{
 "server": "mcp.rco-a2a.ai",
 "transport": "streamable-http",
 "mcp_protocol_version": "2025-06-18",
 "auth": "none (read-only)",
 "contract_version": "1.4",
 "$comment": "Contract of record AND the served declarations - the outputSchemas below are complete and self-contained (internal $defs only; no remote refs). Typed errors surface as MCP tool-execution errors (result.isError true with one JSON text content {code, message, valid?}); schema-invalid arguments surface as JSON-RPC -32602. openWorldHint false by design: every tool reads the issuer's own closed, pre-resolved record corpus. GB is rejected as invalid_jurisdiction naming the valid set; UK is the member code. v1.4 adds publish_record - the ONLY write path in the suite: it accepts only what already verifies (schema-valid RCO, cpg-rail issuer active in the signed registry, verification_url = the registry's JWKS URL, detached JWS verifies against that JWKS, record_id/supersession consistent), receipts the hash to Azure Confidential Ledger under the issuer id, and serves the record at the issuer's allocated slot. GSC never authors a partner record and never holds a partner private key. Reached through the APIM door (gsc-rco-partner.azure-api.net/partner/mcp, one subscription key per issuer, rate-limited, request-logged); the public read MCP stays keyless and unchanged.",
 "$defs": {
  "rco_record": {
   "$comment": "Record wire version stays 1.0. Cross-field checks a JSON Schema cannot express are normative in the specification and enforced by the published validator: (a) resolved_at < valid_until; (b) record_id's issuer/object/jurisdiction segments equal issuer.id, object_id and jurisdiction; (c) supersedes, when present, differs from record_id only in its trailing sequence number, which is exactly one lower; (d) GTINs are zero-padded GTIN-14 with a valid GS1 check digit; (e) host object_ids are lowercase, punycode-encoded, no trailing dot. record_id keeps its colons on the wire; a filesystem mirror replaces each colon with an underscore (CEO ruling 2026-08-29). GB is rejected as invalid_jurisdiction naming the valid set — UK is the member code (permanent GB=UK rule). Verification VERIFIES every byte of the canonical signing payload; nothing claims to reproduce signature bytes (ECDSA is randomized). v1.3 adds the optional case_study boolean and the unit rule: record-holders are keyed GTIN x jurisdiction only (NG-11 s2k).",
   "type": "object",
   "additionalProperties": false,
   "required": [
    "rco_version",
    "record_id",
    "object_id",
    "jurisdiction",
    "signal",
    "state",
    "resolved_at",
    "valid_until",
    "supersedes",
    "eco_ref",
    "rule_set",
    "evidence_refs",
    "issuer",
    "key_id",
    "verification_url",
    "signature"
   ],
   "properties": {
    "rco_version": {
     "const": "1.0"
    },
    "record_id": {
     "type": "string",
     "pattern": "^rco:[a-z0-9-]+:(gtin:[0-9]{14}|host:([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63}):([A-Z]{2}-ECO-10060|apex):[1-9][0-9]*$"
    },
    "object_id": {
     "type": "string",
     "pattern": "^(gtin:[0-9]{14}|host:([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63})$"
    },
    "jurisdiction": {
     "enum": [
      "EU-ECO-10060",
      "FR-ECO-10060",
      "DE-ECO-10060",
      "ES-ECO-10060",
      "IT-ECO-10060",
      "NL-ECO-10060",
      "PL-ECO-10060",
      "CH-ECO-10060",
      "UK-ECO-10060",
      "BE-ECO-10060",
      "PT-ECO-10060",
      "AT-ECO-10060",
      "IE-ECO-10060",
      "CZ-ECO-10060",
      "DK-ECO-10060",
      "SE-ECO-10060",
      "FI-ECO-10060",
      "NO-ECO-10060",
      "GR-ECO-10060",
      "US-ECO-10060",
      "CA-ECO-10060",
      "MX-ECO-10060",
      "BR-ECO-10060",
      "AR-ECO-10060",
      "CL-ECO-10060",
      "CO-ECO-10060",
      "CR-ECO-10060",
      "DO-ECO-10060",
      "EC-ECO-10060",
      "GT-ECO-10060",
      "PA-ECO-10060",
      "PE-ECO-10060",
      "UY-ECO-10060",
      "AU-ECO-10060",
      "JP-ECO-10060",
      "KR-ECO-10060",
      "SG-ECO-10060",
      "IN-ECO-10060",
      "ID-ECO-10060",
      "MY-ECO-10060",
      "PH-ECO-10060",
      "TH-ECO-10060",
      "VN-ECO-10060",
      "AE-ECO-10060",
      "SA-ECO-10060",
      "IL-ECO-10060",
      "TR-ECO-10060",
      "MA-ECO-10060",
      "ZA-ECO-10060",
      "apex"
     ],
     "$comment": "The 49 SM-ECO-10060 member jurisdictions + EU bloc + apex, generated from the signed member registry. GB is rejected; UK is the code."
