@openvtc/trust-tasks 0.27.2 → 0.27.4

package/dist/persona/attribute/put/1.1/payload.d.ts

@@ -0,0 +1,1190 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/persona/attribute/put/1.1/payload.schema.json
+ */
+import type { ClaimType, ExpectedVersion_PersonaV0_1 as ExpectedVersion, Ext, ProofRung, Provenance, ReleaseRequirement, Sensitivity, Ulid, ValueType, Version_PersonaV0_1 as Version } from "../../../../_shared/components.js";
+/**
+ * Create or replace one attribute in the holder's pool. Omit `attributeId` to create; supply it to replace. `expectedVersion` makes the write conditional.
+ */
+export interface PersonaAttributePutPayload {
+    /**
+     * Omit to create — the maintainer assigns one and returns it. Supply to replace an existing attribute, or to make a create idempotent under retry; a supplied id that already exists is a replacement, and a producer that meant to create MUST pair it with `expectedVersion: 0`.
+     */
+    attributeId?: Ulid;
+    type: ClaimType;
+    valueType: ValueType;
+    /**
+     * The fact itself. MUST agree with `valueType`; a maintainer MUST refuse a document where it does not. For a `credentialBacked` provenance this is the initial display cache — the maintainer re-derives it from the credential and MAY overwrite what was supplied.
+     */
+    value: {
+        [k: string]: unknown | undefined;
+    };
+    /**
+     * The holder's own words, for their own picker. Never disclosed to a verifier.
+     */
+    label?: string;
+    provenance: Provenance;
+    /**
+     * Vault identifiers of credentials in which a third party endorses this value. Inventory, not evidence — see the `endorsements` member of the shared Attribute. Replaced whole by each put; omit or send empty for none.
+     *
+     * @maxItems 64
+     */
+    endorsements?: string[];
+    /**
+     * How carefully this value is shown to the holder. OPTIONAL, and its absence is meaningful: it records that the holder made no explicit decision, so a consumer resolves it from the claim-type registry. Sending the resolved value back would freeze it — a later tightening of the registry would then protect new attributes and leave this one exposed.
+     */
+    sensitivity?: Sensitivity;
+    /**
+     * What it takes to disclose this value. OPTIONAL, with the same meaning for absence as `sensitivity`.
+     */
+    release?: ReleaseRequirement;
+    /**
+     * Optional precondition. Omit for last-writer-wins. Supply the version a prior read returned to make the write conditional; supply 0 to create only.
+     */
+    expectedVersion?: ExpectedVersion;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * Success response to persona/attribute/put. Type https://trusttasks.org/spec/persona/attribute/put/1.1#response. A failed precondition is not a success: it is a trust-task-error carrying persona/attribute/put:versionConflict, whose details carry the maintainer's current version and value.
+ */
+export interface PersonaAttributePutResponsePayload {
+    attributeId: Ulid;
+    version: Version;
+    /**
+     * True when this write created the attribute, false when it replaced one. A producer that omitted `attributeId` can still be told which happened, because a retried create with a supplied id is a replacement.
+     */
+    wasCreated: boolean;
+    /**
+     * Advisory result of the correlation check the maintainer runs over the new value (see persona/correlation/analyze). Returned on the write so a producer's builder can warn at the moment of composition rather than requiring a second round trip. Advisory only: the write has already applied, and a maintainer MUST NOT refuse a write on correlation grounds — the holder decides.
+     */
+    correlation?: {
+        severity: "none" | "low" | "high";
+        /**
+         * How many other profiles already present this exact value. A count, not identifiers — the identifiers are available from the analyze task, which is where a producer should go to render remedies.
+         */
+        sharedWithProfileCount?: number;
+    };
+    /**
+     * Every place this write changed what a persona presents: each binding whose projection was re-pushed because a face wearing it shows this attribute live. An edit propagates by design, and a holder told only that it saved cannot tell whether it refreshed one face or nine. Holder-authorized, so identifiers are returned. Absent when nothing was bound to a face showing it.
+     *
+     * @maxItems 256
+     */
+    refreshed?: {
+        profileId: Ulid;
+        contextId: string;
+        personaDid: string;
+    }[];
+    /**
+     * Faces that pin this attribute to an earlier version and so did NOT follow the edit — the counterparties that must keep seeing the value they verified. Named so the holder can decide, per face, whether that is still what they want. Absent when no face pins it.
