@openvtc/trust-tasks 0.28.9 → 0.28.11

package/dist/vtn/memberships/join/0.1/payload.d.ts

@@ -0,0 +1,755 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtn/memberships/join/0.1/payload.schema.json
+ */
+import type { Credential, Did_VtnV0_1 as Did, Ext, RoleMapping, RoleName_VtnV0_1 as RoleName, SignedTask, UpstreamGroup, UpstreamMembership } from "../../../../_shared/components.js";
+/**
+ * Accept a parent network's listing of this network: register this network's groups for the parent's roles, then acknowledge the parent's membership offer. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface VTNMembershipsJoinPayload {
+    /**
+     * The parent network's base URL, as the parent's administrators gave it. Where it is reached, not who it is.
+     */
+    url: string;
+    /**
+     * The parent network's DID. This network refuses if the network found at `url` answers as another DID.
+     */
+    network: Did;
+    /**
+     * Which of this network's roles serves each parent role. A role the parent requires that is not mapped is served by this network's role of the same name.
+     *
+     * @maxItems 32
+     */
+    roles: RoleMapping[];
+    ext?: Ext;
+}
+/**
+ * The membership as it now stands.
+ */
+export interface VTNMembershipsJoinResponsePayload {
+    /**
+     * This network's membership of the parent as it now stands.
+     */
+    membership: UpstreamMembership;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Credential, Did, Ext, RoleMapping, RoleName, SignedTask, UpstreamGroup, UpstreamMembership };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vtn/memberships/join/0.1";
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export declare const EXTENDS: string | null;
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export declare const DEPRECATION: string | null;
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTNMembershipsJoinPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vtn/memberships/join/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTNMembershipsJoinResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/vtn/memberships/join/0.1";
+    readonly title: "VTN Memberships — Join — payload";
+    readonly description: "Accept a parent network's listing of this network: register this network's groups for the parent's roles, then acknowledge the parent's membership offer. The outer document members are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["url", "network", "roles"];
+    readonly properties: {
+        readonly url: {
+            readonly type: "string";
+            readonly format: "uri";
+            readonly maxLength: 2048;
+            readonly description: "The parent network's base URL, as the parent's administrators gave it. Where it is reached, not who it is.";
+        };
+        readonly network: {
+            readonly $ref: "#/$defs/Did";
+            readonly description: "The parent network's DID. This network refuses if the network found at `url` answers as another DID.";
+        };
+        readonly roles: {
+            readonly type: "array";
+            readonly maxItems: 32;
+            readonly items: {
+                readonly $ref: "#/$defs/RoleMapping";
+            };
+            readonly description: "Which of this network's roles serves each parent role. A role the parent requires that is not mapped is served by this network's role of the same name.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTN Memberships — Join — response payload";
+            readonly description: "The membership as it now stands.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["membership"];
+            readonly properties: {
+                readonly membership: {
+                    readonly $ref: "#/$defs/UpstreamMembership";
+                    readonly description: "This network's membership of the parent as it now stands.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly UpstreamMembership: {
+            readonly description: "This network's membership of a parent.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["network", "url", "state", "listing", "groups", "updatedAt"];
+            readonly properties: {
+                readonly network: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The parent network.";
+                };
+                readonly url: {
+                    readonly type: "string";
+                    readonly format: "uri";
+                    readonly maxLength: 2048;
+                    readonly description: "Where the parent is reached.";
+                };
+                readonly name: {
+                    readonly type: "string";
+                    readonly maxLength: 200;
+                    readonly description: "The parent's name.";
+                };
+                readonly state: {
+                    readonly type: "string";
+                    readonly enum: readonly ["acknowledged", "repudiated", "departed"];
+                    readonly description: "`acknowledged`: this network is a member. `repudiated`: it rejected the parent's listing. `departed`: it left.";
+                };
+                readonly listing: {
+                    readonly $ref: "#/$defs/Credential";
+                    readonly description: "The parent's listing of this network, as verified.";
+                };
+                readonly grant: {
+                    readonly $ref: "#/$defs/Credential";
+                    readonly description: "The parent's grant.";
+                };
+                readonly acknowledgement: {
+                    readonly $ref: "#/$defs/Credential";
+                    readonly description: "This network's acknowledgement.";
+                };
+                readonly repudiation: {
+                    readonly $ref: "#/$defs/Credential";
+                    readonly description: "This network's repudiation of the listing or grant.";
