Variable: CONTRACTS

const CONTRACTS: object

Defined in: packages/contracts/src/registry.ts:128

Every subject in the estate, keyed by its registry key: the subject with * in the tenant position (and, for an event, the module position when any module may produce it). platform appears literally for operations that precede or exceed a tenant.

This is the registry. A subject that is not a key here has no schema, and a producer for it must not start (assertRegistered). Adding a key here without a row in PERMISSIONS is a compile error, and the reverse is too. The registry's other halves are STANDING_GRANTS, which holds the keys that are an authority and not a message, and AGENT_COMMANDS, which holds the commands to an agent; none of either is a key here, so none can be sent or routed as a contract. Evolution is additive within a version; anything else is a new v<n> key beside the old one.

Type Declaration

event.*.*.audit.recorded.v1

readonly event.*.*.audit.recorded.v1: EventContract<TUnion<[TObject<{ action: TLiteral<"subject.create">; actor: TUnion<[TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TString; subjectId: TString; tenant: TString; }>, TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TLiteral<...>; subjectId: TLiteral<...>; tenant: TLiteral<...>; }>]>; correlationId: TString; occurredAt: TString; onBehalfOf: TOptional<TString>; outcome: TUnsafe<"success">; payload: TObject<{ kind: TUnion<[TLiteral<...>, TLiteral<...>]>; path: TString; }>; payloadHash: TString; producerModule: TString; recordId: TString; target: TOptional<TObject<{ id: TString; type: TString; }>>; tenant: TString; }>, TObject<{ action: TLiteral<"authentication-identity.link">; actor: TUnion<[TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TString; subjectId: TString; tenant: TString; }>, TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TLiteral<...>; subjectId: TLiteral<...>; tenant: TLiteral<...>; }>]>; correlationId: TString; occurredAt: TString; onBehalfOf: TOptional<TString>; outcome: TUnsafe<"success">; payload: TObject<{ subjectId: TString; }>; payloadHash: TString; producerModule: TString; recordId: TString; target: TOptional<TObject<{ id: TString; type: TString; }>>; tenant: TString; }>, TObject<{ action: TLiteral<"bootstrap.apply">; actor: TUnion<[TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TString; subjectId: TString; tenant: TString; }>, TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TLiteral<...>; subjectId: TLiteral<...>; tenant: TLiteral<...>; }>]>; correlationId: TString; occurredAt: TString; onBehalfOf: TOptional<TString>; outcome: TUnsafe<"success">; payload: TObject<{ anchorCreated: TBoolean; identitiesCreated: TInteger; organizationsCreated: TInteger; }>; payloadHash: TString; producerModule: TString; recordId: TString; target: TOptional<TObject<{ id: TString; type: TString; }>>; tenant: TString; }>]>>

event.*.governance.accreditation.admitted.v1

readonly event.*.governance.accreditation.admitted.v1: EventContract<TObject<{ accreditationId: TString; contacts: TOptional<TArray<TString>>; displayName: TString; entityTypes: TArray<TUnsafe<"federation_entity" | "openid_credential_issuer" | "openid_credential_verifier" | "openid_wallet_provider" | "openid_provider" | "openid_relying_party" | "oauth_authorization_server" | "oauth_client" | "oauth_resource">>; framework: TOptional<TUnion<[TObject<{ contacts: TWith<TArray<...>, { description: ...; }>; disputeRoute: TWith<TString, { description: ...; }>; governingAuthority: TObject<{ contact: ...; name: ...; }>; name: TWith<TString, { description: ...; }>; roles: TArray<TObject<...>>; statementLifetimes: TObject<{ anchorConfigurationSeconds: ...; entityConfigurationSeconds: ...; subordinateStatementSeconds: ...; }>; version: TInteger; }>, TObject<{ contacts: TWith<TArray<...>, { description: ...; }>; disputeRoute: TWith<TString, { description: ...; }>; name: TWith<TString, { description: ...; }>; primaryDocument: TObject<{ administeringAuthority: ...; controlledDocuments: ...; extensions: ...; generalRequirements: ...; governingAuthority: ...; introduction: ...; localization: ...; objectives: ...; principles: ...; purpose: ...; revisions: ...; scope: ...; terminology: ...; }>; roles: TArray<TObject<...>>; schemaVersion: TWith<TLiteral<...>, { description: ...; }>; statementLifetimes: TObject<{ anchorConfigurationSeconds: ...; entityConfigurationSeconds: ...; subordinateStatementSeconds: ...; }>; version: TInteger; }>]>>; frameworkDigest: TOptional<TString>; frameworkVersion: TInteger; hostname: TString; lifetimes: TObject<{ anchorConfigurationSeconds: TWith<TInteger, { description: "Lifetime of the trust anchor's own entity configuration, from `iat` to `exp`."; }>; entityConfigurationSeconds: TWith<TInteger, { description: "Lifetime of an admitted entity's entity configuration."; }>; subordinateStatementSeconds: TWith<TInteger, { description: "Lifetime of the trust anchor's subordinate statement about an admitted entity."; }>; }>; organizationId: TString; path: TString; superior: TOptional<TObject<{ accreditationId: TString; hostname: TString; }>>; }>>

event.*.governance.accreditation.publication-approved.v1

readonly event.*.governance.accreditation.publication-approved.v1: EventContract<TObject<{ accreditationId: TString; approvedAt: TString; organizationId: TString; }>>

event.*.identity.grant.revoked.v1

readonly event.*.identity.grant.revoked.v1: EventContract<TObject<{ granteeId: TString; grantId: TString; organizationId: TString; revokedAt: TString; }>>

event.*.issuance.identifier.published.v1

readonly event.*.issuance.identifier.published.v1: EventContract<TObject<{ did: TString; host: TString; identifierId: TString; organizationId: TString; version: TInteger; }>>

event.*.issuance.identifier.requested.v1

readonly event.*.issuance.identifier.requested.v1: EventContract<TObject<{ identifierId: TString; organizationId: TString; path: TString; }>>

event.*.provisioning.placement.changed.v1

readonly event.*.provisioning.placement.changed.v1: EventContract<TObject<{ instanceId: TString; state: TUnsafe<"active" | "draining" | "retired">; subjectId: TString; }>>

event.*.trust.entity-statement.published.v1

readonly event.*.trust.entity-statement.published.v1: EventContract<TObject<{ accreditationId: TString; digest: TString; expiresAt: TString; issuedAt: TString; issuer: TString; keyId: TString; kind: TUnsafe<"entity-configuration" | "subordinate-statement">; statementId: TString; subject: TString; supersedes: TOptional<TString>; }>>

event.platform.bootstrap.audit.recorded.v1

readonly event.platform.bootstrap.audit.recorded.v1: EventContract<TUnion<[TObject<{ action: TLiteral<"subject.create">; actor: TUnion<[TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TString; subjectId: TString; tenant: TString; }>, TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TLiteral<...>; subjectId: TLiteral<...>; tenant: TLiteral<...>; }>]>; correlationId: TString; occurredAt: TString; onBehalfOf: TOptional<TString>; outcome: TUnsafe<"success">; payload: TObject<{ kind: TUnion<[TLiteral<...>, TLiteral<...>]>; path: TString; }>; payloadHash: TString; producerModule: TString; recordId: TString; target: TOptional<TObject<{ id: TString; type: TString; }>>; tenant: TString; }>, TObject<{ action: TLiteral<"authentication-identity.link">; actor: TUnion<[TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TString; subjectId: TString; tenant: TString; }>, TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TLiteral<...>; subjectId: TLiteral<...>; tenant: TLiteral<...>; }>]>; correlationId: TString; occurredAt: TString; onBehalfOf: TOptional<TString>; outcome: TUnsafe<"success">; payload: TObject<{ subjectId: TString; }>; payloadHash: TString; producerModule: TString; recordId: TString; target: TOptional<TObject<{ id: TString; type: TString; }>>; tenant: TString; }>, TObject<{ action: TLiteral<"bootstrap.apply">; actor: TUnion<[TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TString; subjectId: TString; tenant: TString; }>, TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TLiteral<...>; subjectId: TLiteral<...>; tenant: TLiteral<...>; }>]>; correlationId: TString; occurredAt: TString; onBehalfOf: TOptional<TString>; outcome: TUnsafe<"success">; payload: TObject<{ anchorCreated: TBoolean; identitiesCreated: TInteger; organizationsCreated: TInteger; }>; payloadHash: TString; producerModule: TString; recordId: TString; target: TOptional<TObject<{ id: TString; type: TString; }>>; tenant: TString; }>]>>

