+                            "description": "When true, every counted statement must carry the same identity commitment — all vetters verified the same claimed identity. Absent: false."
+                        }
+                    },
+                    "description": "Caps on how much evidence may come from people close to the applicant. Absent: no caps."
+                },
+                "invitation": {
+                    "type": "string",
+                    "enum": [
+                        "required",
+                        "optional",
+                        "none"
+                    ],
+                    "description": "Whether an invitation credential must accompany the statements at submission (`required`), may (`optional`), or plays no part (`none`). Absent: the presentation-definition alone governs."
+                },
+                "decisionSla": {
+                    "$ref": "#/$defs/Duration"
+                },
+                "requirementsGrace": {
+                    "$ref": "#/$defs/Duration"
+                },
+                "governanceFrameworkUrl": {
+                    "type": "string",
+                    "format": "uri",
+                    "pattern": "^https://",
+                    "maxLength": 2048,
+                    "description": "Where the community's vetting governance — including the attestation text vetters sign — is published."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                },
+                "extCritical": {
+                    "$ref": "#/$defs/ExtCritical"
+                }
+            }
+        },
+        "Duration": {
+            "title": "Duration",
+            "type": "string",
+            "maxLength": 32,
+            "pattern": "^P(([0-9]+W)?([0-9]+D)?T([0-9]+H([0-9]+M)?([0-9]+S)?|[0-9]+M([0-9]+S)?|[0-9]+S)|[0-9]+W([0-9]+D)?|[0-9]+D)$",
+            "description": "An ISO 8601 duration in weeks, days, hours, minutes and seconds only (e.g. `P120D`, `P2W`, `P1DT12H`, `PT15M`). Years and months are refused: their length depends on the calendar, and an age limit that means different things on different days is not a limit."
+        },
+        "ExtCritical": {
+            "title": "ExtCritical",
+            "description": "Names the `ext` namespaces a consumer MUST understand or refuse, per SPEC.md §4.5.1.\n\nEvery entry MUST be an immediate key of the sibling `ext` object at the same level; an entry naming an absent namespace is non-conforming and the consumer rejects the document with `malformedRequest`. A consumer that does not recognize a namespace named here MUST NOT process the document as though the namespace were absent, and rejects it with `unsupportedExtension` — the exception to the rule that unrecognized namespaces are ignored.\n\nA producer marks a namespace only where the document's meaning depends on it. Marking one that merely carries a hint or an annotation turns every consumer that has not implemented it into a failure where it would otherwise have interoperated. JSON Schema cannot check either of those rules: that an entry names a present namespace is checkable only against the sibling `ext`, and whether a namespace is load-bearing is not a schema question at all. Both are consumer-side checks.",
+            "type": "array",
+            "minItems": 1,
+            "uniqueItems": true,
+            "items": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            },
+            "examples": [
+                [
+                    "org.openvtc.hidden-vetting"
+                ]
+            ]
+        },
+        "VettingRelationship": {
+            "title": "VettingRelationship",
+            "type": "string",
+            "enum": [
+                "none",
+                "communityColleague",
+                "sameEmployer",
+                "family",
+                "otherPersonal"
+            ],
+            "description": "The vetter's own declaration of how they relate to the applicant. Declared, not verified: it exists so community policy can cap how much evidence comes from people close to the applicant, and a false declaration is the vetter's attributable act."
+        },
+        "ClaimType": {
+            "title": "ClaimType",
+            "description": "The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.\n\nThe token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.\n\nThe `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "pattern": "^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$"
+        },
+        "VettingDocumentation": {
+            "title": "VettingDocumentation",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64,
+            "pattern": "^[a-z][a-zA-Z0-9]*$",
+            "description": "A class of documentation, named in lowerCamelCase. Open rather than enumerated, because what documentation a vetter accepts is each vetter's own choice. Well-known values: `passport`, `nationalId`, `driverLicence`, and `none` — the vetter will attest without a document, which is the `priorAcquaintance` case. Only the class ever travels — never a document number, an image, an issuing authority or an expiry date. `none` states a policy (what a vetter accepts); a record of what was relied on expresses 'no document' as an empty list instead."
