@openvtc/trust-tasks 0.22.5 → 0.22.7

package/dist/acl/list/0.2/payload.d.ts

@@ -0,0 +1,1853 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/acl/list/0.2/payload.schema.json
+ */
+import type { AclEntry_AclV0_2 as AclEntry, ApproveCapabilityScope, ApproveCapabilityScopeListed, AuthorityScope, AuthorityScopeAll, AuthorityScopeContexts, AuthorityScopeNone, Capability_AclV0_2 as Capability, CapabilityGrant, CapabilityRef, CapabilityScope, CapabilityScopeCeiling, CapabilityScopeListed, CapabilityScopeNone, ContextPath, Ext, KeyScope, KeyScopeAll, KeyScopeListed, KeyScopeNone, ResourceQualifier } from "../../../_shared/components.js";
+/**
+ * Enumerate the AclEntry 0.2 records a maintainer holds, with optional conjunctive filters and paging. A hierarchical filter (`context`, `resource`) MUST state its `direction`; there is no default direction. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface ACLList02Payload {
+    /**
+     * Optional filter — only entries with this role are returned.
+     */
+    role?: string;
+    /**
+     * Optional filter on the entries' ACT scope, read in the stated `direction`. REQUIRES `direction`. Replaces 0.1's `scope` filter.
+     */
+    context?: ContextPath;
+    /**
+     * Optional filter — only entries whose EFFECTIVE capability set includes this capability (the role's full ceiling for `capabilities: {scope: ceiling}`, nothing for `none`, and for `listed` the ceiling ∩ the non-additive grants plus the additive grants). Combined with `resource`, the capability must be held at a qualifier related to that resource by `direction`.
+     */
+    capability?: Capability;
+    /**
+     * Optional filter on the resource qualifiers of the entries' effective capabilities (of `capability` when given, of any capability otherwise), read in the stated `direction`. REQUIRES `direction`.
+     */
+    resource?: ResourceQualifier;
+    /**
+     * How to read a hierarchical filter (`context`, `resource`). REQUIRED when either is present and REFUSED when neither is: `actingIn` — entries whose scope or qualifier is an ancestor-or-self of the queried one, i.e. who may act IN it (unrestricted act scopes and unqualified capabilities match); `subtree` — entries holding a grant at or BENEATH the queried one (an unrestricted act scope or an unqualified capability does NOT match, and an entry naming contexts both inside and outside the subtree DOES); `any` — the union. Same three questions as 0.1's `acting-in` / `subtree` / `any`, re-cased to lowerCamelCase, with no default.
+     */
+    direction?: "actingIn" | "subtree" | "any";
+    /**
+     * Optional filter — only entries whose subject VID starts with this prefix are returned.
+     */
+    subjectPrefix?: string;
+    /**
+     * Maximum number of entries to return. Maintainer-defined default and ceiling.
+     */
+    pageSize?: number;
+    /**
+     * Opaque continuation token returned by the maintainer in a previous response. It binds the filters and `direction` it was minted under; a follow-up request MUST repeat them unchanged.
+     */
+    cursor?: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * The success response to an acl/list/0.2 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/list/0.2#response.
+ */
+export interface ACLList02ResponsePayload {
+    /**
+     * Matching AclEntry items, in maintainer-defined order. May be empty.
+     */
+    entries: AclEntry[];
+    /**
+     * true when more matching entries exist beyond `entries`; false when this response is the complete result. Independent of `cursor`: a maintainer MAY truncate without supporting pagination, in which case `truncated` is true and `cursor` is absent.
+     */
+    truncated: boolean;
+    /**
+     * Opaque continuation token to fetch the next page. Present only when `truncated` is true AND the maintainer supports pagination from this point. Binds the request's filters and direction. Consumers MUST treat it as opaque and re-send it verbatim.
+     */
+    cursor?: string;
+    /**
+     * Names of AclEntry members the maintainer redacted from every returned entry. `act`, `keys` and `capabilities` are never redacted; `approve` and `approveCapabilities` SHOULD NOT be (see acl/show/0.2).
+     */
+    redactedFields?: string[];
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AclEntry, ApproveCapabilityScope, ApproveCapabilityScopeListed, AuthorityScope, AuthorityScopeAll, AuthorityScopeContexts, AuthorityScopeNone, Capability, CapabilityGrant, CapabilityRef, CapabilityScope, CapabilityScopeCeiling, CapabilityScopeListed, CapabilityScopeNone, ContextPath, Ext, KeyScope, KeyScopeAll, KeyScopeListed, KeyScopeNone, ResourceQualifier };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/acl/list/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ACLList02Payload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/acl/list/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ACLList02ResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/acl/list/0.2";
+    readonly title: "ACL List 0.2 — payload";
+    readonly description: "Enumerate the AclEntry 0.2 records a maintainer holds, with optional conjunctive filters and paging. A hierarchical filter (`context`, `resource`) MUST state its `direction`; there is no default direction. The outer document members are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly dependentRequired: {
+        readonly context: readonly ["direction"];
+        readonly resource: readonly ["direction"];
+    };
+    readonly dependentSchemas: {
+        readonly direction: {
+            readonly anyOf: readonly [{
+                readonly required: readonly ["context"];
+            }, {
+                readonly required: readonly ["resource"];
+            }];
+        };
+    };
+    readonly properties: {
+        readonly role: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Optional filter — only entries with this role are returned.";
+        };
+        readonly context: {
+            readonly $ref: "#/$defs/ContextPath";
+            readonly description: "Optional filter on the entries' ACT scope, read in the stated `direction`. REQUIRES `direction`. Replaces 0.1's `scope` filter.";
+        };
+        readonly capability: {
+            readonly $ref: "#/$defs/Capability";
+            readonly description: "Optional filter — only entries whose EFFECTIVE capability set includes this capability (the role's full ceiling for `capabilities: {scope: ceiling}`, nothing for `none`, and for `listed` the ceiling ∩ the non-additive grants plus the additive grants). Combined with `resource`, the capability must be held at a qualifier related to that resource by `direction`.";
+        };
+        readonly resource: {
+            readonly $ref: "#/$defs/ResourceQualifier";
+            readonly description: "Optional filter on the resource qualifiers of the entries' effective capabilities (of `capability` when given, of any capability otherwise), read in the stated `direction`. REQUIRES `direction`.";
+        };
+        readonly direction: {
+            readonly type: "string";
+            readonly enum: readonly ["actingIn", "subtree", "any"];
+            readonly description: "How to read a hierarchical filter (`context`, `resource`). REQUIRED when either is present and REFUSED when neither is: `actingIn` — entries whose scope or qualifier is an ancestor-or-self of the queried one, i.e. who may act IN it (unrestricted act scopes and unqualified capabilities match); `subtree` — entries holding a grant at or BENEATH the queried one (an unrestricted act scope or an unqualified capability does NOT match, and an entry naming contexts both inside and outside the subtree DOES); `any` — the union. Same three questions as 0.1's `acting-in` / `subtree` / `any`, re-cased to lowerCamelCase, with no default.";
+        };
+        readonly subjectPrefix: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Optional filter — only entries whose subject VID starts with this prefix are returned.";
+        };
+        readonly pageSize: {
+            readonly type: "integer";
+            readonly minimum: 1;
+            readonly maximum: 1000;
+            readonly description: "Maximum number of entries to return. Maintainer-defined default and ceiling.";
+        };
+        readonly cursor: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 2048;
+            readonly description: "Opaque continuation token returned by the maintainer in a previous response. It binds the filters and `direction` it was minted under; a follow-up request MUST repeat them unchanged.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "ACL List 0.2 — response payload";
+            readonly description: "The success response to an acl/list/0.2 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/list/0.2#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["entries", "truncated"];
+            readonly properties: {
+                readonly entries: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/AclEntry";
+                    };
+                    readonly description: "Matching AclEntry items, in maintainer-defined order. May be empty.";
+                };
+                readonly truncated: {
+                    readonly type: "boolean";
+                    readonly description: "true when more matching entries exist beyond `entries`; false when this response is the complete result. Independent of `cursor`: a maintainer MAY truncate without supporting pagination, in which case `truncated` is true and `cursor` is absent.";
+                };
+                readonly cursor: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "Opaque continuation token to fetch the next page. Present only when `truncated` is true AND the maintainer supports pagination from this point. Binds the request's filters and direction. Consumers MUST treat it as opaque and re-send it verbatim.";
+                };
+                readonly redactedFields: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly description: "Names of AclEntry members the maintainer redacted from every returned entry. `act`, `keys` and `capabilities` are never redacted; `approve` and `approveCapabilities` SHOULD NOT be (see acl/show/0.2).";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AclEntry: {
+            readonly title: "AclEntry";
+            readonly description: "One access-control entry: who the grant is for (`subject`), the ceiling it is held under (`role`), where the subject may act (`act`) and approve (`approve`), and which capabilities it may exercise (`capabilities`) and approve (`approveCapabilities`).\n\nThe act axis and the approve axis are independent and a consumer MUST resolve them separately: `act` + `capabilities` (+ `keys`) answer \"may this subject do X\"; `approve` + `approveCapabilities` answer \"may this subject ratify someone else doing X\". Neither implies the other. An entry with `act: {scope: none}` and an approve scope other than none is a least-privilege approver — able to satisfy an approval and unable to initiate any change.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "role", "act", "keys", "capabilities"];
