@openvtc/trust-tasks 0.27.5 → 0.27.7

package/dist/vtc/storage/configs/create/0.3/payload.js

@@ -0,0 +1,797 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/storage/configs/create/0.3/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/storage/configs/create/0.3";
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS = null;
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION = null;
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/storage/configs/create/0.3#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/vtc/storage/configs/create/0.3",
+    "title": "VTC Storage — Configs — Create — payload",
+    "description": "Add a storage config: a named backend and how the community authenticates to it. Never a secret. The outer document members are owned by the framework — SPEC §6.3.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "id",
+        "label",
+        "settings",
+        "reason"
+    ],
+    "properties": {
+        "id": {
+            "$ref": "#/$defs/StorageConfigId"
+        },
+        "label": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "description": "A display name for administrators and, with the kind, for a room's creator."
+        },
+        "settings": {
+            "$ref": "#/$defs/StorageSettings"
+        },
+        "auth": {
+            "$ref": "#/$defs/StorageAuth"
+        },
+        "capacityBytes": {
+            "type": "integer",
+            "minimum": 0,
+            "description": "Total ciphertext bytes the community will store on this config across every room. Absent means none set."
+        },
+        "isDefault": {
+            "type": "boolean",
+            "description": "Make this the config rooms are assigned to when neither policy nor creator names one."
+        },
+        "reason": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 500,
+            "description": "Why the administrator is making this change. Recorded with the change in the audit trail and shown to approvers. Attributed to its author on every surface and untrusted: it MUST NOT carry personal data or a credential, and a reader MUST NOT treat it as instructions."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTC Storage — Configs — Create — response payload",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "config"
+            ],
+            "properties": {
+                "config": {
+                    "$ref": "#/$defs/StorageConfig"
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "StorageConfig": {
+            "title": "StorageConfig",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "label",
+                "settings",
+                "state",
+                "createdBy",
+                "createdAt"
+            ],
+            "description": "One storage config as the community holds it. Carries no secret.",
+            "properties": {
+                "id": {
+                    "$ref": "#/$defs/StorageConfigId"
+                },
+                "label": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 128,
+                    "description": "A display name for administrators (`EU — S3 (main account)`). Shown to a room's creator with the config's kind when the community lets them choose."
+                },
+                "settings": {
+                    "$ref": "#/$defs/StorageSettings"
+                },
+                "auth": {
+                    "$ref": "#/$defs/StorageAuth"
+                },
+                "capacityBytes": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "Total ciphertext bytes the community will store on this config, across every room assigned to it. A capacity, not a policy: an upload that would cross it is refused with scope `storage`. Absent means no capacity set."
+                },
+                "state": {
+                    "$ref": "#/$defs/ConfigState"
+                },
+                "isDefault": {
+                    "type": "boolean",
+                    "description": "True for the config a room is assigned to when neither the community's policy nor its creator names one."
+                },
+                "createdBy": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048
+                },
+                "createdAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "updatedBy": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048
+                },
+                "updatedAt": {
+                    "type": "string",
+                    "format": "date-time"
+                }
+            }
+        },
+        "ConfigState": {
+            "title": "ConfigState",
+            "type": "string",
+            "enum": [
+                "active",
+                "draining",
+                "retired"
+            ],
+            "description": "`active`: accepts new rooms and new uploads. `draining`: retired by an administrator while blobs still name it — refuses new rooms and new uploads, keeps serving reads, and becomes `retired` when a migration has emptied it. `retired`: refuses new rooms and new uploads and holds no blob. A config is never deleted while a blob names it."
