trust-tasks-rs 0.35.3

//! Generated by `trust-tasks-codegen` — do not edit by hand.
//!
//! Spec slug: `persona/attribute/get`. Version: `1.0`.
/// Why this specification version is deprecated (SPEC "Superseded and
/// Withdrawn Versions"), or `None` while it is current.
pub const DEPRECATION: Option<&str> = None;
#[allow(unused_imports)]
use serde::{Deserialize, Serialize};
/// Error types.
pub mod error {
    /// Error from a `TryFrom` or `FromStr` implementation.
    pub struct ConversionError(::std::borrow::Cow<'static, str>);
    impl ::std::error::Error for ConversionError {}
    impl ::std::fmt::Display for ConversionError {
        fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
            ::std::fmt::Display::fmt(&self.0, f)
        }
    }
    impl ::std::fmt::Debug for ConversionError {
        fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
            ::std::fmt::Debug::fmt(&self.0, f)
        }
    }
    impl From<&'static str> for ConversionError {
        fn from(value: &'static str) -> Self {
            Self(value.into())
        }
    }
    impl From<String> for ConversionError {
        fn from(value: String) -> Self {
            Self(value.into())
        }
    }
}
///One atomic fact a holder keeps about themselves. Several attributes MAY share a `type` — three phone numbers, a legal name and a preferred name — which is why `attributeId` is the identity of a fact and `type` is not. The pool is flat and unordered; ordering is a profile's concern.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Attribute {
    #[serde(rename = "attributeId")]
    pub attribute_id: Ulid,
    #[serde(
        rename = "createdAt",
        default,
        skip_serializing_if = "::std::option::Option::is_none"
    )]
    pub created_at: ::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
    ///Vault identifiers of credentials in which a third party endorses this value — a colleague vouching for a skill, an employer confirming a title. INVENTORY, not evidence: the value remains whatever its `provenance` says, and a vouched self-assertion is still self-asserted. Folding a vouch into `provenance` would make it render as attested, which is the one thing provenance exists to prevent. Not disclosed with the value; a holder who wants a counterparty to see an endorsement presents the credential itself. Absent when there are none.
    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
    pub endorsements: ::std::option::Option<Vec<AttributeEndorsementsItem>>,
    ///The holder's own words for this attribute, shown in a picker. Never disclosed to a verifier; it is a note to self.
    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
    pub label: ::std::option::Option<AttributeLabel>,
    pub provenance: Provenance,
    ///Set only where the holder decided it explicitly. Absent resolves from the claim-type registry.
    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
    pub release: ::std::option::Option<ReleaseRequirement>,
    ///Earlier versions of this attribute the maintainer still holds, and why. A maintainer that keeps a replaced value to serve `pinVersion` MUST list it here: a holder who overwrote a value may reasonably believe it gone, and this is how they learn otherwise. Values are not included — the holder reads one through the profile that pins it, or removes it with persona/attribute/purge-version. Absent when none are held.
    #[serde(
        rename = "retainedVersions",
        default,
        skip_serializing_if = "::std::vec::Vec::is_empty"
    )]
    pub retained_versions: ::std::vec::Vec<AttributeRetainedVersionsItem>,
    ///Set only where the holder decided it explicitly. Absent resolves from the claim-type registry — see CLAIM-TYPES.md §4, 'store the override, derive the default'.
    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
    pub sensitivity: ::std::option::Option<Sensitivity>,
    ///Present and true when a `credentialBacked` value could not be re-derived. `staleReason` says why. A maintainer MUST refuse to disclose a stale attribute.
    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
    pub stale: ::std::option::Option<bool>,
    ///Why re-derivation failed. Present only alongside `stale`.
    #[serde(
        rename = "staleReason",
        default,
        skip_serializing_if = "::std::option::Option::is_none"
    )]
    pub stale_reason: ::std::option::Option<AttributeStaleReason>,
    #[serde(rename = "type")]
    pub type_: ClaimType,
    #[serde(rename = "updatedAt")]
    pub updated_at: ::chrono::DateTime<::chrono::offset::Utc>,
    /**
    The fact itself, agreeing with `valueType`. Encrypted at rest by the maintainer.

    OPTIONAL, and its absence is meaningful in two distinct situations a consumer MUST NOT conflate: the caller asked for a metadata-only view (`list` without `includeValues`, which is the DEFAULT and the common case), or a credential-backed value could not be re-derived. `stale` tells them apart. Requiring this member would make the default listing unrepresentable — a maintainer would have to choose between disclosing every value in bulk and emitting a non-conformant response.*/
    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
    pub value: ::std::option::Option<::serde_json::Value>,
    #[serde(rename = "valueType")]
    pub value_type: ValueType,
    pub version: Version,
}
impl Attribute {
    pub fn builder() -> builder::Attribute {
        Default::default()
    }
}
///`AttributeEndorsementsItem`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AttributeEndorsementsItem(::std::string::String);
impl ::std::ops::Deref for AttributeEndorsementsItem {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<AttributeEndorsementsItem> for ::std::string::String {
    fn from(value: AttributeEndorsementsItem) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for AttributeEndorsementsItem {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() < 1usize {
            return Err("shorter than 1 characters".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for AttributeEndorsementsItem {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for AttributeEndorsementsItem {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for AttributeEndorsementsItem {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for AttributeEndorsementsItem {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///The holder's own words for this attribute, shown in a picker. Never disclosed to a verifier; it is a note to self.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AttributeLabel(::std::string::String);
impl ::std::ops::Deref for AttributeLabel {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<AttributeLabel> for ::std::string::String {
    fn from(value: AttributeLabel) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for AttributeLabel {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 128usize {
            return Err("longer than 128 characters".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for AttributeLabel {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for AttributeLabel {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for AttributeLabel {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for AttributeLabel {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///`AttributeRetainedVersionsItem`
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AttributeRetainedVersionsItem {
    ///The profiles pinning this version — the reason it is kept. A version no profile pins is not retained.
    #[serde(rename = "pinnedBy")]
    pub pinned_by: ::std::vec::Vec<Ulid>,
    ///When this version was written.
    #[serde(
        rename = "updatedAt",
        default,
        skip_serializing_if = "::std::option::Option::is_none"
    )]
    pub updated_at: ::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
    pub version: Version,
}
impl AttributeRetainedVersionsItem {
    pub fn builder() -> builder::AttributeRetainedVersionsItem {
        Default::default()
    }
}
///Why re-derivation failed. Present only alongside `stale`.
///
#[derive(
    ::serde::Deserialize,
    ::serde::Serialize,
    Clone,
    Copy,
    Debug,
    Eq,
    Hash,
    Ord,
    PartialEq,
    PartialOrd,
)]
#[non_exhaustive]
pub enum AttributeStaleReason {
    #[serde(rename = "revoked")]
    Revoked,
    #[serde(rename = "expired")]
    Expired,
    #[serde(rename = "archived")]
    Archived,
    #[serde(rename = "deleted")]
    Deleted,
    #[serde(rename = "notFound")]
    NotFound,
}
impl ::std::fmt::Display for AttributeStaleReason {
    fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
        match *self {
            Self::Revoked => f.write_str("revoked"),
            Self::Expired => f.write_str("expired"),
            Self::Archived => f.write_str("archived"),
            Self::Deleted => f.write_str("deleted"),
            Self::NotFound => f.write_str("notFound"),
        }
    }
}
impl ::std::str::FromStr for AttributeStaleReason {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        match value {
            "revoked" => Ok(Self::Revoked),
            "expired" => Ok(Self::Expired),
            "archived" => Ok(Self::Archived),
            "deleted" => Ok(Self::Deleted),
            "notFound" => Ok(Self::NotFound),
            _ => Err("invalid value".into()),
        }
    }
}
impl ::std::convert::TryFrom<&str> for AttributeStaleReason {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for AttributeStaleReason {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for AttributeStaleReason {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
/**
The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.

The token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.