+            readonly properties: {
+                readonly subject: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.";
+                };
+                readonly role: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Opaque role identifier interpreted by the ACL maintainer. A role is a CEILING, never a grant: it bounds the capabilities the entry may hold and never adds to them. A consumer that does not recognise the role MUST treat the entry as conferring no authority and MUST NOT fall back to a default role. Act scope and role are independent members; a consumer MUST NOT compute either from the other.";
+                };
+                readonly act: {
+                    readonly $ref: "#/$defs/AuthorityScope";
+                    readonly description: "REQUIRED explicit act scope: where this subject may make a change itself. Exactly one of `{\"scope\": \"all\"}` (unrestricted — every context the maintainer has), `{\"scope\": \"none\"}` (may act nowhere), or `{\"scope\": \"contexts\", \"contexts\": [...]}` with at least one context path (the named contexts and, where the maintainer's contexts are hierarchical, their descendants). There is no default and no implicit form: an entry without `act`, or with an empty `contexts` list, is malformed and MUST be refused, never read as `all` and never read as `none`. A maintainer that has no contexts (for example a community node that narrows authority with resource qualifiers instead) states `all` or `none` only. Replaces 0.1's `scopes`.";
+                };
+                readonly approve: {
+                    readonly $ref: "#/$defs/AuthorityScope";
+                    readonly description: "OPTIONAL approve scope: where this subject may ratify a change made by someone else (a step-up ratification, a consent decision, an N-of-M approval). Same three shapes as `act`, resolved independently of it. ABSENT MEANS NONE — the subject may ratify nothing — so a consumer that has not implemented the member confers less than the producer intended, never more. A producer SHOULD state `{\"scope\": \"none\"}` explicitly rather than rely on omission. A subject MUST NOT confer approve authority wider than the approve authority it holds itself (see acl/grant `approveWiderThanGranter`). Replaces 0.1's `approve {all, scopes}`.";
+                };
+                readonly capabilities: {
+                    readonly $ref: "#/$defs/CapabilityScope";
+                    readonly description: "REQUIRED explicit capability scope: which capabilities this entry holds. Exactly one of `{\"scope\": \"ceiling\"}` (the role's full ceiling, unnarrowed), `{\"scope\": \"none\"}` (no capabilities), or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityGrant. For `listed`, the EFFECTIVE set is (the role's ceiling ∩ the non-additive grants) ∪ the additive grants; it can only narrow the ceiling, except through an explicit additive grant, which only an unrestricted granter may make. There is no implicit form: an entry without `capabilities`, or with an empty `grants` list, is malformed and MUST be refused. A non-additive grant outside the role's ceiling is refused when written, never accepted with the capability silently dropped; a capability the consumer does not recognise is never treated as granted. Producers SHOULD NOT list the same (capability, resource) pair twice; a consumer MAY refuse a list that does.";
+                };
+                readonly approveCapabilities: {
+                    readonly $ref: "#/$defs/ApproveCapabilityScope";
+                    readonly description: "OPTIONAL explicit approvable-capability scope: which capabilities this subject may APPROVE an action needing — independent of what it may do itself, so an approver can ratify a capability it does not hold (the least-privilege approver). One of `{\"scope\": \"ceiling\"}` (the role's full approve ceiling; at a maintainer whose roles define no capability-level approve ceiling, any action within `approve`), `{\"scope\": \"none\"}`, or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityRef (intersected with the role's approve ceiling where one is defined). ABSENT MEANS NONE: the subject may approve no capability, because absence derives no authority. Bounded by `approve`: where `approve` is absent or `{\"scope\": \"none\"}` this member confers nothing whatever it states. A subject MUST NOT confer approvable capabilities it cannot itself approve.";
+                };
+                readonly delegatedBy: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the granter whose authority this entry was delegated from and is bounded by. The entry MUST NOT hold authority the granter did not hold when it was written, and MUST NOT retain authority the granter has since lost, so a maintainer re-evaluates it when the granter's own entry narrows or is removed. Distinct from `createdBy`, which records who wrote the entry: the two differ where an entry is written on a granter's behalf (for example after an N-of-M approval, or by an offline operator). Set by the maintainer from the granter it authorized; absent on an entry that derives from no granter's authority (the first administrator, an operator-written recovery entry).";
+                };
+                readonly keys: {
+                    readonly $ref: "#/$defs/KeyScope";
+                    readonly description: "REQUIRED explicit key scope: which keys this subject may invoke the maintainer's signing oracle on. Exactly one of `{\"scope\": \"all\"}` (every key the entry's act scope reaches), `{\"scope\": \"none\"}` (no keys), or `{\"scope\": \"listed\", \"keys\": [...]}` with at least one key identifier. INTERSECTS WITH `act` — it can only narrow, never widen: a listed key that lies outside the entry's act scope remains unreachable, exactly as if it were not listed. There is no implicit form: an entry without `keys`, or with an empty `keys` list, is malformed and MUST be refused. A maintainer that operates no signing oracle states `{\"scope\": \"none\"}`. Replaces 0.1's `allowedKeys`, whose absence meant every key.";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "Optional human-readable label. Confers nothing.";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly createdBy: {
+                    readonly type: "string";
+                    readonly description: "VID of the party that originally wrote this entry.";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedBy: {
+                    readonly type: "string";
+                    readonly description: "VID of the party that last modified this entry.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Optional time after which the entry confers no authority. Evaluated at every authorization decision, not only when a session is established.";
+                };
+                readonly stepUp: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly description: "Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry). Carried forward from 0.1 unchanged.";
+                    readonly properties: {
+                        readonly approver: {
+                            readonly type: "string";
+                            readonly description: "VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.";
+                        };
+                        readonly require: {
+                            readonly type: "string";
+                            readonly enum: readonly ["self", "delegated"];
+                            readonly description: "Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).";
+                        };
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces. An extension member MUST NOT be interpreted as conferring authority.";
+                };
+            };
+        };
+        readonly KeyScope: {
+            readonly title: "KeyScope";
+            readonly description: "An explicit key scope. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `listed` with a NON-EMPTY list of key identifiers. The empty list is invalid, not a fourth shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/KeyScopeAll";
+            }, {
+                readonly $ref: "#/$defs/KeyScopeNone";
+            }, {
+                readonly $ref: "#/$defs/KeyScopeListed";
+            }];
+        };
+        readonly KeyScopeListed: {
+            readonly title: "KeyScopeListed";
+            readonly description: "Exactly the listed keys, intersected with the entry's act scope.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "keys"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly keys: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                    };
+                    readonly description: "Non-empty set of key identifiers. An empty array is invalid (it is neither `all` nor `none`).";
+                };
+            };
+        };
+        readonly KeyScopeNone: {
+            readonly title: "KeyScopeNone";
+            readonly description: "No keys.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly KeyScopeAll: {
+            readonly title: "KeyScopeAll";
+            readonly description: "Every key the entry's act scope reaches.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "all";
+                };
+            };
+        };
+        readonly ApproveCapabilityScope: {
+            readonly title: "ApproveCapabilityScope";
+            readonly description: "An explicit statement of the capabilities a subject may approve. Exactly one of `ceiling` (the role's full approve ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityRef.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CapabilityScopeCeiling";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/ApproveCapabilityScopeListed";
+            }];
+        };
+        readonly ApproveCapabilityScopeListed: {
+            readonly title: "ApproveCapabilityScopeListed";
+            readonly description: "Exactly the listed capabilities, intersected with the role's approve ceiling where the maintainer's roles define one.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "grants"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly grants: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityRef";
+                    };
+                    readonly description: "Non-empty list of approvable capabilities. An empty array is invalid.";
+                };
+            };
+        };
+        readonly CapabilityRef: {
+            readonly title: "CapabilityRef";
+            readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+            };
+        };
+        readonly ResourceQualifier: {
+            readonly title: "ResourceQualifier";
+            readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly Capability: {
+            readonly title: "Capability";
