@openvtc/trust-tasks 0.2.55 → 0.2.56

package/README.md

@@ -29,15 +29,22 @@ npm install @openvtc/trust-tasks
 import { AclGrant_v0_1, DidManagementDidRegister_v0_1 } from "@openvtc/trust-tasks";
 
 // Compose a request payload, type-checked against the spec's
-// payload.schema.json.
+// payload.schema.json. `Payload` is a stable alias every module
+// exports, so you never have to look up the title-derived interface
+// name (here, `ACLGrantPayload`).
 const grant: AclGrant_v0_1.Payload = {
-  subject: "did:key:z6MkAlice",
-  role: "admin",
-  after: { /* … */ },
+  entry: {
+    subject: "did:key:z6MkAlice",
+    role: "admin",
+  },
+  reason: "onboarding",
 };
 
 // Each module exports the Response sub-schema too when the spec
 // defines one — the framework's #response fragment convention.
+// Fire-and-forget specs export neither `Response` nor
+// `RESPONSE_TYPE_URI`, because SPEC.md §4.4.1 forbids emitting a
+// `#response` document for them.
 const reply: AclGrant_v0_1.Response = {
   entry: { /* … */ },
 };

package/dist/acl/change-role/0.1/payload.d.ts

@@ -27,8 +27,101 @@ export interface ACLChangeRolePayload {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+/**
+ * The success response to an acl/change-role request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/change-role/0.1#response.
+ */
+export interface ACLChangeRoleResponsePayload {
+    entry: AclEntry;
+    ext?: Ext2;
+}
+/**
+ * The AclEntry the maintainer now holds for the subject. entry.role MUST equal the request's payload.toRole.
+ */
+export interface AclEntry {
+    /**
+     * VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.
+     */
+    subject: string;
+    /**
+     * Opaque role identifier interpreted by the ACL maintainer.
+     */
+    role: string;
+    /**
+     * Opaque scope identifiers (e.g. contexts, domains, resource prefixes).
+     */
+    scopes?: string[];
+    /**
+     * Key identifiers this subject may invoke the maintainer's signing oracle on. INTERSECTS WITH `scopes` — it can only narrow, never widen: a key named here that lies outside the entry's scopes remains unreachable, exactly as if it were not named. ABSENT means every key within the entry's scopes (the behaviour of entries that pre-date this member); explicit `null` is equivalent to absent, and producers SHOULD omit the member instead. PRESENT-BUT-EMPTY means authorized on NO keys — the opposite of absent, and deliberately so: emptiness is never a wildcard (CONVENTIONS.md §5). A consumer MUST preserve and enforce the absent-vs-empty distinction end to end; collapsing the two (e.g. by testing emptiness alone) re-creates the empty-means-unrestricted class of privilege-escalation defect this family's conventions exist to prevent.
+     */
+    allowedKeys?: string[] | null;
+    /**
+     * Optional human-readable label.
+     */
+    label?: string;
+    createdAt?: string;
+    /**
+     * VID of the party that originally added this entry.
+     */
+    createdBy?: string;
+    updatedAt?: string;
+    /**
+     * VID of the party that last modified this entry.
+     */
+    updatedBy?: string;
+    /**
+     * Optional time after which the entry is no longer effective.
+     */
+    expiresAt?: string;
+    /**
+     * Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy/0.1). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry).
+     */
+    stepUp?: {
+        /**
+         * VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.
+         */
+        approver?: string;
+        /**
+         * Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).
+         */
+        require?: "self" | "delegated";
+    };
+    /**
+     * Approve-authority: what this subject may **confer on others** by ratifying an approval, as distinct from `scopes`, which is what it may **exercise itself**. The two axes are independent, and that independence is the point — it is what lets a maintainer configure a least-privilege approver who can authorize an operation in a scope it has no authority to perform.
+     *
+     * OMISSION MEANS NOTHING IS CONFERRED. An absent `approve`, an absent `all`, and an empty `scopes` are all equivalent to "this subject may ratify nothing". A consumer that does not implement this member therefore confers less than the producer intended rather than more, which is the direction a missed member has to fail in.
+     *
+     * A subject with approve-authority is NOT thereby authorized to act. Consumers MUST resolve the two axes separately: reading `approve` to answer "may this party ratify X" and `scopes` to answer "may this party do X". Collapsing them grants an approver the ability to perform what it was only meant to sign off on.
+     */
+    approve?: {
+        /**
+         * The subject may confer ANY scope. Takes precedence over `scopes`, which a consumer MUST ignore when this is true. Absent or false → only the scopes listed below, if any.
+         */
+        all?: boolean;
+        /**
+         * Opaque scope identifiers this subject may confer, drawn from the same vocabulary as the entry's own `scopes`. Where a maintainer's scopes are hierarchical, conferring a scope confers its descendants — the same containment rule the maintainer already applies to `scopes`, so the two axes cannot disagree about what a scope means. An empty array confers nothing; it is not a wildcard.
+         */
+        scopes?: string[];
+    };
+    ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces.
+ */
+export interface Ext1 {
+    [k: string]: unknown | undefined;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext2 {
+    [k: string]: unknown | undefined;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/acl/change-role/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ACLChangeRolePayload;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/acl/change-role/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ACLChangeRoleResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/acl/change-role/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/change-role/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,iDAA0D,CAAC;AAEnF,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,0DAAmE,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/change-role/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR;;WAEG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,iDAA0D,CAAC;AAEnF,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,oBAAoB,CAAC;AAE3C,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,0DAAmE,CAAC;AAErG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,4BAA4B,CAAC"}

