@openvtc/trust-tasks 0.22.5 → 0.22.7

package/dist/acl/update/0.2/payload.d.ts

@@ -0,0 +1,1784 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/acl/update/0.2/payload.schema.json
+ */
+import type { AclEntry_AclV0_2 as AclEntry, ApproveCapabilityScope, ApproveCapabilityScopeListed, AuthorityScope, AuthorityScopeAll, AuthorityScopeContexts, AuthorityScopeNone, Capability_AclV0_2 as Capability, CapabilityGrant, CapabilityRef, CapabilityScope, CapabilityScopeCeiling, CapabilityScopeListed, CapabilityScopeNone, ContextPath, Ext, KeyScope, KeyScopeAll, KeyScopeListed, KeyScopeNone, ResourceQualifier } from "../../../_shared/components.js";
+/**
+ * Amend the non-role attributes of an existing AclEntry 0.2: its act scope (widening only), approve scope, capability scope, approvable-capability scope, key scope, label, expiry or step-up requirement. Every member REPLACES the stored value; an omitted member leaves it unchanged. Role changes are NOT expressible here — they go through acl/change-role, which requires the current role as a compare-and-swap. `delegatedBy` and the provenance timestamps are maintainer-populated and not settable.
+ */
+export interface ACLUpdate02Payload {
+    /**
+     * VID of the entry to amend. The entry MUST already exist; this task does not create one (use acl/grant).
+     */
+    subject: string;
+    /**
+     * Replacement act scope, in the same explicit form as the entry's (`all`, `none`, or a non-empty context list). A replacement that WIDENS or equals the stored scope is accepted, subject to the granter bound. NARROWING THE ACT SCOPE IS A REVOCATION and a consumer MUST refuse it here with `narrowingNotPermitted`, directing the caller to acl/revoke, so that every removal of where a subject may act passes through the task that is audited and reasoned as a revocation.
+     */
+    act?: AuthorityScope;
+    /**
+     * Replacement approve scope. To withdraw approve authority entirely, send `{"scope": "none"}` — there is no null form, because the explicit value is the only spelling that cannot be misread. Widening is an escalation vector (a subject able to approve can ratify operations it could not authorize) and is bounded by the granter's own approve authority. Narrowing is accepted here and is a privilege reduction (see the specification).
+     */
+    approve?: AuthorityScope;
+    /**
+     * Replacement capability scope, applied wholesale, in the same explicit form as the entry's. Omitted leaves it unchanged. `{"scope": "ceiling"}` returns the entry to its role's full ceiling — a privilege INCREASE, bounded and gated like any widening; `{"scope": "none"}` removes every capability; `listed` states the exact set. There is no null form. Every listed capability is checked as on a grant (registry, ceiling, additive, granter bound). A replacement that removes a capability the entry held is a privilege reduction.
+     */
+    capabilities?: CapabilityScope;
+    /**
+     * Replacement approvable-capability scope, applied wholesale. Omitted leaves it unchanged. `{"scope": "ceiling"}` lets the subject approve its role's full approve ceiling within its approve scope (a privilege increase); `{"scope": "none"}` withdraws it; `listed` states the exact set. There is no null form. Bounded by the granter's own approve authority.
+     */
+    approveCapabilities?: ApproveCapabilityScope;
+    /**
+     * Replacement key scope, applied wholesale. Omitted leaves it unchanged. `{"scope": "all"}` lets the subject reach every key within its act scope again — a privilege increase a consumer SHOULD gate like clearing `expiresAt`; `{"scope": "none"}` removes every key; `listed` states the exact set. There is no null form. A replacement that narrows the stored key scope IS a privilege reduction: it is accepted here, because acl/revoke/0.2 narrows only the act scope, but the consumer MUST audit it as a reduction and apply it at the subject's next authorization decision.
+     */
+    keys?: KeyScope;
+    /**
+     * Replacement human-readable label. Explicit `null` clears it. Omitted leaves it unchanged.
+     */
+    label?: string | null;
+    /**
+     * Replacement expiry. Explicit `null` makes the entry permanent — a privilege increase, which a consumer SHOULD gate at least as strictly as the original grant, and which is refused where the granter's own entry expires.
+     */
+    expiresAt?: string | null;
+    /**
+     * Replacement per-entry step-up configuration. Same additive-only rule as on the entry itself: it MAY raise the assurance required of this subject above the system floor but MUST NOT lower it.