+     *
+     * @maxItems 256
+     */
+    heldByPin?: {
+        profileId: Ulid;
+        pinVersion: Version;
+    }[];
+    createdAt?: string;
+    updatedAt: string;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ClaimType, ExpectedVersion, Ext, ProofRung, Provenance, ReleaseRequirement, Sensitivity, Ulid, ValueType, Version };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/persona/attribute/put/1.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = PersonaAttributePutPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/persona/attribute/put/1.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = PersonaAttributePutResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/persona/attribute/put/1.1";
+    readonly title: "Persona Attribute Put — payload";
+    readonly description: "Create or replace one attribute in the holder's pool. Omit `attributeId` to create; supply it to replace. `expectedVersion` makes the write conditional.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["type", "valueType", "value", "provenance"];
+    readonly properties: {
+        readonly attributeId: {
+            readonly $ref: "#/$defs/Ulid";
+            readonly description: "Omit to create — the maintainer assigns one and returns it. Supply to replace an existing attribute, or to make a create idempotent under retry; a supplied id that already exists is a replacement, and a producer that meant to create MUST pair it with `expectedVersion: 0`.";
+        };
+        readonly type: {
+            readonly $ref: "#/$defs/ClaimType";
+        };
+        readonly valueType: {
+            readonly $ref: "#/$defs/ValueType";
+        };
+        readonly value: {
+            readonly description: "The fact itself. MUST agree with `valueType`; a maintainer MUST refuse a document where it does not. For a `credentialBacked` provenance this is the initial display cache — the maintainer re-derives it from the credential and MAY overwrite what was supplied.";
+        };
+        readonly label: {
+            readonly type: "string";
+            readonly maxLength: 128;
+            readonly description: "The holder's own words, for their own picker. Never disclosed to a verifier.";
+        };
+        readonly provenance: {
+            readonly $ref: "#/$defs/Provenance";
+        };
+        readonly endorsements: {
+            readonly type: "array";
+            readonly maxItems: 64;
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly type: "string";
+                readonly minLength: 1;
+            };
+            readonly description: "Vault identifiers of credentials in which a third party endorses this value. Inventory, not evidence — see the `endorsements` member of the shared Attribute. Replaced whole by each put; omit or send empty for none.";
+        };
+        readonly sensitivity: {
+            readonly $ref: "#/$defs/Sensitivity";
+            readonly description: "How carefully this value is shown to the holder. OPTIONAL, and its absence is meaningful: it records that the holder made no explicit decision, so a consumer resolves it from the claim-type registry. Sending the resolved value back would freeze it — a later tightening of the registry would then protect new attributes and leave this one exposed.";
+        };
+        readonly release: {
+            readonly $ref: "#/$defs/ReleaseRequirement";
+            readonly description: "What it takes to disclose this value. OPTIONAL, with the same meaning for absence as `sensitivity`.";
+        };
+        readonly expectedVersion: {
+            readonly $ref: "#/$defs/ExpectedVersion";
+            readonly description: "Optional precondition. Omit for last-writer-wins. Supply the version a prior read returned to make the write conditional; supply 0 to create only.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Persona Attribute Put — response payload";
+            readonly description: "Success response to persona/attribute/put. Type https://trusttasks.org/spec/persona/attribute/put/1.1#response. A failed precondition is not a success: it is a trust-task-error carrying persona/attribute/put:versionConflict, whose details carry the maintainer's current version and value.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["attributeId", "version", "wasCreated", "updatedAt"];
+            readonly properties: {
+                readonly attributeId: {
+                    readonly $ref: "#/$defs/Ulid";
+                };
+                readonly version: {
+                    readonly $ref: "#/$defs/Version";
+                };
+                readonly wasCreated: {
+                    readonly type: "boolean";
+                    readonly description: "True when this write created the attribute, false when it replaced one. A producer that omitted `attributeId` can still be told which happened, because a retried create with a supplied id is a replacement.";
+                };
+                readonly correlation: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["severity"];
+                    readonly description: "Advisory result of the correlation check the maintainer runs over the new value (see persona/correlation/analyze). Returned on the write so a producer's builder can warn at the moment of composition rather than requiring a second round trip. Advisory only: the write has already applied, and a maintainer MUST NOT refuse a write on correlation grounds — the holder decides.";
+                    readonly properties: {
+                        readonly severity: {
+                            readonly type: "string";
+                            readonly enum: readonly ["none", "low", "high"];
+                        };
+                        readonly sharedWithProfileCount: {
+                            readonly type: "integer";
+                            readonly minimum: 0;
+                            readonly description: "How many other profiles already present this exact value. A count, not identifiers — the identifiers are available from the analyze task, which is where a producer should go to render remedies.";
+                        };
+                    };
+                };
+                readonly refreshed: {
+                    readonly type: "array";
+                    readonly maxItems: 256;
+                    readonly description: "Every place this write changed what a persona presents: each binding whose projection was re-pushed because a face wearing it shows this attribute live. An edit propagates by design, and a holder told only that it saved cannot tell whether it refreshed one face or nine. Holder-authorized, so identifiers are returned. Absent when nothing was bound to a face showing it.";
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["profileId", "contextId", "personaDid"];
+                        readonly properties: {
+                            readonly profileId: {
+                                readonly $ref: "#/$defs/Ulid";
+                            };
+                            readonly contextId: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly personaDid: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                        };
+                    };
+                };
+                readonly heldByPin: {
+                    readonly type: "array";
+                    readonly maxItems: 256;
+                    readonly description: "Faces that pin this attribute to an earlier version and so did NOT follow the edit — the counterparties that must keep seeing the value they verified. Named so the holder can decide, per face, whether that is still what they want. Absent when no face pins it.";