event.platform.gateway-admin.audit.recorded.v1

readonly event.platform.gateway-admin.audit.recorded.v1: EventContract<TUnion<[TObject<{ action: TLiteral<"subject.create">; actor: TUnion<[TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TString; subjectId: TString; tenant: TString; }>, TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TLiteral<...>; subjectId: TLiteral<...>; tenant: TLiteral<...>; }>]>; correlationId: TString; occurredAt: TString; onBehalfOf: TOptional<TString>; outcome: TUnsafe<"success">; payload: TObject<{ kind: TUnion<[TLiteral<...>, TLiteral<...>]>; path: TString; }>; payloadHash: TString; producerModule: TString; recordId: TString; target: TOptional<TObject<{ id: TString; type: TString; }>>; tenant: TString; }>, TObject<{ action: TLiteral<"authentication-identity.link">; actor: TUnion<[TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TString; subjectId: TString; tenant: TString; }>, TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TLiteral<...>; subjectId: TLiteral<...>; tenant: TLiteral<...>; }>]>; correlationId: TString; occurredAt: TString; onBehalfOf: TOptional<TString>; outcome: TUnsafe<"success">; payload: TObject<{ subjectId: TString; }>; payloadHash: TString; producerModule: TString; recordId: TString; target: TOptional<TObject<{ id: TString; type: TString; }>>; tenant: TString; }>, TObject<{ action: TLiteral<"bootstrap.apply">; actor: TUnion<[TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TString; subjectId: TString; tenant: TString; }>, TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TLiteral<...>; subjectId: TLiteral<...>; tenant: TLiteral<...>; }>]>; correlationId: TString; occurredAt: TString; onBehalfOf: TOptional<TString>; outcome: TUnsafe<"success">; payload: TObject<{ anchorCreated: TBoolean; identitiesCreated: TInteger; organizationsCreated: TInteger; }>; payloadHash: TString; producerModule: TString; recordId: TString; target: TOptional<TObject<{ id: TString; type: TString; }>>; tenant: TString; }>]>>

event.platform.gateway.audit.recorded.v1

readonly event.platform.gateway.audit.recorded.v1: EventContract<TUnion<[TObject<{ action: TLiteral<"subject.create">; actor: TUnion<[TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TString; subjectId: TString; tenant: TString; }>, TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TLiteral<...>; subjectId: TLiteral<...>; tenant: TLiteral<...>; }>]>; correlationId: TString; occurredAt: TString; onBehalfOf: TOptional<TString>; outcome: TUnsafe<"success">; payload: TObject<{ kind: TUnion<[TLiteral<...>, TLiteral<...>]>; path: TString; }>; payloadHash: TString; producerModule: TString; recordId: TString; target: TOptional<TObject<{ id: TString; type: TString; }>>; tenant: TString; }>, TObject<{ action: TLiteral<"authentication-identity.link">; actor: TUnion<[TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TString; subjectId: TString; tenant: TString; }>, TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TLiteral<...>; subjectId: TLiteral<...>; tenant: TLiteral<...>; }>]>; correlationId: TString; occurredAt: TString; onBehalfOf: TOptional<TString>; outcome: TUnsafe<"success">; payload: TObject<{ subjectId: TString; }>; payloadHash: TString; producerModule: TString; recordId: TString; target: TOptional<TObject<{ id: TString; type: TString; }>>; tenant: TString; }>, TObject<{ action: TLiteral<"bootstrap.apply">; actor: TUnion<[TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TString; subjectId: TString; tenant: TString; }>, TObject<{ kind: TLiteral<...>; roles: TArray<...>; scopePath: TLiteral<...>; subjectId: TLiteral<...>; tenant: TLiteral<...>; }>]>; correlationId: TString; occurredAt: TString; onBehalfOf: TOptional<TString>; outcome: TUnsafe<"success">; payload: TObject<{ anchorCreated: TBoolean; identitiesCreated: TInteger; organizationsCreated: TInteger; }>; payloadHash: TString; producerModule: TString; recordId: TString; target: TOptional<TObject<{ id: TString; type: TString; }>>; tenant: TString; }>]>>

request.*.governance.accreditation.admit.v1

readonly request.*.governance.accreditation.admit.v1: RequestContract<TObject<{ accreditationId: TString; }>, TObject<{ admittedAt: TOptional<TWith<TString, { description: "When it was admitted. Absent until then."; }>>; admittedBy: TOptional<TWith<TString, { description: "Who admitted it: a subject id. Where the deployment requires a second person, never the value of `appliedBy`."; }>>; appliedAt: TWith<TString, { description: "When it was put forward."; }>; appliedBy: TWith<TString, { description: "Who put it forward: a subject id, never a name."; }>; entityTypes: TWith<TArray<TUnsafe<"federation_entity" | "openid_credential_issuer" | "openid_credential_verifier" | "openid_wallet_provider" | "openid_provider" | "openid_relying_party" | "oauth_authorization_server" | "oauth_client" | "oauth_resource">>, { description: "The OpenID Federation entity types it was accredited with. This release accepts `federation_entity` alone."; }>; frameworkVersion: TInteger; hostname: TWith<TString, { description: "The host the organization's federation documents are served on, made from the last segment of its path: `/authority/acme` is `acme.identity.<domain>`. Its entity identifier is `https://` followed by this."; }>; id: TWith<TString, { description: "The accreditation. The `{id}` of the admit and publish routes, and the `accreditation` filter of the entity statement list."; }>; organizationId: TWith<TString, { description: "The organization the accreditation is for: its subject id."; }>; path: TWith<TString, { description: "The organization's path when it applied. An organization that has moved since is refused admission with `accreditation.path_mismatch`."; }>; publicationApprovedAt: TOptional<TWith<TString, { description: "When publication was last approved. Absent until the first approval. Signing follows the approval, so this does not say the statements are published: read their `status`."; }>>; publicationApprovedBy: TOptional<TWith<TString, { description: "Who gave that approval: a subject id."; }>>; status: TWith<TUnsafe<"applied" | "admitted" | "suspended" | "withdrawn">, { description: "Where it stands. `applied`: put forward, waiting for admission. `admitted`: admitted; its statements are prepared, and published once publication is approved. `suspended` and `withdrawn` are reserved: no route of this release sets them."; }>; superiorId: TOptional<TWith<TString, { description: "The accreditation it is subordinate to, which is the trust anchor's. Absent on the anchor's own accreditation."; }>>; }>>

request.*.governance.accreditation.apply.v1

readonly request.*.governance.accreditation.apply.v1: RequestContract<TObject<{ entityTypes: TWith<TArray<TUnsafe<"federation_entity" | "openid_credential_issuer" | "openid_credential_verifier" | "openid_wallet_provider" | "openid_provider" | "openid_relying_party" | "oauth_authorization_server" | "oauth_client" | "oauth_resource">>, { description: "The OpenID Federation entity types to accredit it with. Send `["federation_entity"]`: any other type is refused with `accreditation.entity_type_unsupported` until the platform publishes metadata for it."; }>; organizationId: TWith<TString, { description: "The organization to put forward: an active organization inside the scope the caller acts for, directly beneath the trust anchor. Nothing else about it is taken from this body."; }>; }>, TObject<{ admittedAt: TOptional<TWith<TString, { description: "When it was admitted. Absent until then."; }>>; admittedBy: TOptional<TWith<TString, { description: "Who admitted it: a subject id. Where the deployment requires a second person, never the value of `appliedBy`."; }>>; appliedAt: TWith<TString, { description: "When it was put forward."; }>; appliedBy: TWith<TString, { description: "Who put it forward: a subject id, never a name."; }>; entityTypes: TWith<TArray<TUnsafe<"federation_entity" | "openid_credential_issuer" | "openid_credential_verifier" | "openid_wallet_provider" | "openid_provider" | "openid_relying_party" | "oauth_authorization_server" | "oauth_client" | "oauth_resource">>, { description: "The OpenID Federation entity types it was accredited with. This release accepts `federation_entity` alone."; }>; frameworkVersion: TInteger; hostname: TWith<TString, { description: "The host the organization's federation documents are served on, made from the last segment of its path: `/authority/acme` is `acme.identity.<domain>`. Its entity identifier is `https://` followed by this."; }>; id: TWith<TString, { description: "The accreditation. The `{id}` of the admit and publish routes, and the `accreditation` filter of the entity statement list."; }>; organizationId: TWith<TString, { description: "The organization the accreditation is for: its subject id."; }>; path: TWith<TString, { description: "The organization's path when it applied. An organization that has moved since is refused admission with `accreditation.path_mismatch`."; }>; publicationApprovedAt: TOptional<TWith<TString, { description: "When publication was last approved. Absent until the first approval. Signing follows the approval, so this does not say the statements are published: read their `status`."; }>>; publicationApprovedBy: TOptional<TWith<TString, { description: "Who gave that approval: a subject id."; }>>; status: TWith<TUnsafe<"applied" | "admitted" | "suspended" | "withdrawn">, { description: "Where it stands. `applied`: put forward, waiting for admission. `admitted`: admitted; its statements are prepared, and published once publication is approved. `suspended` and `withdrawn` are reserved: no route of this release sets them."; }>; superiorId: TOptional<TWith<TString, { description: "The accreditation it is subordinate to, which is the trust anchor's. Absent on the anchor's own accreditation."; }>>; }>>