+     */
+    stepUp?: {
+        /**
+         * VID that ratifies step-up for this subject. `null` clears it.
+         */
+        approver?: string | null;
+        /**
+         * Minimum step-up mode. `null` clears the per-entry override.
+         */
+        require?: "self" | "delegated" | null;
+    };
+    /**
+     * Optional human-readable rationale, recorded with the change.
+     */
+    reason?: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * The success response to an acl/update/0.2 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/update/0.2#response.
+ */
+export interface ACLUpdate02ResponsePayload {
+    /**
+     * The realized entry the maintainer now holds, after the amendment.
+     */
+    entry: AclEntry;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AclEntry, ApproveCapabilityScope, ApproveCapabilityScopeListed, AuthorityScope, AuthorityScopeAll, AuthorityScopeContexts, AuthorityScopeNone, Capability, CapabilityGrant, CapabilityRef, CapabilityScope, CapabilityScopeCeiling, CapabilityScopeListed, CapabilityScopeNone, ContextPath, Ext, KeyScope, KeyScopeAll, KeyScopeListed, KeyScopeNone, ResourceQualifier };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/acl/update/0.2";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ACLUpdate02Payload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/acl/update/0.2#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ACLUpdate02ResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/acl/update/0.2";
+    readonly title: "ACL Update 0.2 — payload";
+    readonly description: "Amend the non-role attributes of an existing AclEntry 0.2: its act scope (widening only), approve scope, capability scope, approvable-capability scope, key scope, label, expiry or step-up requirement. Every member REPLACES the stored value; an omitted member leaves it unchanged. Role changes are NOT expressible here — they go through acl/change-role, which requires the current role as a compare-and-swap. `delegatedBy` and the provenance timestamps are maintainer-populated and not settable.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["subject"];
+    readonly properties: {
+        readonly subject: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "VID of the entry to amend. The entry MUST already exist; this task does not create one (use acl/grant).";
+        };
+        readonly act: {
+            readonly $ref: "#/$defs/AuthorityScope";
+            readonly description: "Replacement act scope, in the same explicit form as the entry's (`all`, `none`, or a non-empty context list). A replacement that WIDENS or equals the stored scope is accepted, subject to the granter bound. NARROWING THE ACT SCOPE IS A REVOCATION and a consumer MUST refuse it here with `narrowingNotPermitted`, directing the caller to acl/revoke, so that every removal of where a subject may act passes through the task that is audited and reasoned as a revocation.";
+        };
+        readonly approve: {
+            readonly $ref: "#/$defs/AuthorityScope";
+            readonly description: "Replacement approve scope. To withdraw approve authority entirely, send `{\"scope\": \"none\"}` — there is no null form, because the explicit value is the only spelling that cannot be misread. Widening is an escalation vector (a subject able to approve can ratify operations it could not authorize) and is bounded by the granter's own approve authority. Narrowing is accepted here and is a privilege reduction (see the specification).";
+        };
+        readonly capabilities: {
+            readonly $ref: "#/$defs/CapabilityScope";
+            readonly description: "Replacement capability scope, applied wholesale, in the same explicit form as the entry's. Omitted leaves it unchanged. `{\"scope\": \"ceiling\"}` returns the entry to its role's full ceiling — a privilege INCREASE, bounded and gated like any widening; `{\"scope\": \"none\"}` removes every capability; `listed` states the exact set. There is no null form. Every listed capability is checked as on a grant (registry, ceiling, additive, granter bound). A replacement that removes a capability the entry held is a privilege reduction.";
+        };
+        readonly approveCapabilities: {
+            readonly $ref: "#/$defs/ApproveCapabilityScope";
+            readonly description: "Replacement approvable-capability scope, applied wholesale. Omitted leaves it unchanged. `{\"scope\": \"ceiling\"}` lets the subject approve its role's full approve ceiling within its approve scope (a privilege increase); `{\"scope\": \"none\"}` withdraws it; `listed` states the exact set. There is no null form. Bounded by the granter's own approve authority.";
+        };
+        readonly keys: {
+            readonly $ref: "#/$defs/KeyScope";
+            readonly description: "Replacement key scope, applied wholesale. Omitted leaves it unchanged. `{\"scope\": \"all\"}` lets the subject reach every key within its act scope again — a privilege increase a consumer SHOULD gate like clearing `expiresAt`; `{\"scope\": \"none\"}` removes every key; `listed` states the exact set. There is no null form. A replacement that narrows the stored key scope IS a privilege reduction: it is accepted here, because acl/revoke/0.2 narrows only the act scope, but the consumer MUST audit it as a reduction and apply it at the subject's next authorization decision.";
+        };
+        readonly label: {
+            readonly type: readonly ["string", "null"];
+            readonly maxLength: 256;
+            readonly description: "Replacement human-readable label. Explicit `null` clears it. Omitted leaves it unchanged.";
