@openvtc/trust-tasks 0.28.24 → 0.28.26

package/dist/rooms/owner/issue-authority/0.3/payload.d.ts

@@ -0,0 +1,557 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/rooms/owner/issue-authority/0.3/payload.schema.json
+ */
+import type { Ext, Purpose_AclV0_3 as Purpose, Purpose_AclV0_31, Purpose_AclV0_32, PurposeScope, PurposeScopeAny, PurposeScopeListed } from "../../../../_shared/components.js";
+export interface RoomsOwnerIssueAuthorityPayload {
+    /**
+     * The room whose identity issues this credential. The recipient MUST hold a signing key for it — it is signing AS the room, not as itself.
+     */
+    roomId: string;
+    /**
+     * Which held key signs. Named explicitly rather than looked up from `roomId`, because nothing maps a DID to a key it was minted with and inventing that mapping would add a lifecycle to get wrong. A key that is not the room's produces a credential that fails to verify against the room's DID document — loud, and at the first use rather than later.
+     */
+    signingKeyId: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+    /**
+     * The party this grants to. A chain ROOT: the room is the governing party, so this is the grant everything else descends from. A holder narrows their own grant with attenuation instead, which needs no issuer.
+     */
+    subject: string;
+    /**
+     * What the subject may do. MUST NOT be empty — an empty list confers nothing rather than everything, and a schema that allowed it would make the more dangerous reading available to a careless consumer. `curate` is not implied by `write`: pinning, deprecating and retracting are judgements over shared knowledge, not writes.
+     *
+     * @minItems 1
+     */
+    actions: ["read" | "write" | "curate" | "admin", ...("read" | "write" | "curate" | "admin")[]];
+    /**
+     * When the grant lapses. REQUIRED, and not merely recommended: nothing about the subject's current standing is consulted when an authority credential is verified, so a grant that never expires is authority nobody can withdraw by waiting. A verifier refuses a chain link carrying none, so a grant minted without one could not have been used. Changing what a party may do reissues this one small credential and leaves the membership edge alone, which is why the two are separate credentials.
+     */
+    validUntil: string;
+    /**
+     * OPTIONAL. What the subject may use the content it reads under this grant for (VTI-ACL-110): `{"scope": "any"}` or a non-empty list. Stated in the credential exactly as given; absent, the credential states none, which grants `any` — never `modelTraining`, which a grant must name.
+     */
+    purposes?: PurposeScope;
+}
+/**
+ * Success response to rooms/owner/issue-authority. Type https://trusttasks.org/spec/rooms/owner/issue-authority/0.2#response. The signed VAC, a chain root at the room's scope.
+ */
+export interface RoomsOwnerIssueAuthorityResponsePayload {
+    /**
+     * The signed Verifiable Authority Credential, serialised.
+     */
+    credential: string;
+    /**
+     * Its `id`.
+     */
+    credentialId: string;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Purpose, Purpose_AclV0_31, Purpose_AclV0_32, PurposeScope, PurposeScopeAny, PurposeScopeListed };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/rooms/owner/issue-authority/0.3";
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export declare const EXTENDS: string | null;
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export declare const DEPRECATION: string | null;
+/** Stable alias for this specification's request payload shape. */
+export type Payload = RoomsOwnerIssueAuthorityPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/rooms/owner/issue-authority/0.3#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = RoomsOwnerIssueAuthorityResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/rooms/owner/issue-authority/0.3";
+    readonly title: "Rooms Owner Issue Authority — payload";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["roomId", "signingKeyId", "subject", "actions", "validUntil"];
+    readonly properties: {
+        readonly roomId: {
+            readonly type: "string";
+            readonly description: "The room whose identity issues this credential. The recipient MUST hold a signing key for it — it is signing AS the room, not as itself.";
+        };
+        readonly signingKeyId: {
+            readonly type: "string";
+            readonly maxLength: 256;
+            readonly description: "Which held key signs. Named explicitly rather than looked up from `roomId`, because nothing maps a DID to a key it was minted with and inventing that mapping would add a lifecycle to get wrong. A key that is not the room's produces a credential that fails to verify against the room's DID document — loud, and at the first use rather than later.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+        readonly subject: {
+            readonly type: "string";
+            readonly description: "The party this grants to. A chain ROOT: the room is the governing party, so this is the grant everything else descends from. A holder narrows their own grant with attenuation instead, which needs no issuer.";
+        };
+        readonly actions: {
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly items: {
+                readonly type: "string";
+                readonly enum: readonly ["read", "write", "curate", "admin"];
+            };
+            readonly description: "What the subject may do. MUST NOT be empty — an empty list confers nothing rather than everything, and a schema that allowed it would make the more dangerous reading available to a careless consumer. `curate` is not implied by `write`: pinning, deprecating and retracting are judgements over shared knowledge, not writes.";
+        };
+        readonly validUntil: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly description: "When the grant lapses. REQUIRED, and not merely recommended: nothing about the subject's current standing is consulted when an authority credential is verified, so a grant that never expires is authority nobody can withdraw by waiting. A verifier refuses a chain link carrying none, so a grant minted without one could not have been used. Changing what a party may do reissues this one small credential and leaves the membership edge alone, which is why the two are separate credentials.";