request.*.governance.accreditation.get.v1

readonly request.*.governance.accreditation.get.v1: RequestContract<TObject<{ accreditationId: TString; }>, TObject<{ admittedAt: TOptional<TWith<TString, { description: "When it was admitted. Absent until then."; }>>; admittedBy: TOptional<TWith<TString, { description: "Who admitted it: a subject id. Where the deployment requires a second person, never the value of `appliedBy`."; }>>; appliedAt: TWith<TString, { description: "When it was put forward."; }>; appliedBy: TWith<TString, { description: "Who put it forward: a subject id, never a name."; }>; entityTypes: TWith<TArray<TUnsafe<"federation_entity" | "openid_credential_issuer" | "openid_credential_verifier" | "openid_wallet_provider" | "openid_provider" | "openid_relying_party" | "oauth_authorization_server" | "oauth_client" | "oauth_resource">>, { description: "The OpenID Federation entity types it was accredited with. This release accepts `federation_entity` alone."; }>; frameworkVersion: TInteger; hostname: TWith<TString, { description: "The host the organization's federation documents are served on, made from the last segment of its path: `/authority/acme` is `acme.identity.<domain>`. Its entity identifier is `https://` followed by this."; }>; id: TWith<TString, { description: "The accreditation. The `{id}` of the admit and publish routes, and the `accreditation` filter of the entity statement list."; }>; organizationId: TWith<TString, { description: "The organization the accreditation is for: its subject id."; }>; path: TWith<TString, { description: "The organization's path when it applied. An organization that has moved since is refused admission with `accreditation.path_mismatch`."; }>; publicationApprovedAt: TOptional<TWith<TString, { description: "When publication was last approved. Absent until the first approval. Signing follows the approval, so this does not say the statements are published: read their `status`."; }>>; publicationApprovedBy: TOptional<TWith<TString, { description: "Who gave that approval: a subject id."; }>>; status: TWith<TUnsafe<"applied" | "admitted" | "suspended" | "withdrawn">, { description: "Where it stands. `applied`: put forward, waiting for admission. `admitted`: admitted; its statements are prepared, and published once publication is approved. `suspended` and `withdrawn` are reserved: no route of this release sets them."; }>; superiorId: TOptional<TWith<TString, { description: "The accreditation it is subordinate to, which is the trust anchor's. Absent on the anchor's own accreditation."; }>>; }>>

request.*.governance.accreditation.list.v1

readonly request.*.governance.accreditation.list.v1: RequestContract<TObject<{ cursor: TOptional<TString>; limit: TOptional<TInteger>; organizationId: TOptional<TString>; status: TOptional<TUnsafe<"applied" | "admitted" | "suspended" | "withdrawn">>; }>, TObject<{ accreditations: TArray<TObject<{ admittedAt: TOptional<TWith<TString, { description: "When it was admitted. Absent until then."; }>>; admittedBy: TOptional<TWith<TString, { description: "Who admitted it: a subject id. Where the deployment requires a second person, never the value of `appliedBy`."; }>>; appliedAt: TWith<TString, { description: "When it was put forward."; }>; appliedBy: TWith<TString, { description: "Who put it forward: a subject id, never a name."; }>; entityTypes: TWith<TArray<TUnsafe<... | ... | ... | ... | ... | ... | ... | ... | ...>>, { description: "The OpenID Federation entity types it was accredited with. This release accepts `federation_entity` alone."; }>; frameworkVersion: TInteger; hostname: TWith<TString, { description: "The host the organization's federation documents are served on, made from the last segment of its path: `/authority/acme` is `acme.identity.<domain>`. Its entity identifier is `https://` followed by this."; }>; id: TWith<TString, { description: "The accreditation. The `{id}` of the admit and publish routes, and the `accreditation` filter of the entity statement list."; }>; organizationId: TWith<TString, { description: "The organization the accreditation is for: its subject id."; }>; path: TWith<TString, { description: "The organization's path when it applied. An organization that has moved since is refused admission with `accreditation.path_mismatch`."; }>; publicationApprovedAt: TOptional<TWith<TString, { description: "When publication was last approved. Absent until the first approval. Signing follows the approval, so this does not say the statements are published: read their `status`."; }>>; publicationApprovedBy: TOptional<TWith<TString, { description: "Who gave that approval: a subject id."; }>>; status: TWith<TUnsafe<"applied" | "admitted" | "suspended" | "withdrawn">, { description: "Where it stands. `applied`: put forward, waiting for admission. `admitted`: admitted; its statements are prepared, and published once publication is approved. `suspended` and `withdrawn` are reserved: no route of this release sets them."; }>; superiorId: TOptional<TWith<TString, { description: "The accreditation it is subordinate to, which is the trust anchor's. Absent on the anchor's own accreditation."; }>>; }>>; nextCursor: TOptional<TString>; }>>

request.*.governance.accreditation.publish.v1

readonly request.*.governance.accreditation.publish.v1: RequestContract<TObject<{ accreditationId: TString; }>, TObject<{ admittedAt: TOptional<TWith<TString, { description: "When it was admitted. Absent until then."; }>>; admittedBy: TOptional<TWith<TString, { description: "Who admitted it: a subject id. Where the deployment requires a second person, never the value of `appliedBy`."; }>>; appliedAt: TWith<TString, { description: "When it was put forward."; }>; appliedBy: TWith<TString, { description: "Who put it forward: a subject id, never a name."; }>; entityTypes: TWith<TArray<TUnsafe<"federation_entity" | "openid_credential_issuer" | "openid_credential_verifier" | "openid_wallet_provider" | "openid_provider" | "openid_relying_party" | "oauth_authorization_server" | "oauth_client" | "oauth_resource">>, { description: "The OpenID Federation entity types it was accredited with. This release accepts `federation_entity` alone."; }>; frameworkVersion: TInteger; hostname: TWith<TString, { description: "The host the organization's federation documents are served on, made from the last segment of its path: `/authority/acme` is `acme.identity.<domain>`. Its entity identifier is `https://` followed by this."; }>; id: TWith<TString, { description: "The accreditation. The `{id}` of the admit and publish routes, and the `accreditation` filter of the entity statement list."; }>; organizationId: TWith<TString, { description: "The organization the accreditation is for: its subject id."; }>; path: TWith<TString, { description: "The organization's path when it applied. An organization that has moved since is refused admission with `accreditation.path_mismatch`."; }>; publicationApprovedAt: TOptional<TWith<TString, { description: "When publication was last approved. Absent until the first approval. Signing follows the approval, so this does not say the statements are published: read their `status`."; }>>; publicationApprovedBy: TOptional<TWith<TString, { description: "Who gave that approval: a subject id."; }>>; status: TWith<TUnsafe<"applied" | "admitted" | "suspended" | "withdrawn">, { description: "Where it stands. `applied`: put forward, waiting for admission. `admitted`: admitted; its statements are prepared, and published once publication is approved. `suspended` and `withdrawn` are reserved: no route of this release sets them."; }>; superiorId: TOptional<TWith<TString, { description: "The accreditation it is subordinate to, which is the trust anchor's. Absent on the anchor's own accreditation."; }>>; }>>

request.*.identity.grant.create.v1

readonly request.*.identity.grant.create.v1: RequestContract<TObject<{ bundle: TString; granteeId: TString; organizationId: TString; }>, TObject<{ bundle: TString; createdAt: TString; grantedBy: TString; granteeId: TString; id: TString; organizationId: TString; revokedAt: TOptional<TString>; status: TUnion<[TLiteral<"active">, TLiteral<"revoked">]>; }>>

request.*.identity.grant.list.v1

readonly request.*.identity.grant.list.v1: RequestContract<TObject<{ cursor: TOptional<TString>; granteeId: TOptional<TString>; limit: TOptional<TInteger>; organizationId: TOptional<TString>; status: TOptional<TUnion<[TLiteral<"active">, TLiteral<"revoked">]>>; }>, TObject<{ grants: TArray<TObject<{ bundle: TString; createdAt: TString; grantedBy: TString; granteeId: TString; id: TString; organizationId: TString; revokedAt: TOptional<TString>; status: TUnion<[TLiteral<"active">, TLiteral<"revoked">]>; }>>; nextCursor: TOptional<TString>; }>>

request.*.identity.grant.revoke.v1

readonly request.*.identity.grant.revoke.v1: RequestContract<TObject<{ grantId: TString; }>, TObject<{ bundle: TString; createdAt: TString; grantedBy: TString; granteeId: TString; id: TString; organizationId: TString; revokedAt: TOptional<TString>; status: TUnion<[TLiteral<"active">, TLiteral<"revoked">]>; }>>

request.*.identity.person.create.v1

readonly request.*.identity.person.create.v1: RequestContract<TObject<{ email: TString; familyName: TString; givenName: TString; invite: TOptional<TBoolean>; parentPath: TOptional<TString>; }>, TObject<{ createdAt: TString; email: TOptional<TString>; erased: TBoolean; familyName: TOptional<TString>; givenName: TOptional<TString>; id: TString; invitation: TOptional<TObject<{ failureReason: TOptional<TUnsafe<"other" | "provider_conflict" | "provider_rejected" | "account_linked_elsewhere" | "person_erased">>; state: TUnsafe<"failed" | "none" | "sent" | "pending">; }>>; kind: TLiteral<"person">; path: TString; status: TUnion<[TLiteral<"active">, TLiteral<"suspended">]>; }>>

request.*.identity.person.get.v1

readonly request.*.identity.person.get.v1: RequestContract<TObject<{ personId: TString; }>, TObject<{ createdAt: TString; email: TOptional<TString>; erased: TBoolean; familyName: TOptional<TString>; givenName: TOptional<TString>; id: TString; invitation: TOptional<TObject<{ failureReason: TOptional<TUnsafe<"other" | "provider_conflict" | "provider_rejected" | "account_linked_elsewhere" | "person_erased">>; state: TUnsafe<"failed" | "none" | "sent" | "pending">; }>>; kind: TLiteral<"person">; path: TString; status: TUnion<[TLiteral<"active">, TLiteral<"suspended">]>; }>>

request.*.identity.person.invite.v1

readonly request.*.identity.person.invite.v1: RequestContract<TObject<{ personId: TString; }>, TObject<{ invitation: TObject<{ failureReason: TOptional<TUnsafe<"other" | "provider_conflict" | "provider_rejected" | "account_linked_elsewhere" | "person_erased">>; state: TUnsafe<"failed" | "none" | "sent" | "pending">; }>; personId: TString; }>>