+            readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+        };
+        readonly CapabilityScopeNone: {
+            readonly title: "CapabilityScopeNone";
+            readonly description: "No capabilities on this axis.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly CapabilityScopeCeiling: {
+            readonly title: "CapabilityScopeCeiling";
+            readonly description: "The role's full ceiling on this axis, unnarrowed: what the role admits, the entry holds (or, for approvable capabilities, may approve). Stated, not implied — it is the explicit spelling of \"no narrowing\".";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "ceiling";
+                };
+            };
+        };
+        readonly CapabilityScope: {
+            readonly title: "CapabilityScope";
+            readonly description: "An explicit statement of the capabilities an entry holds. Exactly one of three shapes, discriminated by `scope`: `ceiling` (the role's full ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityGrant. The empty list is invalid, not a fourth shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CapabilityScopeCeiling";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeListed";
+            }];
+        };
+        readonly CapabilityScopeListed: {
+            readonly title: "CapabilityScopeListed";
+            readonly description: "Exactly the listed grants: (role ceiling ∩ non-additive grants) ∪ additive grants.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "grants"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly grants: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityGrant";
+                    };
+                    readonly description: "Non-empty list of capability grants. An empty array is invalid (it is neither `ceiling` nor `none`).";
+                };
+            };
+        };
+        readonly CapabilityGrant: {
+            readonly title: "CapabilityGrant";
+            readonly description: "A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+                readonly additive: {
+                    readonly type: "boolean";
+                    readonly description: "`true` declares an ADDITIVE grant: a capability no role implies, granted to this entry beside its role rather than through it, and therefore not intersected with the role's ceiling. Granting one requires unrestricted act authority (`act: {scope: all}`) of the granter, and an entry never acquires one by virtue of its role. Absent or `false` → an ordinary grant, intersected with the role's ceiling, and refused when written if it lies outside it. A consumer MUST refuse `additive: true` on a capability the role's ceiling already includes, so that the flag cannot be used to make an ordinary capability survive a later role change.";
+                };
+            };
+        };
+        readonly AuthorityScope: {
+            readonly title: "AuthorityScope";
+            readonly description: "An explicit authority scope — used for both the act scope and the approve scope of an entry. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `contexts` with a NON-EMPTY list. The empty list is not a fourth shape: it is invalid, so a serializer that drops or empties the list produces a document that fails validation rather than one that silently means something else.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/AuthorityScopeAll";
+            }, {
+                readonly $ref: "#/$defs/AuthorityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/AuthorityScopeContexts";
+            }];
+        };
+        readonly AuthorityScopeContexts: {
+            readonly title: "AuthorityScopeContexts";
+            readonly description: "The named contexts and, where the maintainer's contexts are hierarchical, every descendant of them — and nowhere else. `contexts` MUST carry at least one path.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "contexts"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "contexts";
+                };
+                readonly contexts: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/ContextPath";
+                    };
+                    readonly description: "Non-empty set of context paths. An empty array is invalid (it is neither `all` nor `none`).";
+                };
+            };
+        };
+        readonly ContextPath: {
+            readonly title: "ContextPath";
+            readonly description: "Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly AuthorityScopeNone: {
+            readonly title: "AuthorityScopeNone";
+            readonly description: "No authority on this axis. Stated, not implied: `none` is how an entry says it may not act (a least-privilege approver) or may not approve.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly AuthorityScopeAll: {
+            readonly title: "AuthorityScopeAll";
+            readonly description: "Unrestricted: every context the maintainer holds, present and future. On the act axis this is a super-administrator (or, at a maintainer without contexts, an entry whose authority is not narrowed by location).";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "all";
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "ACL List 0.2 — response payload";
+            readonly description: "The success response to an acl/list/0.2 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/list/0.2#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["entries", "truncated"];
+            readonly properties: {
+                readonly entries: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/AclEntry";
+                    };
+                    readonly description: "Matching AclEntry items, in maintainer-defined order. May be empty.";
+                };
+                readonly truncated: {
+                    readonly type: "boolean";
+                    readonly description: "true when more matching entries exist beyond `entries`; false when this response is the complete result. Independent of `cursor`: a maintainer MAY truncate without supporting pagination, in which case `truncated` is true and `cursor` is absent.";
+                };
+                readonly cursor: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "Opaque continuation token to fetch the next page. Present only when `truncated` is true AND the maintainer supports pagination from this point. Binds the request's filters and direction. Consumers MUST treat it as opaque and re-send it verbatim.";
+                };
+                readonly redactedFields: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly description: "Names of AclEntry members the maintainer redacted from every returned entry. `act`, `keys` and `capabilities` are never redacted; `approve` and `approveCapabilities` SHOULD NOT be (see acl/show/0.2).";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AclEntry: {
+            readonly title: "AclEntry";
+            readonly description: "One access-control entry: who the grant is for (`subject`), the ceiling it is held under (`role`), where the subject may act (`act`) and approve (`approve`), and which capabilities it may exercise (`capabilities`) and approve (`approveCapabilities`).\n\nThe act axis and the approve axis are independent and a consumer MUST resolve them separately: `act` + `capabilities` (+ `keys`) answer \"may this subject do X\"; `approve` + `approveCapabilities` answer \"may this subject ratify someone else doing X\". Neither implies the other. An entry with `act: {scope: none}` and an approve scope other than none is a least-privilege approver — able to satisfy an approval and unable to initiate any change.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "role", "act", "keys", "capabilities"];
+            readonly properties: {
+                readonly subject: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.";
+                };
+                readonly role: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Opaque role identifier interpreted by the ACL maintainer. A role is a CEILING, never a grant: it bounds the capabilities the entry may hold and never adds to them. A consumer that does not recognise the role MUST treat the entry as conferring no authority and MUST NOT fall back to a default role. Act scope and role are independent members; a consumer MUST NOT compute either from the other.";
+                };
+                readonly act: {
+                    readonly $ref: "#/$defs/AuthorityScope";
+                    readonly description: "REQUIRED explicit act scope: where this subject may make a change itself. Exactly one of `{\"scope\": \"all\"}` (unrestricted — every context the maintainer has), `{\"scope\": \"none\"}` (may act nowhere), or `{\"scope\": \"contexts\", \"contexts\": [...]}` with at least one context path (the named contexts and, where the maintainer's contexts are hierarchical, their descendants). There is no default and no implicit form: an entry without `act`, or with an empty `contexts` list, is malformed and MUST be refused, never read as `all` and never read as `none`. A maintainer that has no contexts (for example a community node that narrows authority with resource qualifiers instead) states `all` or `none` only. Replaces 0.1's `scopes`.";
+                };
+                readonly approve: {
+                    readonly $ref: "#/$defs/AuthorityScope";
+                    readonly description: "OPTIONAL approve scope: where this subject may ratify a change made by someone else (a step-up ratification, a consent decision, an N-of-M approval). Same three shapes as `act`, resolved independently of it. ABSENT MEANS NONE — the subject may ratify nothing — so a consumer that has not implemented the member confers less than the producer intended, never more. A producer SHOULD state `{\"scope\": \"none\"}` explicitly rather than rely on omission. A subject MUST NOT confer approve authority wider than the approve authority it holds itself (see acl/grant `approveWiderThanGranter`). Replaces 0.1's `approve {all, scopes}`.";
+                };
+                readonly capabilities: {
+                    readonly $ref: "#/$defs/CapabilityScope";
+                    readonly description: "REQUIRED explicit capability scope: which capabilities this entry holds. Exactly one of `{\"scope\": \"ceiling\"}` (the role's full ceiling, unnarrowed), `{\"scope\": \"none\"}` (no capabilities), or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityGrant. For `listed`, the EFFECTIVE set is (the role's ceiling ∩ the non-additive grants) ∪ the additive grants; it can only narrow the ceiling, except through an explicit additive grant, which only an unrestricted granter may make. There is no implicit form: an entry without `capabilities`, or with an empty `grants` list, is malformed and MUST be refused. A non-additive grant outside the role's ceiling is refused when written, never accepted with the capability silently dropped; a capability the consumer does not recognise is never treated as granted. Producers SHOULD NOT list the same (capability, resource) pair twice; a consumer MAY refuse a list that does.";