+                };
+                readonly groups: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/UpstreamGroup";
+                    };
+                    readonly description: "Groups registered at the parent.";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When it last changed.";
+                };
+            };
+        };
+        readonly UpstreamGroup: {
+            readonly description: "A group this network registered at its parent.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["parentRole", "localRole", "group", "registration", "acceptance"];
+            readonly properties: {
+                readonly parentRole: {
+                    readonly $ref: "#/$defs/RoleName";
+                };
+                readonly localRole: {
+                    readonly $ref: "#/$defs/RoleName";
+                };
+                readonly group: {
+                    readonly type: "string";
+                    readonly maxLength: 2048;
+                    readonly description: "This network's network group (`<did>#role-<localRole>`).";
+                };
+                readonly registration: {
+                    readonly $ref: "#/$defs/SignedTask";
+                    readonly description: "This network's signed vtn/groups/register request to the parent.";
+                };
+                readonly acceptance: {
+                    readonly $ref: "#/$defs/Credential";
+                    readonly description: "The parent's groupRegistered credential accepting the registration: issued by the parent, subject this network's network group, `object.digestMultibase` the digest of `registration`, revocable on the parent's status list.";
+                };
+            };
+        };
+        readonly Credential: {
+            readonly type: "object";
+            readonly description: "A DTG credential (W3C VC 2.0, JSON) exactly as signed. Verified by the party relying on it, never by its shape here: it is an open object so a binding cannot narrow away a member the proof covers.";
+        };
+        readonly SignedTask: {
+            readonly type: "object";
+            readonly description: "A complete Trust Task document, with its proof, exactly as signed and received. Verified as a document in its own right; open so its proof still covers every member, and so its digest can be recomputed.";
+        };
+        readonly RoleName: {
+            readonly type: "string";
+            readonly pattern: "^[a-z0-9_-]{1,64}$";
+            readonly description: "A role's name: 1–64 lowercase letters, digits, `-` or `_`.";
+        };
+        readonly Did: {
+            readonly type: "string";
+            readonly pattern: "^did:[a-z0-9]+:.+$";
+            readonly maxLength: 2048;
+            readonly description: "A DID.";
+        };
+        readonly RoleMapping: {
+            readonly description: "Which of this network's roles serves a parent's role.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["parentRole", "localRole"];
+            readonly properties: {
+                readonly parentRole: {
+                    readonly $ref: "#/$defs/RoleName";
+                    readonly description: "The parent's role.";
+                };
+                readonly localRole: {
+                    readonly $ref: "#/$defs/RoleName";
+                    readonly description: "This network's role whose network group serves it.";
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTN Memberships — Join — response payload";
+            readonly description: "The membership as it now stands.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["membership"];
+            readonly properties: {
+                readonly membership: {
+                    readonly $ref: "#/$defs/UpstreamMembership";
+                    readonly description: "This network's membership of the parent as it now stands.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly UpstreamMembership: {
+            readonly description: "This network's membership of a parent.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["network", "url", "state", "listing", "groups", "updatedAt"];
+            readonly properties: {
+                readonly network: {
+                    readonly $ref: "#/$defs/Did";
+                    readonly description: "The parent network.";
+                };
+                readonly url: {
+                    readonly type: "string";
+                    readonly format: "uri";
+                    readonly maxLength: 2048;
+                    readonly description: "Where the parent is reached.";
+                };
+                readonly name: {
+                    readonly type: "string";
+                    readonly maxLength: 200;
+                    readonly description: "The parent's name.";
+                };
+                readonly state: {
+                    readonly type: "string";
+                    readonly enum: readonly ["acknowledged", "repudiated", "departed"];
+                    readonly description: "`acknowledged`: this network is a member. `repudiated`: it rejected the parent's listing. `departed`: it left.";
+                };
+                readonly listing: {
+                    readonly $ref: "#/$defs/Credential";
+                    readonly description: "The parent's listing of this network, as verified.";
+                };
+                readonly grant: {
+                    readonly $ref: "#/$defs/Credential";
+                    readonly description: "The parent's grant.";
+                };
+                readonly acknowledgement: {
+                    readonly $ref: "#/$defs/Credential";
+                    readonly description: "This network's acknowledgement.";
+                };
+                readonly repudiation: {
+                    readonly $ref: "#/$defs/Credential";