    },
    "signal": {
     "enum": [
      "CPG-000",
      "CPG-200",
      "CPG-300",
      "CPG-403",
      "CPG-404",
      "CPG-451",
      "CPG-500"
     ]
    },
    "state": {
     "enum": [
      "NOT_APPLICABLE",
      "ALLOW",
      "CONDITIONAL",
      "RESTRICT",
      "NOT_FOUND",
      "ESCALATE",
      "SYSTEM_ERROR"
     ]
    },
    "conditions": {
     "type": "array",
     "items": {
      "type": "object",
      "required": [
       "code",
       "ref"
      ],
      "properties": {
       "code": {
        "type": "string",
        "minLength": 1
       },
       "ref": {
        "type": "string",
        "format": "uri"
       }
      },
      "additionalProperties": false
     }
    },
    "resolved_at": {
     "type": "string",
     "format": "date-time"
    },
    "valid_until": {
     "type": "string",
     "format": "date-time"
    },
    "supersedes": {
     "anyOf": [
      {
       "type": "null"
      },
      {
       "type": "string",
       "pattern": "^rco:[a-z0-9-]+:(gtin:[0-9]{14}|host:([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63}):([A-Z]{2}-ECO-10060|apex):[1-9][0-9]*$"
      }
     ]
    },
    "eco_ref": {
     "anyOf": [
      {
       "type": "null"
      },
      {
       "type": "object",
       "required": [
        "url",
        "hash"
       ],
       "properties": {
        "url": {
         "type": "string",
         "format": "uri"
        },
        "hash": {
         "type": "string",
         "pattern": "^sha256:[a-f0-9]{64}$"
        }
       },
       "additionalProperties": false
      }
     ]
    },
    "rule_set": {
     "type": "object",
     "required": [
      "id",
      "version",
      "hash",
      "effective_from"
     ],
     "properties": {
      "id": {
       "type": "string"
      },
      "version": {
       "type": "string",
       "pattern": "^20[0-9]{2}\\.(0[1-9]|1[0-2])(\\.[0-9]+)?$"
      },
      "hash": {
       "type": "string",
       "pattern": "^sha256:[a-f0-9]{64}$"
      },
      "effective_from": {
       "type": "string",
       "format": "date-time"
      }
     },
     "additionalProperties": false
    },
    "evidence_refs": {
     "type": "array",
     "items": {
      "type": "object",
      "required": [
       "kind",
       "url",
       "hash"
      ],
      "properties": {
       "kind": {
        "enum": [
         "esg-credential",
         "dpu-proof",
         "eco-object",
         "other"
        ]
       },
       "url": {
        "type": "string",
        "format": "uri"
       },
       "hash": {
        "type": "string",
        "pattern": "^sha256:[a-f0-9]{64}$"
       }
      },
      "additionalProperties": false
     }
    },
    "issuer": {
     "type": "object",
     "required": [
      "id",
      "rail",
      "name"
     ],
     "properties": {
      "id": {
       "type": "string",
       "pattern": "^[a-z0-9-]+$"
      },
      "rail": {
       "enum": [
        "bpc",
        "cpg"
       ]
      },
      "name": {
       "type": "string",
       "minLength": 1
      }
     },
     "additionalProperties": false
    },
    "key_id": {
     "type": "string",
     "minLength": 1
    },
    "verification_url": {
     "type": "string",
     "format": "uri",
     "$comment": "Cross-check only. The verification root is the signed consortium issuer registry: consumers resolve issuer.id there and take the JWKS URL from the registry; mismatch with this field fails verification."
    },
    "signature": {
     "type": "string",
     "pattern": "^[A-Za-z0-9_-]+\\.\\.[A-Za-z0-9_-]+$",
     "description": "Detached JWS Compact Serialization (RFC 7515) with unencoded payload (RFC 7797): BASE64URL(protected header {alg:ES256, b64:false, crit:[b64], kid}) '..' BASE64URL(ES256 raw R||S). Signing input = ASCII(BASE64URL(protected header) '.') || RFC 8785 canonical JSON of the record with this member removed. Test vectors: signature-test-vectors.json."