+                };
+                readonly approveCapabilities: {
+                    readonly $ref: "#/$defs/ApproveCapabilityScope";
+                    readonly description: "OPTIONAL explicit approvable-capability scope: which capabilities this subject may APPROVE an action needing — independent of what it may do itself, so an approver can ratify a capability it does not hold (the least-privilege approver). One of `{\"scope\": \"ceiling\"}` (the role's full approve ceiling; at a maintainer whose roles define no capability-level approve ceiling, any action within `approve`), `{\"scope\": \"none\"}`, or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityRef (intersected with the role's approve ceiling where one is defined). ABSENT MEANS NONE: the subject may approve no capability, because absence derives no authority. Bounded by `approve`: where `approve` is absent or `{\"scope\": \"none\"}` this member confers nothing whatever it states. A subject MUST NOT confer approvable capabilities it cannot itself approve.";
+                };
+                readonly delegatedBy: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the granter whose authority this entry was delegated from and is bounded by. The entry MUST NOT hold authority the granter did not hold when it was written, and MUST NOT retain authority the granter has since lost, so a maintainer re-evaluates it when the granter's own entry narrows or is removed. Distinct from `createdBy`, which records who wrote the entry: the two differ where an entry is written on a granter's behalf (for example after an N-of-M approval, or by an offline operator). Set by the maintainer from the granter it authorized; absent on an entry that derives from no granter's authority (the first administrator, an operator-written recovery entry).";
+                };
+                readonly keys: {
+                    readonly $ref: "#/$defs/KeyScope";
+                    readonly description: "REQUIRED explicit key scope: which keys this subject may invoke the maintainer's signing oracle on. Exactly one of `{\"scope\": \"all\"}` (every key the entry's act scope reaches), `{\"scope\": \"none\"}` (no keys), or `{\"scope\": \"listed\", \"keys\": [...]}` with at least one key identifier. INTERSECTS WITH `act` — it can only narrow, never widen: a listed key that lies outside the entry's act scope remains unreachable, exactly as if it were not listed. There is no implicit form: an entry without `keys`, or with an empty `keys` list, is malformed and MUST be refused. A maintainer that operates no signing oracle states `{\"scope\": \"none\"}`. Replaces 0.1's `allowedKeys`, whose absence meant every key.";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "Optional human-readable label. Confers nothing.";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly createdBy: {
+                    readonly type: "string";
+                    readonly description: "VID of the party that originally wrote this entry.";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedBy: {
+                    readonly type: "string";
+                    readonly description: "VID of the party that last modified this entry.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Optional time after which the entry confers no authority. Evaluated at every authorization decision, not only when a session is established.";
+                };
+                readonly stepUp: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly description: "Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry). Carried forward from 0.1 unchanged.";
+                    readonly properties: {
+                        readonly approver: {
+                            readonly type: "string";
+                            readonly description: "VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.";
+                        };
+                        readonly require: {
+                            readonly type: "string";
+                            readonly enum: readonly ["self", "delegated"];
+                            readonly description: "Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).";
+                        };
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces. An extension member MUST NOT be interpreted as conferring authority.";
+                };
+            };
+        };
+        readonly KeyScope: {
+            readonly title: "KeyScope";
+            readonly description: "An explicit key scope. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `listed` with a NON-EMPTY list of key identifiers. The empty list is invalid, not a fourth shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/KeyScopeAll";
+            }, {
+                readonly $ref: "#/$defs/KeyScopeNone";
+            }, {
+                readonly $ref: "#/$defs/KeyScopeListed";
+            }];
+        };
+        readonly KeyScopeListed: {
+            readonly title: "KeyScopeListed";
+            readonly description: "Exactly the listed keys, intersected with the entry's act scope.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "keys"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly keys: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                    };
+                    readonly description: "Non-empty set of key identifiers. An empty array is invalid (it is neither `all` nor `none`).";
+                };
+            };
+        };
+        readonly KeyScopeNone: {
+            readonly title: "KeyScopeNone";
+            readonly description: "No keys.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly KeyScopeAll: {
+            readonly title: "KeyScopeAll";
+            readonly description: "Every key the entry's act scope reaches.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "all";
+                };
+            };
+        };
+        readonly ApproveCapabilityScope: {
+            readonly title: "ApproveCapabilityScope";
+            readonly description: "An explicit statement of the capabilities a subject may approve. Exactly one of `ceiling` (the role's full approve ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityRef.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CapabilityScopeCeiling";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/ApproveCapabilityScopeListed";
+            }];
+        };
+        readonly ApproveCapabilityScopeListed: {
+            readonly title: "ApproveCapabilityScopeListed";
+            readonly description: "Exactly the listed capabilities, intersected with the role's approve ceiling where the maintainer's roles define one.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "grants"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly grants: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityRef";
+                    };
+                    readonly description: "Non-empty list of approvable capabilities. An empty array is invalid.";
+                };
+            };
+        };
+        readonly CapabilityRef: {
+            readonly title: "CapabilityRef";
+            readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+            };
+        };
+        readonly ResourceQualifier: {
+            readonly title: "ResourceQualifier";
+            readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly Capability: {
+            readonly title: "Capability";
+            readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+        };
+        readonly CapabilityScopeNone: {
+            readonly title: "CapabilityScopeNone";
+            readonly description: "No capabilities on this axis.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly CapabilityScopeCeiling: {
+            readonly title: "CapabilityScopeCeiling";
+            readonly description: "The role's full ceiling on this axis, unnarrowed: what the role admits, the entry holds (or, for approvable capabilities, may approve). Stated, not implied — it is the explicit spelling of \"no narrowing\".";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "ceiling";
+                };
+            };
+        };
+        readonly CapabilityScope: {
+            readonly title: "CapabilityScope";
+            readonly description: "An explicit statement of the capabilities an entry holds. Exactly one of three shapes, discriminated by `scope`: `ceiling` (the role's full ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityGrant. The empty list is invalid, not a fourth shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CapabilityScopeCeiling";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeListed";
+            }];
+        };
+        readonly CapabilityScopeListed: {
+            readonly title: "CapabilityScopeListed";
+            readonly description: "Exactly the listed grants: (role ceiling ∩ non-additive grants) ∪ additive grants.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "grants"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly grants: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityGrant";
+                    };
+                    readonly description: "Non-empty list of capability grants. An empty array is invalid (it is neither `ceiling` nor `none`).";
+                };
+            };
+        };
+        readonly CapabilityGrant: {
+            readonly title: "CapabilityGrant";
+            readonly description: "A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+                readonly additive: {
+                    readonly type: "boolean";
+                    readonly description: "`true` declares an ADDITIVE grant: a capability no role implies, granted to this entry beside its role rather than through it, and therefore not intersected with the role's ceiling. Granting one requires unrestricted act authority (`act: {scope: all}`) of the granter, and an entry never acquires one by virtue of its role. Absent or `false` → an ordinary grant, intersected with the role's ceiling, and refused when written if it lies outside it. A consumer MUST refuse `additive: true` on a capability the role's ceiling already includes, so that the flag cannot be used to make an ordinary capability survive a later role change.";
+                };
+            };
+        };
+        readonly AuthorityScope: {
+            readonly title: "AuthorityScope";
+            readonly description: "An explicit authority scope — used for both the act scope and the approve scope of an entry. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `contexts` with a NON-EMPTY list. The empty list is not a fourth shape: it is invalid, so a serializer that drops or empties the list produces a document that fails validation rather than one that silently means something else.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/AuthorityScopeAll";
+            }, {