+                    readonly description: "This network's repudiation of the listing or grant.";
+                };
+                readonly groups: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/UpstreamGroup";
+                    };
+                    readonly description: "Groups registered at the parent.";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When it last changed.";
+                };
+            };
+        };
+        readonly UpstreamGroup: {
+            readonly description: "A group this network registered at its parent.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["parentRole", "localRole", "group", "registration", "acceptance"];
+            readonly properties: {
+                readonly parentRole: {
+                    readonly $ref: "#/$defs/RoleName";
+                };
+                readonly localRole: {
+                    readonly $ref: "#/$defs/RoleName";
+                };
+                readonly group: {
+                    readonly type: "string";
+                    readonly maxLength: 2048;
+                    readonly description: "This network's network group (`<did>#role-<localRole>`).";
+                };
+                readonly registration: {
+                    readonly $ref: "#/$defs/SignedTask";
+                    readonly description: "This network's signed vtn/groups/register request to the parent.";
+                };
+                readonly acceptance: {
+                    readonly $ref: "#/$defs/Credential";
+                    readonly description: "The parent's groupRegistered credential accepting the registration: issued by the parent, subject this network's network group, `object.digestMultibase` the digest of `registration`, revocable on the parent's status list.";
+                };
+            };
+        };
+        readonly Credential: {
+            readonly type: "object";
+            readonly description: "A DTG credential (W3C VC 2.0, JSON) exactly as signed. Verified by the party relying on it, never by its shape here: it is an open object so a binding cannot narrow away a member the proof covers.";
+        };
+        readonly SignedTask: {
+            readonly type: "object";
+            readonly description: "A complete Trust Task document, with its proof, exactly as signed and received. Verified as a document in its own right; open so its proof still covers every member, and so its digest can be recomputed.";
+        };
+        readonly RoleName: {
+            readonly type: "string";
+            readonly pattern: "^[a-z0-9_-]{1,64}$";
+            readonly description: "A role's name: 1–64 lowercase letters, digits, `-` or `_`.";
+        };
+        readonly Did: {
+            readonly type: "string";
+            readonly pattern: "^did:[a-z0-9]+:.+$";
+            readonly maxLength: 2048;
+            readonly description: "A DID.";
+        };
+        readonly RoleMapping: {
+            readonly description: "Which of this network's roles serves a parent's role.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["parentRole", "localRole"];
+            readonly properties: {
+                readonly parentRole: {
+                    readonly $ref: "#/$defs/RoleName";
+                    readonly description: "The parent's role.";
+                };
+                readonly localRole: {
+                    readonly $ref: "#/$defs/RoleName";
+                    readonly description: "This network's role whose network group serves it.";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtn/memberships/join/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/vtn/memberships/join/0.1";
+        readonly title: "VTN Memberships — Join — payload";
+        readonly description: "Accept a parent network's listing of this network: register this network's groups for the parent's roles, then acknowledge the parent's membership offer. The outer document members are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["url", "network", "roles"];
+        readonly properties: {
+            readonly url: {
+                readonly type: "string";
+                readonly format: "uri";
+                readonly maxLength: 2048;
+                readonly description: "The parent network's base URL, as the parent's administrators gave it. Where it is reached, not who it is.";
+            };
+            readonly network: {
+                readonly $ref: "#/$defs/Did";
+                readonly description: "The parent network's DID. This network refuses if the network found at `url` answers as another DID.";
+            };
+            readonly roles: {
+                readonly type: "array";
+                readonly maxItems: 32;
+                readonly items: {
+                    readonly $ref: "#/$defs/RoleMapping";
+                };
+                readonly description: "Which of this network's roles serves each parent role. A role the parent requires that is not mapped is served by this network's role of the same name.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTN Memberships — Join — response payload";
+                readonly description: "The membership as it now stands.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["membership"];
+                readonly properties: {
+                    readonly membership: {
+                        readonly $ref: "#/$defs/UpstreamMembership";
+                        readonly description: "This network's membership of the parent as it now stands.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly UpstreamMembership: {
+                readonly description: "This network's membership of a parent.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["network", "url", "state", "listing", "groups", "updatedAt"];
+                readonly properties: {
+                    readonly network: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The parent network.";