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["profileId", "pinVersion"];
+                        readonly properties: {
+                            readonly profileId: {
+                                readonly $ref: "#/$defs/Ulid";
+                            };
+                            readonly pinVersion: {
+                                readonly $ref: "#/$defs/Version";
+                            };
+                        };
+                    };
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Version: {
+            readonly title: "Version";
+            readonly description: "A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.";
+            readonly type: "integer";
+            readonly minimum: 1;
+        };
+        readonly Ulid: {
+            readonly title: "Ulid";
+            readonly description: "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.";
+            readonly type: "string";
+            readonly pattern: "^[0-9A-HJKMNP-TV-Z]{26}$";
+        };
+        readonly ExpectedVersion: {
+            readonly title: "ExpectedVersion";
+            readonly description: "Optimistic-concurrency precondition. A positive value requires the record's current `version` to equal it exactly; zero means create-only and applies only when no live record exists at the address.";
+            readonly type: "integer";
+            readonly minimum: 0;
+        };
+        readonly ReleaseRequirement: {
+            readonly title: "ReleaseRequirement";
+            readonly description: "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.";
+            readonly type: "string";
+            readonly enum: readonly ["consent", "stepUp"];
+        };
+        readonly Sensitivity: {
+            readonly title: "Sensitivity";
+            readonly description: "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.";
+            readonly type: "string";
+            readonly enum: readonly ["normal", "high"];
+        };
+        readonly Provenance: {
+            readonly title: "Provenance";
+            readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.";
+            readonly type: "object";
+            readonly required: readonly ["kind"];
+            readonly oneOf: readonly [{
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "selfAsserted";
+                    };
+                };
+            }, {
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "credentialId", "claimPath"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "credentialBacked";
+                    };
+                    readonly credentialId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Vault identifier of the backing credential.";
+                    };
+                    readonly claimPath: {
+                        readonly type: "string";
+                        readonly pattern: "^(/[^/~]*(~[01][^/~]*)*)*$";
+                        readonly description: "RFC 6901 JSON Pointer to the claim within the credential, e.g. `/credentialSubject/familyName`.";
+                    };
+                    readonly issuerDid: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Issuer of the backing credential. Advisory: a consumer MUST verify the credential rather than trusting this member.";
+                    };
+                    readonly proof: {
+                        readonly $ref: "#/$defs/ProofRung";
+                        readonly description: "The disclosure rung this claim was, or will be, presented at.";
+                    };
+                };
+            }, {
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "generator"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "generated";
+                    };
+                    readonly generator: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly description: "Names the minting scheme, e.g. `relayEmail`. Maintainer-defined.";
+                    };
+                    readonly perVerifier: {
+                        readonly type: "boolean";
+                        readonly default: true;
+                        readonly description: "When true (the default and the only useful setting), a distinct value is minted for each verifier.";
+                    };
+                };
+            }, {
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "source", "derivedAt"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "derived";
+                    };
+                    readonly source: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly pattern: "^[a-z][A-Za-z0-9.-]*$";
+                        readonly description: "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.";
+                    };
+                    readonly derivedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it.";
+                    };
+                };
+            }];
+        };
+        readonly ProofRung: {
+            readonly title: "ProofRung";
+            readonly description: "How strongly a credential-backed claim is hidden when presented, ordered most private first. `predicate` proves a statement over a claim without disclosing the claim. `derived` discloses exactly the claims needed via an unlinkable derived proof, so two presentations cannot be joined. `selectiveDisclosure` discloses exactly the claims needed but carries the issuer's signature unchanged, so two presentations ARE linkable. `whole` discloses the entire credential.\n\nThe distinction between the first two and the last two is of kind, not degree: only `predicate` and `derived` avoid handing two verifiers a join key. A maintainer MUST default to the highest rung the credential's format supports, and MUST NOT silently fall to a lower one — a request that cannot be satisfied at the rung a producer asked for is refused, because a silent privacy downgrade discloses material the holder believed was hidden.";
+            readonly type: "string";
+            readonly enum: readonly ["predicate", "derived", "selectiveDisclosure", "whole"];
+        };
+        readonly ValueType: {
+            readonly title: "ValueType";
+            readonly description: "The JSON shape of `value`, declared so that a consumer can render and compare without guessing. The maintainer validates that `value` agrees with this member and does nothing further: it does NOT validate a phone number against a phone-number grammar. That is a producer's affordance, and a store that grows opinions about the contents of its records eventually blocks its consumer's release.";
+            readonly type: "string";
+            readonly enum: readonly ["string", "number", "boolean", "date", "object"];
+        };
+        readonly ClaimType: {
+            readonly title: "ClaimType";
+            readonly description: "The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.\n\nThe token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.\n\nThe `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly pattern: "^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Persona Attribute Put — response payload";
+            readonly description: "Success response to persona/attribute/put. Type https://trusttasks.org/spec/persona/attribute/put/1.1#response. A failed precondition is not a success: it is a trust-task-error carrying persona/attribute/put:versionConflict, whose details carry the maintainer's current version and value.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["attributeId", "version", "wasCreated", "updatedAt"];
+            readonly properties: {
+                readonly attributeId: {
+                    readonly $ref: "#/$defs/Ulid";