request.*.identity.subject.create.v1

readonly request.*.identity.subject.create.v1: RequestContract<TObject<{ displayName: TString; kind: TLiteral<"organization">; parentPath: TOptional<TString>; slug: TString; }>, TObject<{ createdAt: TString; displayName: TString; id: TString; kind: TUnion<[TLiteral<"organization">, TLiteral<"person">]>; path: TString; status: TUnion<[TLiteral<"active">, TLiteral<"suspended">]>; }>>

request.*.identity.subject.get.v1

readonly request.*.identity.subject.get.v1: RequestContract<TObject<{ subjectId: TString; }>, TObject<{ createdAt: TString; displayName: TString; id: TString; kind: TUnion<[TLiteral<"organization">, TLiteral<"person">]>; path: TString; status: TUnion<[TLiteral<"active">, TLiteral<"suspended">]>; }>>

request.*.issuance.identifier.create.v1

readonly request.*.issuance.identifier.create.v1: RequestContract<TObject<{ host: TOptional<TWith<TString, { description: "A delegated host to serve the identifier on, such as `id.acme.example`, whose DNS already points at the platform. Leave it out to use the organization's own publisher host, `<slug>.identity.<domain>`. A name under the platform's own domains is refused."; }>>; method: TOptional<TWith<TUnsafe<"webvh" | "web">, { default: "webvh"; description: "The DID method. Leave it out for `webvh`, the default: a signed, append-only log that lets a verifier tell a key rotation from a substitution and survives a lost key. Choose `web` only for verifiers that resolve nothing else: it is one replaceable document with no history and no recovery, and whoever controls the domain can replace it. The choice is permanent for this identifier, and a deployment may not permit `web` at all."; }>>; organizationId: TWith<TString, { description: "The organization to create the identifier for: an active organization inside the scope the caller acts for. It may hold one identifier that has not failed."; }>; }>, TObject<{ assertionKeyId: TOptional<TWith<TString, { description: "The key credentials are signed with: the RFC 7638 thumbprint of its public key. Absent while `placing`. An update replaces it."; }>>; createdAt: TWith<TString, { description: "When the identifier was created."; }>; createdBy: TWith<TString, { description: "Who created it: a subject id, never a name."; }>; did: TOptional<TWith<TString, { description: "The DID. Absent while `placing`. For `webvh` it is also absent until the first version is published, because the DID is derived from the first log entry and there is none yet; the preview shows the placeholder in its place."; }>>; failureReason: TOptional<TWith<TUnsafe<"document-mismatch" | "agent-refused" | "other">, { description: "Why it failed, present when `status` is `failed` and only then. `document-mismatch`: what was signed was not what was previewed, so nothing was written. `agent-refused`: the keys could not be generated or used. `other`: anything else. In every case create a new identifier."; }>>; history: TBoolean; host: TWith<TString, { description: "The host the identifier is served on: the organization's own publisher host, `<slug>.identity.<domain>`, or the delegated host named at creation."; }>; id: TWith<TString, { description: "The identifier. The `{id}` of the read, preview, publish and update routes."; }>; method: TWith<TUnsafe<"webvh" | "web">, { description: "The DID method, chosen at creation and never changed. `webvh`: a signed, append-only log, so every change can be verified against the one before it. `web`: one replaceable document with no history, so a key change cannot be told from a substitution and whoever controls the domain can replace it."; }>; nextUpdateKeyId: TOptional<TWith<TString, { description: "The update key committed to in advance (pre-rotation), as a thumbprint: the log already carries its hash, so a lost update key does not freeze the identifier. Present while a version waits to be published, as the key that version commits to; once it is published that key is `updateKeyId`, and this is absent until an update begins. Absent for `did:web`."; }>>; organizationId: TWith<TString, { description: "The organization the identifier belongs to: its subject id."; }>; path: TWith<TString, { description: "The organization's path when the identifier was created."; }>; pendingDiscardKeyIds: TOptional<TArray<TString>>; previewedAt: TOptional<TWith<TString, { description: "When the document was last previewed. A render after the preview leaves this in place, so it alone does not say the current document was seen: compare `previewedDigest`."; }>>; previewedBy: TOptional<TWith<TString, { description: "Who last previewed it: a subject id. Present exactly when `previewedAt` is."; }>>; previewedDigest: TOptional<TWith<TString, { description: "SHA-256 of the document that preview showed. The preview covers the identifier only while this equals the `documentDigest` a preview returns now. Present exactly when `previewedAt` is."; }>>; publishedAt: TOptional<TWith<TString, { description: "When the version now served was written out. Absent until then."; }>>; renderedAt: TOptional<TWith<TString, { description: "When the document now waiting, or last published, was rendered. A preview older than this no longer counts."; }>>; retiredAssertionKeyIds: TOptional<TArray<TString>>; retiredUpdateKeyIds: TOptional<TArray<TString>>; scid: TOptional<TString>; status: TWith<TUnsafe<"placing" | "prepared" | "published" | "failed">, { description: "Where it stands. `placing`: created, waiting to be placed on an agent; read again shortly. `prepared`: keys generated and a document rendered, waiting to be previewed and published. `published`: served and resolvable. `failed`: could not be published; its keys were destroyed and nothing was written."; }>; updateKeyId: TOptional<TWith<TString, { description: "The key that signs the next log entry, as a thumbprint. While a version waits to be published it is the key that will sign that version; once the version is published it is the key that version committed to, and the key that signed is spent and listed in `retiredUpdateKeyIds` only. Absent for `did:web`, where nothing signs the document."; }>>; version: TWith<TInteger, { description: "How many versions have been published: 0 until the first, then the number of the log entry (or, for `did:web`, of the document) now served."; }>; versionId: TOptional<TWith<TString, { description: "The `versionId` of the log entry now served. Absent until the first publication, and always for `did:web`, which has no log."; }>>; versionLimit: TOptional<TInteger>; }>>

request.*.issuance.identifier.get.v1

readonly request.*.issuance.identifier.get.v1: RequestContract<TObject<{ identifierId: TString; }>, TObject<{ assertionKeyId: TOptional<TWith<TString, { description: "The key credentials are signed with: the RFC 7638 thumbprint of its public key. Absent while `placing`. An update replaces it."; }>>; createdAt: TWith<TString, { description: "When the identifier was created."; }>; createdBy: TWith<TString, { description: "Who created it: a subject id, never a name."; }>; did: TOptional<TWith<TString, { description: "The DID. Absent while `placing`. For `webvh` it is also absent until the first version is published, because the DID is derived from the first log entry and there is none yet; the preview shows the placeholder in its place."; }>>; failureReason: TOptional<TWith<TUnsafe<"document-mismatch" | "agent-refused" | "other">, { description: "Why it failed, present when `status` is `failed` and only then. `document-mismatch`: what was signed was not what was previewed, so nothing was written. `agent-refused`: the keys could not be generated or used. `other`: anything else. In every case create a new identifier."; }>>; history: TBoolean; host: TWith<TString, { description: "The host the identifier is served on: the organization's own publisher host, `<slug>.identity.<domain>`, or the delegated host named at creation."; }>; id: TWith<TString, { description: "The identifier. The `{id}` of the read, preview, publish and update routes."; }>; method: TWith<TUnsafe<"webvh" | "web">, { description: "The DID method, chosen at creation and never changed. `webvh`: a signed, append-only log, so every change can be verified against the one before it. `web`: one replaceable document with no history, so a key change cannot be told from a substitution and whoever controls the domain can replace it."; }>; nextUpdateKeyId: TOptional<TWith<TString, { description: "The update key committed to in advance (pre-rotation), as a thumbprint: the log already carries its hash, so a lost update key does not freeze the identifier. Present while a version waits to be published, as the key that version commits to; once it is published that key is `updateKeyId`, and this is absent until an update begins. Absent for `did:web`."; }>>; organizationId: TWith<TString, { description: "The organization the identifier belongs to: its subject id."; }>; path: TWith<TString, { description: "The organization's path when the identifier was created."; }>; pendingDiscardKeyIds: TOptional<TArray<TString>>; previewedAt: TOptional<TWith<TString, { description: "When the document was last previewed. A render after the preview leaves this in place, so it alone does not say the current document was seen: compare `previewedDigest`."; }>>; previewedBy: TOptional<TWith<TString, { description: "Who last previewed it: a subject id. Present exactly when `previewedAt` is."; }>>; previewedDigest: TOptional<TWith<TString, { description: "SHA-256 of the document that preview showed. The preview covers the identifier only while this equals the `documentDigest` a preview returns now. Present exactly when `previewedAt` is."; }>>; publishedAt: TOptional<TWith<TString, { description: "When the version now served was written out. Absent until then."; }>>; renderedAt: TOptional<TWith<TString, { description: "When the document now waiting, or last published, was rendered. A preview older than this no longer counts."; }>>; retiredAssertionKeyIds: TOptional<TArray<TString>>; retiredUpdateKeyIds: TOptional<TArray<TString>>; scid: TOptional<TString>; status: TWith<TUnsafe<"placing" | "prepared" | "published" | "failed">, { description: "Where it stands. `placing`: created, waiting to be placed on an agent; read again shortly. `prepared`: keys generated and a document rendered, waiting to be previewed and published. `published`: served and resolvable. `failed`: could not be published; its keys were destroyed and nothing was written."; }>; updateKeyId: TOptional<TWith<TString, { description: "The key that signs the next log entry, as a thumbprint. While a version waits to be published it is the key that will sign that version; once the version is published it is the key that version committed to, and the key that signed is spent and listed in `retiredUpdateKeyIds` only. Absent for `did:web`, where nothing signs the document."; }>>; version: TWith<TInteger, { description: "How many versions have been published: 0 until the first, then the number of the log entry (or, for `did:web`, of the document) now served."; }>; versionId: TOptional<TWith<TString, { description: "The `versionId` of the log entry now served. Absent until the first publication, and always for `did:web`, which has no log."; }>>; versionLimit: TOptional<TInteger>; }>>