The `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.*/
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ClaimType(::std::string::String);
impl ::std::ops::Deref for ClaimType {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<ClaimType> for ::std::string::String {
    fn from(value: ClaimType) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for ClaimType {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 128usize {
            return Err("longer than 128 characters".into());
        }
        if value.chars().count() < 1usize {
            return Err("shorter than 1 characters".into());
        }
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| {
                ::regress::Regex::new("^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$").unwrap()
            });
        if PATTERN.find(value).is_none() {
            return Err(
                "doesn't match pattern \"^(x:)?[a-z][a-zA-Z0-9]*(\\.[a-z][a-zA-Z0-9]*)*$\"".into(),
            );
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for ClaimType {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ClaimType {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ClaimType {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for ClaimType {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(transparent)]
pub struct Ext(pub ::std::collections::HashMap<ExtKey, ::serde_json::Value>);
impl ::std::ops::Deref for Ext {
    type Target = ::std::collections::HashMap<ExtKey, ::serde_json::Value>;
    fn deref(&self) -> &::std::collections::HashMap<ExtKey, ::serde_json::Value> {
        &self.0
    }
}
impl ::std::convert::From<Ext> for ::std::collections::HashMap<ExtKey, ::serde_json::Value> {
    fn from(value: Ext) -> Self {
        value.0
    }
}
impl ::std::convert::From<::std::collections::HashMap<ExtKey, ::serde_json::Value>> for Ext {
    fn from(value: ::std::collections::HashMap<ExtKey, ::serde_json::Value>) -> Self {
        Self(value)
    }
}
///`ExtKey`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExtKey(::std::string::String);
impl ::std::ops::Deref for ExtKey {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<ExtKey> for ::std::string::String {
    fn from(value: ExtKey) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for ExtKey {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| {
                ::regress::Regex::new("^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$").unwrap()
            });
        if PATTERN.find(value).is_none() {
            return Err("doesn't match pattern \"^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$\"".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for ExtKey {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ExtKey {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ExtKey {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for ExtKey {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///Read one attribute the holder holds, by identifier. Values are withheld unless asked for, on the same two-step as persona/attribute/list: the expensive, disclosing path is the one a producer has to name.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Payload {
    ///The attribute to read. One identifier, never a list: a maintainer that accepted several would recreate the enumeration this task exists to avoid.
    #[serde(rename = "attributeId")]
    pub attribute_id: Ulid,
    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
    pub ext: ::std::option::Option<Ext>,
    /**
    When false (the default), a request that asked for the value still does not receive it for an attribute resolving to `sensitivity: high` — the metadata is returned, the plaintext is not. Setting it asks for that too.

    The second flag is not ceremony. A consumer that masks a value it has already received defends a screen; it does not keep a passport number out of a log, a crash dump, or a process's memory. The value never being sent is what does.*/
    #[serde(rename = "includeSensitive", default)]
    pub include_sensitive: bool,
    ///When false (the default), the attribute's metadata is returned and its `value` is not. The default is false even though a caller naming one attribute usually wants its value, because the alternative makes the disclosing path the one nobody has to ask for — and the audit row can then say whether plaintext left, which is the question worth being able to answer later.
    #[serde(rename = "includeValue", default)]
    pub include_value: bool,
    /**
    Read a retained earlier version instead of the current one. Absent means current.

    This is what makes "what did I show them in March" answerable: a disclosure record and a pinned profile entry both name a version, and without this a caller holding one has no way to read what it said. A version the holder has purged is `persona/attribute/get:versionPurged` — never a silent fall back to the current value, which would answer a question about the past with a fact about the present.*/
    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
    pub version: ::std::option::Option<Version>,
}
impl Payload {
    pub fn builder() -> builder::Payload {
        Default::default()
    }
}
/**
How strongly a credential-backed claim is hidden when presented, ordered most private first. `predicate` proves a statement over a claim without disclosing the claim. `derived` discloses exactly the claims needed via an unlinkable derived proof, so two presentations cannot be joined. `selectiveDisclosure` discloses exactly the claims needed but carries the issuer's signature unchanged, so two presentations ARE linkable. `whole` discloses the entire credential.

The distinction between the first two and the last two is of kind, not degree: only `predicate` and `derived` avoid handing two verifiers a join key. A maintainer MUST default to the highest rung the credential's format supports, and MUST NOT silently fall to a lower one — a request that cannot be satisfied at the rung a producer asked for is refused, because a silent privacy downgrade discloses material the holder believed was hidden.*/
///
#[derive(
    ::serde::Deserialize,
    ::serde::Serialize,
    Clone,
    Copy,
    Debug,
    Eq,
    Hash,
    Ord,
    PartialEq,
    PartialOrd,
)]
#[non_exhaustive]
pub enum ProofRung {
    #[serde(rename = "predicate")]
    Predicate,
    #[serde(rename = "derived")]
    Derived,
    #[serde(rename = "selectiveDisclosure")]
    SelectiveDisclosure,
    #[serde(rename = "whole")]
    Whole,
}
impl ::std::fmt::Display for ProofRung {
    fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
        match *self {
            Self::Predicate => f.write_str("predicate"),
            Self::Derived => f.write_str("derived"),
            Self::SelectiveDisclosure => f.write_str("selectiveDisclosure"),
            Self::Whole => f.write_str("whole"),
        }
    }
}
impl ::std::str::FromStr for ProofRung {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        match value {
            "predicate" => Ok(Self::Predicate),
            "derived" => Ok(Self::Derived),
            "selectiveDisclosure" => Ok(Self::SelectiveDisclosure),
            "whole" => Ok(Self::Whole),
            _ => Err("invalid value".into()),
        }
    }
}
impl ::std::convert::TryFrom<&str> for ProofRung {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ProofRung {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ProofRung {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
/**
Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.

`selfAsserted` — the holder supplied it.

`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.

`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.

`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.

For how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.*/
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(untagged, deny_unknown_fields)]
#[non_exhaustive]
pub enum Provenance {
    Variant0 {
        kind: ::serde_json::Value,
    },
    Variant1 {
        ///RFC 6901 JSON Pointer to the claim within the credential, e.g. `/credentialSubject/familyName`.
        #[serde(rename = "claimPath")]
        claim_path: ProvenanceVariant1ClaimPath,
        ///Vault identifier of the backing credential.
        #[serde(rename = "credentialId")]
        credential_id: ProvenanceVariant1CredentialId,
        ///Issuer of the backing credential. Advisory: a consumer MUST verify the credential rather than trusting this member.
        #[serde(
            rename = "issuerDid",
            default,
            skip_serializing_if = "::std::option::Option::is_none"
        )]
        issuer_did: ::std::option::Option<ProvenanceVariant1IssuerDid>,
        kind: ::serde_json::Value,
        ///The disclosure rung this claim was, or will be, presented at.
        #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
        proof: ::std::option::Option<ProofRung>,
    },
    Variant2 {
        ///Names the minting scheme, e.g. `relayEmail`. Maintainer-defined.
        generator: ProvenanceVariant2Generator,
        kind: ::serde_json::Value,
        ///When true (the default and the only useful setting), a distinct value is minted for each verifier.
        #[serde(rename = "perVerifier", default = "defaults::default_bool::<true>")]
        per_verifier: bool,
    },
    Variant3 {
        ///When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it.
        #[serde(rename = "derivedAt")]
        derived_at: ::chrono::DateTime<::chrono::offset::Utc>,
        kind: ::serde_json::Value,
        ///The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.
        source: ProvenanceVariant3Source,
    },
}
///RFC 6901 JSON Pointer to the claim within the credential, e.g. `/credentialSubject/familyName`.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProvenanceVariant1ClaimPath(::std::string::String);
impl ::std::ops::Deref for ProvenanceVariant1ClaimPath {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<ProvenanceVariant1ClaimPath> for ::std::string::String {
    fn from(value: ProvenanceVariant1ClaimPath) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for ProvenanceVariant1ClaimPath {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| {
                ::regress::Regex::new("^(/[^/~]*(~[01][^/~]*)*)*$").unwrap()
            });
        if PATTERN.find(value).is_none() {
            return Err("doesn't match pattern \"^(/[^/~]*(~[01][^/~]*)*)*$\"".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for ProvenanceVariant1ClaimPath {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ProvenanceVariant1ClaimPath {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ProvenanceVariant1ClaimPath {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for ProvenanceVariant1ClaimPath {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///Vault identifier of the backing credential.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProvenanceVariant1CredentialId(::std::string::String);
impl ::std::ops::Deref for ProvenanceVariant1CredentialId {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<ProvenanceVariant1CredentialId> for ::std::string::String {
    fn from(value: ProvenanceVariant1CredentialId) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for ProvenanceVariant1CredentialId {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() < 1usize {
            return Err("shorter than 1 characters".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for ProvenanceVariant1CredentialId {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ProvenanceVariant1CredentialId {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ProvenanceVariant1CredentialId {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for ProvenanceVariant1CredentialId {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///Issuer of the backing credential. Advisory: a consumer MUST verify the credential rather than trusting this member.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProvenanceVariant1IssuerDid(::std::string::String);
impl ::std::ops::Deref for ProvenanceVariant1IssuerDid {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<ProvenanceVariant1IssuerDid> for ::std::string::String {
    fn from(value: ProvenanceVariant1IssuerDid) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for ProvenanceVariant1IssuerDid {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() < 1usize {
            return Err("shorter than 1 characters".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for ProvenanceVariant1IssuerDid {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ProvenanceVariant1IssuerDid {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ProvenanceVariant1IssuerDid {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for ProvenanceVariant1IssuerDid {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///Names the minting scheme, e.g. `relayEmail`. Maintainer-defined.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProvenanceVariant2Generator(::std::string::String);
impl ::std::ops::Deref for ProvenanceVariant2Generator {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<ProvenanceVariant2Generator> for ::std::string::String {
    fn from(value: ProvenanceVariant2Generator) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for ProvenanceVariant2Generator {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 64usize {
            return Err("longer than 64 characters".into());
        }
        if value.chars().count() < 1usize {
            return Err("shorter than 1 characters".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for ProvenanceVariant2Generator {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ProvenanceVariant2Generator {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ProvenanceVariant2Generator {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for ProvenanceVariant2Generator {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProvenanceVariant3Source(::std::string::String);
impl ::std::ops::Deref for ProvenanceVariant3Source {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<ProvenanceVariant3Source> for ::std::string::String {
    fn from(value: ProvenanceVariant3Source) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for ProvenanceVariant3Source {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 64usize {
            return Err("longer than 64 characters".into());
        }
        if value.chars().count() < 1usize {
            return Err("shorter than 1 characters".into());
        }
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z][A-Za-z0-9.-]*$").unwrap());
        if PATTERN.find(value).is_none() {
            return Err("doesn't match pattern \"^[a-z][A-Za-z0-9.-]*$\"".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for ProvenanceVariant3Source {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ProvenanceVariant3Source {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ProvenanceVariant3Source {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for ProvenanceVariant3Source {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
/**
What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.