+                readonly $ref: "#/$defs/AuthorityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/AuthorityScopeContexts";
+            }];
+        };
+        readonly AuthorityScopeContexts: {
+            readonly title: "AuthorityScopeContexts";
+            readonly description: "The named contexts and, where the maintainer's contexts are hierarchical, every descendant of them — and nowhere else. `contexts` MUST carry at least one path.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "contexts"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "contexts";
+                };
+                readonly contexts: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/ContextPath";
+                    };
+                    readonly description: "Non-empty set of context paths. An empty array is invalid (it is neither `all` nor `none`).";
+                };
+            };
+        };
+        readonly ContextPath: {
+            readonly title: "ContextPath";
+            readonly description: "Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly AuthorityScopeNone: {
+            readonly title: "AuthorityScopeNone";
+            readonly description: "No authority on this axis. Stated, not implied: `none` is how an entry says it may not act (a least-privilege approver) or may not approve.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly AuthorityScopeAll: {
+            readonly title: "AuthorityScopeAll";
+            readonly description: "Unrestricted: every context the maintainer holds, present and future. On the act axis this is a super-administrator (or, at a maintainer without contexts, an entry whose authority is not narrowed by location).";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "all";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/acl/list/0.2";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/acl/list/0.2";
+        readonly title: "ACL List 0.2 — payload";
+        readonly description: "Enumerate the AclEntry 0.2 records a maintainer holds, with optional conjunctive filters and paging. A hierarchical filter (`context`, `resource`) MUST state its `direction`; there is no default direction. The outer document members are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly dependentRequired: {
+            readonly context: readonly ["direction"];
+            readonly resource: readonly ["direction"];
+        };
+        readonly dependentSchemas: {
+            readonly direction: {
+                readonly anyOf: readonly [{
+                    readonly required: readonly ["context"];
+                }, {
+                    readonly required: readonly ["resource"];
+                }];
+            };
+        };
+        readonly properties: {
+            readonly role: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Optional filter — only entries with this role are returned.";
+            };
+            readonly context: {
+                readonly $ref: "#/$defs/ContextPath";
+                readonly description: "Optional filter on the entries' ACT scope, read in the stated `direction`. REQUIRES `direction`. Replaces 0.1's `scope` filter.";
+            };
+            readonly capability: {
+                readonly $ref: "#/$defs/Capability";
+                readonly description: "Optional filter — only entries whose EFFECTIVE capability set includes this capability (the role's full ceiling for `capabilities: {scope: ceiling}`, nothing for `none`, and for `listed` the ceiling ∩ the non-additive grants plus the additive grants). Combined with `resource`, the capability must be held at a qualifier related to that resource by `direction`.";
+            };
+            readonly resource: {
+                readonly $ref: "#/$defs/ResourceQualifier";
+                readonly description: "Optional filter on the resource qualifiers of the entries' effective capabilities (of `capability` when given, of any capability otherwise), read in the stated `direction`. REQUIRES `direction`.";
+            };
+            readonly direction: {
+                readonly type: "string";
+                readonly enum: readonly ["actingIn", "subtree", "any"];
+                readonly description: "How to read a hierarchical filter (`context`, `resource`). REQUIRED when either is present and REFUSED when neither is: `actingIn` — entries whose scope or qualifier is an ancestor-or-self of the queried one, i.e. who may act IN it (unrestricted act scopes and unqualified capabilities match); `subtree` — entries holding a grant at or BENEATH the queried one (an unrestricted act scope or an unqualified capability does NOT match, and an entry naming contexts both inside and outside the subtree DOES); `any` — the union. Same three questions as 0.1's `acting-in` / `subtree` / `any`, re-cased to lowerCamelCase, with no default.";
+            };
+            readonly subjectPrefix: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Optional filter — only entries whose subject VID starts with this prefix are returned.";
+            };
+            readonly pageSize: {
+                readonly type: "integer";
+                readonly minimum: 1;
+                readonly maximum: 1000;
+                readonly description: "Maximum number of entries to return. Maintainer-defined default and ceiling.";
+            };
+            readonly cursor: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 2048;
+                readonly description: "Opaque continuation token returned by the maintainer in a previous response. It binds the filters and `direction` it was minted under; a follow-up request MUST repeat them unchanged.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "ACL List 0.2 — response payload";
+                readonly description: "The success response to an acl/list/0.2 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/list/0.2#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["entries", "truncated"];
+                readonly properties: {
+                    readonly entries: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/AclEntry";
+                        };
+                        readonly description: "Matching AclEntry items, in maintainer-defined order. May be empty.";
+                    };
+                    readonly truncated: {
+                        readonly type: "boolean";
+                        readonly description: "true when more matching entries exist beyond `entries`; false when this response is the complete result. Independent of `cursor`: a maintainer MAY truncate without supporting pagination, in which case `truncated` is true and `cursor` is absent.";
+                    };
+                    readonly cursor: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "Opaque continuation token to fetch the next page. Present only when `truncated` is true AND the maintainer supports pagination from this point. Binds the request's filters and direction. Consumers MUST treat it as opaque and re-send it verbatim.";
+                    };
+                    readonly redactedFields: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly description: "Names of AclEntry members the maintainer redacted from every returned entry. `act`, `keys` and `capabilities` are never redacted; `approve` and `approveCapabilities` SHOULD NOT be (see acl/show/0.2).";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AclEntry: {
+                readonly title: "AclEntry";
+                readonly description: "One access-control entry: who the grant is for (`subject`), the ceiling it is held under (`role`), where the subject may act (`act`) and approve (`approve`), and which capabilities it may exercise (`capabilities`) and approve (`approveCapabilities`).\n\nThe act axis and the approve axis are independent and a consumer MUST resolve them separately: `act` + `capabilities` (+ `keys`) answer \"may this subject do X\"; `approve` + `approveCapabilities` answer \"may this subject ratify someone else doing X\". Neither implies the other. An entry with `act: {scope: none}` and an approve scope other than none is a least-privilege approver — able to satisfy an approval and unable to initiate any change.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "role", "act", "keys", "capabilities"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.";
+                    };
+                    readonly role: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Opaque role identifier interpreted by the ACL maintainer. A role is a CEILING, never a grant: it bounds the capabilities the entry may hold and never adds to them. A consumer that does not recognise the role MUST treat the entry as conferring no authority and MUST NOT fall back to a default role. Act scope and role are independent members; a consumer MUST NOT compute either from the other.";
+                    };
+                    readonly act: {
+                        readonly $ref: "#/$defs/AuthorityScope";
+                        readonly description: "REQUIRED explicit act scope: where this subject may make a change itself. Exactly one of `{\"scope\": \"all\"}` (unrestricted — every context the maintainer has), `{\"scope\": \"none\"}` (may act nowhere), or `{\"scope\": \"contexts\", \"contexts\": [...]}` with at least one context path (the named contexts and, where the maintainer's contexts are hierarchical, their descendants). There is no default and no implicit form: an entry without `act`, or with an empty `contexts` list, is malformed and MUST be refused, never read as `all` and never read as `none`. A maintainer that has no contexts (for example a community node that narrows authority with resource qualifiers instead) states `all` or `none` only. Replaces 0.1's `scopes`.";
+                    };
+                    readonly approve: {
+                        readonly $ref: "#/$defs/AuthorityScope";
+                        readonly description: "OPTIONAL approve scope: where this subject may ratify a change made by someone else (a step-up ratification, a consent decision, an N-of-M approval). Same three shapes as `act`, resolved independently of it. ABSENT MEANS NONE — the subject may ratify nothing — so a consumer that has not implemented the member confers less than the producer intended, never more. A producer SHOULD state `{\"scope\": \"none\"}` explicitly rather than rely on omission. A subject MUST NOT confer approve authority wider than the approve authority it holds itself (see acl/grant `approveWiderThanGranter`). Replaces 0.1's `approve {all, scopes}`.";
+                    };
+                    readonly capabilities: {
+                        readonly $ref: "#/$defs/CapabilityScope";