    },
    "case_study": {
     "type": "boolean",
     "default": false,
     "$comment": "v1.3 (CEO close-out ruling): true marks a labelled case-study record (e.g. the elyssah worked chain); never counted in the real-maker number. Absent = false."
    }
   },
   "allOf": [
    {
     "$comment": "The seven legal signal/state pairs.",
     "oneOf": [
      {
       "properties": {
        "signal": {
         "const": "CPG-000"
        },
        "state": {
         "const": "NOT_APPLICABLE"
        }
       }
      },
      {
       "properties": {
        "signal": {
         "const": "CPG-200"
        },
        "state": {
         "const": "ALLOW"
        }
       }
      },
      {
       "properties": {
        "signal": {
         "const": "CPG-300"
        },
        "state": {
         "const": "CONDITIONAL"
        }
       }
      },
      {
       "properties": {
        "signal": {
         "const": "CPG-403"
        },
        "state": {
         "const": "RESTRICT"
        }
       }
      },
      {
       "properties": {
        "signal": {
         "const": "CPG-404"
        },
        "state": {
         "const": "NOT_FOUND"
        }
       }
      },
      {
       "properties": {
        "signal": {
         "const": "CPG-451"
        },
        "state": {
         "const": "ESCALATE"
        }
       }
      },
      {
       "properties": {
        "signal": {
         "const": "CPG-500"
        },
        "state": {
         "const": "SYSTEM_ERROR"
        }
       }
      }
     ]
    },
    {
     "$comment": "conditions: required non-empty for CPG-300, forbidden otherwise.",
     "if": {
      "properties": {
       "signal": {
        "const": "CPG-300"
       }
      }
     },
     "then": {
      "required": [
       "conditions"
      ],
      "properties": {
       "conditions": {
        "minItems": 1
       }
      }
     },
     "else": {
      "not": {
       "required": [
        "conditions"
       ]
      }
     }
    },
    {
     "$comment": "CPG-404 carries eco_ref null; every other signal carries a non-null eco_ref.",
     "if": {
      "properties": {
       "signal": {
        "const": "CPG-404"
       }
      }
     },
     "then": {
      "properties": {
       "eco_ref": {
        "type": "null"
       }
      }
     },
     "else": {
      "properties": {
       "eco_ref": {
        "type": "object"
       }
      }
     }
    }
   ]
  },
  "issuer_registry": {
   "$comment": "Published at consortium-10060.org/issuers.json and returned by list_issuers. This document is the verification root: consumers resolve issuer.id here and take the JWKS URL from this registry; a record's in-record verification_url is a cross-check only. The registry is signed with the consortium key using the same detached-JWS profile as records; the consortium public keyring (the trust anchor) is pinned at consortium-10060.org/.well-known/jwks.json and mirrored in the RCO tree. Amendments append to amendments.json; the registry document is superseded whole, never edited.",
   "type": "object",
   "additionalProperties": false,
   "required": [
    "registry_version",
    "updated",
    "issuers",
    "key_id",
    "verification_url",
    "signature"
   ],
   "properties": {
    "registry_version": {
     "type": "string",
     "pattern": "^20[0-9]{2}\\.(0[1-9]|1[0-2])(\\.[0-9]+)?$"
    },
    "updated": {
     "type": "string",
     "format": "date-time"
    },
    "issuers": {
     "type": "array",
     "minItems": 1,
     "items": {
      "type": "object",
      "additionalProperties": false,
      "required": [
       "id",
       "rail",
       "name",
       "jwks_url",
       "status",
       "admitted"
      ],
      "properties": {
       "id": {
        "type": "string",
        "pattern": "^[a-z0-9-]+$"
       },
       "rail": {
        "enum": [
         "bpc",
         "cpg"
        ]
       },
       "name": {
        "type": "string",
        "minLength": 1
       },
       "jwks_url": {
        "type": "string",
        "format": "uri"
       },
       "status": {
        "enum": [
         "active",
         "suspended",
         "revoked"
        ]
       },
       "admitted": {
        "type": "string",
        "format": "date-time"
       },
       "status_changed": {
        "type": "string",
        "format": "date-time",
        "$comment": "Required when status is not active — the effective time of the suspension or revocation. Records signed before this instant by then-valid keys still verify; consumers reject records whose resolved_at is at or after it."