package/dist/acl/change-role/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/change-role/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4BH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,iDAA0D,CAAC;AAEnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,0DAAmE,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/change-role/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAqHH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,iDAA0D,CAAC;AAKnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,0DAAmE,CAAC"}

package/dist/acl/grant/0.1/payload.d.ts

@@ -92,8 +92,95 @@ export interface Ext {
 export interface Ext1 {
     [k: string]: unknown | undefined;
 }
+/**
+ * The success response to an acl/grant request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/grant/0.1#response.
+ */
+export interface ACLGrantResponsePayload {
+    entry: AclEntry1;
+    ext?: Ext2;
+}
+/**
+ * The canonical AclEntry the maintainer now holds for the subject.
+ */
+export interface AclEntry1 {
+    /**
+     * VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.
+     */
+    subject: string;
+    /**
+     * Opaque role identifier interpreted by the ACL maintainer.
+     */
+    role: string;
+    /**
+     * Opaque scope identifiers (e.g. contexts, domains, resource prefixes).
+     */
+    scopes?: string[];
+    /**
+     * Key identifiers this subject may invoke the maintainer's signing oracle on. INTERSECTS WITH `scopes` — it can only narrow, never widen: a key named here that lies outside the entry's scopes remains unreachable, exactly as if it were not named. ABSENT means every key within the entry's scopes (the behaviour of entries that pre-date this member); explicit `null` is equivalent to absent, and producers SHOULD omit the member instead. PRESENT-BUT-EMPTY means authorized on NO keys — the opposite of absent, and deliberately so: emptiness is never a wildcard (CONVENTIONS.md §5). A consumer MUST preserve and enforce the absent-vs-empty distinction end to end; collapsing the two (e.g. by testing emptiness alone) re-creates the empty-means-unrestricted class of privilege-escalation defect this family's conventions exist to prevent.
+     */
+    allowedKeys?: string[] | null;
+    /**
+     * Optional human-readable label.
+     */
+    label?: string;
+    createdAt?: string;
+    /**
+     * VID of the party that originally added this entry.
+     */
+    createdBy?: string;
+    updatedAt?: string;
+    /**
+     * VID of the party that last modified this entry.
+     */
+    updatedBy?: string;
+    /**
+     * Optional time after which the entry is no longer effective.
+     */
+    expiresAt?: string;
+    /**
+     * Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy/0.1). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry).
+     */
+    stepUp?: {
+        /**
+         * VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.
+         */
+        approver?: string;
+        /**
+         * Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).
+         */
+        require?: "self" | "delegated";
+    };
+    /**
+     * Approve-authority: what this subject may **confer on others** by ratifying an approval, as distinct from `scopes`, which is what it may **exercise itself**. The two axes are independent, and that independence is the point — it is what lets a maintainer configure a least-privilege approver who can authorize an operation in a scope it has no authority to perform.
+     *
+     * OMISSION MEANS NOTHING IS CONFERRED. An absent `approve`, an absent `all`, and an empty `scopes` are all equivalent to "this subject may ratify nothing". A consumer that does not implement this member therefore confers less than the producer intended rather than more, which is the direction a missed member has to fail in.
+     *
+     * A subject with approve-authority is NOT thereby authorized to act. Consumers MUST resolve the two axes separately: reading `approve` to answer "may this party ratify X" and `scopes` to answer "may this party do X". Collapsing them grants an approver the ability to perform what it was only meant to sign off on.
+     */
+    approve?: {
+        /**
+         * The subject may confer ANY scope. Takes precedence over `scopes`, which a consumer MUST ignore when this is true. Absent or false → only the scopes listed below, if any.
+         */
+        all?: boolean;
+        /**
+         * Opaque scope identifiers this subject may confer, drawn from the same vocabulary as the entry's own `scopes`. Where a maintainer's scopes are hierarchical, conferring a scope confers its descendants — the same containment rule the maintainer already applies to `scopes`, so the two axes cannot disagree about what a scope means. An empty array confers nothing; it is not a wildcard.
+         */
+        scopes?: string[];
+    };
+    ext?: Ext;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext2 {
+    [k: string]: unknown | undefined;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/acl/grant/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ACLGrantPayload;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/acl/grant/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ACLGrantResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/acl/grant/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/grant/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,CAAC;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR;;WAEG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2CAAoD,CAAC;AAE7E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oDAA6D,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/grant/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,CAAC;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR;;WAEG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,SAAS,CAAC;IACjB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR;;WAEG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,2CAAoD,CAAC;AAE7E,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,eAAe,CAAC;AAEtC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,oDAA6D,CAAC;AAE/F,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,uBAAuB,CAAC"}