+        };
+        readonly purposes: {
+            readonly $ref: "#/$defs/PurposeScope";
+            readonly description: "OPTIONAL. What the subject may use the content it reads under this grant for (VTI-ACL-110): `{\"scope\": \"any\"}` or a non-empty list. Stated in the credential exactly as given; absent, the credential states none, which grants `any` — never `modelTraining`, which a grant must name.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Rooms Owner Issue Authority — response payload";
+            readonly description: "Success response to rooms/owner/issue-authority. Type https://trusttasks.org/spec/rooms/owner/issue-authority/0.2#response. The signed VAC, a chain root at the room's scope.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["credential", "credentialId"];
+            readonly properties: {
+                readonly credential: {
+                    readonly type: "string";
+                    readonly description: "The signed Verifiable Authority Credential, serialised.";
+                };
+                readonly credentialId: {
+                    readonly type: "string";
+                    readonly description: "Its `id`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly PurposeScope: {
+            readonly title: "PurposeScope";
+            readonly description: "An explicit purpose scope. Exactly one of two shapes, discriminated by `scope`: `any`, or `listed` with a NON-EMPTY list of purposes. The empty list is invalid, not a third shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/PurposeScopeAny";
+            }, {
+                readonly $ref: "#/$defs/PurposeScopeListed";
+            }];
+        };
+        readonly PurposeScopeListed: {
+            readonly title: "PurposeScopeListed";
+            readonly description: "Exactly the listed purposes. A request naming any other purpose is refused.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "purposes"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly purposes: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 32;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/Purpose";
+                    };
+                    readonly description: "Non-empty set of purposes. An empty array is invalid (it is not `any`).";
+                };
+            };
+        };
+        readonly Purpose: {
+            readonly title: "Purpose";
+            readonly description: "What content is used for: a lowerCamelCase name registered in the VTI specification's purpose registry (Appendix H) — `personalisation`, `taskExecution`, `analytics`, `modelTraining` at the time of writing — or an absolute IRI naming a purpose defined elsewhere, such as a purpose of the W3C Data Privacy Vocabulary (`https://w3id.org/dpv#ServicePersonalisation`). Compared by exact string equality: a consumer MUST NOT treat a purpose it does not recognise as equal to any other, and grants only a request naming exactly a listed purpose (VTI-ACL-109). A registered name is never an IRI, because it contains no `:`.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly anyOf: readonly [{
+                readonly pattern: "^[a-z][a-zA-Z0-9]{0,63}$";
+            }, {
+                readonly pattern: "^[a-zA-Z][a-zA-Z0-9+.-]*:[^\\s]+$";
+            }];
+        };
+        readonly PurposeScopeAny: {
+            readonly title: "PurposeScopeAny";
+            readonly description: "Any purpose except `modelTraining` (training, fine-tuning or evaluating a machine-learning model on the content), which `any` never grants (VTI-ACL-105).";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "any";
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Rooms Owner Issue Authority — response payload";
+            readonly description: "Success response to rooms/owner/issue-authority. Type https://trusttasks.org/spec/rooms/owner/issue-authority/0.2#response. The signed VAC, a chain root at the room's scope.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["credential", "credentialId"];
+            readonly properties: {
+                readonly credential: {
+                    readonly type: "string";
+                    readonly description: "The signed Verifiable Authority Credential, serialised.";
+                };
+                readonly credentialId: {
+                    readonly type: "string";
+                    readonly description: "Its `id`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly PurposeScope: {
+            readonly title: "PurposeScope";
+            readonly description: "An explicit purpose scope. Exactly one of two shapes, discriminated by `scope`: `any`, or `listed` with a NON-EMPTY list of purposes. The empty list is invalid, not a third shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/PurposeScopeAny";
+            }, {
+                readonly $ref: "#/$defs/PurposeScopeListed";
+            }];
+        };
+        readonly PurposeScopeListed: {
+            readonly title: "PurposeScopeListed";
+            readonly description: "Exactly the listed purposes. A request naming any other purpose is refused.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "purposes"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly purposes: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 32;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/Purpose";
+                    };
+                    readonly description: "Non-empty set of purposes. An empty array is invalid (it is not `any`).";
+                };
+            };
+        };
+        readonly Purpose: {
+            readonly title: "Purpose";