       },
       "keys": {
        "type": "array",
        "$comment": "Key lifecycle of record. Retired kids stay on the issuer JWKS indefinitely so historical records remain verifiable; this array dates each kid.",
        "items": {
         "type": "object",
         "additionalProperties": false,
         "required": [
          "kid",
          "valid_from"
         ],
         "properties": {
          "kid": {
           "type": "string"
          },
          "valid_from": {
           "type": "string",
           "format": "date-time"
          },
          "valid_to": {
           "anyOf": [
            {
             "type": "null"
            },
            {
             "type": "string",
             "format": "date-time"
            }
           ]
          },
          "revoked": {
           "type": "boolean"
          }
         }
        }
       }
      }
     }
    },
    "key_id": {
     "type": "string",
     "minLength": 1
    },
    "verification_url": {
     "type": "string",
     "format": "uri"
    },
    "signature": {
     "type": "string",
     "pattern": "^[A-Za-z0-9_-]+\\.\\.[A-Za-z0-9_-]+$"
    },
    "trust_anchor": {
     "type": "object",
     "additionalProperties": false,
     "required": [
      "kid",
      "sha256_fingerprint",
      "method",
      "published"
     ],
     "properties": {
      "kid": {
       "type": "string"
      },
      "sha256_fingerprint": {
       "type": "string",
       "pattern": "^sha256:[a-f0-9]{64}$"
      },
      "method": {
       "type": "string"
      },
      "published": {
       "type": "array",
       "minItems": 2,
       "items": {
        "type": "string"
       }
      }
     },
     "$comment": "v1.3: the consortium key's out-of-band pin - the fingerprint is published on the dpuone.ai keyring page and as a DNS TXT record on this zone; verify either before trusting this document's own JWKS."
    }
   }
  }
 },
 "tools": [
  {
   "name": "resolve_compliance",
   "description": "Return the current signed Regulatory Compliance Object for an object in a jurisdiction. Deterministic. Inside the resolved universe (SPEC v1.2 pairs.json + the jurisdiction doors' own objects) an unknown object returns a pre-resolved, signed CPG-404 record; outside it the typed error record_not_found is returned - nothing is signed at request time. Never narrative.",
   "annotations": {
    "readOnlyHint": true,
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "title": "Resolve compliance state"
   },
   "inputSchema": {
    "type": "object",
    "required": [
     "object_id",
     "jurisdiction"
    ],
    "additionalProperties": false,
    "properties": {
     "object_id": {
      "type": "string",
      "pattern": "^(gtin:[0-9]{14}|host:([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63})$"
     },
     "jurisdiction": {
      "type": "string",
      "enum": [
       "EU-ECO-10060",
       "FR-ECO-10060",
       "DE-ECO-10060",
       "ES-ECO-10060",
       "IT-ECO-10060",
       "NL-ECO-10060",
       "PL-ECO-10060",
       "CH-ECO-10060",
       "UK-ECO-10060",
       "BE-ECO-10060",
       "PT-ECO-10060",
       "AT-ECO-10060",
       "IE-ECO-10060",
       "CZ-ECO-10060",
       "DK-ECO-10060",
       "SE-ECO-10060",
       "FI-ECO-10060",
       "NO-ECO-10060",
       "GR-ECO-10060",
       "US-ECO-10060",
       "CA-ECO-10060",
       "MX-ECO-10060",
       "BR-ECO-10060",
       "AR-ECO-10060",
       "CL-ECO-10060",
       "CO-ECO-10060",
       "CR-ECO-10060",
       "DO-ECO-10060",
       "EC-ECO-10060",
       "GT-ECO-10060",
       "PA-ECO-10060",
       "PE-ECO-10060",
       "UY-ECO-10060",
       "AU-ECO-10060",
       "JP-ECO-10060",
       "KR-ECO-10060",
       "SG-ECO-10060",
       "IN-ECO-10060",
       "ID-ECO-10060",
       "MY-ECO-10060",
       "PH-ECO-10060",
       "TH-ECO-10060",
       "VN-ECO-10060",
       "AE-ECO-10060",
       "SA-ECO-10060",
       "IL-ECO-10060",
       "TR-ECO-10060",
       "MA-ECO-10060",
       "ZA-ECO-10060",
       "apex"
      ]
     }
    }
   },
   "outputSchema": {
    "$ref": "#/$defs/rco_record"
   },