package/dist/acl/grant/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/grant/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6FH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2CAAoD,CAAC;AAE7E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oDAA6D,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/grant/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgLH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,2CAAoD,CAAC;AAK7E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oDAA6D,CAAC"}

package/dist/acl/list/0.1/payload.d.ts

@@ -35,8 +35,113 @@ export interface ACLListPayload {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+/**
+ * The success response to an acl/list request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/list/0.1#response.
+ */
+export interface ACLListResponsePayload {
+    /**
+     * Matching AclEntry items, in maintainer-defined order. May be empty.
+     */
+    entries: AclEntry[];
+    /**
+     * true when more matching entries exist beyond `entries`; false when this response is the complete result. Independent of `cursor`: a maintainer MAY truncate without supporting pagination, in which case `truncated` is true and `cursor` is absent.
+     */
+    truncated: boolean;
+    /**
+     * Opaque continuation token to fetch the next page. Present only when `truncated` is true AND the maintainer supports pagination from this point. Consumers MUST treat the cursor as opaque and re-send it verbatim.
+     */
+    cursor?: string;
+    /**
+     * Names of AclEntry fields the maintainer redacted from every returned entry (for example, ['label'] or ['ext.vnd.example.audit']).
+     */
+    redactedFields?: string[];
+    ext?: Ext2;
+}
+export interface AclEntry {
+    /**
+     * VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.
+     */
+    subject: string;
+    /**
+     * Opaque role identifier interpreted by the ACL maintainer.
+     */
+    role: string;
+    /**
+     * Opaque scope identifiers (e.g. contexts, domains, resource prefixes).
+     */
+    scopes?: string[];
+    /**
+     * Key identifiers this subject may invoke the maintainer's signing oracle on. INTERSECTS WITH `scopes` — it can only narrow, never widen: a key named here that lies outside the entry's scopes remains unreachable, exactly as if it were not named. ABSENT means every key within the entry's scopes (the behaviour of entries that pre-date this member); explicit `null` is equivalent to absent, and producers SHOULD omit the member instead. PRESENT-BUT-EMPTY means authorized on NO keys — the opposite of absent, and deliberately so: emptiness is never a wildcard (CONVENTIONS.md §5). A consumer MUST preserve and enforce the absent-vs-empty distinction end to end; collapsing the two (e.g. by testing emptiness alone) re-creates the empty-means-unrestricted class of privilege-escalation defect this family's conventions exist to prevent.
+     */
+    allowedKeys?: string[] | null;
+    /**
+     * Optional human-readable label.
+     */
+    label?: string;
+    createdAt?: string;
+    /**
+     * VID of the party that originally added this entry.
+     */
+    createdBy?: string;
+    updatedAt?: string;
+    /**
+     * VID of the party that last modified this entry.
+     */
+    updatedBy?: string;
+    /**
+     * Optional time after which the entry is no longer effective.
+     */
+    expiresAt?: string;
+    /**
+     * Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy/0.1). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry).
+     */
+    stepUp?: {
+        /**
+         * VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.
+         */
+        approver?: string;
+        /**
+         * Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).