+                };
+                readonly version: {
+                    readonly $ref: "#/$defs/Version";
+                };
+                readonly wasCreated: {
+                    readonly type: "boolean";
+                    readonly description: "True when this write created the attribute, false when it replaced one. A producer that omitted `attributeId` can still be told which happened, because a retried create with a supplied id is a replacement.";
+                };
+                readonly correlation: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["severity"];
+                    readonly description: "Advisory result of the correlation check the maintainer runs over the new value (see persona/correlation/analyze). Returned on the write so a producer's builder can warn at the moment of composition rather than requiring a second round trip. Advisory only: the write has already applied, and a maintainer MUST NOT refuse a write on correlation grounds — the holder decides.";
+                    readonly properties: {
+                        readonly severity: {
+                            readonly type: "string";
+                            readonly enum: readonly ["none", "low", "high"];
+                        };
+                        readonly sharedWithProfileCount: {
+                            readonly type: "integer";
+                            readonly minimum: 0;
+                            readonly description: "How many other profiles already present this exact value. A count, not identifiers — the identifiers are available from the analyze task, which is where a producer should go to render remedies.";
+                        };
+                    };
+                };
+                readonly refreshed: {
+                    readonly type: "array";
+                    readonly maxItems: 256;
+                    readonly description: "Every place this write changed what a persona presents: each binding whose projection was re-pushed because a face wearing it shows this attribute live. An edit propagates by design, and a holder told only that it saved cannot tell whether it refreshed one face or nine. Holder-authorized, so identifiers are returned. Absent when nothing was bound to a face showing it.";
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["profileId", "contextId", "personaDid"];
+                        readonly properties: {
+                            readonly profileId: {
+                                readonly $ref: "#/$defs/Ulid";
+                            };
+                            readonly contextId: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly personaDid: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                        };
+                    };
+                };
+                readonly heldByPin: {
+                    readonly type: "array";
+                    readonly maxItems: 256;
+                    readonly description: "Faces that pin this attribute to an earlier version and so did NOT follow the edit — the counterparties that must keep seeing the value they verified. Named so the holder can decide, per face, whether that is still what they want. Absent when no face pins it.";
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["profileId", "pinVersion"];
+                        readonly properties: {
+                            readonly profileId: {
+                                readonly $ref: "#/$defs/Ulid";
+                            };
+                            readonly pinVersion: {
+                                readonly $ref: "#/$defs/Version";
+                            };
+                        };
+                    };
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Version: {
+            readonly title: "Version";
+            readonly description: "A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.";
+            readonly type: "integer";
+            readonly minimum: 1;
+        };
+        readonly Ulid: {
+            readonly title: "Ulid";
+            readonly description: "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.";
+            readonly type: "string";
+            readonly pattern: "^[0-9A-HJKMNP-TV-Z]{26}$";
+        };
+        readonly ExpectedVersion: {
+            readonly title: "ExpectedVersion";
+            readonly description: "Optimistic-concurrency precondition. A positive value requires the record's current `version` to equal it exactly; zero means create-only and applies only when no live record exists at the address.";
+            readonly type: "integer";
+            readonly minimum: 0;
+        };
+        readonly ReleaseRequirement: {
+            readonly title: "ReleaseRequirement";
+            readonly description: "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.";
+            readonly type: "string";
+            readonly enum: readonly ["consent", "stepUp"];
+        };
+        readonly Sensitivity: {
+            readonly title: "Sensitivity";
+            readonly description: "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.";
+            readonly type: "string";
+            readonly enum: readonly ["normal", "high"];
+        };
+        readonly Provenance: {
+            readonly title: "Provenance";
+            readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.";
+            readonly type: "object";
+            readonly required: readonly ["kind"];
+            readonly oneOf: readonly [{
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "selfAsserted";
+                    };
+                };
+            }, {
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "credentialId", "claimPath"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "credentialBacked";
+                    };
+                    readonly credentialId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Vault identifier of the backing credential.";
+                    };
+                    readonly claimPath: {
+                        readonly type: "string";
+                        readonly pattern: "^(/[^/~]*(~[01][^/~]*)*)*$";
+                        readonly description: "RFC 6901 JSON Pointer to the claim within the credential, e.g. `/credentialSubject/familyName`.";
+                    };
+                    readonly issuerDid: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Issuer of the backing credential. Advisory: a consumer MUST verify the credential rather than trusting this member.";
+                    };
+                    readonly proof: {
+                        readonly $ref: "#/$defs/ProofRung";
+                        readonly description: "The disclosure rung this claim was, or will be, presented at.";
+                    };
+                };
+            }, {
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "generator"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "generated";
+                    };
+                    readonly generator: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly description: "Names the minting scheme, e.g. `relayEmail`. Maintainer-defined.";
+                    };
+                    readonly perVerifier: {
+                        readonly type: "boolean";
+                        readonly default: true;
+                        readonly description: "When true (the default and the only useful setting), a distinct value is minted for each verifier.";
+                    };
+                };
+            }, {
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "source", "derivedAt"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "derived";