+                    };
+                    readonly url: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                        readonly maxLength: 2048;
+                        readonly description: "Where the parent is reached.";
+                    };
+                    readonly name: {
+                        readonly type: "string";
+                        readonly maxLength: 200;
+                        readonly description: "The parent's name.";
+                    };
+                    readonly state: {
+                        readonly type: "string";
+                        readonly enum: readonly ["acknowledged", "repudiated", "departed"];
+                        readonly description: "`acknowledged`: this network is a member. `repudiated`: it rejected the parent's listing. `departed`: it left.";
+                    };
+                    readonly listing: {
+                        readonly $ref: "#/$defs/Credential";
+                        readonly description: "The parent's listing of this network, as verified.";
+                    };
+                    readonly grant: {
+                        readonly $ref: "#/$defs/Credential";
+                        readonly description: "The parent's grant.";
+                    };
+                    readonly acknowledgement: {
+                        readonly $ref: "#/$defs/Credential";
+                        readonly description: "This network's acknowledgement.";
+                    };
+                    readonly repudiation: {
+                        readonly $ref: "#/$defs/Credential";
+                        readonly description: "This network's repudiation of the listing or grant.";
+                    };
+                    readonly groups: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/UpstreamGroup";
+                        };
+                        readonly description: "Groups registered at the parent.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When it last changed.";
+                    };
+                };
+            };
+            readonly UpstreamGroup: {
+                readonly description: "A group this network registered at its parent.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["parentRole", "localRole", "group", "registration", "acceptance"];
+                readonly properties: {
+                    readonly parentRole: {
+                        readonly $ref: "#/$defs/RoleName";
+                    };
+                    readonly localRole: {
+                        readonly $ref: "#/$defs/RoleName";
+                    };
+                    readonly group: {
+                        readonly type: "string";
+                        readonly maxLength: 2048;
+                        readonly description: "This network's network group (`<did>#role-<localRole>`).";
+                    };
+                    readonly registration: {
+                        readonly $ref: "#/$defs/SignedTask";
+                        readonly description: "This network's signed vtn/groups/register request to the parent.";
+                    };
+                    readonly acceptance: {
+                        readonly $ref: "#/$defs/Credential";
+                        readonly description: "The parent's groupRegistered credential accepting the registration: issued by the parent, subject this network's network group, `object.digestMultibase` the digest of `registration`, revocable on the parent's status list.";
+                    };
+                };
+            };
+            readonly Credential: {
+                readonly type: "object";
+                readonly description: "A DTG credential (W3C VC 2.0, JSON) exactly as signed. Verified by the party relying on it, never by its shape here: it is an open object so a binding cannot narrow away a member the proof covers.";
+            };
+            readonly SignedTask: {
+                readonly type: "object";
+                readonly description: "A complete Trust Task document, with its proof, exactly as signed and received. Verified as a document in its own right; open so its proof still covers every member, and so its digest can be recomputed.";
+            };
+            readonly RoleName: {
+                readonly type: "string";
+                readonly pattern: "^[a-z0-9_-]{1,64}$";
+                readonly description: "A role's name: 1–64 lowercase letters, digits, `-` or `_`.";
+            };
+            readonly Did: {
+                readonly type: "string";
+                readonly pattern: "^did:[a-z0-9]+:.+$";
+                readonly maxLength: 2048;
+                readonly description: "A DID.";
+            };
+            readonly RoleMapping: {
+                readonly description: "Which of this network's roles serves a parent's role.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["parentRole", "localRole"];
+                readonly properties: {
+                    readonly parentRole: {
+                        readonly $ref: "#/$defs/RoleName";
+                        readonly description: "The parent's role.";
+                    };
+                    readonly localRole: {
+                        readonly $ref: "#/$defs/RoleName";
+                        readonly description: "This network's role whose network group serves it.";
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtn/memberships/join/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTN Memberships — Join — response payload";
+                readonly description: "The membership as it now stands.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["membership"];
+                readonly properties: {
+                    readonly membership: {
+                        readonly $ref: "#/$defs/UpstreamMembership";