+        };
+        readonly expiresAt: {
+            readonly type: readonly ["string", "null"];
+            readonly format: "date-time";
+            readonly description: "Replacement expiry. Explicit `null` makes the entry permanent — a privilege increase, which a consumer SHOULD gate at least as strictly as the original grant, and which is refused where the granter's own entry expires.";
+        };
+        readonly stepUp: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "Replacement per-entry step-up configuration. Same additive-only rule as on the entry itself: it MAY raise the assurance required of this subject above the system floor but MUST NOT lower it.";
+            readonly properties: {
+                readonly approver: {
+                    readonly type: readonly ["string", "null"];
+                    readonly description: "VID that ratifies step-up for this subject. `null` clears it.";
+                };
+                readonly require: {
+                    readonly type: readonly ["string", "null"];
+                    readonly enum: readonly ["self", "delegated", null];
+                    readonly description: "Minimum step-up mode. `null` clears the per-entry override.";
+                };
+            };
+        };
+        readonly reason: {
+            readonly type: "string";
+            readonly maxLength: 1024;
+            readonly description: "Optional human-readable rationale, recorded with the change.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "ACL Update 0.2 — response payload";
+            readonly description: "The success response to an acl/update/0.2 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/update/0.2#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["entry"];
+            readonly properties: {
+                readonly entry: {
+                    readonly $ref: "#/$defs/AclEntry";
+                    readonly description: "The realized entry the maintainer now holds, after the amendment.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AclEntry: {
+            readonly title: "AclEntry";
+            readonly description: "One access-control entry: who the grant is for (`subject`), the ceiling it is held under (`role`), where the subject may act (`act`) and approve (`approve`), and which capabilities it may exercise (`capabilities`) and approve (`approveCapabilities`).\n\nThe act axis and the approve axis are independent and a consumer MUST resolve them separately: `act` + `capabilities` (+ `keys`) answer \"may this subject do X\"; `approve` + `approveCapabilities` answer \"may this subject ratify someone else doing X\". Neither implies the other. An entry with `act: {scope: none}` and an approve scope other than none is a least-privilege approver — able to satisfy an approval and unable to initiate any change.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "role", "act", "keys", "capabilities"];
+            readonly properties: {
+                readonly subject: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.";
+                };
+                readonly role: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Opaque role identifier interpreted by the ACL maintainer. A role is a CEILING, never a grant: it bounds the capabilities the entry may hold and never adds to them. A consumer that does not recognise the role MUST treat the entry as conferring no authority and MUST NOT fall back to a default role. Act scope and role are independent members; a consumer MUST NOT compute either from the other.";
+                };
+                readonly act: {
+                    readonly $ref: "#/$defs/AuthorityScope";
+                    readonly description: "REQUIRED explicit act scope: where this subject may make a change itself. Exactly one of `{\"scope\": \"all\"}` (unrestricted — every context the maintainer has), `{\"scope\": \"none\"}` (may act nowhere), or `{\"scope\": \"contexts\", \"contexts\": [...]}` with at least one context path (the named contexts and, where the maintainer's contexts are hierarchical, their descendants). There is no default and no implicit form: an entry without `act`, or with an empty `contexts` list, is malformed and MUST be refused, never read as `all` and never read as `none`. A maintainer that has no contexts (for example a community node that narrows authority with resource qualifiers instead) states `all` or `none` only. Replaces 0.1's `scopes`.";
+                };
+                readonly approve: {
+                    readonly $ref: "#/$defs/AuthorityScope";
+                    readonly description: "OPTIONAL approve scope: where this subject may ratify a change made by someone else (a step-up ratification, a consent decision, an N-of-M approval). Same three shapes as `act`, resolved independently of it. ABSENT MEANS NONE — the subject may ratify nothing — so a consumer that has not implemented the member confers less than the producer intended, never more. A producer SHOULD state `{\"scope\": \"none\"}` explicitly rather than rely on omission. A subject MUST NOT confer approve authority wider than the approve authority it holds itself (see acl/grant `approveWiderThanGranter`). Replaces 0.1's `approve {all, scopes}`.";
+                };
+                readonly capabilities: {
+                    readonly $ref: "#/$defs/CapabilityScope";