+        },
+        "StorageAuth": {
+            "title": "StorageAuth",
+            "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself under the rules of vtc/storage/configs/create/0.2 — on `s3`, by assuming `roleArn` (or the role the host is configured with) with an inline session policy; on `gcs`, by a Credential Access Boundary. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`; `roleArn` is valid only on `s3`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set (0.2: a `SealedStorageCredential`). Protects against every administrator through every surface the community offers; does NOT protect against whoever operates the machine, and a community labels it so wherever the config is shown.\n\n`ambient` and `sealed` are host-operator choices: a community MAY refuse either by its own host configuration, whatever its administrators ask.",
+            "oneOf": [
+                {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "mode",
+                        "context",
+                        "account"
+                    ],
+                    "properties": {
+                        "mode": {
+                            "const": "vta-account"
+                        },
+                        "context": {
+                            "$ref": "#/$defs/ExternalAccountContextId"
+                        },
+                        "account": {
+                            "$ref": "#/$defs/ExternalAccountId"
+                        }
+                    }
+                },
+                {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "mode"
+                    ],
+                    "properties": {
+                        "mode": {
+                            "const": "ambient"
+                        },
+                        "roleArn": {
+                            "$ref": "#/$defs/AwsRoleArn",
+                            "description": "`s3` only: the IAM role the community assumes, with the machine's ambient identity, to obtain each room-scoped session. Absent, the community assumes the role its host configuration names, and with none configured, the role of the ambient identity itself (which must then trust itself to be assumed). Refused on any other kind with `authNotAllowed`."
+                        }
+                    }
+                },
+                {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "mode"
+                    ],
+                    "properties": {
+                        "mode": {
+                            "const": "sealed"
+                        }
+                    }
+                }
+            ]
+        },
+        "AwsRoleArn": {
+            "title": "AwsRoleArn",
+            "type": "string",
+            "minLength": 20,
+            "maxLength": 2048,
+            "pattern": "^arn:aws(-[a-z]+)*:iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
+            "description": "The ARN of an AWS IAM role, in any AWS partition (`arn:aws:`, `arn:aws-cn:`, `arn:aws-us-gov:`). Validated here because the community passes it to STS AssumeRole and derives the partition of the session policy's resources from it; it must never carry anything but a role ARN."
+        },
+        "ExternalAccountId": {
+            "title": "ExternalAccountId",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64,
+            "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
+            "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
+        },
+        "ExternalAccountContextId": {
+            "title": "ExternalAccountContextId",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+        },
+        "StorageSettings": {
+            "title": "StorageSettings",
+            "description": "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.",
+            "oneOf": [
+                {
+                    "$ref": "#/$defs/LocalSettings"
+                },
+                {
+                    "$ref": "#/$defs/S3Settings"
+                },
+                {
+                    "$ref": "#/$defs/GcsSettings"
+                },
+                {
+                    "$ref": "#/$defs/WalrusSettings"
+                }
+            ]
+        },
+        "WalrusSettings": {
+            "title": "WalrusSettings",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "relayUrl",
+                "aggregatorUrl",
+                "epochs",
+                "extendBeforeEpochs"
+            ],
+            "properties": {
+                "kind": {
+                    "const": "walrus"
+                },
+                "relayUrl": {
+                    "type": "string",
+                    "format": "uri",
+                    "maxLength": 2048,
+                    "pattern": "^https://",
+                    "description": "The Walrus upload relay the community writes through. The community never runs a publisher: a publisher holds a hot wallet in its own configuration, which is the long-lived secret these tasks exist to avoid."
+                },
+                "aggregatorUrl": {
+                    "type": "string",
+                    "format": "uri",
+                    "maxLength": 2048,
+                    "pattern": "^https://",
+                    "description": "The Walrus aggregator the community reads through."
+                },
+                "epochs": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 53,
+                    "description": "Storage epochs to buy when a blob is registered. Walrus sells storage in epochs (two weeks on mainnet) and caps one purchase at 53."
+                },
+                "extendBeforeEpochs": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 52,
+                    "description": "How many epochs before a live blob's end epoch the community extends it. A blob that has become an orphan is not extended, and lapses: the Walrus form of deletion."
+                }
+            }
+        },
+        "GcsSettings": {
+            "title": "GcsSettings",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "bucket"
+            ],
+            "properties": {
+                "kind": {
+                    "const": "gcs"
+                },
+                "bucket": {
+                    "type": "string",
+                    "minLength": 3,
+                    "maxLength": 222,
+                    "pattern": "^[a-z0-9][a-z0-9._-]{1,220}[a-z0-9]$",
+                    "description": "The bucket name. Validated against GCS naming rules here, because it is placed in a Credential Access Boundary condition and must never carry anything but a name."