+                    };
+                    readonly source: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly pattern: "^[a-z][A-Za-z0-9.-]*$";
+                        readonly description: "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.";
+                    };
+                    readonly derivedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it.";
+                    };
+                };
+            }];
+        };
+        readonly ProofRung: {
+            readonly title: "ProofRung";
+            readonly description: "How strongly a credential-backed claim is hidden when presented, ordered most private first. `predicate` proves a statement over a claim without disclosing the claim. `derived` discloses exactly the claims needed via an unlinkable derived proof, so two presentations cannot be joined. `selectiveDisclosure` discloses exactly the claims needed but carries the issuer's signature unchanged, so two presentations ARE linkable. `whole` discloses the entire credential.\n\nThe distinction between the first two and the last two is of kind, not degree: only `predicate` and `derived` avoid handing two verifiers a join key. A maintainer MUST default to the highest rung the credential's format supports, and MUST NOT silently fall to a lower one — a request that cannot be satisfied at the rung a producer asked for is refused, because a silent privacy downgrade discloses material the holder believed was hidden.";
+            readonly type: "string";
+            readonly enum: readonly ["predicate", "derived", "selectiveDisclosure", "whole"];
+        };
+        readonly ValueType: {
+            readonly title: "ValueType";
+            readonly description: "The JSON shape of `value`, declared so that a consumer can render and compare without guessing. The maintainer validates that `value` agrees with this member and does nothing further: it does NOT validate a phone number against a phone-number grammar. That is a producer's affordance, and a store that grows opinions about the contents of its records eventually blocks its consumer's release.";
+            readonly type: "string";
+            readonly enum: readonly ["string", "number", "boolean", "date", "object"];
+        };
+        readonly ClaimType: {
+            readonly title: "ClaimType";
+            readonly description: "The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.\n\nThe token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.\n\nThe `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly pattern: "^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/persona/attribute/put/1.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/persona/attribute/put/1.1";
+        readonly title: "Persona Attribute Put — payload";
+        readonly description: "Create or replace one attribute in the holder's pool. Omit `attributeId` to create; supply it to replace. `expectedVersion` makes the write conditional.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["type", "valueType", "value", "provenance"];
+        readonly properties: {
+            readonly attributeId: {
+                readonly $ref: "#/$defs/Ulid";
+                readonly description: "Omit to create — the maintainer assigns one and returns it. Supply to replace an existing attribute, or to make a create idempotent under retry; a supplied id that already exists is a replacement, and a producer that meant to create MUST pair it with `expectedVersion: 0`.";
+            };
+            readonly type: {
+                readonly $ref: "#/$defs/ClaimType";
+            };
+            readonly valueType: {
+                readonly $ref: "#/$defs/ValueType";
+            };
+            readonly value: {
+                readonly description: "The fact itself. MUST agree with `valueType`; a maintainer MUST refuse a document where it does not. For a `credentialBacked` provenance this is the initial display cache — the maintainer re-derives it from the credential and MAY overwrite what was supplied.";
+            };
+            readonly label: {
+                readonly type: "string";
+                readonly maxLength: 128;
+                readonly description: "The holder's own words, for their own picker. Never disclosed to a verifier.";
+            };
+            readonly provenance: {
+                readonly $ref: "#/$defs/Provenance";
+            };
+            readonly endorsements: {
+                readonly type: "array";
+                readonly maxItems: 64;
+                readonly uniqueItems: true;
+                readonly items: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly description: "Vault identifiers of credentials in which a third party endorses this value. Inventory, not evidence — see the `endorsements` member of the shared Attribute. Replaced whole by each put; omit or send empty for none.";
+            };
+            readonly sensitivity: {
+                readonly $ref: "#/$defs/Sensitivity";
+                readonly description: "How carefully this value is shown to the holder. OPTIONAL, and its absence is meaningful: it records that the holder made no explicit decision, so a consumer resolves it from the claim-type registry. Sending the resolved value back would freeze it — a later tightening of the registry would then protect new attributes and leave this one exposed.";
+            };
+            readonly release: {
+                readonly $ref: "#/$defs/ReleaseRequirement";
+                readonly description: "What it takes to disclose this value. OPTIONAL, with the same meaning for absence as `sensitivity`.";
+            };
+            readonly expectedVersion: {
+                readonly $ref: "#/$defs/ExpectedVersion";
+                readonly description: "Optional precondition. Omit for last-writer-wins. Supply the version a prior read returned to make the write conditional; supply 0 to create only.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Persona Attribute Put — response payload";
+                readonly description: "Success response to persona/attribute/put. Type https://trusttasks.org/spec/persona/attribute/put/1.1#response. A failed precondition is not a success: it is a trust-task-error carrying persona/attribute/put:versionConflict, whose details carry the maintainer's current version and value.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["attributeId", "version", "wasCreated", "updatedAt"];
+                readonly properties: {
+                    readonly attributeId: {
+                        readonly $ref: "#/$defs/Ulid";
+                    };
+                    readonly version: {
+                        readonly $ref: "#/$defs/Version";
+                    };
+                    readonly wasCreated: {
+                        readonly type: "boolean";
+                        readonly description: "True when this write created the attribute, false when it replaced one. A producer that omitted `attributeId` can still be told which happened, because a retried create with a supplied id is a replacement.";
+                    };
+                    readonly correlation: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["severity"];
+                        readonly description: "Advisory result of the correlation check the maintainer runs over the new value (see persona/correlation/analyze). Returned on the write so a producer's builder can warn at the moment of composition rather than requiring a second round trip. Advisory only: the write has already applied, and a maintainer MUST NOT refuse a write on correlation grounds — the holder decides.";