+        },
+        "VettingMethod": {
+            "title": "VettingMethod",
+            "type": "string",
+            "enum": [
+                "inPerson",
+                "video",
+                "priorAcquaintance"
+            ],
+            "description": "How the vetter established that the person they checked is the person controlling the applicant's DID. `inPerson` — both people were physically together. `video` — a live, two-way video call. `priorAcquaintance` — the vetter has known or worked with this person over a period, and attests from that knowledge rather than from a document. A method is a description of what happened, not an assurance level: which methods count, and how many of each, is community policy."
+        },
+        "CriterionDescription": {
+            "title": "CriterionDescription",
+            "type": "string",
+            "maxLength": 1024,
+            "description": "Plain-language summary of the criterion, written by the registering administrator. Published to prospective applicants in the join manifest, and used as the `purpose` of the credential-exchange/query a join sends when the criterion has a `query` — so it is read by applicants and their agents, not only by administrators. Untrusted as a statement of the rule: where it and the criterion's other members disagree, those govern."
+        },
+        "CredentialIssuers": {
+            "title": "CredentialIssuers",
+            "type": "string",
+            "enum": [
+                "any",
+                "community",
+                "recognised"
+            ],
+            "description": "Whose credentials meet the criterion's `query`. `community`: only credentials this community issued. `recognised`: credentials this community issued, or issued by a community it recognises (vtc/recognition/check). `any`: any issuer whose credential verifies — the query's own constraints, including DCQL `trusted_authorities`, are then all that limits it. A credential that does not verify (signature, validity window, revocation) never meets a criterion, whichever value is chosen."
+        },
+        "DcqlQuery": {
+            "title": "DcqlQuery",
+            "type": "object",
+            "additionalProperties": true,
+            "description": "An OpenID for Verifiable Presentations DCQL query, carried verbatim: per-credential `format`, `meta` type selector (`vct_values`) and requested `claims`. Defined by OID4VP and not re-specified here; snake_case member names are DCQL's own. The community parses it as DCQL and checks every type it references against the registry."
+        },
+        "Admission": {
+            "title": "Admission",
+            "type": "string",
+            "enum": [
+                "automatic",
+                "review"
+            ],
+            "description": "How the community decides a submission that meets the criterion. `automatic`: it admits the applicant without a person deciding. `review`: it refers the submission to an administrator, who admits or rejects it; meeting the criterion never admits by itself. Which a criterion uses is the community's policy; this definition prefers neither."
+        },
+        "AcceptsCriterionId": {
+            "title": "AcceptsCriterionId",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "description": "An Accepts criterion's identifier, chosen by the registering administrator — a ceremony purpose or a named manifest criterion, e.g. `membership`. Compared as an exact string after surrounding whitespace is trimmed. Bounded at 128 characters, the bound vtc/join-requests/manifest/0.2 places on the criterion `id` it publishes."
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTC Schemas — Accepts — List — response payload",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "items"
+            ],
+            "properties": {
+                "items": {
+                    "type": "array",
+                    "maxItems": 50,
+                    "items": {
+                        "$ref": "#/$defs/AcceptsCriterion"
+                    }
+                },
+                "nextCursor": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 1024,
+                    "description": "Present when more criteria remain; pass it as `cursor`."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "AcceptsCriterion": {
+            "title": "AcceptsCriterion",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "admission",
+                "createdAt",
+                "createdByDid"
+            ],
+            "dependentRequired": {
+                "query": [
+                    "credentialIssuers"
+                ],
+                "credentialIssuers": [
+                    "query"
+                ]
+            },
+            "description": "One way into the community: what an applicant must present, and how a submission that presents it is decided. Every requirement it states must be met; requirements it does not state are not requirements. A criterion stating none is met by every submission. A community's criteria are alternatives: a submission is decided under the one it names. What vtc/join-requests/manifest/0.3 publishes to applicants as a `Criterion` is derived from this.",
+            "properties": {
+                "id": {
+                    "$ref": "#/$defs/AcceptsCriterionId"
+                },
+                "admission": {
+                    "$ref": "#/$defs/Admission"
+                },
+                "query": {
+                    "$ref": "#/$defs/DcqlQuery",
+                    "description": "The credentials an applicant must present, as a DCQL query. Absent: the criterion requires no credential."