`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.

`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, "each time" degrades into "once per login", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.

Absent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.*/
///
#[derive(
    ::serde::Deserialize,
    ::serde::Serialize,
    Clone,
    Copy,
    Debug,
    Eq,
    Hash,
    Ord,
    PartialEq,
    PartialOrd,
)]
#[non_exhaustive]
pub enum ReleaseRequirement {
    #[serde(rename = "consent")]
    Consent,
    #[serde(rename = "stepUp")]
    StepUp,
}
impl ::std::fmt::Display for ReleaseRequirement {
    fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
        match *self {
            Self::Consent => f.write_str("consent"),
            Self::StepUp => f.write_str("stepUp"),
        }
    }
}
impl ::std::str::FromStr for ReleaseRequirement {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        match value {
            "consent" => Ok(Self::Consent),
            "stepUp" => Ok(Self::StepUp),
            _ => Err("invalid value".into()),
        }
    }
}
impl ::std::convert::TryFrom<&str> for ReleaseRequirement {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ReleaseRequirement {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ReleaseRequirement {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
///Success response to persona/attribute/get. Type https://trusttasks.org/spec/persona/attribute/get/1.0#response.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Response {
    ///The attribute as at `version`, or as it stands when none was asked for. Its `value` is present only if the request asked for it and the attribute's sensitivity permitted it.
    pub attribute: Attribute,
    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
    pub ext: ::std::option::Option<Ext>,
    /**
    The versions of this attribute the maintainer still holds, newest first, including the current one. Names versions and never their values.

    It is here because a holder deciding whether to purge cannot see what purging would take away: which earlier versions exist, and therefore which pinned profile entries would stop presenting. A consumer that cannot enumerate them asks the holder to make an irreversible decision blind.*/
    #[serde(
        rename = "retainedVersions",
        default,
        skip_serializing_if = "::std::vec::Vec::is_empty"
    )]
    pub retained_versions: ::std::vec::Vec<Version>,
    ///True when the value was withheld although `includeValue` asked for it — the attribute resolves to `sensitivity: high` and `includeSensitive` was not set. Stated rather than left to inference: a consumer that reads an absent `value` as "this attribute has none" will show the holder an empty field where a passport number is, and conclude the record is broken.
    #[serde(
        rename = "valueWithheld",
        default,
        skip_serializing_if = "::std::option::Option::is_none"
    )]
    pub value_withheld: ::std::option::Option<bool>,
}
impl Response {
    pub fn builder() -> builder::Response {
        Default::default()
    }
}
/**
How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.

Absent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.

Distinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.*/
///
#[derive(
    ::serde::Deserialize,
    ::serde::Serialize,
    Clone,
    Copy,
    Debug,
    Eq,
    Hash,
    Ord,
    PartialEq,
    PartialOrd,
)]
#[non_exhaustive]
pub enum Sensitivity {
    #[serde(rename = "normal")]
    Normal,
    #[serde(rename = "high")]
    High,
}
impl ::std::fmt::Display for Sensitivity {
    fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
        match *self {
            Self::Normal => f.write_str("normal"),
            Self::High => f.write_str("high"),
        }
    }
}
impl ::std::str::FromStr for Sensitivity {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        match value {
            "normal" => Ok(Self::Normal),
            "high" => Ok(Self::High),
            _ => Err("invalid value".into()),
        }
    }
}
impl ::std::convert::TryFrom<&str> for Sensitivity {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for Sensitivity {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for Sensitivity {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
///A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct Ulid(::std::string::String);
impl ::std::ops::Deref for Ulid {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<Ulid> for ::std::string::String {
    fn from(value: Ulid) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for Ulid {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| {
                ::regress::Regex::new("^[0-9A-HJKMNP-TV-Z]{26}$").unwrap()
            });
        if PATTERN.find(value).is_none() {
            return Err("doesn't match pattern \"^[0-9A-HJKMNP-TV-Z]{26}$\"".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for Ulid {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for Ulid {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for Ulid {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for Ulid {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///The JSON shape of `value`, declared so that a consumer can render and compare without guessing. The maintainer validates that `value` agrees with this member and does nothing further: it does NOT validate a phone number against a phone-number grammar. That is a producer's affordance, and a store that grows opinions about the contents of its records eventually blocks its consumer's release.
///
#[derive(
    ::serde::Deserialize,
    ::serde::Serialize,
    Clone,
    Copy,
    Debug,
    Eq,
    Hash,
    Ord,
    PartialEq,
    PartialOrd,
)]
#[non_exhaustive]
pub enum ValueType {
    #[serde(rename = "string")]
    String,
    #[serde(rename = "number")]
    Number,
    #[serde(rename = "boolean")]
    Boolean,
    #[serde(rename = "date")]
    Date,
    #[serde(rename = "object")]
    Object,
}
impl ::std::fmt::Display for ValueType {
    fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
        match *self {
            Self::String => f.write_str("string"),
            Self::Number => f.write_str("number"),
            Self::Boolean => f.write_str("boolean"),
            Self::Date => f.write_str("date"),
            Self::Object => f.write_str("object"),
        }
    }
}
impl ::std::str::FromStr for ValueType {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        match value {
            "string" => Ok(Self::String),
            "number" => Ok(Self::Number),
            "boolean" => Ok(Self::Boolean),
            "date" => Ok(Self::Date),
            "object" => Ok(Self::Object),
            _ => Err("invalid value".into()),
        }
    }
}
impl ::std::convert::TryFrom<&str> for ValueType {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ValueType {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ValueType {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
///A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(transparent)]
pub struct Version(pub ::std::num::NonZeroU64);
impl ::std::ops::Deref for Version {
    type Target = ::std::num::NonZeroU64;
    fn deref(&self) -> &::std::num::NonZeroU64 {
        &self.0
    }
}
impl ::std::convert::From<Version> for ::std::num::NonZeroU64 {
    fn from(value: Version) -> Self {
        value.0
    }
}
impl ::std::convert::From<::std::num::NonZeroU64> for Version {
    fn from(value: ::std::num::NonZeroU64) -> Self {
        Self(value)
    }
}
impl ::std::str::FromStr for Version {
    type Err = <::std::num::NonZeroU64 as ::std::str::FromStr>::Err;
    fn from_str(value: &str) -> ::std::result::Result<Self, Self::Err> {
        Ok(Self(value.parse()?))
    }
}
impl ::std::convert::TryFrom<&str> for Version {
    type Error = <::std::num::NonZeroU64 as ::std::str::FromStr>::Err;
    fn try_from(value: &str) -> ::std::result::Result<Self, Self::Error> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<String> for Version {
    type Error = <::std::num::NonZeroU64 as ::std::str::FromStr>::Err;
    fn try_from(value: String) -> ::std::result::Result<Self, Self::Error> {
        value.parse()
    }
}
impl ::std::fmt::Display for Version {
    fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
        self.0.fmt(f)
    }
}
/// Types for composing complex structures.
pub mod builder {
    #[derive(Clone, Debug)]
    pub struct Attribute {
        attribute_id: ::std::result::Result<super::Ulid, ::std::string::String>,
        created_at: ::std::result::Result<
            ::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
            ::std::string::String,
        >,
        endorsements: ::std::result::Result<
            ::std::option::Option<Vec<super::AttributeEndorsementsItem>>,
            ::std::string::String,
        >,
        label: ::std::result::Result<
            ::std::option::Option<super::AttributeLabel>,
            ::std::string::String,
        >,
        provenance: ::std::result::Result<super::Provenance, ::std::string::String>,
        release: ::std::result::Result<
            ::std::option::Option<super::ReleaseRequirement>,
            ::std::string::String,
        >,
        retained_versions: ::std::result::Result<
            ::std::vec::Vec<super::AttributeRetainedVersionsItem>,
            ::std::string::String,
        >,
        sensitivity:
            ::std::result::Result<::std::option::Option<super::Sensitivity>, ::std::string::String>,
        stale: ::std::result::Result<::std::option::Option<bool>, ::std::string::String>,
        stale_reason: ::std::result::Result<
            ::std::option::Option<super::AttributeStaleReason>,
            ::std::string::String,
        >,
        type_: ::std::result::Result<super::ClaimType, ::std::string::String>,
        updated_at:
            ::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
        value: ::std::result::Result<
            ::std::option::Option<::serde_json::Value>,
            ::std::string::String,
        >,
        value_type: ::std::result::Result<super::ValueType, ::std::string::String>,
        version: ::std::result::Result<super::Version, ::std::string::String>,
    }
    impl ::std::default::Default for Attribute {
        fn default() -> Self {
            Self {
                attribute_id: Err("no value supplied for attribute_id".to_string()),
                created_at: Ok(Default::default()),
                endorsements: Ok(Default::default()),
                label: Ok(Default::default()),
                provenance: Err("no value supplied for provenance".to_string()),
                release: Ok(Default::default()),
                retained_versions: Ok(Default::default()),
                sensitivity: Ok(Default::default()),
                stale: Ok(Default::default()),
                stale_reason: Ok(Default::default()),
                type_: Err("no value supplied for type_".to_string()),
                updated_at: Err("no value supplied for updated_at".to_string()),
                value: Ok(Default::default()),
                value_type: Err("no value supplied for value_type".to_string()),
                version: Err("no value supplied for version".to_string()),
            }
        }
    }
    impl Attribute {
        pub fn attribute_id<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<super::Ulid>,
            T::Error: ::std::fmt::Display,
        {
            self.attribute_id = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for attribute_id: {e}"));
            self
        }
        pub fn created_at<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<
                ::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
            >,
            T::Error: ::std::fmt::Display,
        {
            self.created_at = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for created_at: {e}"));
            self
        }
        pub fn endorsements<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<
                ::std::option::Option<Vec<super::AttributeEndorsementsItem>>,
            >,
            T::Error: ::std::fmt::Display,
        {
            self.endorsements = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for endorsements: {e}"));
            self
        }
        pub fn label<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<super::AttributeLabel>>,
            T::Error: ::std::fmt::Display,
        {
            self.label = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for label: {e}"));
            self
        }
        pub fn provenance<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<super::Provenance>,
            T::Error: ::std::fmt::Display,
        {
            self.provenance = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for provenance: {e}"));
            self
        }
        pub fn release<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<super::ReleaseRequirement>>,
            T::Error: ::std::fmt::Display,
        {
            self.release = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for release: {e}"));
            self
        }
        pub fn retained_versions<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::vec::Vec<super::AttributeRetainedVersionsItem>>,
            T::Error: ::std::fmt::Display,
        {
            self.retained_versions = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for retained_versions: {e}"));
            self
        }
        pub fn sensitivity<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<super::Sensitivity>>,
            T::Error: ::std::fmt::Display,
        {
            self.sensitivity = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for sensitivity: {e}"));
            self
        }
        pub fn stale<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<bool>>,
            T::Error: ::std::fmt::Display,
        {
            self.stale = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for stale: {e}"));
            self
        }
        pub fn stale_reason<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<super::AttributeStaleReason>>,