+                        readonly properties: {
+                            readonly severity: {
+                                readonly type: "string";
+                                readonly enum: readonly ["none", "low", "high"];
+                            };
+                            readonly sharedWithProfileCount: {
+                                readonly type: "integer";
+                                readonly minimum: 0;
+                                readonly description: "How many other profiles already present this exact value. A count, not identifiers — the identifiers are available from the analyze task, which is where a producer should go to render remedies.";
+                            };
+                        };
+                    };
+                    readonly refreshed: {
+                        readonly type: "array";
+                        readonly maxItems: 256;
+                        readonly description: "Every place this write changed what a persona presents: each binding whose projection was re-pushed because a face wearing it shows this attribute live. An edit propagates by design, and a holder told only that it saved cannot tell whether it refreshed one face or nine. Holder-authorized, so identifiers are returned. Absent when nothing was bound to a face showing it.";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["profileId", "contextId", "personaDid"];
+                            readonly properties: {
+                                readonly profileId: {
+                                    readonly $ref: "#/$defs/Ulid";
+                                };
+                                readonly contextId: {
+                                    readonly type: "string";
+                                    readonly minLength: 1;
+                                };
+                                readonly personaDid: {
+                                    readonly type: "string";
+                                    readonly minLength: 1;
+                                };
+                            };
+                        };
+                    };
+                    readonly heldByPin: {
+                        readonly type: "array";
+                        readonly maxItems: 256;
+                        readonly description: "Faces that pin this attribute to an earlier version and so did NOT follow the edit — the counterparties that must keep seeing the value they verified. Named so the holder can decide, per face, whether that is still what they want. Absent when no face pins it.";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["profileId", "pinVersion"];
+                            readonly properties: {
+                                readonly profileId: {
+                                    readonly $ref: "#/$defs/Ulid";
+                                };
+                                readonly pinVersion: {
+                                    readonly $ref: "#/$defs/Version";
+                                };
+                            };
+                        };
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Version: {
+                readonly title: "Version";
+                readonly description: "A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.";
+                readonly type: "integer";
+                readonly minimum: 1;
+            };
+            readonly Ulid: {
+                readonly title: "Ulid";
+                readonly description: "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.";
+                readonly type: "string";
+                readonly pattern: "^[0-9A-HJKMNP-TV-Z]{26}$";
+            };
+            readonly ExpectedVersion: {
+                readonly title: "ExpectedVersion";
+                readonly description: "Optimistic-concurrency precondition. A positive value requires the record's current `version` to equal it exactly; zero means create-only and applies only when no live record exists at the address.";
+                readonly type: "integer";
+                readonly minimum: 0;
+            };
+            readonly ReleaseRequirement: {
+                readonly title: "ReleaseRequirement";
+                readonly description: "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.";
+                readonly type: "string";
+                readonly enum: readonly ["consent", "stepUp"];
+            };
+            readonly Sensitivity: {
+                readonly title: "Sensitivity";
+                readonly description: "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.";
+                readonly type: "string";
+                readonly enum: readonly ["normal", "high"];
+            };
+            readonly Provenance: {
+                readonly title: "Provenance";
+                readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.";
+                readonly type: "object";
+                readonly required: readonly ["kind"];
+                readonly oneOf: readonly [{
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "selfAsserted";
+                        };
+                    };
+                }, {
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "credentialId", "claimPath"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "credentialBacked";
+                        };
+                        readonly credentialId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly description: "Vault identifier of the backing credential.";
+                        };
+                        readonly claimPath: {
+                            readonly type: "string";
+                            readonly pattern: "^(/[^/~]*(~[01][^/~]*)*)*$";
+                            readonly description: "RFC 6901 JSON Pointer to the claim within the credential, e.g. `/credentialSubject/familyName`.";
+                        };
+                        readonly issuerDid: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly description: "Issuer of the backing credential. Advisory: a consumer MUST verify the credential rather than trusting this member.";
+                        };
+                        readonly proof: {
+                            readonly $ref: "#/$defs/ProofRung";
+                            readonly description: "The disclosure rung this claim was, or will be, presented at.";
+                        };
+                    };
+                }, {
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "generator"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "generated";
+                        };
+                        readonly generator: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 64;
+                            readonly description: "Names the minting scheme, e.g. `relayEmail`. Maintainer-defined.";
+                        };
+                        readonly perVerifier: {
+                            readonly type: "boolean";
+                            readonly default: true;
+                            readonly description: "When true (the default and the only useful setting), a distinct value is minted for each verifier.";
+                        };
+                    };
+                }, {
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "source", "derivedAt"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "derived";
+                        };
+                        readonly source: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 64;
+                            readonly pattern: "^[a-z][A-Za-z0-9.-]*$";
+                            readonly description: "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.";