+                        readonly description: "This network's membership of the parent as it now stands.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly UpstreamMembership: {
+                readonly description: "This network's membership of a parent.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["network", "url", "state", "listing", "groups", "updatedAt"];
+                readonly properties: {
+                    readonly network: {
+                        readonly $ref: "#/$defs/Did";
+                        readonly description: "The parent network.";
+                    };
+                    readonly url: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                        readonly maxLength: 2048;
+                        readonly description: "Where the parent is reached.";
+                    };
+                    readonly name: {
+                        readonly type: "string";
+                        readonly maxLength: 200;
+                        readonly description: "The parent's name.";
+                    };
+                    readonly state: {
+                        readonly type: "string";
+                        readonly enum: readonly ["acknowledged", "repudiated", "departed"];
+                        readonly description: "`acknowledged`: this network is a member. `repudiated`: it rejected the parent's listing. `departed`: it left.";
+                    };
+                    readonly listing: {
+                        readonly $ref: "#/$defs/Credential";
+                        readonly description: "The parent's listing of this network, as verified.";
+                    };
+                    readonly grant: {
+                        readonly $ref: "#/$defs/Credential";
+                        readonly description: "The parent's grant.";
+                    };
+                    readonly acknowledgement: {
+                        readonly $ref: "#/$defs/Credential";
+                        readonly description: "This network's acknowledgement.";
+                    };
+                    readonly repudiation: {
+                        readonly $ref: "#/$defs/Credential";
+                        readonly description: "This network's repudiation of the listing or grant.";
+                    };
+                    readonly groups: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/UpstreamGroup";
+                        };
+                        readonly description: "Groups registered at the parent.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When it last changed.";
+                    };
+                };
+            };
+            readonly UpstreamGroup: {
+                readonly description: "A group this network registered at its parent.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["parentRole", "localRole", "group", "registration", "acceptance"];
+                readonly properties: {
+                    readonly parentRole: {
+                        readonly $ref: "#/$defs/RoleName";
+                    };
+                    readonly localRole: {
+                        readonly $ref: "#/$defs/RoleName";
+                    };
+                    readonly group: {
+                        readonly type: "string";
+                        readonly maxLength: 2048;
+                        readonly description: "This network's network group (`<did>#role-<localRole>`).";
+                    };
+                    readonly registration: {
+                        readonly $ref: "#/$defs/SignedTask";
+                        readonly description: "This network's signed vtn/groups/register request to the parent.";
+                    };
+                    readonly acceptance: {
+                        readonly $ref: "#/$defs/Credential";
+                        readonly description: "The parent's groupRegistered credential accepting the registration: issued by the parent, subject this network's network group, `object.digestMultibase` the digest of `registration`, revocable on the parent's status list.";
+                    };
+                };
+            };
+            readonly Credential: {
+                readonly type: "object";
+                readonly description: "A DTG credential (W3C VC 2.0, JSON) exactly as signed. Verified by the party relying on it, never by its shape here: it is an open object so a binding cannot narrow away a member the proof covers.";
+            };
+            readonly SignedTask: {
+                readonly type: "object";
+                readonly description: "A complete Trust Task document, with its proof, exactly as signed and received. Verified as a document in its own right; open so its proof still covers every member, and so its digest can be recomputed.";
+            };
+            readonly RoleName: {
+                readonly type: "string";
+                readonly pattern: "^[a-z0-9_-]{1,64}$";
+                readonly description: "A role's name: 1–64 lowercase letters, digits, `-` or `_`.";
+            };
+            readonly Did: {
+                readonly type: "string";
+                readonly pattern: "^did:[a-z0-9]+:.+$";
+                readonly maxLength: 2048;
+                readonly description: "A DID.";
+            };
+            readonly RoleMapping: {
+                readonly description: "Which of this network's roles serves a parent's role.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["parentRole", "localRole"];
+                readonly properties: {
+                    readonly parentRole: {
+                        readonly $ref: "#/$defs/RoleName";
+                        readonly description: "The parent's role.";
+                    };
+                    readonly localRole: {
+                        readonly $ref: "#/$defs/RoleName";
+                        readonly description: "This network's role whose network group serves it.";
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map