+                },
+                "prefix": {
+                    "$ref": "#/$defs/ObjectPrefix"
+                }
+            }
+        },
+        "ObjectPrefix": {
+            "title": "ObjectPrefix",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "pattern": "^[A-Za-z0-9!_.*'()/-]+/$",
+            "description": "A key prefix inside the bucket, ending in `/`, under which the config's `rooms/` tree is placed. Restricted to the S3 safe-character set so that it can be placed in a downscoped policy without escaping."
+        },
+        "S3Settings": {
+            "title": "S3Settings",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "region",
+                "bucket"
+            ],
+            "properties": {
+                "kind": {
+                    "const": "s3"
+                },
+                "endpoint": {
+                    "type": "string",
+                    "format": "uri",
+                    "maxLength": 2048,
+                    "pattern": "^https://",
+                    "description": "The S3 API endpoint, for a store other than AWS (R2, B2, MinIO). Absent means AWS S3 in `region`. HTTPS only."
+                },
+                "region": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 64,
+                    "pattern": "^[a-z0-9-]+$",
+                    "description": "The bucket's region, as the store names it (`eu-west-1`; `auto` for R2)."
+                },
+                "bucket": {
+                    "type": "string",
+                    "minLength": 3,
+                    "maxLength": 63,
+                    "pattern": "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$",
+                    "description": "The bucket name. Validated against S3 naming rules here, because it is placed in downscoped session policies and must never carry anything but a name."
+                },
+                "prefix": {
+                    "$ref": "#/$defs/ObjectPrefix"
+                },
+                "pathStyle": {
+                    "type": "boolean",
+                    "description": "Address the bucket in the path rather than the host name, as MinIO usually needs. Absent means virtual-hosted style."
+                }
+            }
+        },
+        "LocalSettings": {
+            "title": "LocalSettings",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "root"
+            ],
+            "properties": {
+                "kind": {
+                    "const": "local"
+                },
+                "root": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 1024,
+                    "pattern": "^/",
+                    "description": "Absolute path of the directory the community writes blobs under, on its own host. Created owner-only. Not carried by the community's backup: back it up beside it."
+                }
+            }
+        },
+        "StorageConfigId": {
+            "title": "StorageConfigId",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64,
+            "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
+            "description": "A storage config's identifier, chosen by the administrator who creates it and immutable thereafter: lowercase letters, digits and inner hyphens, at most 64 characters (`eu-s3-primary`, `walrus-main`). Unique within the community. Never reused after a config is retired, because blobs name their config by this value."
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTC Storage — Configs — Create — response payload",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "config"
+            ],
+            "properties": {
+                "config": {
+                    "$ref": "#/$defs/StorageConfig"
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "StorageConfig": {
+            "title": "StorageConfig",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "id",
+                "label",
+                "settings",
+                "state",
+                "createdBy",
+                "createdAt"
+            ],
+            "description": "One storage config as the community holds it. Carries no secret.",
+            "properties": {
+                "id": {
+                    "$ref": "#/$defs/StorageConfigId"
+                },
+                "label": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 128,
+                    "description": "A display name for administrators (`EU — S3 (main account)`). Shown to a room's creator with the config's kind when the community lets them choose."
+                },
+                "settings": {
+                    "$ref": "#/$defs/StorageSettings"
+                },
+                "auth": {
+                    "$ref": "#/$defs/StorageAuth"
+                },
+                "capacityBytes": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "Total ciphertext bytes the community will store on this config, across every room assigned to it. A capacity, not a policy: an upload that would cross it is refused with scope `storage`. Absent means no capacity set."
+                },
+                "state": {
+                    "$ref": "#/$defs/ConfigState"
+                },
+                "isDefault": {
+                    "type": "boolean",
+                    "description": "True for the config a room is assigned to when neither the community's policy nor its creator names one."