+                },
+                "credentialIssuers": {
+                    "$ref": "#/$defs/CredentialIssuers",
+                    "description": "Whose credentials meet `query`. Present exactly when `query` is."
+                },
+                "invitationRequired": {
+                    "type": "boolean",
+                    "description": "True: a submission meets the criterion only when it carries a valid, unconsumed invitation credential this community issued to the applicant. Absent or false: an invitation plays no part in meeting this criterion (another criterion may still require one)."
+                },
+                "description": {
+                    "$ref": "#/$defs/CriterionDescription"
+                },
+                "vetting": {
+                    "$ref": "#/$defs/VettingRequirements"
+                },
+                "createdAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When this criterion was last registered. Registering an existing id replaces it."
+                },
+                "createdByDid": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048,
+                    "description": "The administrator who last registered the criterion."
+                }
+            }
+        },
+        "VettingRequirements": {
+            "title": "VettingRequirements",
+            "type": "object",
+            "additionalProperties": true,
+            "required": [
+                "version",
+                "statementType",
+                "minStatements",
+                "acceptedMethods",
+                "eligibleVetters"
+            ],
+            "description": "What identity-vetting evidence a criterion needs, beyond what a presentation-definition can express: distinct eligible vetters, per-method floors, independence caps. Every number is the community's own policy. This schema supplies no defaults — an absent optional member means the community imposes no constraint of that kind, never that some protocol value applies. Deliberately open: a consumer MUST ignore members it does not recognise, so a community publishing a newer shape does not make an older client unable to read the rest. Durations: `maxStatementAge` — a statement older than this at decision time does not count (absent: no limit beyond the statement's own validity); `decisionSla` — how long after submission the community undertakes to decide, including on a referred application; `requirementsGrace` — how long an application started under an earlier `requirementsDigest` is still evaluated under that version.",
+            "properties": {
+                "version": {
+                    "type": "string",
+                    "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$",
+                    "description": "Version of this requirements object's shape. `0.1` for the members defined here."
+                },
+                "statementType": {
+                    "type": "string",
+                    "format": "uri",
+                    "minLength": 1,
+                    "maxLength": 512,
+                    "description": "The predicate IRI a counted vetting statement carries in `credentialSubject.predicate` — `https://registry.trustoverip.org/dtg/vsc/vetted/1`, the DTG VSC registry's identity-vetting predicate, or a predicate in a namespace the community controls — registered as one the community accepts via vtc/endorsement-types/register. A statement under any other predicate does not count."
+                },
+                "minStatements": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "description": "How many counted statements are needed, counting each vetter once however many DIDs they hold."
+                },
+                "minByMethod": {
+                    "type": "object",
+                    "propertyNames": {
+                        "$ref": "#/$defs/VettingMethod"
+                    },
+                    "additionalProperties": {
+                        "type": "integer",
+                        "minimum": 0
+                    },
+                    "description": "Per-method floors within `minStatements` — e.g. `{ \"inPerson\": 1 }`. Every method named MUST also be in `acceptedMethods`. Absent: no method floor."
+                },
+                "acceptedMethods": {
+                    "type": "array",
+                    "minItems": 1,
+                    "uniqueItems": true,
+                    "items": {
+                        "$ref": "#/$defs/VettingMethod"
+                    },
+                    "description": "Methods whose statements count at all."
+                },
+                "acceptedDocumentClasses": {
+                    "type": "array",
+                    "minItems": 1,
+                    "uniqueItems": true,
+                    "items": {
+                        "$ref": "#/$defs/VettingDocumentation"
+                    },
+                    "description": "Documentation a statement must have relied on in order to count. Absent — the expected case — means each vetter decides what documentation they accept, including none for prior acquaintance, and the community counts what they attest."
+                },
+                "requiredClaims": {
+                    "type": "array",
+                    "uniqueItems": true,
+                    "items": {
+                        "$ref": "#/$defs/ClaimType"
+                    },
+                    "description": "Claim types the applicant's Vetting Card must carry, which the identity commitment is computed over, and which a counted statement must list as verified. Absent: none."
+                },
+                "optionalClaims": {
+                    "type": "array",
+                    "uniqueItems": true,
+                    "items": {
+                        "$ref": "#/$defs/ClaimType"
+                    },
+                    "description": "Claim types an applicant MAY add to the card and a vetter MAY verify. They never affect whether a statement counts."