+                        };
+                        readonly derivedAt: {
+                            readonly type: "string";
+                            readonly format: "date-time";
+                            readonly description: "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it.";
+                        };
+                    };
+                }];
+            };
+            readonly ProofRung: {
+                readonly title: "ProofRung";
+                readonly description: "How strongly a credential-backed claim is hidden when presented, ordered most private first. `predicate` proves a statement over a claim without disclosing the claim. `derived` discloses exactly the claims needed via an unlinkable derived proof, so two presentations cannot be joined. `selectiveDisclosure` discloses exactly the claims needed but carries the issuer's signature unchanged, so two presentations ARE linkable. `whole` discloses the entire credential.\n\nThe distinction between the first two and the last two is of kind, not degree: only `predicate` and `derived` avoid handing two verifiers a join key. A maintainer MUST default to the highest rung the credential's format supports, and MUST NOT silently fall to a lower one — a request that cannot be satisfied at the rung a producer asked for is refused, because a silent privacy downgrade discloses material the holder believed was hidden.";
+                readonly type: "string";
+                readonly enum: readonly ["predicate", "derived", "selectiveDisclosure", "whole"];
+            };
+            readonly ValueType: {
+                readonly title: "ValueType";
+                readonly description: "The JSON shape of `value`, declared so that a consumer can render and compare without guessing. The maintainer validates that `value` agrees with this member and does nothing further: it does NOT validate a phone number against a phone-number grammar. That is a producer's affordance, and a store that grows opinions about the contents of its records eventually blocks its consumer's release.";
+                readonly type: "string";
+                readonly enum: readonly ["string", "number", "boolean", "date", "object"];
+            };
+            readonly ClaimType: {
+                readonly title: "ClaimType";
+                readonly description: "The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.\n\nThe token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.\n\nThe `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly pattern: "^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/persona/attribute/put/1.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Persona Attribute Put — response payload";
+                readonly description: "Success response to persona/attribute/put. Type https://trusttasks.org/spec/persona/attribute/put/1.1#response. A failed precondition is not a success: it is a trust-task-error carrying persona/attribute/put:versionConflict, whose details carry the maintainer's current version and value.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["attributeId", "version", "wasCreated", "updatedAt"];
+                readonly properties: {
+                    readonly attributeId: {
+                        readonly $ref: "#/$defs/Ulid";
+                    };
+                    readonly version: {
+                        readonly $ref: "#/$defs/Version";
+                    };
+                    readonly wasCreated: {
+                        readonly type: "boolean";
+                        readonly description: "True when this write created the attribute, false when it replaced one. A producer that omitted `attributeId` can still be told which happened, because a retried create with a supplied id is a replacement.";
+                    };
+                    readonly correlation: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["severity"];
+                        readonly description: "Advisory result of the correlation check the maintainer runs over the new value (see persona/correlation/analyze). Returned on the write so a producer's builder can warn at the moment of composition rather than requiring a second round trip. Advisory only: the write has already applied, and a maintainer MUST NOT refuse a write on correlation grounds — the holder decides.";
+                        readonly properties: {
+                            readonly severity: {
+                                readonly type: "string";
+                                readonly enum: readonly ["none", "low", "high"];
+                            };
+                            readonly sharedWithProfileCount: {
+                                readonly type: "integer";
+                                readonly minimum: 0;
+                                readonly description: "How many other profiles already present this exact value. A count, not identifiers — the identifiers are available from the analyze task, which is where a producer should go to render remedies.";
+                            };
+                        };
+                    };
+                    readonly refreshed: {
+                        readonly type: "array";
+                        readonly maxItems: 256;
+                        readonly description: "Every place this write changed what a persona presents: each binding whose projection was re-pushed because a face wearing it shows this attribute live. An edit propagates by design, and a holder told only that it saved cannot tell whether it refreshed one face or nine. Holder-authorized, so identifiers are returned. Absent when nothing was bound to a face showing it.";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["profileId", "contextId", "personaDid"];
+                            readonly properties: {
+                                readonly profileId: {
+                                    readonly $ref: "#/$defs/Ulid";
+                                };
+                                readonly contextId: {
+                                    readonly type: "string";
+                                    readonly minLength: 1;
+                                };
+                                readonly personaDid: {
+                                    readonly type: "string";
+                                    readonly minLength: 1;
+                                };
+                            };
+                        };
+                    };
+                    readonly heldByPin: {
+                        readonly type: "array";
+                        readonly maxItems: 256;
+                        readonly description: "Faces that pin this attribute to an earlier version and so did NOT follow the edit — the counterparties that must keep seeing the value they verified. Named so the holder can decide, per face, whether that is still what they want. Absent when no face pins it.";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["profileId", "pinVersion"];
+                            readonly properties: {
+                                readonly profileId: {
+                                    readonly $ref: "#/$defs/Ulid";
+                                };
+                                readonly pinVersion: {
+                                    readonly $ref: "#/$defs/Version";
+                                };
+                            };
+                        };
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Version: {
+                readonly title: "Version";
+                readonly description: "A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.";