   "errors": [
    {
     "code": "invalid_object_id",
     "when": "syntactically invalid, bad GTIN check digit, or unnormalized host"
    },
    {
     "code": "invalid_jurisdiction",
     "when": "not in the member set or apex; GB is rejected - UK is the code"
    },
    {
     "code": "record_not_found",
     "when": "the pair is outside the resolved universe"
    }
   ],
   "title": "Resolve compliance state"
  },
  {
   "name": "get_record",
   "description": "Return any RCO by record_id, including superseded records - the audit trail, retained byte-identical.",
   "annotations": {
    "readOnlyHint": true,
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "title": "Get record by id"
   },
   "inputSchema": {
    "type": "object",
    "required": [
     "record_id"
    ],
    "additionalProperties": false,
    "properties": {
     "record_id": {
      "type": "string",
      "pattern": "^rco:[a-z0-9-]+:(gtin:[0-9]{14}|host:([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63}):([A-Z]{2}-ECO-10060|apex):[1-9][0-9]*$"
     }
    }
   },
   "outputSchema": {
    "$ref": "#/$defs/rco_record"
   },
   "errors": [
    {
     "code": "invalid_record_id",
     "when": "the id does not match the pattern"
    },
    {
     "code": "record_not_found",
     "when": "no record was ever issued under this id"
    }
   ],
   "title": "Get record by id"
  },
  {
   "name": "list_rule_sets",
   "description": "List the versioned rule sets in force and formerly in force for a jurisdiction: id, version, hash, effective dates, artifact URL. Never the regulation text.",
   "annotations": {
    "readOnlyHint": true,
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "title": "List rule sets"
   },
   "inputSchema": {
    "type": "object",
    "required": [
     "jurisdiction"
    ],
    "additionalProperties": false,
    "properties": {
     "jurisdiction": {
      "type": "string",
      "enum": [
       "EU-ECO-10060",
       "FR-ECO-10060",
       "DE-ECO-10060",
       "ES-ECO-10060",
       "IT-ECO-10060",
       "NL-ECO-10060",
       "PL-ECO-10060",
       "CH-ECO-10060",
       "UK-ECO-10060",
       "BE-ECO-10060",
       "PT-ECO-10060",
       "AT-ECO-10060",
       "IE-ECO-10060",
       "CZ-ECO-10060",
       "DK-ECO-10060",
       "SE-ECO-10060",
       "FI-ECO-10060",
       "NO-ECO-10060",
       "GR-ECO-10060",
       "US-ECO-10060",
       "CA-ECO-10060",
       "MX-ECO-10060",
       "BR-ECO-10060",
       "AR-ECO-10060",
       "CL-ECO-10060",
       "CO-ECO-10060",
       "CR-ECO-10060",
       "DO-ECO-10060",
       "EC-ECO-10060",
       "GT-ECO-10060",
       "PA-ECO-10060",
       "PE-ECO-10060",
       "UY-ECO-10060",
       "AU-ECO-10060",
       "JP-ECO-10060",
       "KR-ECO-10060",
       "SG-ECO-10060",
       "IN-ECO-10060",
       "ID-ECO-10060",
       "MY-ECO-10060",
       "PH-ECO-10060",
       "TH-ECO-10060",
       "VN-ECO-10060",
       "AE-ECO-10060",
       "SA-ECO-10060",
       "IL-ECO-10060",
       "TR-ECO-10060",
       "MA-ECO-10060",
       "ZA-ECO-10060",
       "apex"
      ]
     }
    }
   },
   "outputSchema": {
    "type": "object",
    "additionalProperties": false,
    "required": [
     "jurisdiction",
     "rule_sets"
    ],
    "properties": {
     "jurisdiction": {
      "enum": [
       "EU-ECO-10060",
       "FR-ECO-10060",
       "DE-ECO-10060",
       "ES-ECO-10060",
       "IT-ECO-10060",
       "NL-ECO-10060",
       "PL-ECO-10060",
       "CH-ECO-10060",
       "UK-ECO-10060",
       "BE-ECO-10060",
       "PT-ECO-10060",
       "AT-ECO-10060",
       "IE-ECO-10060",
       "CZ-ECO-10060",
       "DK-ECO-10060",
       "SE-ECO-10060",
       "FI-ECO-10060",
       "NO-ECO-10060",
       "GR-ECO-10060",
       "US-ECO-10060",
       "CA-ECO-10060",
       "MX-ECO-10060",
       "BR-ECO-10060",
       "AR-ECO-10060",
       "CL-ECO-10060",
       "CO-ECO-10060",
       "CR-ECO-10060",
       "DO-ECO-10060",
       "EC-ECO-10060",
       "GT-ECO-10060",
       "PA-ECO-10060",
       "PE-ECO-10060",
       "UY-ECO-10060",
       "AU-ECO-10060",
       "JP-ECO-10060",
       "KR-ECO-10060",