+                },
+                "maxStatementAge": {
+                    "$ref": "#/$defs/Duration"
+                },
+                "eligibleVetters": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "role"
+                    ],
+                    "properties": {
+                        "role": {
+                            "type": "string",
+                            "minLength": 1,
+                            "maxLength": 128,
+                            "pattern": "^[a-zA-Z][a-zA-Z0-9_-]*$",
+                            "description": "The role a statement's issuer must hold, matched as the action `role:<role>` in a Verifiable Authority Credential (`AuthorityCredential`) the community issued to that issuer, whose `authority.scope` is the community's DID (see `vtc/vetting/vetters/grant/0.1`). A statement counts only if its issuer holds such a credential."
+                        }
+                    },
+                    "description": "How a vetter's eligibility is established."
+                },
+                "independence": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "properties": {
+                        "maxByDeclaredRelationship": {
+                            "type": "object",
+                            "propertyNames": {
+                                "$ref": "#/$defs/VettingRelationship"
+                            },
+                            "additionalProperties": {
+                                "type": "integer",
+                                "minimum": 0
+                            },
+                            "description": "The most counted statements that may come from vetters declaring each relationship — e.g. `{ \"family\": 0 }`."
+                        },
+                        "requireConsistentIdentityCommitment": {
+                            "type": "boolean",
+                            "description": "When true, every counted statement must carry the same identity commitment — all vetters verified the same claimed identity. Absent: false."
+                        }
+                    },
+                    "description": "Caps on how much evidence may come from people close to the applicant. Absent: no caps."
+                },
+                "invitation": {
+                    "type": "string",
+                    "enum": [
+                        "required",
+                        "optional",
+                        "none"
+                    ],
+                    "description": "Whether an invitation credential must accompany the statements at submission (`required`), may (`optional`), or plays no part (`none`). Absent: the presentation-definition alone governs."
+                },
+                "decisionSla": {
+                    "$ref": "#/$defs/Duration"
+                },
+                "requirementsGrace": {
+                    "$ref": "#/$defs/Duration"
+                },
+                "governanceFrameworkUrl": {
+                    "type": "string",
+                    "format": "uri",
+                    "pattern": "^https://",
+                    "maxLength": 2048,
+                    "description": "Where the community's vetting governance — including the attestation text vetters sign — is published."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                },
+                "extCritical": {
+                    "$ref": "#/$defs/ExtCritical"
+                }
+            }
+        },
+        "Duration": {
+            "title": "Duration",
+            "type": "string",
+            "maxLength": 32,
+            "pattern": "^P(([0-9]+W)?([0-9]+D)?T([0-9]+H([0-9]+M)?([0-9]+S)?|[0-9]+M([0-9]+S)?|[0-9]+S)|[0-9]+W([0-9]+D)?|[0-9]+D)$",
+            "description": "An ISO 8601 duration in weeks, days, hours, minutes and seconds only (e.g. `P120D`, `P2W`, `P1DT12H`, `PT15M`). Years and months are refused: their length depends on the calendar, and an age limit that means different things on different days is not a limit."
+        },
+        "ExtCritical": {
+            "title": "ExtCritical",
+            "description": "Names the `ext` namespaces a consumer MUST understand or refuse, per SPEC.md §4.5.1.\n\nEvery entry MUST be an immediate key of the sibling `ext` object at the same level; an entry naming an absent namespace is non-conforming and the consumer rejects the document with `malformedRequest`. A consumer that does not recognize a namespace named here MUST NOT process the document as though the namespace were absent, and rejects it with `unsupportedExtension` — the exception to the rule that unrecognized namespaces are ignored.\n\nA producer marks a namespace only where the document's meaning depends on it. Marking one that merely carries a hint or an annotation turns every consumer that has not implemented it into a failure where it would otherwise have interoperated. JSON Schema cannot check either of those rules: that an entry names a present namespace is checkable only against the sibling `ext`, and whether a namespace is load-bearing is not a schema question at all. Both are consumer-side checks.",
+            "type": "array",
+            "minItems": 1,
+            "uniqueItems": true,
+            "items": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            },
+            "examples": [
+                [
+                    "org.openvtc.hidden-vetting"
+                ]
+            ]
+        },
+        "VettingRelationship": {
+            "title": "VettingRelationship",
+            "type": "string",
+            "enum": [
+                "none",
+                "communityColleague",
+                "sameEmployer",
+                "family",
+                "otherPersonal"
+            ],
+            "description": "The vetter's own declaration of how they relate to the applicant. Declared, not verified: it exists so community policy can cap how much evidence comes from people close to the applicant, and a false declaration is the vetter's attributable act."