+         */
+        require?: "self" | "delegated";
+    };
+    /**
+     * Approve-authority: what this subject may **confer on others** by ratifying an approval, as distinct from `scopes`, which is what it may **exercise itself**. The two axes are independent, and that independence is the point — it is what lets a maintainer configure a least-privilege approver who can authorize an operation in a scope it has no authority to perform.
+     *
+     * OMISSION MEANS NOTHING IS CONFERRED. An absent `approve`, an absent `all`, and an empty `scopes` are all equivalent to "this subject may ratify nothing". A consumer that does not implement this member therefore confers less than the producer intended rather than more, which is the direction a missed member has to fail in.
+     *
+     * A subject with approve-authority is NOT thereby authorized to act. Consumers MUST resolve the two axes separately: reading `approve` to answer "may this party ratify X" and `scopes` to answer "may this party do X". Collapsing them grants an approver the ability to perform what it was only meant to sign off on.
+     */
+    approve?: {
+        /**
+         * The subject may confer ANY scope. Takes precedence over `scopes`, which a consumer MUST ignore when this is true. Absent or false → only the scopes listed below, if any.
+         */
+        all?: boolean;
+        /**
+         * Opaque scope identifiers this subject may confer, drawn from the same vocabulary as the entry's own `scopes`. Where a maintainer's scopes are hierarchical, conferring a scope confers its descendants — the same containment rule the maintainer already applies to `scopes`, so the two axes cannot disagree about what a scope means. An empty array confers nothing; it is not a wildcard.
+         */
+        scopes?: string[];
+    };
+    ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces.
+ */
+export interface Ext1 {
+    [k: string]: unknown | undefined;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext2 {
+    [k: string]: unknown | undefined;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/acl/list/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ACLListPayload;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/acl/list/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ACLListResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/acl/list/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/list/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,WAAW,GAAG,SAAS,GAAG,KAAK,CAAC;IAC5C;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,0CAAmD,CAAC;AAE5E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,mDAA4D,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/list/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,WAAW,GAAG,SAAS,GAAG,KAAK,CAAC;IAC5C;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB;;OAEG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR;;WAEG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,0CAAmD,CAAC;AAE5E,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,cAAc,CAAC;AAErC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,mDAA4D,CAAC;AAE9F,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,sBAAsB,CAAC"}

package/dist/acl/list/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/list/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoCH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,0CAAmD,CAAC;AAE5E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,mDAA4D,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/list/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyIH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,0CAAmD,CAAC;AAK5E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,mDAA4D,CAAC"}