            T::Error: ::std::fmt::Display,
        {
            self.stale_reason = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for stale_reason: {e}"));
            self
        }
        pub fn type_<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<super::ClaimType>,
            T::Error: ::std::fmt::Display,
        {
            self.type_ = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for type_: {e}"));
            self
        }
        pub fn updated_at<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
            T::Error: ::std::fmt::Display,
        {
            self.updated_at = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for updated_at: {e}"));
            self
        }
        pub fn value<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<::serde_json::Value>>,
            T::Error: ::std::fmt::Display,
        {
            self.value = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for value: {e}"));
            self
        }
        pub fn value_type<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<super::ValueType>,
            T::Error: ::std::fmt::Display,
        {
            self.value_type = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for value_type: {e}"));
            self
        }
        pub fn version<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<super::Version>,
            T::Error: ::std::fmt::Display,
        {
            self.version = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for version: {e}"));
            self
        }
    }
    impl ::std::convert::TryFrom<Attribute> for super::Attribute {
        type Error = super::error::ConversionError;
        fn try_from(
            value: Attribute,
        ) -> ::std::result::Result<Self, super::error::ConversionError> {
            Ok(Self {
                attribute_id: value.attribute_id?,
                created_at: value.created_at?,
                endorsements: value.endorsements?,
                label: value.label?,
                provenance: value.provenance?,
                release: value.release?,
                retained_versions: value.retained_versions?,
                sensitivity: value.sensitivity?,
                stale: value.stale?,
                stale_reason: value.stale_reason?,
                type_: value.type_?,
                updated_at: value.updated_at?,
                value: value.value?,
                value_type: value.value_type?,
                version: value.version?,
            })
        }
    }
    impl ::std::convert::From<super::Attribute> for Attribute {
        fn from(value: super::Attribute) -> Self {
            Self {
                attribute_id: Ok(value.attribute_id),
                created_at: Ok(value.created_at),
                endorsements: Ok(value.endorsements),
                label: Ok(value.label),
                provenance: Ok(value.provenance),
                release: Ok(value.release),
                retained_versions: Ok(value.retained_versions),
                sensitivity: Ok(value.sensitivity),
                stale: Ok(value.stale),
                stale_reason: Ok(value.stale_reason),
                type_: Ok(value.type_),
                updated_at: Ok(value.updated_at),
                value: Ok(value.value),
                value_type: Ok(value.value_type),
                version: Ok(value.version),
            }
        }
    }
    #[derive(Clone, Debug)]
    pub struct AttributeRetainedVersionsItem {
        pinned_by: ::std::result::Result<::std::vec::Vec<super::Ulid>, ::std::string::String>,
        updated_at: ::std::result::Result<
            ::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
            ::std::string::String,
        >,
        version: ::std::result::Result<super::Version, ::std::string::String>,
    }
    impl ::std::default::Default for AttributeRetainedVersionsItem {
        fn default() -> Self {
            Self {
                pinned_by: Err("no value supplied for pinned_by".to_string()),
                updated_at: Ok(Default::default()),
                version: Err("no value supplied for version".to_string()),
            }
        }
    }
    impl AttributeRetainedVersionsItem {
        pub fn pinned_by<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::vec::Vec<super::Ulid>>,
            T::Error: ::std::fmt::Display,
        {
            self.pinned_by = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for pinned_by: {e}"));
            self
        }
        pub fn updated_at<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<
                ::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
            >,
            T::Error: ::std::fmt::Display,
        {
            self.updated_at = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for updated_at: {e}"));
            self
        }
        pub fn version<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<super::Version>,
            T::Error: ::std::fmt::Display,
        {
            self.version = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for version: {e}"));
            self
        }
    }
    impl ::std::convert::TryFrom<AttributeRetainedVersionsItem>
        for super::AttributeRetainedVersionsItem
    {
        type Error = super::error::ConversionError;
        fn try_from(
            value: AttributeRetainedVersionsItem,
        ) -> ::std::result::Result<Self, super::error::ConversionError> {
            Ok(Self {
                pinned_by: value.pinned_by?,
                updated_at: value.updated_at?,
                version: value.version?,
            })
        }
    }
    impl ::std::convert::From<super::AttributeRetainedVersionsItem> for AttributeRetainedVersionsItem {
        fn from(value: super::AttributeRetainedVersionsItem) -> Self {
            Self {
                pinned_by: Ok(value.pinned_by),
                updated_at: Ok(value.updated_at),
                version: Ok(value.version),
            }
        }
    }
    #[derive(Clone, Debug)]
    pub struct Payload {
        attribute_id: ::std::result::Result<super::Ulid, ::std::string::String>,
        ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
        include_sensitive: ::std::result::Result<bool, ::std::string::String>,
        include_value: ::std::result::Result<bool, ::std::string::String>,
        version:
            ::std::result::Result<::std::option::Option<super::Version>, ::std::string::String>,
    }
    impl ::std::default::Default for Payload {
        fn default() -> Self {
            Self {
                attribute_id: Err("no value supplied for attribute_id".to_string()),
                ext: Ok(Default::default()),
                include_sensitive: Ok(Default::default()),
                include_value: Ok(Default::default()),
                version: Ok(Default::default()),
            }
        }
    }
    impl Payload {
        pub fn attribute_id<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<super::Ulid>,
            T::Error: ::std::fmt::Display,
        {
            self.attribute_id = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for attribute_id: {e}"));
            self
        }
        pub fn ext<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
            T::Error: ::std::fmt::Display,
        {
            self.ext = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for ext: {e}"));
            self
        }
        pub fn include_sensitive<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<bool>,
            T::Error: ::std::fmt::Display,
        {
            self.include_sensitive = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for include_sensitive: {e}"));
            self
        }
        pub fn include_value<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<bool>,
            T::Error: ::std::fmt::Display,
        {
            self.include_value = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for include_value: {e}"));
            self
        }
        pub fn version<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<super::Version>>,
            T::Error: ::std::fmt::Display,
        {
            self.version = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for version: {e}"));
            self
        }
    }
    impl ::std::convert::TryFrom<Payload> for super::Payload {
        type Error = super::error::ConversionError;
        fn try_from(value: Payload) -> ::std::result::Result<Self, super::error::ConversionError> {
            Ok(Self {
                attribute_id: value.attribute_id?,
                ext: value.ext?,
                include_sensitive: value.include_sensitive?,
                include_value: value.include_value?,
                version: value.version?,
            })
        }
    }
    impl ::std::convert::From<super::Payload> for Payload {
        fn from(value: super::Payload) -> Self {
            Self {
                attribute_id: Ok(value.attribute_id),
                ext: Ok(value.ext),
                include_sensitive: Ok(value.include_sensitive),
                include_value: Ok(value.include_value),
                version: Ok(value.version),
            }
        }
    }
    #[derive(Clone, Debug)]
    pub struct Response {
        attribute: ::std::result::Result<super::Attribute, ::std::string::String>,
        ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
        retained_versions:
            ::std::result::Result<::std::vec::Vec<super::Version>, ::std::string::String>,
        value_withheld: ::std::result::Result<::std::option::Option<bool>, ::std::string::String>,
    }
    impl ::std::default::Default for Response {
        fn default() -> Self {
            Self {
                attribute: Err("no value supplied for attribute".to_string()),
                ext: Ok(Default::default()),
                retained_versions: Ok(Default::default()),
                value_withheld: Ok(Default::default()),
            }
        }
    }
    impl Response {
        pub fn attribute<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<super::Attribute>,
            T::Error: ::std::fmt::Display,
        {
            self.attribute = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for attribute: {e}"));
            self
        }
        pub fn ext<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
            T::Error: ::std::fmt::Display,
        {
            self.ext = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for ext: {e}"));
            self
        }
        pub fn retained_versions<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::vec::Vec<super::Version>>,
            T::Error: ::std::fmt::Display,
        {
            self.retained_versions = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for retained_versions: {e}"));