+            readonly description: "What content is used for: a lowerCamelCase name registered in the VTI specification's purpose registry (Appendix H) — `personalisation`, `taskExecution`, `analytics`, `modelTraining` at the time of writing — or an absolute IRI naming a purpose defined elsewhere, such as a purpose of the W3C Data Privacy Vocabulary (`https://w3id.org/dpv#ServicePersonalisation`). Compared by exact string equality: a consumer MUST NOT treat a purpose it does not recognise as equal to any other, and grants only a request naming exactly a listed purpose (VTI-ACL-109). A registered name is never an IRI, because it contains no `:`.";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly anyOf: readonly [{
+                readonly pattern: "^[a-z][a-zA-Z0-9]{0,63}$";
+            }, {
+                readonly pattern: "^[a-zA-Z][a-zA-Z0-9+.-]*:[^\\s]+$";
+            }];
+        };
+        readonly PurposeScopeAny: {
+            readonly title: "PurposeScopeAny";
+            readonly description: "Any purpose except `modelTraining` (training, fine-tuning or evaluating a machine-learning model on the content), which `any` never grants (VTI-ACL-105).";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "any";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/rooms/owner/issue-authority/0.3";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/rooms/owner/issue-authority/0.3";
+        readonly title: "Rooms Owner Issue Authority — payload";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["roomId", "signingKeyId", "subject", "actions", "validUntil"];
+        readonly properties: {
+            readonly roomId: {
+                readonly type: "string";
+                readonly description: "The room whose identity issues this credential. The recipient MUST hold a signing key for it — it is signing AS the room, not as itself.";
+            };
+            readonly signingKeyId: {
+                readonly type: "string";
+                readonly maxLength: 256;
+                readonly description: "Which held key signs. Named explicitly rather than looked up from `roomId`, because nothing maps a DID to a key it was minted with and inventing that mapping would add a lifecycle to get wrong. A key that is not the room's produces a credential that fails to verify against the room's DID document — loud, and at the first use rather than later.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+            readonly subject: {
+                readonly type: "string";
+                readonly description: "The party this grants to. A chain ROOT: the room is the governing party, so this is the grant everything else descends from. A holder narrows their own grant with attenuation instead, which needs no issuer.";
+            };
+            readonly actions: {
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly items: {
+                    readonly type: "string";
+                    readonly enum: readonly ["read", "write", "curate", "admin"];
+                };
+                readonly description: "What the subject may do. MUST NOT be empty — an empty list confers nothing rather than everything, and a schema that allowed it would make the more dangerous reading available to a careless consumer. `curate` is not implied by `write`: pinning, deprecating and retracting are judgements over shared knowledge, not writes.";
+            };
+            readonly validUntil: {
+                readonly type: "string";
+                readonly format: "date-time";
+                readonly description: "When the grant lapses. REQUIRED, and not merely recommended: nothing about the subject's current standing is consulted when an authority credential is verified, so a grant that never expires is authority nobody can withdraw by waiting. A verifier refuses a chain link carrying none, so a grant minted without one could not have been used. Changing what a party may do reissues this one small credential and leaves the membership edge alone, which is why the two are separate credentials.";
+            };
+            readonly purposes: {
+                readonly $ref: "#/$defs/PurposeScope";
+                readonly description: "OPTIONAL. What the subject may use the content it reads under this grant for (VTI-ACL-110): `{\"scope\": \"any\"}` or a non-empty list. Stated in the credential exactly as given; absent, the credential states none, which grants `any` — never `modelTraining`, which a grant must name.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Rooms Owner Issue Authority — response payload";
+                readonly description: "Success response to rooms/owner/issue-authority. Type https://trusttasks.org/spec/rooms/owner/issue-authority/0.2#response. The signed VAC, a chain root at the room's scope.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["credential", "credentialId"];
+                readonly properties: {
+                    readonly credential: {
+                        readonly type: "string";
+                        readonly description: "The signed Verifiable Authority Credential, serialised.";
+                    };
+                    readonly credentialId: {
+                        readonly type: "string";
+                        readonly description: "Its `id`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly PurposeScope: {
+                readonly title: "PurposeScope";
+                readonly description: "An explicit purpose scope. Exactly one of two shapes, discriminated by `scope`: `any`, or `listed` with a NON-EMPTY list of purposes. The empty list is invalid, not a third shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/PurposeScopeAny";
+                }, {
+                    readonly $ref: "#/$defs/PurposeScopeListed";
+                }];
+            };
+            readonly PurposeScopeListed: {
+                readonly title: "PurposeScopeListed";
+                readonly description: "Exactly the listed purposes. A request naming any other purpose is refused.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "purposes"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly purposes: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 32;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/Purpose";
+                        };