request.*.issuance.identifier.list.v1

readonly request.*.issuance.identifier.list.v1: RequestContract<TObject<{ cursor: TOptional<TString>; limit: TOptional<TInteger>; organizationId: TOptional<TString>; status: TOptional<TUnsafe<"placing" | "prepared" | "published" | "failed">>; }>, TObject<{ identifiers: TArray<TObject<{ assertionKeyId: TOptional<TWith<TString, { description: "The key credentials are signed with: the RFC 7638 thumbprint of its public key. Absent while `placing`. An update replaces it."; }>>; createdAt: TWith<TString, { description: "When the identifier was created."; }>; createdBy: TWith<TString, { description: "Who created it: a subject id, never a name."; }>; did: TOptional<TWith<TString, { description: "The DID. Absent while `placing`. For `webvh` it is also absent until the first version is published, because the DID is derived from the first log entry and there is none yet; the preview shows the placeholder in its place."; }>>; failureReason: TOptional<TWith<TUnsafe<... | ... | ...>, { description: "Why it failed, present when `status` is `failed` and only then. `document-mismatch`: what was signed was not what was previewed, so nothing was written. `agent-refused`: the keys could not be generated or used. `other`: anything else. In every case create a new identifier."; }>>; history: TBoolean; host: TWith<TString, { description: "The host the identifier is served on: the organization's own publisher host, `<slug>.identity.<domain>`, or the delegated host named at creation."; }>; id: TWith<TString, { description: "The identifier. The `{id}` of the read, preview, publish and update routes."; }>; method: TWith<TUnsafe<"webvh" | "web">, { description: "The DID method, chosen at creation and never changed. `webvh`: a signed, append-only log, so every change can be verified against the one before it. `web`: one replaceable document with no history, so a key change cannot be told from a substitution and whoever controls the domain can replace it."; }>; nextUpdateKeyId: TOptional<TWith<TString, { description: "The update key committed to in advance (pre-rotation), as a thumbprint: the log already carries its hash, so a lost update key does not freeze the identifier. Present while a version waits to be published, as the key that version commits to; once it is published that key is `updateKeyId`, and this is absent until an update begins. Absent for `did:web`."; }>>; organizationId: TWith<TString, { description: "The organization the identifier belongs to: its subject id."; }>; path: TWith<TString, { description: "The organization's path when the identifier was created."; }>; pendingDiscardKeyIds: TOptional<TArray<TString>>; previewedAt: TOptional<TWith<TString, { description: "When the document was last previewed. A render after the preview leaves this in place, so it alone does not say the current document was seen: compare `previewedDigest`."; }>>; previewedBy: TOptional<TWith<TString, { description: "Who last previewed it: a subject id. Present exactly when `previewedAt` is."; }>>; previewedDigest: TOptional<TWith<TString, { description: "SHA-256 of the document that preview showed. The preview covers the identifier only while this equals the `documentDigest` a preview returns now. Present exactly when `previewedAt` is."; }>>; publishedAt: TOptional<TWith<TString, { description: "When the version now served was written out. Absent until then."; }>>; renderedAt: TOptional<TWith<TString, { description: "When the document now waiting, or last published, was rendered. A preview older than this no longer counts."; }>>; retiredAssertionKeyIds: TOptional<TArray<TString>>; retiredUpdateKeyIds: TOptional<TArray<TString>>; scid: TOptional<TString>; status: TWith<TUnsafe<"placing" | "prepared" | "published" | "failed">, { description: "Where it stands. `placing`: created, waiting to be placed on an agent; read again shortly. `prepared`: keys generated and a document rendered, waiting to be previewed and published. `published`: served and resolvable. `failed`: could not be published; its keys were destroyed and nothing was written."; }>; updateKeyId: TOptional<TWith<TString, { description: "The key that signs the next log entry, as a thumbprint. While a version waits to be published it is the key that will sign that version; once the version is published it is the key that version committed to, and the key that signed is spent and listed in `retiredUpdateKeyIds` only. Absent for `did:web`, where nothing signs the document."; }>>; version: TWith<TInteger, { description: "How many versions have been published: 0 until the first, then the number of the log entry (or, for `did:web`, of the document) now served."; }>; versionId: TOptional<TWith<TString, { description: "The `versionId` of the log entry now served. Absent until the first publication, and always for `did:web`, which has no log."; }>>; versionLimit: TOptional<TInteger>; }>>; nextCursor: TOptional<TString>; }>>

request.*.issuance.identifier.preview.v1

readonly request.*.issuance.identifier.preview.v1: RequestContract<TObject<{ identifierId: TString; }>, TObject<{ document: TString; documentDigest: TWith<TString, { description: "SHA-256 of the UTF-8 bytes of `document`, in lowercase hex. It is what the preview records on the identifier as `previewedDigest`."; }>; identifier: TObject<{ assertionKeyId: TOptional<TWith<TString, { description: "The key credentials are signed with: the RFC 7638 thumbprint of its public key. Absent while `placing`. An update replaces it."; }>>; createdAt: TWith<TString, { description: "When the identifier was created."; }>; createdBy: TWith<TString, { description: "Who created it: a subject id, never a name."; }>; did: TOptional<TWith<TString, { description: "The DID. Absent while `placing`. For `webvh` it is also absent until the first version is published, because the DID is derived from the first log entry and there is none yet; the preview shows the placeholder in its place."; }>>; failureReason: TOptional<TWith<TUnsafe<"document-mismatch" | "agent-refused" | "other">, { description: "Why it failed, present when `status` is `failed` and only then. `document-mismatch`: what was signed was not what was previewed, so nothing was written. `agent-refused`: the keys could not be generated or used. `other`: anything else. In every case create a new identifier."; }>>; history: TBoolean; host: TWith<TString, { description: "The host the identifier is served on: the organization's own publisher host, `<slug>.identity.<domain>`, or the delegated host named at creation."; }>; id: TWith<TString, { description: "The identifier. The `{id}` of the read, preview, publish and update routes."; }>; method: TWith<TUnsafe<"webvh" | "web">, { description: "The DID method, chosen at creation and never changed. `webvh`: a signed, append-only log, so every change can be verified against the one before it. `web`: one replaceable document with no history, so a key change cannot be told from a substitution and whoever controls the domain can replace it."; }>; nextUpdateKeyId: TOptional<TWith<TString, { description: "The update key committed to in advance (pre-rotation), as a thumbprint: the log already carries its hash, so a lost update key does not freeze the identifier. Present while a version waits to be published, as the key that version commits to; once it is published that key is `updateKeyId`, and this is absent until an update begins. Absent for `did:web`."; }>>; organizationId: TWith<TString, { description: "The organization the identifier belongs to: its subject id."; }>; path: TWith<TString, { description: "The organization's path when the identifier was created."; }>; pendingDiscardKeyIds: TOptional<TArray<TString>>; previewedAt: TOptional<TWith<TString, { description: "When the document was last previewed. A render after the preview leaves this in place, so it alone does not say the current document was seen: compare `previewedDigest`."; }>>; previewedBy: TOptional<TWith<TString, { description: "Who last previewed it: a subject id. Present exactly when `previewedAt` is."; }>>; previewedDigest: TOptional<TWith<TString, { description: "SHA-256 of the document that preview showed. The preview covers the identifier only while this equals the `documentDigest` a preview returns now. Present exactly when `previewedAt` is."; }>>; publishedAt: TOptional<TWith<TString, { description: "When the version now served was written out. Absent until then."; }>>; renderedAt: TOptional<TWith<TString, { description: "When the document now waiting, or last published, was rendered. A preview older than this no longer counts."; }>>; retiredAssertionKeyIds: TOptional<TArray<TString>>; retiredUpdateKeyIds: TOptional<TArray<TString>>; scid: TOptional<TString>; status: TWith<TUnsafe<"placing" | "prepared" | "published" | "failed">, { description: "Where it stands. `placing`: created, waiting to be placed on an agent; read again shortly. `prepared`: keys generated and a document rendered, waiting to be previewed and published. `published`: served and resolvable. `failed`: could not be published; its keys were destroyed and nothing was written."; }>; updateKeyId: TOptional<TWith<TString, { description: "The key that signs the next log entry, as a thumbprint. While a version waits to be published it is the key that will sign that version; once the version is published it is the key that version committed to, and the key that signed is spent and listed in `retiredUpdateKeyIds` only. Absent for `did:web`, where nothing signs the document."; }>>; version: TWith<TInteger, { description: "How many versions have been published: 0 until the first, then the number of the log entry (or, for `did:web`, of the document) now served."; }>; versionId: TOptional<TWith<TString, { description: "The `versionId` of the log entry now served. Absent until the first publication, and always for `did:web`, which has no log."; }>>; versionLimit: TOptional<TInteger>; }>; parallelDocument: TOptional<TString>; scid: TOptional<TUnion<[TString, TNull]>>; scidPlaceholder: TOptional<TLiteral<"{SCID}">>; servedAt: TArray<TString>; version: TInteger; }>>