            self
        }
        pub fn value_withheld<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<bool>>,
            T::Error: ::std::fmt::Display,
        {
            self.value_withheld = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for value_withheld: {e}"));
            self
        }
    }
    impl ::std::convert::TryFrom<Response> for super::Response {
        type Error = super::error::ConversionError;
        fn try_from(value: Response) -> ::std::result::Result<Self, super::error::ConversionError> {
            Ok(Self {
                attribute: value.attribute?,
                ext: value.ext?,
                retained_versions: value.retained_versions?,
                value_withheld: value.value_withheld?,
            })
        }
    }
    impl ::std::convert::From<super::Response> for Response {
        fn from(value: super::Response) -> Self {
            Self {
                attribute: Ok(value.attribute),
                ext: Ok(value.ext),
                retained_versions: Ok(value.retained_versions),
                value_withheld: Ok(value.value_withheld),
            }
        }
    }
}
/// Generation of default values for serde.
pub mod defaults {
    pub(super) fn default_bool<const V: bool>() -> bool {
        V
    }
}
impl crate::Payload for Payload {
    const TYPE_URI: &'static str = "https://trusttasks.org/spec/persona/attribute/get/1.0";
    const IS_PROOF_REQUIRED: bool = true;
    const IS_RECIPIENT_REQUIRED: bool = true;
    const PAYLOAD_SCHEMA: Option<&'static str> = Some(
        "{\"$defs\":{\"Attribute\":{\"additionalProperties\":false,\"description\":\"One atomic fact a holder keeps about themselves. Several attributes MAY share a `type` — three phone numbers, a legal name and a preferred name — which is why `attributeId` is the identity of a fact and `type` is not. The pool is flat and unordered; ordering is a profile's concern.\",\"properties\":{\"attributeId\":{\"$ref\":\"#/$defs/Ulid\"},\"createdAt\":{\"format\":\"date-time\",\"type\":\"string\"},\"endorsements\":{\"description\":\"Vault identifiers of credentials in which a third party endorses this value — a colleague vouching for a skill, an employer confirming a title. INVENTORY, not evidence: the value remains whatever its `provenance` says, and a vouched self-assertion is still self-asserted. Folding a vouch into `provenance` would make it render as attested, which is the one thing provenance exists to prevent. Not disclosed with the value; a holder who wants a counterparty to see an endorsement presents the credential itself. Absent when there are none.\",\"items\":{\"minLength\":1,\"type\":\"string\"},\"maxItems\":64,\"type\":\"array\",\"uniqueItems\":true},\"label\":{\"description\":\"The holder's own words for this attribute, shown in a picker. Never disclosed to a verifier; it is a note to self.\",\"maxLength\":128,\"type\":\"string\"},\"provenance\":{\"$ref\":\"#/$defs/Provenance\"},\"release\":{\"$ref\":\"#/$defs/ReleaseRequirement\",\"description\":\"Set only where the holder decided it explicitly. Absent resolves from the claim-type registry.\"},\"retainedVersions\":{\"description\":\"Earlier versions of this attribute the maintainer still holds, and why. A maintainer that keeps a replaced value to serve `pinVersion` MUST list it here: a holder who overwrote a value may reasonably believe it gone, and this is how they learn otherwise. Values are not included — the holder reads one through the profile that pins it, or removes it with persona/attribute/purge-version. Absent when none are held.\",\"items\":{\"additionalProperties\":false,\"properties\":{\"pinnedBy\":{\"description\":\"The profiles pinning this version — the reason it is kept. A version no profile pins is not retained.\",\"items\":{\"$ref\":\"#/$defs/Ulid\"},\"maxItems\":256,\"minItems\":1,\"type\":\"array\"},\"updatedAt\":{\"description\":\"When this version was written.\",\"format\":\"date-time\",\"type\":\"string\"},\"version\":{\"$ref\":\"#/$defs/Version\"}},\"required\":[\"version\",\"pinnedBy\"],\"type\":\"object\"},\"maxItems\":64,\"type\":\"array\"},\"sensitivity\":{\"$ref\":\"#/$defs/Sensitivity\",\"description\":\"Set only where the holder decided it explicitly. Absent resolves from the claim-type registry — see CLAIM-TYPES.md §4, 'store the override, derive the default'.\"},\"stale\":{\"description\":\"Present and true when a `credentialBacked` value could not be re-derived. `staleReason` says why. A maintainer MUST refuse to disclose a stale attribute.\",\"type\":\"boolean\"},\"staleReason\":{\"description\":\"Why re-derivation failed. Present only alongside `stale`.\",\"enum\":[\"revoked\",\"expired\",\"archived\",\"deleted\",\"notFound\"],\"type\":\"string\"},\"type\":{\"$ref\":\"#/$defs/ClaimType\"},\"updatedAt\":{\"format\":\"date-time\",\"type\":\"string\"},\"value\":{\"description\":\"The fact itself, agreeing with `valueType`. Encrypted at rest by the maintainer.\\n\\nOPTIONAL, and its absence is meaningful in two distinct situations a consumer MUST NOT conflate: the caller asked for a metadata-only view (`list` without `includeValues`, which is the DEFAULT and the common case), or a credential-backed value could not be re-derived. `stale` tells them apart. Requiring this member would make the default listing unrepresentable — a maintainer would have to choose between disclosing every value in bulk and emitting a non-conformant response.\"},\"valueType\":{\"$ref\":\"#/$defs/ValueType\"},\"version\":{\"$ref\":\"#/$defs/Version\"}},\"required\":[\"attributeId\",\"type\",\"valueType\",\"provenance\",\"version\",\"updatedAt\"],\"title\":\"Attribute\",\"type\":\"object\"},\"ClaimType\":{\"description\":\"The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.\\n\\nThe token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.\\n\\nThe `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.\",\"maxLength\":128,\"minLength\":1,\"pattern\":\"^(x:)?[a-z][a-zA-Z0-9]*(\\\\.[a-z][a-zA-Z0-9]*)*$\",\"title\":\"ClaimType\",\"type\":\"string\"},\"Ext\":{\"additionalProperties\":true,\"description\":\"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\"minProperties\":1,\"propertyNames\":{\"pattern\":\"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"},\"title\":\"Ext\",\"type\":\"object\"},\"ProofRung\":{\"description\":\"How strongly a credential-backed claim is hidden when presented, ordered most private first. `predicate` proves a statement over a claim without disclosing the claim. `derived` discloses exactly the claims needed via an unlinkable derived proof, so two presentations cannot be joined. `selectiveDisclosure` discloses exactly the claims needed but carries the issuer's signature unchanged, so two presentations ARE linkable. `whole` discloses the entire credential.\\n\\nThe distinction between the first two and the last two is of kind, not degree: only `predicate` and `derived` avoid handing two verifiers a join key. A maintainer MUST default to the highest rung the credential's format supports, and MUST NOT silently fall to a lower one — a request that cannot be satisfied at the rung a producer asked for is refused, because a silent privacy downgrade discloses material the holder believed was hidden.\",\"enum\":[\"predicate\",\"derived\",\"selectiveDisclosure\",\"whole\"],\"title\":\"ProofRung\",\"type\":\"string\"},\"Provenance\":{\"description\":\"Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\\n\\n`selfAsserted` — the holder supplied it.\\n\\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\\n\\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\\n\\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\\n\\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.\",\"oneOf\":[{\"additionalProperties\":false,\"properties\":{\"kind\":{\"const\":\"selfAsserted\"}},\"required\":[\"kind\"]},{\"additionalProperties\":false,\"properties\":{\"claimPath\":{\"description\":\"RFC 6901 JSON Pointer to the claim within the credential, e.g. `/credentialSubject/familyName`.\",\"pattern\":\"^(/[^/~]*(~[01][^/~]*)*)*$\",\"type\":\"string\"},\"credentialId\":{\"description\":\"Vault identifier of the backing credential.\",\"minLength\":1,\"type\":\"string\"},\"issuerDid\":{\"description\":\"Issuer of the backing credential. Advisory: a consumer MUST verify the credential rather than trusting this member.\",\"minLength\":1,\"type\":\"string\"},\"kind\":{\"const\":\"credentialBacked\"},\"proof\":{\"$ref\":\"#/$defs/ProofRung\",\"description\":\"The disclosure rung this claim was, or will be, presented at.\"}},\"required\":[\"kind\",\"credentialId\",\"claimPath\"]},{\"additionalProperties\":false,\"properties\":{\"generator\":{\"description\":\"Names the minting scheme, e.g. `relayEmail`. Maintainer-defined.\",\"maxLength\":64,\"minLength\":1,\"type\":\"string\"},\"kind\":{\"const\":\"generated\"},\"perVerifier\":{\"default\":true,\"description\":\"When true (the default and the only useful setting), a distinct value is minted for each verifier.\",\"type\":\"boolean\"}},\"required\":[\"kind\",\"generator\"]},{\"additionalProperties\":false,\"properties\":{\"derivedAt\":{\"description\":\"When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it.\",\"format\":\"date-time\",\"type\":\"string\"},\"kind\":{\"const\":\"derived\"},\"source\":{\"description\":\"The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.\",\"maxLength\":64,\"minLength\":1,\"pattern\":\"^[a-z][A-Za-z0-9.-]*$\",\"type\":\"string\"}},\"required\":[\"kind\",\"source\",\"derivedAt\"]}],\"required\":[\"kind\"],\"title\":\"Provenance\",\"type\":\"object\"},\"ReleaseRequirement\":{\"description\":\"What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\\n\\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\\n\\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \\\"each time\\\" degrades into \\\"once per login\\\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\\n\\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.\",\"enum\":[\"consent\",\"stepUp\"],\"title\":\"ReleaseRequirement\",\"type\":\"string\"},\"Response\":{\"$anchor\":\"response\",\"additionalProperties\":false,\"description\":\"Success response to persona/attribute/get. Type https://trusttasks.org/spec/persona/attribute/get/1.0#response.\",\"properties\":{\"attribute\":{\"$ref\":\"#/$defs/Attribute\",\"description\":\"The attribute as at `version`, or as it stands when none was asked for. Its `value` is present only if the request asked for it and the attribute's sensitivity permitted it.\"},\"ext\":{\"$ref\":\"#/$defs/Ext\"},\"retainedVersions\":{\"description\":\"The versions of this attribute the maintainer still holds, newest first, including the current one. Names versions and never their values.