       "SG-ECO-10060",
       "IN-ECO-10060",
       "ID-ECO-10060",
       "MY-ECO-10060",
       "PH-ECO-10060",
       "TH-ECO-10060",
       "VN-ECO-10060",
       "AE-ECO-10060",
       "SA-ECO-10060",
       "IL-ECO-10060",
       "TR-ECO-10060",
       "MA-ECO-10060",
       "ZA-ECO-10060",
       "apex"
      ]
     },
     "rule_sets": {
      "type": "array",
      "items": {
       "type": "object",
       "additionalProperties": false,
       "required": [
        "id",
        "version",
        "hash",
        "effective_from",
        "effective_to",
        "url"
       ],
       "properties": {
        "id": {
         "type": "string"
        },
        "version": {
         "type": "string",
         "pattern": "^20[0-9]{2}\\.(0[1-9]|1[0-2])(\\.[0-9]+)?$"
        },
        "hash": {
         "type": "string",
         "pattern": "^sha256:[a-f0-9]{64}$"
        },
        "effective_from": {
         "type": "string",
         "format": "date-time"
        },
        "effective_to": {
         "anyOf": [
          {
           "type": "null"
          },
          {
           "type": "string",
           "format": "date-time"
          }
         ]
        },
        "url": {
         "type": "string",
         "format": "uri"
        }
       }
      }
     }
    }
   },
   "errors": [
    {
     "code": "invalid_jurisdiction",
     "when": "not in the member set or apex"
    }
   ],
   "title": "List rule sets"
  },
  {
   "name": "list_issuers",
   "description": "Return the signed consortium issuer registry document, verbatim as published at consortium-10060.org/issuers.json.",
   "annotations": {
    "readOnlyHint": true,
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "title": "List issuers"
   },
   "inputSchema": {
    "type": "object",
    "properties": {},
    "additionalProperties": false
   },
   "outputSchema": {
    "$ref": "#/$defs/issuer_registry"
   },
   "errors": [],
   "title": "List issuers"
  },
  {
   "name": "publish_record",
   "description": "Publish a signed Regulatory Compliance Object to the partner rail (rco-a2a-cpg.ai). Accepts only what already verifies; a submitted record is never modified; idempotent (byte-identical republish returns the same receipt). Typed errors: schema_invalid, issuer_not_registered, wrong_rail, issuer_not_active, verification_url_mismatch, jwks_unreachable, key_not_found, key_revoked, key_id_mismatch, invalid_signature_format, signature_invalid, record_id_mismatch, supersedes_required, supersedes_not_found, supersedes_not_prior, record_id_taken, no_slot_allocation, slot_block_exhausted, ledger_write_failed, ledger_receipt_timeout.",
   "annotations": {
    "readOnlyHint": false,
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "title": "Publish record (issuer)"
   },
   "inputSchema": {
    "type": "object",
    "required": [
     "record"
    ],
    "additionalProperties": false,
    "properties": {
     "record": {
      "$ref": "#/$defs/rco_record"
     }
    }
   },
   "outputSchema": {
    "type": "object",
    "additionalProperties": true,
    "required": [
     "published",
     "record_id",
     "slot",
     "record_url",
     "ledger"
    ],
    "properties": {
     "published": {
      "type": "boolean"
     },
     "idempotent": {
      "type": "boolean"
     },
     "record_id": {
      "type": "string"
     },
     "slot": {
      "type": "string",
      "pattern": "^cpg-[0-9]{4}$"
     },
     "record_url": {
      "type": "string",
      "format": "uri"
     },
     "card_url": {
      "type": "string",
      "format": "uri"
     },
     "ledger": {
      "type": "object",
      "properties": {
       "transaction_id": {
        "type": "string"
       },
       "hash": {
        "type": "string"
       },
       "receipt_url": {
        "type": "string",
        "format": "uri"
       }
      }
     },
     "note": {
      "type": "string"
     }
    }
   },
   "errors": [
    {
     "code": "see description",
     "when": "any verification step fails; the record is never modified"
    }
   ],
   "title": "Publish record (issuer)"
  }
 ]
}