+        },
+        "ClaimType": {
+            "title": "ClaimType",
+            "description": "The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.\n\nThe token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.\n\nThe `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "pattern": "^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$"
+        },
+        "VettingDocumentation": {
+            "title": "VettingDocumentation",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64,
+            "pattern": "^[a-z][a-zA-Z0-9]*$",
+            "description": "A class of documentation, named in lowerCamelCase. Open rather than enumerated, because what documentation a vetter accepts is each vetter's own choice. Well-known values: `passport`, `nationalId`, `driverLicence`, and `none` — the vetter will attest without a document, which is the `priorAcquaintance` case. Only the class ever travels — never a document number, an image, an issuing authority or an expiry date. `none` states a policy (what a vetter accepts); a record of what was relied on expresses 'no document' as an empty list instead."
+        },
+        "VettingMethod": {
+            "title": "VettingMethod",
+            "type": "string",
+            "enum": [
+                "inPerson",
+                "video",
+                "priorAcquaintance"
+            ],
+            "description": "How the vetter established that the person they checked is the person controlling the applicant's DID. `inPerson` — both people were physically together. `video` — a live, two-way video call. `priorAcquaintance` — the vetter has known or worked with this person over a period, and attests from that knowledge rather than from a document. A method is a description of what happened, not an assurance level: which methods count, and how many of each, is community policy."
+        },
+        "CriterionDescription": {
+            "title": "CriterionDescription",
+            "type": "string",
+            "maxLength": 1024,
+            "description": "Plain-language summary of the criterion, written by the registering administrator. Published to prospective applicants in the join manifest, and used as the `purpose` of the credential-exchange/query a join sends when the criterion has a `query` — so it is read by applicants and their agents, not only by administrators. Untrusted as a statement of the rule: where it and the criterion's other members disagree, those govern."
+        },
+        "CredentialIssuers": {
+            "title": "CredentialIssuers",
+            "type": "string",
+            "enum": [
+                "any",
+                "community",
+                "recognised"
+            ],
+            "description": "Whose credentials meet the criterion's `query`. `community`: only credentials this community issued. `recognised`: credentials this community issued, or issued by a community it recognises (vtc/recognition/check). `any`: any issuer whose credential verifies — the query's own constraints, including DCQL `trusted_authorities`, are then all that limits it. A credential that does not verify (signature, validity window, revocation) never meets a criterion, whichever value is chosen."
+        },
+        "DcqlQuery": {
+            "title": "DcqlQuery",
+            "type": "object",
+            "additionalProperties": true,
+            "description": "An OpenID for Verifiable Presentations DCQL query, carried verbatim: per-credential `format`, `meta` type selector (`vct_values`) and requested `claims`. Defined by OID4VP and not re-specified here; snake_case member names are DCQL's own. The community parses it as DCQL and checks every type it references against the registry."
+        },
+        "Admission": {
+            "title": "Admission",
+            "type": "string",
+            "enum": [
+                "automatic",
+                "review"
+            ],
+            "description": "How the community decides a submission that meets the criterion. `automatic`: it admits the applicant without a person deciding. `review`: it refers the submission to an administrator, who admits or rejects it; meeting the criterion never admits by itself. Which a criterion uses is the community's policy; this definition prefers neither."
+        },
+        "AcceptsCriterionId": {
+            "title": "AcceptsCriterionId",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "description": "An Accepts criterion's identifier, chosen by the registering administrator — a ceremony purpose or a named manifest criterion, e.g. `membership`. Compared as an exact string after surrounding whitespace is trimmed. Bounded at 128 characters, the bound vtc/join-requests/manifest/0.2 places on the criterion `id` it publishes."
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    isIssuedAtRequired: false,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    isIssuedAtRequired: false,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map