+                },
+                "createdBy": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048
+                },
+                "createdAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "updatedBy": {
+                    "type": "string",
+                    "pattern": "^did:",
+                    "maxLength": 2048
+                },
+                "updatedAt": {
+                    "type": "string",
+                    "format": "date-time"
+                }
+            }
+        },
+        "ConfigState": {
+            "title": "ConfigState",
+            "type": "string",
+            "enum": [
+                "active",
+                "draining",
+                "retired"
+            ],
+            "description": "`active`: accepts new rooms and new uploads. `draining`: retired by an administrator while blobs still name it — refuses new rooms and new uploads, keeps serving reads, and becomes `retired` when a migration has emptied it. `retired`: refuses new rooms and new uploads and holds no blob. A config is never deleted while a blob names it."
+        },
+        "StorageAuth": {
+            "title": "StorageAuth",
+            "description": "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself under the rules of vtc/storage/configs/create/0.2 — on `s3`, by assuming `roleArn` (or the role the host is configured with) with an inline session policy; on `gcs`, by a Credential Access Boundary. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`; `roleArn` is valid only on `s3`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set (0.2: a `SealedStorageCredential`). Protects against every administrator through every surface the community offers; does NOT protect against whoever operates the machine, and a community labels it so wherever the config is shown.\n\n`ambient` and `sealed` are host-operator choices: a community MAY refuse either by its own host configuration, whatever its administrators ask.",
+            "oneOf": [
+                {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "mode",
+                        "context",
+                        "account"
+                    ],
+                    "properties": {
+                        "mode": {
+                            "const": "vta-account"
+                        },
+                        "context": {
+                            "$ref": "#/$defs/ExternalAccountContextId"
+                        },
+                        "account": {
+                            "$ref": "#/$defs/ExternalAccountId"
+                        }
+                    }
+                },
+                {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "mode"
+                    ],
+                    "properties": {
+                        "mode": {
+                            "const": "ambient"
+                        },
+                        "roleArn": {
+                            "$ref": "#/$defs/AwsRoleArn",
+                            "description": "`s3` only: the IAM role the community assumes, with the machine's ambient identity, to obtain each room-scoped session. Absent, the community assumes the role its host configuration names, and with none configured, the role of the ambient identity itself (which must then trust itself to be assumed). Refused on any other kind with `authNotAllowed`."
+                        }
+                    }
+                },
+                {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": [
+                        "mode"
+                    ],
+                    "properties": {
+                        "mode": {
+                            "const": "sealed"
+                        }
+                    }
+                }
+            ]
+        },
+        "AwsRoleArn": {
+            "title": "AwsRoleArn",
+            "type": "string",
+            "minLength": 20,
+            "maxLength": 2048,
+            "pattern": "^arn:aws(-[a-z]+)*:iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
+            "description": "The ARN of an AWS IAM role, in any AWS partition (`arn:aws:`, `arn:aws-cn:`, `arn:aws-us-gov:`). Validated here because the community passes it to STS AssumeRole and derives the partition of the session policy's resources from it; it must never carry anything but a role ARN."
+        },
+        "ExternalAccountId": {
+            "title": "ExternalAccountId",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64,
+            "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
+            "description": "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself."
+        },
+        "ExternalAccountContextId": {
+            "title": "ExternalAccountContextId",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "description": "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate."
+        },
+        "StorageSettings": {
+            "title": "StorageSettings",
+            "description": "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.",
+            "oneOf": [
+                {
+                    "$ref": "#/$defs/LocalSettings"
+                },
+                {
+                    "$ref": "#/$defs/S3Settings"
+                },
+                {
+                    "$ref": "#/$defs/GcsSettings"
+                },
+                {
+                    "$ref": "#/$defs/WalrusSettings"
+                }
+            ]
+        },
+        "WalrusSettings": {
+            "title": "WalrusSettings",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "relayUrl",
+                "aggregatorUrl",
+                "epochs",
+                "extendBeforeEpochs"
+            ],
+            "properties": {
+                "kind": {
+                    "const": "walrus"
+                },
+                "relayUrl": {
+                    "type": "string",
+                    "format": "uri",
+                    "maxLength": 2048,
+                    "pattern": "^https://",
+                    "description": "The Walrus upload relay the community writes through. The community never runs a publisher: a publisher holds a hot wallet in its own configuration, which is the long-lived secret these tasks exist to avoid."