+                        readonly description: "Non-empty set of purposes. An empty array is invalid (it is not `any`).";
+                    };
+                };
+            };
+            readonly Purpose: {
+                readonly title: "Purpose";
+                readonly description: "What content is used for: a lowerCamelCase name registered in the VTI specification's purpose registry (Appendix H) — `personalisation`, `taskExecution`, `analytics`, `modelTraining` at the time of writing — or an absolute IRI naming a purpose defined elsewhere, such as a purpose of the W3C Data Privacy Vocabulary (`https://w3id.org/dpv#ServicePersonalisation`). Compared by exact string equality: a consumer MUST NOT treat a purpose it does not recognise as equal to any other, and grants only a request naming exactly a listed purpose (VTI-ACL-109). A registered name is never an IRI, because it contains no `:`.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly anyOf: readonly [{
+                    readonly pattern: "^[a-z][a-zA-Z0-9]{0,63}$";
+                }, {
+                    readonly pattern: "^[a-zA-Z][a-zA-Z0-9+.-]*:[^\\s]+$";
+                }];
+            };
+            readonly PurposeScopeAny: {
+                readonly title: "PurposeScopeAny";
+                readonly description: "Any purpose except `modelTraining` (training, fine-tuning or evaluating a machine-learning model on the content), which `any` never grants (VTI-ACL-105).";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "any";
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/rooms/owner/issue-authority/0.3#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Rooms Owner Issue Authority — response payload";
+                readonly description: "Success response to rooms/owner/issue-authority. Type https://trusttasks.org/spec/rooms/owner/issue-authority/0.2#response. The signed VAC, a chain root at the room's scope.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["credential", "credentialId"];
+                readonly properties: {
+                    readonly credential: {
+                        readonly type: "string";
+                        readonly description: "The signed Verifiable Authority Credential, serialised.";
+                    };
+                    readonly credentialId: {
+                        readonly type: "string";
+                        readonly description: "Its `id`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly PurposeScope: {
+                readonly title: "PurposeScope";
+                readonly description: "An explicit purpose scope. Exactly one of two shapes, discriminated by `scope`: `any`, or `listed` with a NON-EMPTY list of purposes. The empty list is invalid, not a third shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/PurposeScopeAny";
+                }, {
+                    readonly $ref: "#/$defs/PurposeScopeListed";
+                }];
+            };
+            readonly PurposeScopeListed: {
+                readonly title: "PurposeScopeListed";
+                readonly description: "Exactly the listed purposes. A request naming any other purpose is refused.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "purposes"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly purposes: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 32;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/Purpose";
+                        };
+                        readonly description: "Non-empty set of purposes. An empty array is invalid (it is not `any`).";
+                    };
+                };
+            };
+            readonly Purpose: {
+                readonly title: "Purpose";
+                readonly description: "What content is used for: a lowerCamelCase name registered in the VTI specification's purpose registry (Appendix H) — `personalisation`, `taskExecution`, `analytics`, `modelTraining` at the time of writing — or an absolute IRI naming a purpose defined elsewhere, such as a purpose of the W3C Data Privacy Vocabulary (`https://w3id.org/dpv#ServicePersonalisation`). Compared by exact string equality: a consumer MUST NOT treat a purpose it does not recognise as equal to any other, and grants only a request naming exactly a listed purpose (VTI-ACL-109). A registered name is never an IRI, because it contains no `:`.";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly anyOf: readonly [{
+                    readonly pattern: "^[a-z][a-zA-Z0-9]{0,63}$";
+                }, {
+                    readonly pattern: "^[a-zA-Z][a-zA-Z0-9+.-]*:[^\\s]+$";
+                }];
+            };
+            readonly PurposeScopeAny: {
+                readonly title: "PurposeScopeAny";
+                readonly description: "Any purpose except `modelTraining` (training, fine-tuning or evaluating a machine-learning model on the content), which `any` never grants (VTI-ACL-105).";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "any";
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/rooms/owner/issue-authority/0.3/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/rooms/owner/issue-authority/0.3/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,eAAe,IAAI,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAGhL,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;IACV;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/F;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AACD;;GAEG;AACH,MAAM,WAAW,uCAAuC;IACtD;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC;AAEpH,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,6DAAsE,CAAC;AAE/F;;;;;GAKG;AACH,eAAO,MAAM,OAAO,EAAE,MAAM,GAAG,IAAY,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,GAAG,IAAW,CAAC;AAE/C,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAEtD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,sEAA+E,CAAC;AAEjH,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,uCAAuC,CAAC;AAE/D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4JjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwG1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}