+                readonly type: "integer";
+                readonly minimum: 1;
+            };
+            readonly Ulid: {
+                readonly title: "Ulid";
+                readonly description: "A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.";
+                readonly type: "string";
+                readonly pattern: "^[0-9A-HJKMNP-TV-Z]{26}$";
+            };
+            readonly ExpectedVersion: {
+                readonly title: "ExpectedVersion";
+                readonly description: "Optimistic-concurrency precondition. A positive value requires the record's current `version` to equal it exactly; zero means create-only and applies only when no live record exists at the address.";
+                readonly type: "integer";
+                readonly minimum: 0;
+            };
+            readonly ReleaseRequirement: {
+                readonly title: "ReleaseRequirement";
+                readonly description: "What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\n\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\n\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \"each time\" degrades into \"once per login\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\n\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.";
+                readonly type: "string";
+                readonly enum: readonly ["consent", "stepUp"];
+            };
+            readonly Sensitivity: {
+                readonly title: "Sensitivity";
+                readonly description: "How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\n\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\n\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.";
+                readonly type: "string";
+                readonly enum: readonly ["normal", "high"];
+            };
+            readonly Provenance: {
+                readonly title: "Provenance";
+                readonly description: "Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\n\n`selfAsserted` — the holder supplied it.\n\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\n\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\n\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\n\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.";
+                readonly type: "object";
+                readonly required: readonly ["kind"];
+                readonly oneOf: readonly [{
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "selfAsserted";
+                        };
+                    };
+                }, {
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "credentialId", "claimPath"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "credentialBacked";
+                        };
+                        readonly credentialId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly description: "Vault identifier of the backing credential.";
+                        };
+                        readonly claimPath: {
+                            readonly type: "string";
+                            readonly pattern: "^(/[^/~]*(~[01][^/~]*)*)*$";
+                            readonly description: "RFC 6901 JSON Pointer to the claim within the credential, e.g. `/credentialSubject/familyName`.";
+                        };
+                        readonly issuerDid: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly description: "Issuer of the backing credential. Advisory: a consumer MUST verify the credential rather than trusting this member.";
+                        };
+                        readonly proof: {
+                            readonly $ref: "#/$defs/ProofRung";
+                            readonly description: "The disclosure rung this claim was, or will be, presented at.";
+                        };
+                    };
+                }, {
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "generator"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "generated";
+                        };
+                        readonly generator: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 64;
+                            readonly description: "Names the minting scheme, e.g. `relayEmail`. Maintainer-defined.";
+                        };
+                        readonly perVerifier: {
+                            readonly type: "boolean";
+                            readonly default: true;
+                            readonly description: "When true (the default and the only useful setting), a distinct value is minted for each verifier.";
+                        };
+                    };
+                }, {
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kind", "source", "derivedAt"];
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "derived";
+                        };
+                        readonly source: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 64;
+                            readonly pattern: "^[a-z][A-Za-z0-9.-]*$";
+                            readonly description: "The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.";
+                        };
+                        readonly derivedAt: {
+                            readonly type: "string";
+                            readonly format: "date-time";
+                            readonly description: "When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it.";
+                        };
+                    };
+                }];
+            };
+            readonly ProofRung: {
+                readonly title: "ProofRung";
+                readonly description: "How strongly a credential-backed claim is hidden when presented, ordered most private first. `predicate` proves a statement over a claim without disclosing the claim. `derived` discloses exactly the claims needed via an unlinkable derived proof, so two presentations cannot be joined. `selectiveDisclosure` discloses exactly the claims needed but carries the issuer's signature unchanged, so two presentations ARE linkable. `whole` discloses the entire credential.\n\nThe distinction between the first two and the last two is of kind, not degree: only `predicate` and `derived` avoid handing two verifiers a join key. A maintainer MUST default to the highest rung the credential's format supports, and MUST NOT silently fall to a lower one — a request that cannot be satisfied at the rung a producer asked for is refused, because a silent privacy downgrade discloses material the holder believed was hidden.";
+                readonly type: "string";
+                readonly enum: readonly ["predicate", "derived", "selectiveDisclosure", "whole"];
+            };
+            readonly ValueType: {
+                readonly title: "ValueType";
+                readonly description: "The JSON shape of `value`, declared so that a consumer can render and compare without guessing. The maintainer validates that `value` agrees with this member and does nothing further: it does NOT validate a phone number against a phone-number grammar. That is a producer's affordance, and a store that grows opinions about the contents of its records eventually blocks its consumer's release.";
+                readonly type: "string";
+                readonly enum: readonly ["string", "number", "boolean", "date", "object"];
+            };
+            readonly ClaimType: {
+                readonly title: "ClaimType";
+                readonly description: "The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.\n\nThe token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.\n\nThe `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly pattern: "^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map