package/dist/acl/revoke/0.1/payload.d.ts

@@ -25,8 +25,101 @@ export interface ACLRevokePayload {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+/**
+ * The success response to an acl/revoke request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/revoke/0.1#response.
+ */
+export interface ACLRevokeResponsePayload {
+    /**
+     * The AclEntry the maintainer now holds for the subject. null for a full removal; an AclEntry with reduced scopes for a scope reduction.
+     */
+    entry: null | AclEntry;
+    ext?: Ext2;
+}
+export interface AclEntry {
+    /**
+     * VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.
+     */
+    subject: string;
+    /**
+     * Opaque role identifier interpreted by the ACL maintainer.
+     */
+    role: string;
+    /**
+     * Opaque scope identifiers (e.g. contexts, domains, resource prefixes).
+     */
+    scopes?: string[];
+    /**
+     * Key identifiers this subject may invoke the maintainer's signing oracle on. INTERSECTS WITH `scopes` — it can only narrow, never widen: a key named here that lies outside the entry's scopes remains unreachable, exactly as if it were not named. ABSENT means every key within the entry's scopes (the behaviour of entries that pre-date this member); explicit `null` is equivalent to absent, and producers SHOULD omit the member instead. PRESENT-BUT-EMPTY means authorized on NO keys — the opposite of absent, and deliberately so: emptiness is never a wildcard (CONVENTIONS.md §5). A consumer MUST preserve and enforce the absent-vs-empty distinction end to end; collapsing the two (e.g. by testing emptiness alone) re-creates the empty-means-unrestricted class of privilege-escalation defect this family's conventions exist to prevent.
+     */
+    allowedKeys?: string[] | null;
+    /**
+     * Optional human-readable label.
+     */
+    label?: string;
+    createdAt?: string;
+    /**
+     * VID of the party that originally added this entry.
+     */
+    createdBy?: string;
+    updatedAt?: string;
+    /**
+     * VID of the party that last modified this entry.
+     */
+    updatedBy?: string;
+    /**
+     * Optional time after which the entry is no longer effective.
+     */
+    expiresAt?: string;
+    /**
+     * Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy/0.1). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry).
+     */
+    stepUp?: {
+        /**
+         * VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.
+         */
+        approver?: string;
+        /**
+         * Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).
+         */
+        require?: "self" | "delegated";
+    };
+    /**
+     * Approve-authority: what this subject may **confer on others** by ratifying an approval, as distinct from `scopes`, which is what it may **exercise itself**. The two axes are independent, and that independence is the point — it is what lets a maintainer configure a least-privilege approver who can authorize an operation in a scope it has no authority to perform.
+     *
+     * OMISSION MEANS NOTHING IS CONFERRED. An absent `approve`, an absent `all`, and an empty `scopes` are all equivalent to "this subject may ratify nothing". A consumer that does not implement this member therefore confers less than the producer intended rather than more, which is the direction a missed member has to fail in.
+     *
+     * A subject with approve-authority is NOT thereby authorized to act. Consumers MUST resolve the two axes separately: reading `approve` to answer "may this party ratify X" and `scopes` to answer "may this party do X". Collapsing them grants an approver the ability to perform what it was only meant to sign off on.
+     */
+    approve?: {
+        /**
+         * The subject may confer ANY scope. Takes precedence over `scopes`, which a consumer MUST ignore when this is true. Absent or false → only the scopes listed below, if any.
+         */
+        all?: boolean;
+        /**
+         * Opaque scope identifiers this subject may confer, drawn from the same vocabulary as the entry's own `scopes`. Where a maintainer's scopes are hierarchical, conferring a scope confers its descendants — the same containment rule the maintainer already applies to `scopes`, so the two axes cannot disagree about what a scope means. An empty array confers nothing; it is not a wildcard.
+         */
+        scopes?: string[];
+    };
+    ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces.
+ */
+export interface Ext1 {
+    [k: string]: unknown | undefined;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext2 {
+    [k: string]: unknown | undefined;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/acl/revoke/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ACLRevokePayload;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/acl/revoke/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ACLRevokeResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/acl/revoke/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/revoke/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC/B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4CAAqD,CAAC;AAE9E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qDAA8D,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/revoke/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC/B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,KAAK,EAAE,IAAI,GAAG,QAAQ,CAAC;IACvB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR;;WAEG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,4CAAqD,CAAC;AAE9E,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEvC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,qDAA8D,CAAC;AAEhG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,wBAAwB,CAAC"}

package/dist/acl/revoke/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/revoke/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA0BH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,4CAAqD,CAAC;AAE9E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qDAA8D,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/revoke/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmHH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,4CAAqD,CAAC;AAK9E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qDAA8D,CAAC"}