request.*.issuance.identifier.publish.v1

readonly request.*.issuance.identifier.publish.v1: RequestContract<TObject<{ identifierId: TString; }>, TObject<{ assertionKeyId: TOptional<TWith<TString, { description: "The key credentials are signed with: the RFC 7638 thumbprint of its public key. Absent while `placing`. An update replaces it."; }>>; createdAt: TWith<TString, { description: "When the identifier was created."; }>; createdBy: TWith<TString, { description: "Who created it: a subject id, never a name."; }>; did: TOptional<TWith<TString, { description: "The DID. Absent while `placing`. For `webvh` it is also absent until the first version is published, because the DID is derived from the first log entry and there is none yet; the preview shows the placeholder in its place."; }>>; failureReason: TOptional<TWith<TUnsafe<"document-mismatch" | "agent-refused" | "other">, { description: "Why it failed, present when `status` is `failed` and only then. `document-mismatch`: what was signed was not what was previewed, so nothing was written. `agent-refused`: the keys could not be generated or used. `other`: anything else. In every case create a new identifier."; }>>; history: TBoolean; host: TWith<TString, { description: "The host the identifier is served on: the organization's own publisher host, `<slug>.identity.<domain>`, or the delegated host named at creation."; }>; id: TWith<TString, { description: "The identifier. The `{id}` of the read, preview, publish and update routes."; }>; method: TWith<TUnsafe<"webvh" | "web">, { description: "The DID method, chosen at creation and never changed. `webvh`: a signed, append-only log, so every change can be verified against the one before it. `web`: one replaceable document with no history, so a key change cannot be told from a substitution and whoever controls the domain can replace it."; }>; nextUpdateKeyId: TOptional<TWith<TString, { description: "The update key committed to in advance (pre-rotation), as a thumbprint: the log already carries its hash, so a lost update key does not freeze the identifier. Present while a version waits to be published, as the key that version commits to; once it is published that key is `updateKeyId`, and this is absent until an update begins. Absent for `did:web`."; }>>; organizationId: TWith<TString, { description: "The organization the identifier belongs to: its subject id."; }>; path: TWith<TString, { description: "The organization's path when the identifier was created."; }>; pendingDiscardKeyIds: TOptional<TArray<TString>>; previewedAt: TOptional<TWith<TString, { description: "When the document was last previewed. A render after the preview leaves this in place, so it alone does not say the current document was seen: compare `previewedDigest`."; }>>; previewedBy: TOptional<TWith<TString, { description: "Who last previewed it: a subject id. Present exactly when `previewedAt` is."; }>>; previewedDigest: TOptional<TWith<TString, { description: "SHA-256 of the document that preview showed. The preview covers the identifier only while this equals the `documentDigest` a preview returns now. Present exactly when `previewedAt` is."; }>>; publishedAt: TOptional<TWith<TString, { description: "When the version now served was written out. Absent until then."; }>>; renderedAt: TOptional<TWith<TString, { description: "When the document now waiting, or last published, was rendered. A preview older than this no longer counts."; }>>; retiredAssertionKeyIds: TOptional<TArray<TString>>; retiredUpdateKeyIds: TOptional<TArray<TString>>; scid: TOptional<TString>; status: TWith<TUnsafe<"placing" | "prepared" | "published" | "failed">, { description: "Where it stands. `placing`: created, waiting to be placed on an agent; read again shortly. `prepared`: keys generated and a document rendered, waiting to be previewed and published. `published`: served and resolvable. `failed`: could not be published; its keys were destroyed and nothing was written."; }>; updateKeyId: TOptional<TWith<TString, { description: "The key that signs the next log entry, as a thumbprint. While a version waits to be published it is the key that will sign that version; once the version is published it is the key that version committed to, and the key that signed is spent and listed in `retiredUpdateKeyIds` only. Absent for `did:web`, where nothing signs the document."; }>>; version: TWith<TInteger, { description: "How many versions have been published: 0 until the first, then the number of the log entry (or, for `did:web`, of the document) now served."; }>; versionId: TOptional<TWith<TString, { description: "The `versionId` of the log entry now served. Absent until the first publication, and always for `did:web`, which has no log."; }>>; versionLimit: TOptional<TInteger>; }>>

request.*.issuance.identifier.update.v1

readonly request.*.issuance.identifier.update.v1: RequestContract<TObject<{ identifierId: TString; }>, TObject<{ assertionKeyId: TOptional<TWith<TString, { description: "The key credentials are signed with: the RFC 7638 thumbprint of its public key. Absent while `placing`. An update replaces it."; }>>; createdAt: TWith<TString, { description: "When the identifier was created."; }>; createdBy: TWith<TString, { description: "Who created it: a subject id, never a name."; }>; did: TOptional<TWith<TString, { description: "The DID. Absent while `placing`. For `webvh` it is also absent until the first version is published, because the DID is derived from the first log entry and there is none yet; the preview shows the placeholder in its place."; }>>; failureReason: TOptional<TWith<TUnsafe<"document-mismatch" | "agent-refused" | "other">, { description: "Why it failed, present when `status` is `failed` and only then. `document-mismatch`: what was signed was not what was previewed, so nothing was written. `agent-refused`: the keys could not be generated or used. `other`: anything else. In every case create a new identifier."; }>>; history: TBoolean; host: TWith<TString, { description: "The host the identifier is served on: the organization's own publisher host, `<slug>.identity.<domain>`, or the delegated host named at creation."; }>; id: TWith<TString, { description: "The identifier. The `{id}` of the read, preview, publish and update routes."; }>; method: TWith<TUnsafe<"webvh" | "web">, { description: "The DID method, chosen at creation and never changed. `webvh`: a signed, append-only log, so every change can be verified against the one before it. `web`: one replaceable document with no history, so a key change cannot be told from a substitution and whoever controls the domain can replace it."; }>; nextUpdateKeyId: TOptional<TWith<TString, { description: "The update key committed to in advance (pre-rotation), as a thumbprint: the log already carries its hash, so a lost update key does not freeze the identifier. Present while a version waits to be published, as the key that version commits to; once it is published that key is `updateKeyId`, and this is absent until an update begins. Absent for `did:web`."; }>>; organizationId: TWith<TString, { description: "The organization the identifier belongs to: its subject id."; }>; path: TWith<TString, { description: "The organization's path when the identifier was created."; }>; pendingDiscardKeyIds: TOptional<TArray<TString>>; previewedAt: TOptional<TWith<TString, { description: "When the document was last previewed. A render after the preview leaves this in place, so it alone does not say the current document was seen: compare `previewedDigest`."; }>>; previewedBy: TOptional<TWith<TString, { description: "Who last previewed it: a subject id. Present exactly when `previewedAt` is."; }>>; previewedDigest: TOptional<TWith<TString, { description: "SHA-256 of the document that preview showed. The preview covers the identifier only while this equals the `documentDigest` a preview returns now. Present exactly when `previewedAt` is."; }>>; publishedAt: TOptional<TWith<TString, { description: "When the version now served was written out. Absent until then."; }>>; renderedAt: TOptional<TWith<TString, { description: "When the document now waiting, or last published, was rendered. A preview older than this no longer counts."; }>>; retiredAssertionKeyIds: TOptional<TArray<TString>>; retiredUpdateKeyIds: TOptional<TArray<TString>>; scid: TOptional<TString>; status: TWith<TUnsafe<"placing" | "prepared" | "published" | "failed">, { description: "Where it stands. `placing`: created, waiting to be placed on an agent; read again shortly. `prepared`: keys generated and a document rendered, waiting to be previewed and published. `published`: served and resolvable. `failed`: could not be published; its keys were destroyed and nothing was written."; }>; updateKeyId: TOptional<TWith<TString, { description: "The key that signs the next log entry, as a thumbprint. While a version waits to be published it is the key that will sign that version; once the version is published it is the key that version committed to, and the key that signed is spent and listed in `retiredUpdateKeyIds` only. Absent for `did:web`, where nothing signs the document."; }>>; version: TWith<TInteger, { description: "How many versions have been published: 0 until the first, then the number of the log entry (or, for `did:web`, of the document) now served."; }>; versionId: TOptional<TWith<TString, { description: "The `versionId` of the log entry now served. Absent until the first publication, and always for `did:web`, which has no log."; }>>; versionLimit: TOptional<TInteger>; }>>