+                        readonly description: "REQUIRED explicit capability scope: which capabilities this entry holds. Exactly one of `{\"scope\": \"ceiling\"}` (the role's full ceiling, unnarrowed), `{\"scope\": \"none\"}` (no capabilities), or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityGrant. For `listed`, the EFFECTIVE set is (the role's ceiling ∩ the non-additive grants) ∪ the additive grants; it can only narrow the ceiling, except through an explicit additive grant, which only an unrestricted granter may make. There is no implicit form: an entry without `capabilities`, or with an empty `grants` list, is malformed and MUST be refused. A non-additive grant outside the role's ceiling is refused when written, never accepted with the capability silently dropped; a capability the consumer does not recognise is never treated as granted. Producers SHOULD NOT list the same (capability, resource) pair twice; a consumer MAY refuse a list that does.";
+                    };
+                    readonly approveCapabilities: {
+                        readonly $ref: "#/$defs/ApproveCapabilityScope";
+                        readonly description: "OPTIONAL explicit approvable-capability scope: which capabilities this subject may APPROVE an action needing — independent of what it may do itself, so an approver can ratify a capability it does not hold (the least-privilege approver). One of `{\"scope\": \"ceiling\"}` (the role's full approve ceiling; at a maintainer whose roles define no capability-level approve ceiling, any action within `approve`), `{\"scope\": \"none\"}`, or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityRef (intersected with the role's approve ceiling where one is defined). ABSENT MEANS NONE: the subject may approve no capability, because absence derives no authority. Bounded by `approve`: where `approve` is absent or `{\"scope\": \"none\"}` this member confers nothing whatever it states. A subject MUST NOT confer approvable capabilities it cannot itself approve.";
+                    };
+                    readonly delegatedBy: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the granter whose authority this entry was delegated from and is bounded by. The entry MUST NOT hold authority the granter did not hold when it was written, and MUST NOT retain authority the granter has since lost, so a maintainer re-evaluates it when the granter's own entry narrows or is removed. Distinct from `createdBy`, which records who wrote the entry: the two differ where an entry is written on a granter's behalf (for example after an N-of-M approval, or by an offline operator). Set by the maintainer from the granter it authorized; absent on an entry that derives from no granter's authority (the first administrator, an operator-written recovery entry).";
+                    };
+                    readonly keys: {
+                        readonly $ref: "#/$defs/KeyScope";
+                        readonly description: "REQUIRED explicit key scope: which keys this subject may invoke the maintainer's signing oracle on. Exactly one of `{\"scope\": \"all\"}` (every key the entry's act scope reaches), `{\"scope\": \"none\"}` (no keys), or `{\"scope\": \"listed\", \"keys\": [...]}` with at least one key identifier. INTERSECTS WITH `act` — it can only narrow, never widen: a listed key that lies outside the entry's act scope remains unreachable, exactly as if it were not listed. There is no implicit form: an entry without `keys`, or with an empty `keys` list, is malformed and MUST be refused. A maintainer that operates no signing oracle states `{\"scope\": \"none\"}`. Replaces 0.1's `allowedKeys`, whose absence meant every key.";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "Optional human-readable label. Confers nothing.";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly createdBy: {
+                        readonly type: "string";
+                        readonly description: "VID of the party that originally wrote this entry.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedBy: {
+                        readonly type: "string";
+                        readonly description: "VID of the party that last modified this entry.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Optional time after which the entry confers no authority. Evaluated at every authorization decision, not only when a session is established.";
+                    };
+                    readonly stepUp: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly description: "Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry). Carried forward from 0.1 unchanged.";
+                        readonly properties: {
+                            readonly approver: {
+                                readonly type: "string";
+                                readonly description: "VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.";
+                            };
+                            readonly require: {
+                                readonly type: "string";
+                                readonly enum: readonly ["self", "delegated"];
+                                readonly description: "Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).";
+                            };
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces. An extension member MUST NOT be interpreted as conferring authority.";
+                    };
+                };
+            };
+            readonly KeyScope: {
+                readonly title: "KeyScope";
+                readonly description: "An explicit key scope. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `listed` with a NON-EMPTY list of key identifiers. The empty list is invalid, not a fourth shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/KeyScopeAll";
+                }, {
+                    readonly $ref: "#/$defs/KeyScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/KeyScopeListed";
+                }];
+            };
+            readonly KeyScopeListed: {
+                readonly title: "KeyScopeListed";
+                readonly description: "Exactly the listed keys, intersected with the entry's act scope.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "keys"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly keys: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 512;
+                        };
+                        readonly description: "Non-empty set of key identifiers. An empty array is invalid (it is neither `all` nor `none`).";
+                    };
+                };
+            };
+            readonly KeyScopeNone: {
+                readonly title: "KeyScopeNone";
+                readonly description: "No keys.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly KeyScopeAll: {
+                readonly title: "KeyScopeAll";
+                readonly description: "Every key the entry's act scope reaches.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "all";
+                    };
+                };
+            };
+            readonly ApproveCapabilityScope: {
+                readonly title: "ApproveCapabilityScope";
+                readonly description: "An explicit statement of the capabilities a subject may approve. Exactly one of `ceiling` (the role's full approve ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityRef.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CapabilityScopeCeiling";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/ApproveCapabilityScopeListed";
+                }];
+            };
+            readonly ApproveCapabilityScopeListed: {
+                readonly title: "ApproveCapabilityScopeListed";
+                readonly description: "Exactly the listed capabilities, intersected with the role's approve ceiling where the maintainer's roles define one.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "grants"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly grants: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityRef";
+                        };
+                        readonly description: "Non-empty list of approvable capabilities. An empty array is invalid.";
+                    };
+                };
+            };
+            readonly CapabilityRef: {
+                readonly title: "CapabilityRef";
+                readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                };
+            };
+            readonly ResourceQualifier: {
+                readonly title: "ResourceQualifier";
+                readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly Capability: {
+                readonly title: "Capability";
+                readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+            };
+            readonly CapabilityScopeNone: {
+                readonly title: "CapabilityScopeNone";
+                readonly description: "No capabilities on this axis.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly CapabilityScopeCeiling: {
+                readonly title: "CapabilityScopeCeiling";
+                readonly description: "The role's full ceiling on this axis, unnarrowed: what the role admits, the entry holds (or, for approvable capabilities, may approve). Stated, not implied — it is the explicit spelling of \"no narrowing\".";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "ceiling";
+                    };
+                };
+            };
+            readonly CapabilityScope: {
+                readonly title: "CapabilityScope";
+                readonly description: "An explicit statement of the capabilities an entry holds. Exactly one of three shapes, discriminated by `scope`: `ceiling` (the role's full ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityGrant. The empty list is invalid, not a fourth shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CapabilityScopeCeiling";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeListed";
+                }];
+            };
+            readonly CapabilityScopeListed: {
+                readonly title: "CapabilityScopeListed";
+                readonly description: "Exactly the listed grants: (role ceiling ∩ non-additive grants) ∪ additive grants.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "grants"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly grants: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityGrant";
+                        };
+                        readonly description: "Non-empty list of capability grants. An empty array is invalid (it is neither `ceiling` nor `none`).";
+                    };
+                };
+            };
+            readonly CapabilityGrant: {
+                readonly title: "CapabilityGrant";
+                readonly description: "A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                    readonly additive: {
+                        readonly type: "boolean";
+                        readonly description: "`true` declares an ADDITIVE grant: a capability no role implies, granted to this entry beside its role rather than through it, and therefore not intersected with the role's ceiling. Granting one requires unrestricted act authority (`act: {scope: all}`) of the granter, and an entry never acquires one by virtue of its role. Absent or `false` → an ordinary grant, intersected with the role's ceiling, and refused when written if it lies outside it. A consumer MUST refuse `additive: true` on a capability the role's ceiling already includes, so that the flag cannot be used to make an ordinary capability survive a later role change.";