\\n\\nIt is here because a holder deciding whether to purge cannot see what purging would take away: which earlier versions exist, and therefore which pinned profile entries would stop presenting. A consumer that cannot enumerate them asks the holder to make an irreversible decision blind.\",\"items\":{\"$ref\":\"#/$defs/Version\"},\"maxItems\":64,\"type\":\"array\"},\"valueWithheld\":{\"description\":\"True when the value was withheld although `includeValue` asked for it — the attribute resolves to `sensitivity: high` and `includeSensitive` was not set. Stated rather than left to inference: a consumer that reads an absent `value` as \\\"this attribute has none\\\" will show the holder an empty field where a passport number is, and conclude the record is broken.\",\"type\":\"boolean\"}},\"required\":[\"attribute\"],\"title\":\"Persona Attribute — Get — response payload\",\"type\":\"object\"},\"Sensitivity\":{\"description\":\"How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\\n\\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\\n\\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.\",\"enum\":[\"normal\",\"high\"],\"title\":\"Sensitivity\",\"type\":\"string\"},\"Ulid\":{\"description\":\"A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.\",\"pattern\":\"^[0-9A-HJKMNP-TV-Z]{26}$\",\"title\":\"Ulid\",\"type\":\"string\"},\"ValueType\":{\"description\":\"The JSON shape of `value`, declared so that a consumer can render and compare without guessing. The maintainer validates that `value` agrees with this member and does nothing further: it does NOT validate a phone number against a phone-number grammar. That is a producer's affordance, and a store that grows opinions about the contents of its records eventually blocks its consumer's release.\",\"enum\":[\"string\",\"number\",\"boolean\",\"date\",\"object\"],\"title\":\"ValueType\",\"type\":\"string\"},\"Version\":{\"description\":\"A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.\",\"minimum\":1,\"title\":\"Version\",\"type\":\"integer\"}},\"$id\":\"https://trusttasks.org/spec/persona/attribute/get/1.0\",\"$schema\":\"https://json-schema.org/draft/2020-12/schema\",\"additionalProperties\":false,\"description\":\"Read one attribute the holder holds, by identifier. Values are withheld unless asked for, on the same two-step as persona/attribute/list: the expensive, disclosing path is the one a producer has to name.\",\"properties\":{\"attributeId\":{\"$ref\":\"#/$defs/Ulid\",\"description\":\"The attribute to read. One identifier, never a list: a maintainer that accepted several would recreate the enumeration this task exists to avoid.\"},\"ext\":{\"$ref\":\"#/$defs/Ext\"},\"includeSensitive\":{\"default\":false,\"description\":\"When false (the default), a request that asked for the value still does not receive it for an attribute resolving to `sensitivity: high` — the metadata is returned, the plaintext is not. Setting it asks for that too.\\n\\nThe second flag is not ceremony. A consumer that masks a value it has already received defends a screen; it does not keep a passport number out of a log, a crash dump, or a process's memory. The value never being sent is what does.\",\"type\":\"boolean\"},\"includeValue\":{\"$comment\":\"Mirrors includeValues on persona/attribute/list. The plural is a listing of many; this is one.\",\"default\":false,\"description\":\"When false (the default), the attribute's metadata is returned and its `value` is not. The default is false even though a caller naming one attribute usually wants its value, because the alternative makes the disclosing path the one nobody has to ask for — and the audit row can then say whether plaintext left, which is the question worth being able to answer later.\",\"type\":\"boolean\"},\"version\":{\"$ref\":\"#/$defs/Version\",\"description\":\"Read a retained earlier version instead of the current one. Absent means current.\\n\\nThis is what makes \\\"what did I show them in March\\\" answerable: a disclosure record and a pinned profile entry both name a version, and without this a caller holding one has no way to read what it said. A version the holder has purged is `persona/attribute/get:versionPurged` — never a silent fall back to the current value, which would answer a question about the past with a fact about the present.\"}},\"required\":[\"attributeId\"],\"title\":\"Persona Attribute — Get — payload\",\"type\":\"object\"}\n",
    );
}
impl crate::Payload for Response {
    const TYPE_URI: &'static str = "https://trusttasks.org/spec/persona/attribute/get/1.0#response";
    const IS_PROOF_REQUIRED: bool = true;
    const IS_RECIPIENT_REQUIRED: bool = true;
    const PAYLOAD_SCHEMA: Option<&'static str> = Some(
        "{\"$defs\":{\"Attribute\":{\"additionalProperties\":false,\"description\":\"One atomic fact a holder keeps about themselves. Several attributes MAY share a `type` — three phone numbers, a legal name and a preferred name — which is why `attributeId` is the identity of a fact and `type` is not. The pool is flat and unordered; ordering is a profile's concern.\",\"properties\":{\"attributeId\":{\"$ref\":\"#/$defs/Ulid\"},\"createdAt\":{\"format\":\"date-time\",\"type\":\"string\"},\"endorsements\":{\"description\":\"Vault identifiers of credentials in which a third party endorses this value — a colleague vouching for a skill, an employer confirming a title. INVENTORY, not evidence: the value remains whatever its `provenance` says, and a vouched self-assertion is still self-asserted. Folding a vouch into `provenance` would make it render as attested, which is the one thing provenance exists to prevent. Not disclosed with the value; a holder who wants a counterparty to see an endorsement presents the credential itself. Absent when there are none.\",\"items\":{\"minLength\":1,\"type\":\"string\"},\"maxItems\":64,\"type\":\"array\",\"uniqueItems\":true},\"label\":{\"description\":\"The holder's own words for this attribute, shown in a picker. Never disclosed to a verifier; it is a note to self.\",\"maxLength\":128,\"type\":\"string\"},\"provenance\":{\"$ref\":\"#/$defs/Provenance\"},\"release\":{\"$ref\":\"#/$defs/ReleaseRequirement\",\"description\":\"Set only where the holder decided it explicitly. Absent resolves from the claim-type registry.\"},\"retainedVersions\":{\"description\":\"Earlier versions of this attribute the maintainer still holds, and why. A maintainer that keeps a replaced value to serve `pinVersion` MUST list it here: a holder who overwrote a value may reasonably believe it gone, and this is how they learn otherwise. Values are not included — the holder reads one through the profile that pins it, or removes it with persona/attribute/purge-version. Absent when none are held.\",\"items\":{\"additionalProperties\":false,\"properties\":{\"pinnedBy\":{\"description\":\"The profiles pinning this version — the reason it is kept. A version no profile pins is not retained.\",\"items\":{\"$ref\":\"#/$defs/Ulid\"},\"maxItems\":256,\"minItems\":1,\"type\":\"array\"},\"updatedAt\":{\"description\":\"When this version was written.\",\"format\":\"date-time\",\"type\":\"string\"},\"version\":{\"$ref\":\"#/$defs/Version\"}},\"required\":[\"version\",\"pinnedBy\"],\"type\":\"object\"},\"maxItems\":64,\"type\":\"array\"},\"sensitivity\":{\"$ref\":\"#/$defs/Sensitivity\",\"description\":\"Set only where the holder decided it explicitly. Absent resolves from the claim-type registry — see CLAIM-TYPES.md §4, 'store the override, derive the default'.\"},\"stale\":{\"description\":\"Present and true when a `credentialBacked` value could not be re-derived. `staleReason` says why. A maintainer MUST refuse to disclose a stale attribute.\",\"type\":\"boolean\"},\"staleReason\":{\"description\":\"Why re-derivation failed. Present only alongside `stale`.\",\"enum\":[\"revoked\",\"expired\",\"archived\",\"deleted\",\"notFound\"],\"type\":\"string\"},\"type\":{\"$ref\":\"#/$defs/ClaimType\"},\"updatedAt\":{\"format\":\"date-time\",\"type\":\"string\"},\"value\":{\"description\":\"The fact itself, agreeing with `valueType`. Encrypted at rest by the maintainer.\\n\\nOPTIONAL, and its absence is meaningful in two distinct situations a consumer MUST NOT conflate: the caller asked for a metadata-only view (`list` without `includeValues`, which is the DEFAULT and the common case), or a credential-backed value could not be re-derived. `stale` tells them apart. Requiring this member would make the default listing unrepresentable — a maintainer would have to choose between disclosing every value in bulk and emitting a non-conformant response.\"},\"valueType\":{\"$ref\":\"#/$defs/ValueType\"},\"version\":{\"$ref\":\"#/$defs/Version\"}},\"required\":[\"attributeId\",\"type\",\"valueType\",\"provenance\",\"version\",\"updatedAt\"],\"title\":\"Attribute\",\"type\":\"object\"},\"ClaimType\":{\"description\":\"The vocabulary token naming what a value IS — `name.legal`, `phone.mobile`, `address.postal`, `person.birthDate`. Dotted, most-general segment first, so that a consumer with no knowledge of the specific token can still group by its prefix.\\n\\nThe token is the maintainer's own; no external vocabulary is primary. External vocabularies (vCard/jCard, OIDC standard claims, schema.org) are mappings applied at PRESENTATION by a renderer, not at rest, so that a query written in any of them can be matched without the store having to live inside any one of them.\\n\\nThe `x:` prefix is an open extension namespace and is not decoration. The closest prior art — Windows CardSpace's self-issued card — supported exactly fifteen predefined claim types with no extensibility, and that is the specific way it failed the requirement a holder actually has. An `x:` attribute stores, composes, binds and discloses exactly like a known one; it renders generically and matches only an explicit query.\",\"maxLength\":128,\"minLength\":1,\"pattern\":\"^(x:)?[a-z][a-zA-Z0-9]*(\\\\.[a-z][a-zA-Z0-9]*)*$\",\"title\":\"ClaimType\",\"type\":\"string\"},\"Ext\":{\"additionalProperties\":true,\"description\":\"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\"minProperties\":1,\"propertyNames\":{\"pattern\":\"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"},\"title\":\"Ext\",\"type\":\"object\"},\"ProofRung\":{\"description\":\"How strongly a credential-backed claim is hidden when presented, ordered most private first. `predicate` proves a statement over a claim without disclosing the claim. `derived` discloses exactly the claims needed via an unlinkable derived proof, so two presentations cannot be joined. `selectiveDisclosure` discloses exactly the claims needed but carries the issuer's signature unchanged, so two presentations ARE linkable. `whole` discloses the entire credential.\\n\\nThe distinction between the first two and the last two is of kind, not degree: only `predicate` and `derived` avoid handing two verifiers a join key. A maintainer MUST default to the highest rung the credential's format supports, and MUST NOT silently fall to a lower one — a request that cannot be satisfied at the rung a producer asked for is refused, because a silent privacy downgrade discloses material the holder believed was hidden.