request.*.trust.entity-statement.list.v1

readonly request.*.trust.entity-statement.list.v1: RequestContract<TObject<{ accreditationId: TOptional<TString>; cursor: TOptional<TString>; kind: TOptional<TUnsafe<"entity-configuration" | "subordinate-statement">>; limit: TOptional<TInteger>; status: TOptional<TUnsafe<"prepared" | "published" | "superseded" | "expired">>; }>, TObject<{ nextCursor: TOptional<TString>; statements: TArray<TObject<{ accreditationId: TWith<TString, { description: "The accreditation the statement was prepared for."; }>; expiresAt: TOptional<TWith<TString, { description: "The statement's `exp` claim, present once the statement is published."; }>>; id: TWith<TString, { description: "The statement. The `{id}` of the preview route."; }>; issuedAt: TOptional<TWith<TString, { description: "The statement's `iat` claim, present once the statement is published. It is the time the signed bytes were rendered."; }>>; issuer: TWith<TString, { description: "The `iss` claim: the entity itself for an entity configuration, its superior for a subordinate statement."; }>; keyId: TWith<TString, { description: "The key that signs or signed it: the `kid` of the JWS header, which is the RFC 7638 thumbprint of the public key."; }>; kind: TWith<TUnsafe<"entity-configuration" | "subordinate-statement">, { description: "Which statement it is. `entity-configuration`: the entity's statement about itself, signed by its own key. `subordinate-statement`: its superior's statement about it, signed by the superior's key."; }>; previewedAt: TOptional<TWith<TString, { description: "When the statement was last previewed. Present whenever a preview receipt exists, a stale one included: a render after the preview leaves the receipt in place, so this alone does not say the current bytes were seen. Compare `previewedDigest`. Absent only if the statement was never previewed."; }>>; previewedBy: TOptional<TWith<TString, { description: "Who last previewed it: a subject id. Present exactly when `previewedAt` is. Publication is signed only when the person who approves it is this person."; }>>; previewedDigest: TOptional<TWith<TString, { description: "SHA-256 of the payload bytes that preview showed. The receipt covers the statement only while this equals the `payloadDigest` a preview returns now. Present exactly when `previewedAt` is."; }>>; publishedAt: TOptional<TWith<TString, { description: "When the signed statement was written out. Absent until then."; }>>; renderedAt: TWith<TString, { description: "When these bytes were rendered. A statement is rendered again when it has waited past half its lifetime, and a preview older than this no longer counts."; }>; status: TWith<TUnsafe<"prepared" | "published" | "superseded" | "expired">, { description: "Where it stands. `prepared`: rendered and unsigned, waiting for publication to be approved. `published`: signed and served. `superseded`: replaced by a renewal. `expired`: reserved; nothing in this release sets it."; }>; subject: TWith<TString, { description: "The `sub` claim: the entity the statement is about."; }>; }>>; }>>

request.*.trust.entity-statement.preview.v1

readonly request.*.trust.entity-statement.preview.v1: RequestContract<TObject<{ statementId: TString; }>, TObject<{ nameConfusable: TOptional<TWith<TArray<TString>, { description: "A warning, present only when it applies: the entities whose name reads the same as this entity's once case, width, invisible characters and spacing are set aside. Each is an entity identifier, and each is the entity's superior, an entity above that, or another entity under the same superior. Admission refuses such a name, so a statement that carries this was admitted beside one the check could not see: two admissions decided at the same moment, or an entity admitted before the check existed. Compare the names before approving publication. Only entities inside the scope the caller acts for are compared, so its absence is not proof that no such entity exists."; }>>; payload: TString; payloadDigest: TWith<TString, { description: "SHA-256 of the decoded payload bytes, in lowercase hex. It is what a preview receipt records as `previewedDigest`."; }>; protectedHeader: TString; servedAt: TArray<TString>; statement: TObject<{ accreditationId: TWith<TString, { description: "The accreditation the statement was prepared for."; }>; expiresAt: TOptional<TWith<TString, { description: "The statement's `exp` claim, present once the statement is published."; }>>; id: TWith<TString, { description: "The statement. The `{id}` of the preview route."; }>; issuedAt: TOptional<TWith<TString, { description: "The statement's `iat` claim, present once the statement is published. It is the time the signed bytes were rendered."; }>>; issuer: TWith<TString, { description: "The `iss` claim: the entity itself for an entity configuration, its superior for a subordinate statement."; }>; keyId: TWith<TString, { description: "The key that signs or signed it: the `kid` of the JWS header, which is the RFC 7638 thumbprint of the public key."; }>; kind: TWith<TUnsafe<"entity-configuration" | "subordinate-statement">, { description: "Which statement it is. `entity-configuration`: the entity's statement about itself, signed by its own key. `subordinate-statement`: its superior's statement about it, signed by the superior's key."; }>; previewedAt: TOptional<TWith<TString, { description: "When the statement was last previewed. Present whenever a preview receipt exists, a stale one included: a render after the preview leaves the receipt in place, so this alone does not say the current bytes were seen. Compare `previewedDigest`. Absent only if the statement was never previewed."; }>>; previewedBy: TOptional<TWith<TString, { description: "Who last previewed it: a subject id. Present exactly when `previewedAt` is. Publication is signed only when the person who approves it is this person."; }>>; previewedDigest: TOptional<TWith<TString, { description: "SHA-256 of the payload bytes that preview showed. The receipt covers the statement only while this equals the `payloadDigest` a preview returns now. Present exactly when `previewedAt` is."; }>>; publishedAt: TOptional<TWith<TString, { description: "When the signed statement was written out. Absent until then."; }>>; renderedAt: TWith<TString, { description: "When these bytes were rendered. A statement is rendered again when it has waited past half its lifetime, and a preview older than this no longer counts."; }>; status: TWith<TUnsafe<"prepared" | "published" | "superseded" | "expired">, { description: "Where it stands. `prepared`: rendered and unsigned, waiting for publication to be approved. `published`: signed and served. `superseded`: replaced by a renewal. `expired`: reserved; nothing in this release sets it."; }>; subject: TWith<TString, { description: "The `sub` claim: the entity the statement is about."; }>; }>; }>>

request.platform.governance.anchor.converge.v1

readonly request.platform.governance.anchor.converge.v1: RequestContract<TObject<{ anchorDid: TOptional<TString>; contacts: TArray<TString>; displayName: TString; fourEyes: TOptional<TBoolean>; framework: TUnion<[TObject<{ contacts: TWith<TArray<TString>, { description: "Whom to write to about the framework: one to eight role mailboxes, none repeated."; }>; disputeRoute: TWith<TString, { description: "Where an entity, a holder or a verifier takes a dispute."; }>; governingAuthority: TObject<{ contact: TWith<..., ...>; name: TWith<..., ...>; }>; name: TWith<TString, { description: "The framework's title."; }>; roles: TArray<TObject<{ admissionCriteria: ...; code: ...; name: ...; }>>; statementLifetimes: TObject<{ anchorConfigurationSeconds: TWith<..., ...>; entityConfigurationSeconds: TWith<..., ...>; subordinateStatementSeconds: TWith<..., ...>; }>; version: TInteger; }>, TObject<{ contacts: TWith<TArray<TString>, { description: "Whom to write to about the framework: one to eight role mailboxes, none repeated."; }>; disputeRoute: TWith<TString, { description: "Where an entity, a holder or a verifier takes a dispute."; }>; name: TWith<TString, { description: "The framework's title."; }>; primaryDocument: TObject<{ administeringAuthority: TOptional<...>; controlledDocuments: TArray<...>; extensions: TUnion<...>; generalRequirements: TArray<...>; governingAuthority: TObject<...>; introduction: TObject<...>; localization: TObject<...>; objectives: TArray<...>; principles: TArray<...>; purpose: TWith<..., ...>; revisions: TObject<...>; scope: TObject<...>; terminology: TObject<...>; }>; roles: TArray<TObject<{ admissionCriteria: ...; code: ...; name: ...; }>>; schemaVersion: TWith<TLiteral<2>, { description: "Which shape of the framework this is: `2`. Not the document's version, which is `version`. A version 1 document has no such field."; }>; statementLifetimes: TObject<{ anchorConfigurationSeconds: TWith<..., ...>; entityConfigurationSeconds: TWith<..., ...>; subordinateStatementSeconds: TWith<..., ...>; }>; version: TInteger; }>]>; organizationId: TString; path: TString; plan: TOptional<TBoolean>; }>, TObject<{ accreditationId: TString; changed: TArray<TUnsafe<"statement" | "key" | "framework" | "accreditation" | "four-eyes">>; frameworkVersion: TInteger; hostname: TString; planned: TOptional<TBoolean>; }>>

request.platform.identity.bootstrap.apply.v1

readonly request.platform.identity.bootstrap.apply.v1: RequestContract<TObject<{ anchor: TObject<{ displayName: TString; slug: TString; }>; bundles: TOptional<TArray<TObject<{ code: TString; name: TString; permissions: TArray<TUnsafe<... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ...>>; }>>>; governingAccount: TOptional<TObject<{ issuer: TString; subjectClaim: TString; }>>; identities: TArray<TObject<{ actsFor: TString; bundle: TOptional<TString>; issuer: TString; subjectClaim: TString; }>>; identityProviderChanges: TOptional<TArray<TObject<{ changed: TArray<TUnsafe<... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ... | ...>>; realm: TUnsafe<"staff" | "holders">; }>>>; organizations: TArray<TObject<{ displayName: TString; path: TString; }>>; plan: TOptional<TBoolean>; rootAccount: TOptional<TObject<{ bundle: TOptional<TString>; issuer: TString; subjectClaim: TString; }>>; }>, TObject<{ anchor: TObject<{ created: TBoolean; path: TString; subjectId: TString; }>; bundlesCreated: TOptional<TInteger>; governingAccount: TOptional<TObject<{ created: TBoolean; subjectId: TString; }>>; identities: TArray<TObject<{ created: TBoolean; issuer: TString; subjectClaim: TString; subjectId: TString; }>>; organizations: TArray<TObject<{ created: TBoolean; path: TString; subjectId: TString; }>>; rootAccount: TOptional<TObject<{ created: TBoolean; grantRestored: TOptional<TLiteral<true>>; subjectId: TString; }>>; wouldRevoke: TOptional<TInteger>; }>>