+                    };
+                };
+            };
+            readonly AuthorityScope: {
+                readonly title: "AuthorityScope";
+                readonly description: "An explicit authority scope — used for both the act scope and the approve scope of an entry. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `contexts` with a NON-EMPTY list. The empty list is not a fourth shape: it is invalid, so a serializer that drops or empties the list produces a document that fails validation rather than one that silently means something else.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/AuthorityScopeAll";
+                }, {
+                    readonly $ref: "#/$defs/AuthorityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/AuthorityScopeContexts";
+                }];
+            };
+            readonly AuthorityScopeContexts: {
+                readonly title: "AuthorityScopeContexts";
+                readonly description: "The named contexts and, where the maintainer's contexts are hierarchical, every descendant of them — and nowhere else. `contexts` MUST carry at least one path.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "contexts"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "contexts";
+                    };
+                    readonly contexts: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/ContextPath";
+                        };
+                        readonly description: "Non-empty set of context paths. An empty array is invalid (it is neither `all` nor `none`).";
+                    };
+                };
+            };
+            readonly ContextPath: {
+                readonly title: "ContextPath";
+                readonly description: "Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly AuthorityScopeNone: {
+                readonly title: "AuthorityScopeNone";
+                readonly description: "No authority on this axis. Stated, not implied: `none` is how an entry says it may not act (a least-privilege approver) or may not approve.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly AuthorityScopeAll: {
+                readonly title: "AuthorityScopeAll";
+                readonly description: "Unrestricted: every context the maintainer holds, present and future. On the act axis this is a super-administrator (or, at a maintainer without contexts, an entry whose authority is not narrowed by location).";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "all";
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/acl/list/0.2#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "ACL List 0.2 — response payload";
+                readonly description: "The success response to an acl/list/0.2 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/list/0.2#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["entries", "truncated"];
+                readonly properties: {
+                    readonly entries: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/AclEntry";
+                        };
+                        readonly description: "Matching AclEntry items, in maintainer-defined order. May be empty.";
+                    };
+                    readonly truncated: {
+                        readonly type: "boolean";
+                        readonly description: "true when more matching entries exist beyond `entries`; false when this response is the complete result. Independent of `cursor`: a maintainer MAY truncate without supporting pagination, in which case `truncated` is true and `cursor` is absent.";
+                    };
+                    readonly cursor: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "Opaque continuation token to fetch the next page. Present only when `truncated` is true AND the maintainer supports pagination from this point. Binds the request's filters and direction. Consumers MUST treat it as opaque and re-send it verbatim.";
+                    };
+                    readonly redactedFields: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                        readonly description: "Names of AclEntry members the maintainer redacted from every returned entry. `act`, `keys` and `capabilities` are never redacted; `approve` and `approveCapabilities` SHOULD NOT be (see acl/show/0.2).";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AclEntry: {
+                readonly title: "AclEntry";
+                readonly description: "One access-control entry: who the grant is for (`subject`), the ceiling it is held under (`role`), where the subject may act (`act`) and approve (`approve`), and which capabilities it may exercise (`capabilities`) and approve (`approveCapabilities`).\n\nThe act axis and the approve axis are independent and a consumer MUST resolve them separately: `act` + `capabilities` (+ `keys`) answer \"may this subject do X\"; `approve` + `approveCapabilities` answer \"may this subject ratify someone else doing X\". Neither implies the other. An entry with `act: {scope: none}` and an approve scope other than none is a least-privilege approver — able to satisfy an approval and unable to initiate any change.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "role", "act", "keys", "capabilities"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.";
+                    };
+                    readonly role: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Opaque role identifier interpreted by the ACL maintainer. A role is a CEILING, never a grant: it bounds the capabilities the entry may hold and never adds to them. A consumer that does not recognise the role MUST treat the entry as conferring no authority and MUST NOT fall back to a default role. Act scope and role are independent members; a consumer MUST NOT compute either from the other.";
+                    };
+                    readonly act: {
+                        readonly $ref: "#/$defs/AuthorityScope";
+                        readonly description: "REQUIRED explicit act scope: where this subject may make a change itself. Exactly one of `{\"scope\": \"all\"}` (unrestricted — every context the maintainer has), `{\"scope\": \"none\"}` (may act nowhere), or `{\"scope\": \"contexts\", \"contexts\": [...]}` with at least one context path (the named contexts and, where the maintainer's contexts are hierarchical, their descendants). There is no default and no implicit form: an entry without `act`, or with an empty `contexts` list, is malformed and MUST be refused, never read as `all` and never read as `none`. A maintainer that has no contexts (for example a community node that narrows authority with resource qualifiers instead) states `all` or `none` only. Replaces 0.1's `scopes`.";
+                    };
+                    readonly approve: {
+                        readonly $ref: "#/$defs/AuthorityScope";
+                        readonly description: "OPTIONAL approve scope: where this subject may ratify a change made by someone else (a step-up ratification, a consent decision, an N-of-M approval). Same three shapes as `act`, resolved independently of it. ABSENT MEANS NONE — the subject may ratify nothing — so a consumer that has not implemented the member confers less than the producer intended, never more. A producer SHOULD state `{\"scope\": \"none\"}` explicitly rather than rely on omission. A subject MUST NOT confer approve authority wider than the approve authority it holds itself (see acl/grant `approveWiderThanGranter`). Replaces 0.1's `approve {all, scopes}`.";
+                    };
+                    readonly capabilities: {
+                        readonly $ref: "#/$defs/CapabilityScope";
+                        readonly description: "REQUIRED explicit capability scope: which capabilities this entry holds. Exactly one of `{\"scope\": \"ceiling\"}` (the role's full ceiling, unnarrowed), `{\"scope\": \"none\"}` (no capabilities), or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityGrant. For `listed`, the EFFECTIVE set is (the role's ceiling ∩ the non-additive grants) ∪ the additive grants; it can only narrow the ceiling, except through an explicit additive grant, which only an unrestricted granter may make. There is no implicit form: an entry without `capabilities`, or with an empty `grants` list, is malformed and MUST be refused. A non-additive grant outside the role's ceiling is refused when written, never accepted with the capability silently dropped; a capability the consumer does not recognise is never treated as granted. Producers SHOULD NOT list the same (capability, resource) pair twice; a consumer MAY refuse a list that does.";
+                    };
+                    readonly approveCapabilities: {
+                        readonly $ref: "#/$defs/ApproveCapabilityScope";
+                        readonly description: "OPTIONAL explicit approvable-capability scope: which capabilities this subject may APPROVE an action needing — independent of what it may do itself, so an approver can ratify a capability it does not hold (the least-privilege approver). One of `{\"scope\": \"ceiling\"}` (the role's full approve ceiling; at a maintainer whose roles define no capability-level approve ceiling, any action within `approve`), `{\"scope\": \"none\"}`, or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityRef (intersected with the role's approve ceiling where one is defined). ABSENT MEANS NONE: the subject may approve no capability, because absence derives no authority. Bounded by `approve`: where `approve` is absent or `{\"scope\": \"none\"}` this member confers nothing whatever it states. A subject MUST NOT confer approvable capabilities it cannot itself approve.";
+                    };
+                    readonly delegatedBy: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the granter whose authority this entry was delegated from and is bounded by. The entry MUST NOT hold authority the granter did not hold when it was written, and MUST NOT retain authority the granter has since lost, so a maintainer re-evaluates it when the granter's own entry narrows or is removed. Distinct from `createdBy`, which records who wrote the entry: the two differ where an entry is written on a granter's behalf (for example after an N-of-M approval, or by an offline operator). Set by the maintainer from the granter it authorized; absent on an entry that derives from no granter's authority (the first administrator, an operator-written recovery entry).";
+                    };
+                    readonly keys: {
+                        readonly $ref: "#/$defs/KeyScope";