+                },
+                "aggregatorUrl": {
+                    "type": "string",
+                    "format": "uri",
+                    "maxLength": 2048,
+                    "pattern": "^https://",
+                    "description": "The Walrus aggregator the community reads through."
+                },
+                "epochs": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 53,
+                    "description": "Storage epochs to buy when a blob is registered. Walrus sells storage in epochs (two weeks on mainnet) and caps one purchase at 53."
+                },
+                "extendBeforeEpochs": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 52,
+                    "description": "How many epochs before a live blob's end epoch the community extends it. A blob that has become an orphan is not extended, and lapses: the Walrus form of deletion."
+                }
+            }
+        },
+        "GcsSettings": {
+            "title": "GcsSettings",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "bucket"
+            ],
+            "properties": {
+                "kind": {
+                    "const": "gcs"
+                },
+                "bucket": {
+                    "type": "string",
+                    "minLength": 3,
+                    "maxLength": 222,
+                    "pattern": "^[a-z0-9][a-z0-9._-]{1,220}[a-z0-9]$",
+                    "description": "The bucket name. Validated against GCS naming rules here, because it is placed in a Credential Access Boundary condition and must never carry anything but a name."
+                },
+                "prefix": {
+                    "$ref": "#/$defs/ObjectPrefix"
+                }
+            }
+        },
+        "ObjectPrefix": {
+            "title": "ObjectPrefix",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "pattern": "^[A-Za-z0-9!_.*'()/-]+/$",
+            "description": "A key prefix inside the bucket, ending in `/`, under which the config's `rooms/` tree is placed. Restricted to the S3 safe-character set so that it can be placed in a downscoped policy without escaping."
+        },
+        "S3Settings": {
+            "title": "S3Settings",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "region",
+                "bucket"
+            ],
+            "properties": {
+                "kind": {
+                    "const": "s3"
+                },
+                "endpoint": {
+                    "type": "string",
+                    "format": "uri",
+                    "maxLength": 2048,
+                    "pattern": "^https://",
+                    "description": "The S3 API endpoint, for a store other than AWS (R2, B2, MinIO). Absent means AWS S3 in `region`. HTTPS only."
+                },
+                "region": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 64,
+                    "pattern": "^[a-z0-9-]+$",
+                    "description": "The bucket's region, as the store names it (`eu-west-1`; `auto` for R2)."
+                },
+                "bucket": {
+                    "type": "string",
+                    "minLength": 3,
+                    "maxLength": 63,
+                    "pattern": "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$",
+                    "description": "The bucket name. Validated against S3 naming rules here, because it is placed in downscoped session policies and must never carry anything but a name."
+                },
+                "prefix": {
+                    "$ref": "#/$defs/ObjectPrefix"
+                },
+                "pathStyle": {
+                    "type": "boolean",
+                    "description": "Address the bucket in the path rather than the host name, as MinIO usually needs. Absent means virtual-hosted style."
+                }
+            }
+        },
+        "LocalSettings": {
+            "title": "LocalSettings",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind",
+                "root"
+            ],
+            "properties": {
+                "kind": {
+                    "const": "local"
+                },
+                "root": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 1024,
+                    "pattern": "^/",
+                    "description": "Absolute path of the directory the community writes blobs under, on its own host. Created owner-only. Not carried by the community's backup: back it up beside it."
+                }
+            }
+        },
+        "StorageConfigId": {
+            "title": "StorageConfigId",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64,
+            "pattern": "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
+            "description": "A storage config's identifier, chosen by the administrator who creates it and immutable thereafter: lowercase letters, digits and inner hyphens, at most 64 characters (`eu-s3-primary`, `walrus-main`). Unique within the community. Never reused after a config is retired, because blobs name their config by this value."
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: true,
+    isRecipientRequired: true,
+    isIssuedAtRequired: true,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map