request.platform.identity.me.get.v1

readonly request.platform.identity.me.get.v1: RequestContract<TObject<{ issuer: TString; subjectClaim: TString; }>, TObject<{ grants: TArray<TObject<{ bundle: TString; organizationId: TString; path: TString; }>>; }>>

request.platform.identity.principal.resolve.v1

readonly request.platform.identity.principal.resolve.v1: RequestContract<TObject<{ actingFor: TOptional<TString>; issuer: TString; subjectClaim: TString; }>, TObject<{ kind: TLiteral<"tenant">; roles: TArray<TString>; scopePath: TString; subjectId: TString; tenant: TString; }>>

request.platform.identity.root-sign-in.get.v1

readonly request.platform.identity.root-sign-in.get.v1: RequestContract<TObject<{ issuer: TString; subjectClaim: TString; }>, TObject<{ linked: TBoolean; signedInAt: TOptional<TString>; }>>

request.platform.issuance.identifier.converge.v1

readonly request.platform.issuance.identifier.converge.v1: RequestContract<TObject<{ anchor: TOptional<TObject<{ entityIdentifier: TString; host: TString; method: TUnsafe<"webvh" | "web">; organizationId: TString; path: TString; }>>; methods: TArray<TUnsafe<"webvh" | "web">>; plan: TOptional<TBoolean>; }>, TObject<{ changed: TArray<TUnsafe<"identifier" | "probe" | "methods">>; identifier: TOptional<TObject<{ assertionKeyId: TOptional<TWith<TString, { description: "The key credentials are signed with: the RFC 7638 thumbprint of its public key. Absent while `placing`. An update replaces it."; }>>; createdAt: TWith<TString, { description: "When the identifier was created."; }>; createdBy: TWith<TString, { description: "Who created it: a subject id, never a name."; }>; did: TOptional<TWith<TString, { description: "The DID. Absent while `placing`. For `webvh` it is also absent until the first version is published, because the DID is derived from the first log entry and there is none yet; the preview shows the placeholder in its place."; }>>; failureReason: TOptional<TWith<TUnsafe<... | ... | ...>, { description: "Why it failed, present when `status` is `failed` and only then. `document-mismatch`: what was signed was not what was previewed, so nothing was written. `agent-refused`: the keys could not be generated or used. `other`: anything else. In every case create a new identifier."; }>>; history: TBoolean; host: TWith<TString, { description: "The host the identifier is served on: the organization's own publisher host, `<slug>.identity.<domain>`, or the delegated host named at creation."; }>; id: TWith<TString, { description: "The identifier. The `{id}` of the read, preview, publish and update routes."; }>; method: TWith<TUnsafe<"webvh" | "web">, { description: "The DID method, chosen at creation and never changed. `webvh`: a signed, append-only log, so every change can be verified against the one before it. `web`: one replaceable document with no history, so a key change cannot be told from a substitution and whoever controls the domain can replace it."; }>; nextUpdateKeyId: TOptional<TWith<TString, { description: "The update key committed to in advance (pre-rotation), as a thumbprint: the log already carries its hash, so a lost update key does not freeze the identifier. Present while a version waits to be published, as the key that version commits to; once it is published that key is `updateKeyId`, and this is absent until an update begins. Absent for `did:web`."; }>>; organizationId: TWith<TString, { description: "The organization the identifier belongs to: its subject id."; }>; path: TWith<TString, { description: "The organization's path when the identifier was created."; }>; pendingDiscardKeyIds: TOptional<TArray<TString>>; previewedAt: TOptional<TWith<TString, { description: "When the document was last previewed. A render after the preview leaves this in place, so it alone does not say the current document was seen: compare `previewedDigest`."; }>>; previewedBy: TOptional<TWith<TString, { description: "Who last previewed it: a subject id. Present exactly when `previewedAt` is."; }>>; previewedDigest: TOptional<TWith<TString, { description: "SHA-256 of the document that preview showed. The preview covers the identifier only while this equals the `documentDigest` a preview returns now. Present exactly when `previewedAt` is."; }>>; publishedAt: TOptional<TWith<TString, { description: "When the version now served was written out. Absent until then."; }>>; renderedAt: TOptional<TWith<TString, { description: "When the document now waiting, or last published, was rendered. A preview older than this no longer counts."; }>>; retiredAssertionKeyIds: TOptional<TArray<TString>>; retiredUpdateKeyIds: TOptional<TArray<TString>>; scid: TOptional<TString>; status: TWith<TUnsafe<"placing" | "prepared" | "published" | "failed">, { description: "Where it stands. `placing`: created, waiting to be placed on an agent; read again shortly. `prepared`: keys generated and a document rendered, waiting to be previewed and published. `published`: served and resolvable. `failed`: could not be published; its keys were destroyed and nothing was written."; }>; updateKeyId: TOptional<TWith<TString, { description: "The key that signs the next log entry, as a thumbprint. While a version waits to be published it is the key that will sign that version; once the version is published it is the key that version committed to, and the key that signed is spent and listed in `retiredUpdateKeyIds` only. Absent for `did:web`, where nothing signs the document."; }>>; version: TWith<TInteger, { description: "How many versions have been published: 0 until the first, then the number of the log entry (or, for `did:web`, of the document) now served."; }>; versionId: TOptional<TWith<TString, { description: "The `versionId` of the log entry now served. Absent until the first publication, and always for `did:web`, which has no log."; }>>; versionLimit: TOptional<TInteger>; }>>; methods: TArray<TUnsafe<"webvh" | "web">>; planned: TOptional<TLiteral<true>>; }>>

request.platform.issuance.identifier.resolve.v1

readonly request.platform.issuance.identifier.resolve.v1: RequestContract<TObject<{ did: TOptional<TString>; path: TOptional<TString>; }>, TObject<{ did: TOptional<TString>; documentId: TOptional<TString>; entries: TOptional<TInteger>; evidence: TOptional<TString>; expected: TOptional<TString>; method: TUnsafe<"webvh" | "web">; parallel: TOptional<TObject<{ evidence: TOptional<TString>; expected: TOptional<TString>; returned: TOptional<TString>; state: TUnsafe<"differs" | "matches" | "absent">; }>>; problem: TOptional<TUnsafe<"keys" | "identity" | "version" | "deactivated" | "not_found" | "unreadable" | "parameters" | "hash" | "proof">>; resolved: TBoolean; returned: TOptional<TString>; sources: TArray<TString>; versionId: TOptional<TString>; versionTime: TOptional<TString>; }>>

request.platform.issuance.registry.probe.v1

readonly request.platform.issuance.registry.probe.v1: RequestContract<TObject<{ plan: TOptional<TBoolean>; registry: TUnsafe<"centralized">; runId: TString; }>, TObject<{ changed: TArray<TUnsafe<"identifier" | "probe" | "methods">>; registry: TUnsafe<"centralized">; runId: TString; wouldWrite: TOptional<TLiteral<true>>; }>>

request.platform.provisioning.agent.converge.v1

readonly request.platform.provisioning.agent.converge.v1: RequestContract<TObject<{ instance: TObject<{ custody: TUnsafe<"platform-software" | "platform-hsm" | "entity-hsm">; instanceId: TString; storeScheme: TUnsafe<"profile-per-tenant" | "database-per-tenant">; tenancy: TUnsafe<"shared" | "dedicated">; }>; plan: TOptional<TBoolean>; registries: TArray<TUnsafe<"centralized">>; }>, TObject<{ changed: TArray<TUnsafe<"registries" | "instance" | "scheme-refused" | "tenancy-refused" | "custody-refused">>; instance: TObject<{ createdAt: TString; custody: TUnsafe<"platform-software" | "platform-hsm" | "entity-hsm">; instanceId: TString; registries: TArray<TUnsafe<"centralized">>; storeScheme: TUnsafe<"profile-per-tenant" | "database-per-tenant">; tenancy: TUnsafe<"shared" | "dedicated">; }>; planned: TOptional<TLiteral<true>>; }>>

request.platform.trust.key-store.probe.v1

readonly request.platform.trust.key-store.probe.v1: RequestContract<TObject<{ expectedManufacturer: TOptional<TString>; expectedModel: TOptional<TString>; plan: TOptional<TBoolean>; runId: TString; }>, TObject<{ library: TObject<{ loadMs: TInteger; path: TString; }>; partitions: TArray<TObject<{ checked: TBoolean; label: TString; slot: TString; }>>; planned: TOptional<TLiteral<true>>; runId: TString; session: TObject<{ mismatched: TOptional<TArray<TUnsafe<"manufacturer" | "model">>>; slot: TOptional<TString>; state: TUnsafe<"open" | "token_absent" | "not_logged_in" | "expectation_missing" | "identity_mismatch" | "unavailable">; tokenLabel: TString; }>; testKey: TOptional<TObject<{ algorithm: TLiteral<"ES256">; code: TOptional<TString>; destroyed: TBoolean; failedAt: TOptional<TUnsafe<"generate" | "sign" | "verify" | "destroy">>; handle: TOptional<TString>; label: TOptional<TString>; made: TBoolean; timings: TObject<{ destroy: TOptional<TInteger>; generate: TOptional<TInteger>; sign: TOptional<TInteger>; verify: TOptional<TInteger>; }>; }>>; token: TOptional<TObject<{ firmware: TOptional<TString>; manufacturer: TString; model: TString; serial: TString; }>>; }>>