+                        readonly description: "REQUIRED explicit key scope: which keys this subject may invoke the maintainer's signing oracle on. Exactly one of `{\"scope\": \"all\"}` (every key the entry's act scope reaches), `{\"scope\": \"none\"}` (no keys), or `{\"scope\": \"listed\", \"keys\": [...]}` with at least one key identifier. INTERSECTS WITH `act` — it can only narrow, never widen: a listed key that lies outside the entry's act scope remains unreachable, exactly as if it were not listed. There is no implicit form: an entry without `keys`, or with an empty `keys` list, is malformed and MUST be refused. A maintainer that operates no signing oracle states `{\"scope\": \"none\"}`. Replaces 0.1's `allowedKeys`, whose absence meant every key.";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "Optional human-readable label. Confers nothing.";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly createdBy: {
+                        readonly type: "string";
+                        readonly description: "VID of the party that originally wrote this entry.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedBy: {
+                        readonly type: "string";
+                        readonly description: "VID of the party that last modified this entry.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Optional time after which the entry confers no authority. Evaluated at every authorization decision, not only when a session is established.";
+                    };
+                    readonly stepUp: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly description: "Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry). Carried forward from 0.1 unchanged.";
+                        readonly properties: {
+                            readonly approver: {
+                                readonly type: "string";
+                                readonly description: "VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.";
+                            };
+                            readonly require: {
+                                readonly type: "string";
+                                readonly enum: readonly ["self", "delegated"];
+                                readonly description: "Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).";
+                            };
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces. An extension member MUST NOT be interpreted as conferring authority.";
+                    };
+                };
+            };
+            readonly KeyScope: {
+                readonly title: "KeyScope";
+                readonly description: "An explicit key scope. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `listed` with a NON-EMPTY list of key identifiers. The empty list is invalid, not a fourth shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/KeyScopeAll";
+                }, {
+                    readonly $ref: "#/$defs/KeyScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/KeyScopeListed";
+                }];
+            };
+            readonly KeyScopeListed: {
+                readonly title: "KeyScopeListed";
+                readonly description: "Exactly the listed keys, intersected with the entry's act scope.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "keys"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly keys: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 512;
+                        };
+                        readonly description: "Non-empty set of key identifiers. An empty array is invalid (it is neither `all` nor `none`).";
+                    };
+                };
+            };
+            readonly KeyScopeNone: {
+                readonly title: "KeyScopeNone";
+                readonly description: "No keys.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly KeyScopeAll: {
+                readonly title: "KeyScopeAll";
+                readonly description: "Every key the entry's act scope reaches.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "all";
+                    };
+                };
+            };
+            readonly ApproveCapabilityScope: {
+                readonly title: "ApproveCapabilityScope";
+                readonly description: "An explicit statement of the capabilities a subject may approve. Exactly one of `ceiling` (the role's full approve ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityRef.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CapabilityScopeCeiling";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/ApproveCapabilityScopeListed";
+                }];
+            };
+            readonly ApproveCapabilityScopeListed: {
+                readonly title: "ApproveCapabilityScopeListed";
+                readonly description: "Exactly the listed capabilities, intersected with the role's approve ceiling where the maintainer's roles define one.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "grants"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly grants: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityRef";
+                        };
+                        readonly description: "Non-empty list of approvable capabilities. An empty array is invalid.";
+                    };
+                };
+            };
+            readonly CapabilityRef: {
+                readonly title: "CapabilityRef";
+                readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                };
+            };
+            readonly ResourceQualifier: {
+                readonly title: "ResourceQualifier";
+                readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly Capability: {
+                readonly title: "Capability";
+                readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+            };
+            readonly CapabilityScopeNone: {
+                readonly title: "CapabilityScopeNone";
+                readonly description: "No capabilities on this axis.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly CapabilityScopeCeiling: {
+                readonly title: "CapabilityScopeCeiling";
+                readonly description: "The role's full ceiling on this axis, unnarrowed: what the role admits, the entry holds (or, for approvable capabilities, may approve). Stated, not implied — it is the explicit spelling of \"no narrowing\".";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "ceiling";
+                    };
+                };
+            };
+            readonly CapabilityScope: {
+                readonly title: "CapabilityScope";
+                readonly description: "An explicit statement of the capabilities an entry holds. Exactly one of three shapes, discriminated by `scope`: `ceiling` (the role's full ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityGrant. The empty list is invalid, not a fourth shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CapabilityScopeCeiling";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeListed";
+                }];
+            };
+            readonly CapabilityScopeListed: {
+                readonly title: "CapabilityScopeListed";
+                readonly description: "Exactly the listed grants: (role ceiling ∩ non-additive grants) ∪ additive grants.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "grants"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly grants: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityGrant";
+                        };
+                        readonly description: "Non-empty list of capability grants. An empty array is invalid (it is neither `ceiling` nor `none`).";
+                    };
+                };
+            };
+            readonly CapabilityGrant: {
+                readonly title: "CapabilityGrant";
+                readonly description: "A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                    readonly additive: {
+                        readonly type: "boolean";
+                        readonly description: "`true` declares an ADDITIVE grant: a capability no role implies, granted to this entry beside its role rather than through it, and therefore not intersected with the role's ceiling. Granting one requires unrestricted act authority (`act: {scope: all}`) of the granter, and an entry never acquires one by virtue of its role. Absent or `false` → an ordinary grant, intersected with the role's ceiling, and refused when written if it lies outside it. A consumer MUST refuse `additive: true` on a capability the role's ceiling already includes, so that the flag cannot be used to make an ordinary capability survive a later role change.";
+                    };
+                };
+            };
+            readonly AuthorityScope: {
+                readonly title: "AuthorityScope";
+                readonly description: "An explicit authority scope — used for both the act scope and the approve scope of an entry. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `contexts` with a NON-EMPTY list. The empty list is not a fourth shape: it is invalid, so a serializer that drops or empties the list produces a document that fails validation rather than one that silently means something else.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/AuthorityScopeAll";
+                }, {
+                    readonly $ref: "#/$defs/AuthorityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/AuthorityScopeContexts";
+                }];
+            };
+            readonly AuthorityScopeContexts: {
+                readonly title: "AuthorityScopeContexts";
+                readonly description: "The named contexts and, where the maintainer's contexts are hierarchical, every descendant of them — and nowhere else. `contexts` MUST carry at least one path.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "contexts"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "contexts";
+                    };
+                    readonly contexts: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/ContextPath";
+                        };
+                        readonly description: "Non-empty set of context paths. An empty array is invalid (it is neither `all` nor `none`).";
+                    };
+                };
+            };
+            readonly ContextPath: {
+                readonly title: "ContextPath";
+                readonly description: "Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly AuthorityScopeNone: {
+                readonly title: "AuthorityScopeNone";
+                readonly description: "No authority on this axis. Stated, not implied: `none` is how an entry says it may not act (a least-privilege approver) or may not approve.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly AuthorityScopeAll: {
+                readonly title: "AuthorityScopeAll";
+                readonly description: "Unrestricted: every context the maintainer holds, present and future. On the act axis this is a super-administrator (or, at a maintainer without contexts, an entry whose authority is not narrowed by location).";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "all";
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map