package/dist/acl/show/0.1/payload.d.ts

@@ -15,8 +15,105 @@ export interface ACLShowPayload {
 export interface Ext {
     [k: string]: unknown | undefined;
 }
+/**
+ * The success response to an acl/show request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/show/0.1#response.
+ */
+export interface ACLShowResponsePayload {
+    /**
+     * The looked-up AclEntry, or null if the subject is not in the ACL.
+     */
+    entry: null | AclEntry;
+    /**
+     * Names of AclEntry fields the maintainer redacted (for example, ['label'] or ['ext.vnd.example.audit']).
+     */
+    redactedFields?: string[];
+    ext?: Ext2;
+}
+export interface AclEntry {
+    /**
+     * VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.
+     */
+    subject: string;
+    /**
+     * Opaque role identifier interpreted by the ACL maintainer.
+     */
+    role: string;
+    /**
+     * Opaque scope identifiers (e.g. contexts, domains, resource prefixes).
+     */
+    scopes?: string[];
+    /**
+     * Key identifiers this subject may invoke the maintainer's signing oracle on. INTERSECTS WITH `scopes` — it can only narrow, never widen: a key named here that lies outside the entry's scopes remains unreachable, exactly as if it were not named. ABSENT means every key within the entry's scopes (the behaviour of entries that pre-date this member); explicit `null` is equivalent to absent, and producers SHOULD omit the member instead. PRESENT-BUT-EMPTY means authorized on NO keys — the opposite of absent, and deliberately so: emptiness is never a wildcard (CONVENTIONS.md §5). A consumer MUST preserve and enforce the absent-vs-empty distinction end to end; collapsing the two (e.g. by testing emptiness alone) re-creates the empty-means-unrestricted class of privilege-escalation defect this family's conventions exist to prevent.
+     */
+    allowedKeys?: string[] | null;
+    /**
+     * Optional human-readable label.
+     */
+    label?: string;
+    createdAt?: string;
+    /**
+     * VID of the party that originally added this entry.
+     */
+    createdBy?: string;
+    updatedAt?: string;
+    /**
+     * VID of the party that last modified this entry.
+     */
+    updatedBy?: string;
+    /**
+     * Optional time after which the entry is no longer effective.
+     */
+    expiresAt?: string;
+    /**
+     * Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy/0.1). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry).
+     */
+    stepUp?: {
+        /**
+         * VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.
+         */
+        approver?: string;
+        /**
+         * Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).
+         */
+        require?: "self" | "delegated";
+    };
+    /**
+     * Approve-authority: what this subject may **confer on others** by ratifying an approval, as distinct from `scopes`, which is what it may **exercise itself**. The two axes are independent, and that independence is the point — it is what lets a maintainer configure a least-privilege approver who can authorize an operation in a scope it has no authority to perform.
+     *
+     * OMISSION MEANS NOTHING IS CONFERRED. An absent `approve`, an absent `all`, and an empty `scopes` are all equivalent to "this subject may ratify nothing". A consumer that does not implement this member therefore confers less than the producer intended rather than more, which is the direction a missed member has to fail in.
+     *
+     * A subject with approve-authority is NOT thereby authorized to act. Consumers MUST resolve the two axes separately: reading `approve` to answer "may this party ratify X" and `scopes` to answer "may this party do X". Collapsing them grants an approver the ability to perform what it was only meant to sign off on.
+     */
+    approve?: {
+        /**
+         * The subject may confer ANY scope. Takes precedence over `scopes`, which a consumer MUST ignore when this is true. Absent or false → only the scopes listed below, if any.
+         */
+        all?: boolean;
+        /**
+         * Opaque scope identifiers this subject may confer, drawn from the same vocabulary as the entry's own `scopes`. Where a maintainer's scopes are hierarchical, conferring a scope confers its descendants — the same containment rule the maintainer already applies to `scopes`, so the two axes cannot disagree about what a scope means. An empty array confers nothing; it is not a wildcard.
+         */
+        scopes?: string[];
+    };
+    ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces.
+ */
+export interface Ext1 {
+    [k: string]: unknown | undefined;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext2 {
+    [k: string]: unknown | undefined;
+}
 /** Trust Task type URI. */
 export declare const TYPE_URI: "https://trusttasks.org/spec/acl/show/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ACLShowPayload;
 /** Trust Task response type URI (request type URI + "#response"). */
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/acl/show/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ACLShowResponsePayload;
 //# sourceMappingURL=payload.d.ts.map

package/dist/acl/show/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/show/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,0CAAmD,CAAC;AAE5E,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,mDAA4D,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/acl/show/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,KAAK,EAAE,IAAI,GAAG,QAAQ,CAAC;IACvB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR;;WAEG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,0CAAmD,CAAC;AAE5E,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,cAAc,CAAC;AAErC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,mDAA4D,CAAC;AAE9F,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,sBAAsB,CAAC"}

package/dist/acl/show/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/show/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,0CAAmD,CAAC;AAE5E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,mDAA4D,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/acl/show/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6GH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,0CAAmD,CAAC;AAK5E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,mDAA4D,CAAC"}