\",\"enum\":[\"predicate\",\"derived\",\"selectiveDisclosure\",\"whole\"],\"title\":\"ProofRung\",\"type\":\"string\"},\"Provenance\":{\"description\":\"Where a value comes from, and the member that makes this family worth building on a trust stack rather than in an address book. It survives to the verifier, so a recipient can tell — per field — what the holder typed from what an issuer attested.\\n\\n`selfAsserted` — the holder supplied it.\\n\\n`credentialBacked` — the value is derived from a credential in the vault at `claimPath`. The stored value is a CACHE FOR DISPLAY; the credential is the truth. A maintainer MUST re-derive it on read and MUST fail closed (never presenting a stale value) when the credential has been revoked, has expired, or has been archived or deleted.\\n\\n`generated` — the value is minted per verifier at disclosure time and recorded against that verifier, so every relying party receives a different one that routes back to the holder. This is the shape of the most widely adopted consumer privacy feature in this space; a maintainer need not operate a relay to conform, but the shape must exist, because retrofitting per-verifier values into a pool-of-values model is a migration rather than an addition.\\n\\n`derived` — the value was taken from a source the holder connected or supplied — a code-hosting profile, an uploaded CV — rather than typed by them or attested by an issuer. Nobody signed it: it is the holder's claim that the source said so, and a consumer MUST NOT present it as attested. It exists as its own kind because a derived value is neither of the others — the holder did not author it, and no one vouches for it — and a holder deciding whether to disclose deserves to know which of their values they typed.\\n\\nFor how strongly a disclosed value identifies the holder, the kinds rank `credentialBacked` above `derived` above `selfAsserted`; `generated` values are per-verifier and do not correlate.\",\"oneOf\":[{\"additionalProperties\":false,\"properties\":{\"kind\":{\"const\":\"selfAsserted\"}},\"required\":[\"kind\"]},{\"additionalProperties\":false,\"properties\":{\"claimPath\":{\"description\":\"RFC 6901 JSON Pointer to the claim within the credential, e.g. `/credentialSubject/familyName`.\",\"pattern\":\"^(/[^/~]*(~[01][^/~]*)*)*$\",\"type\":\"string\"},\"credentialId\":{\"description\":\"Vault identifier of the backing credential.\",\"minLength\":1,\"type\":\"string\"},\"issuerDid\":{\"description\":\"Issuer of the backing credential. Advisory: a consumer MUST verify the credential rather than trusting this member.\",\"minLength\":1,\"type\":\"string\"},\"kind\":{\"const\":\"credentialBacked\"},\"proof\":{\"$ref\":\"#/$defs/ProofRung\",\"description\":\"The disclosure rung this claim was, or will be, presented at.\"}},\"required\":[\"kind\",\"credentialId\",\"claimPath\"]},{\"additionalProperties\":false,\"properties\":{\"generator\":{\"description\":\"Names the minting scheme, e.g. `relayEmail`. Maintainer-defined.\",\"maxLength\":64,\"minLength\":1,\"type\":\"string\"},\"kind\":{\"const\":\"generated\"},\"perVerifier\":{\"default\":true,\"description\":\"When true (the default and the only useful setting), a distinct value is minted for each verifier.\",\"type\":\"boolean\"}},\"required\":[\"kind\",\"generator\"]},{\"additionalProperties\":false,\"properties\":{\"derivedAt\":{\"description\":\"When the value was taken from the source. A derived value is a snapshot: the source may have changed since, and nothing re-derives it.\",\"format\":\"date-time\",\"type\":\"string\"},\"kind\":{\"const\":\"derived\"},\"source\":{\"description\":\"The KIND of source the value was taken from — `github`, `cvUpload`, `linkedIn` — never an account, handle or URL. Provenance survives to the verifier, so this member is disclosed with the claim; a handle here would disclose an identifier the holder never chose to share.\",\"maxLength\":64,\"minLength\":1,\"pattern\":\"^[a-z][A-Za-z0-9.-]*$\",\"type\":\"string\"}},\"required\":[\"kind\",\"source\",\"derivedAt\"]}],\"required\":[\"kind\"],\"title\":\"Provenance\",\"type\":\"object\"},\"ReleaseRequirement\":{\"description\":\"What it takes to let a value LEAVE. Distinct from `Sensitivity`, which governs showing it to the holder.\\n\\n`consent` is the ordinary gate: `persona/disclosure/preview` renders what would leave and `persona/disclosure/present` releases it, so a human sees it once.\\n\\n`stepUp` additionally requires a fresh authentication bound to THAT preview — not to the session. Without the binding, \\\"each time\\\" degrades into \\\"once per login\\\", which is the failure the requirement exists to prevent; the single-use `previewId` the preview already mints is what an implementation binds to. A maintainer MUST refuse `persona/disclosure/present` for a `stepUp` attribute when no such approval accompanies it.\\n\\nAbsent means *not decided by the holder* and resolves from the claim-type registry, which defaults `payment.*` and `gov.*` to `stepUp`.\",\"enum\":[\"consent\",\"stepUp\"],\"title\":\"ReleaseRequirement\",\"type\":\"string\"},\"Response\":{\"$anchor\":\"response\",\"additionalProperties\":false,\"description\":\"Success response to persona/attribute/get. Type https://trusttasks.org/spec/persona/attribute/get/1.0#response.\",\"properties\":{\"attribute\":{\"$ref\":\"#/$defs/Attribute\",\"description\":\"The attribute as at `version`, or as it stands when none was asked for. Its `value` is present only if the request asked for it and the attribute's sensitivity permitted it.\"},\"ext\":{\"$ref\":\"#/$defs/Ext\"},\"retainedVersions\":{\"description\":\"The versions of this attribute the maintainer still holds, newest first, including the current one. Names versions and never their values.\\n\\nIt is here because a holder deciding whether to purge cannot see what purging would take away: which earlier versions exist, and therefore which pinned profile entries would stop presenting. A consumer that cannot enumerate them asks the holder to make an irreversible decision blind.\",\"items\":{\"$ref\":\"#/$defs/Version\"},\"maxItems\":64,\"type\":\"array\"},\"valueWithheld\":{\"description\":\"True when the value was withheld although `includeValue` asked for it — the attribute resolves to `sensitivity: high` and `includeSensitive` was not set. Stated rather than left to inference: a consumer that reads an absent `value` as \\\"this attribute has none\\\" will show the holder an empty field where a passport number is, and conclude the record is broken.\",\"type\":\"boolean\"}},\"required\":[\"attribute\"],\"title\":\"Persona Attribute — Get — response payload\",\"type\":\"object\"},\"Sensitivity\":{\"description\":\"How carefully a value is shown TO ITS OWN HOLDER. `high` means a consumer masks it by default, reveals it one attribute at a time on a deliberate act, and — the half that is not cosmetic — omits it from a listing that did not ask for sensitive values.\\n\\nAbsent means *not decided by the holder*, not `normal`: a consumer resolves it from the claim-type registry (see CLAIM-TYPES.md §4), which is why this member is optional and why an unregistered token resolves conservatively rather than permissively.\\n\\nDistinct from how linkable the value is. A payment card is highly sensitive and barely linkable — every card number is unique, so knowing one tells a second verifier nothing about the first. Reading either as a proxy for the other produces a consumer that hides the wrong things.\",\"enum\":[\"normal\",\"high\"],\"title\":\"Sensitivity\",\"type\":\"string\"},\"Ulid\":{\"description\":\"A ULID in Crockford base32, uppercase. Used for `attributeId` and `profileId`. Chosen over a UUID because the leading 48 bits are a timestamp, so a key-ordered scan of the store is also creation-ordered and a `list` needs no secondary sort. Server-assigned on create; a producer MAY supply one to make a create idempotent, and a maintainer MUST reject a supplied value that already exists rather than silently overwriting.\",\"pattern\":\"^[0-9A-HJKMNP-TV-Z]{26}$\",\"title\":\"Ulid\",\"type\":\"string\"},\"ValueType\":{\"description\":\"The JSON shape of `value`, declared so that a consumer can render and compare without guessing. The maintainer validates that `value` agrees with this member and does nothing further: it does NOT validate a phone number against a phone-number grammar. That is a producer's affordance, and a store that grows opinions about the contents of its records eventually blocks its consumer's release.\",\"enum\":[\"string\",\"number\",\"boolean\",\"date\",\"object\"],\"title\":\"ValueType\",\"type\":\"string\"},\"Version\":{\"description\":\"A value of the store's monotonic write counter. Server-assigned; a producer never chooses one.\",\"minimum\":1,\"title\":\"Version\",\"type\":\"integer\"}},\"$ref\":\"#/$defs/Response\",\"$schema\":\"https://json-schema.org/draft/2020-12/schema\"}\n",
    );
}
impl crate::RequestPayload for Payload {
    type Response = Response;
}
/// The earlier `MAJOR.MINOR` of this slug that this version declares it
/// extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
/// `None`. Only the direct declaration; walk a chain with
/// [`crate::extension::extends_for`].
pub const EXTENDS: Option<&str> = None;
/// The extended error codes this specification declares (SPEC §7.3 item 9,
/// §8.5), in declaration order. Empty when it declares none.
pub const ERROR_CODES: &[crate::DeclaredErrorCode] =
    &[error_codes::NOT_FOUND, error_codes::VERSION_PURGED];
/// One constant per extended error code this specification declares
/// (SPEC §7.3 item 9), named for its local part.
///
/// Emit these rather than a string literal: the code is read from the
/// specification, so it cannot name a code the specification never
/// declared.
pub mod error_codes {
    /// `persona/attribute/get:notFound`
    ///
    /// No attribute exists at the given identifier.
    ///
    /// Declared `retryable: false`.
    pub const NOT_FOUND: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "persona/attribute/get:notFound",
        retryable: false,
        details_schema: ::core::option::Option::None,
    };
    /// `persona/attribute/get:versionPurged`
    ///
    /// The attribute exists, but the `version` asked for is no longer held — the holder purged it (`persona/attribute/purge-version`). Distinct from `notFound`, because the attribute is still there and its current version is readable.
    ///
    /// Declared `retryable: false`.
    pub const VERSION_PURGED: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "persona/attribute/get:versionPurged",
        retryable: false,
        details_schema: ::core::option::Option::None,
    };
}