+                    readonly description: "REQUIRED explicit capability scope: which capabilities this entry holds. Exactly one of `{\"scope\": \"ceiling\"}` (the role's full ceiling, unnarrowed), `{\"scope\": \"none\"}` (no capabilities), or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityGrant. For `listed`, the EFFECTIVE set is (the role's ceiling ∩ the non-additive grants) ∪ the additive grants; it can only narrow the ceiling, except through an explicit additive grant, which only an unrestricted granter may make. There is no implicit form: an entry without `capabilities`, or with an empty `grants` list, is malformed and MUST be refused. A non-additive grant outside the role's ceiling is refused when written, never accepted with the capability silently dropped; a capability the consumer does not recognise is never treated as granted. Producers SHOULD NOT list the same (capability, resource) pair twice; a consumer MAY refuse a list that does.";
+                };
+                readonly approveCapabilities: {
+                    readonly $ref: "#/$defs/ApproveCapabilityScope";
+                    readonly description: "OPTIONAL explicit approvable-capability scope: which capabilities this subject may APPROVE an action needing — independent of what it may do itself, so an approver can ratify a capability it does not hold (the least-privilege approver). One of `{\"scope\": \"ceiling\"}` (the role's full approve ceiling; at a maintainer whose roles define no capability-level approve ceiling, any action within `approve`), `{\"scope\": \"none\"}`, or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityRef (intersected with the role's approve ceiling where one is defined). ABSENT MEANS NONE: the subject may approve no capability, because absence derives no authority. Bounded by `approve`: where `approve` is absent or `{\"scope\": \"none\"}` this member confers nothing whatever it states. A subject MUST NOT confer approvable capabilities it cannot itself approve.";
+                };
+                readonly delegatedBy: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the granter whose authority this entry was delegated from and is bounded by. The entry MUST NOT hold authority the granter did not hold when it was written, and MUST NOT retain authority the granter has since lost, so a maintainer re-evaluates it when the granter's own entry narrows or is removed. Distinct from `createdBy`, which records who wrote the entry: the two differ where an entry is written on a granter's behalf (for example after an N-of-M approval, or by an offline operator). Set by the maintainer from the granter it authorized; absent on an entry that derives from no granter's authority (the first administrator, an operator-written recovery entry).";
+                };
+                readonly keys: {
+                    readonly $ref: "#/$defs/KeyScope";
+                    readonly description: "REQUIRED explicit key scope: which keys this subject may invoke the maintainer's signing oracle on. Exactly one of `{\"scope\": \"all\"}` (every key the entry's act scope reaches), `{\"scope\": \"none\"}` (no keys), or `{\"scope\": \"listed\", \"keys\": [...]}` with at least one key identifier. INTERSECTS WITH `act` — it can only narrow, never widen: a listed key that lies outside the entry's act scope remains unreachable, exactly as if it were not listed. There is no implicit form: an entry without `keys`, or with an empty `keys` list, is malformed and MUST be refused. A maintainer that operates no signing oracle states `{\"scope\": \"none\"}`. Replaces 0.1's `allowedKeys`, whose absence meant every key.";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "Optional human-readable label. Confers nothing.";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly createdBy: {
+                    readonly type: "string";
+                    readonly description: "VID of the party that originally wrote this entry.";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedBy: {
+                    readonly type: "string";
+                    readonly description: "VID of the party that last modified this entry.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Optional time after which the entry confers no authority. Evaluated at every authorization decision, not only when a session is established.";
+                };
+                readonly stepUp: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly description: "Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry). Carried forward from 0.1 unchanged.";
+                    readonly properties: {
+                        readonly approver: {
+                            readonly type: "string";
+                            readonly description: "VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.";
+                        };
+                        readonly require: {
+                            readonly type: "string";
+                            readonly enum: readonly ["self", "delegated"];
+                            readonly description: "Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).";
+                        };
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces. An extension member MUST NOT be interpreted as conferring authority.";
+                };
+            };
+        };
+        readonly KeyScope: {
+            readonly title: "KeyScope";
+            readonly description: "An explicit key scope. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `listed` with a NON-EMPTY list of key identifiers. The empty list is invalid, not a fourth shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/KeyScopeAll";
+            }, {
+                readonly $ref: "#/$defs/KeyScopeNone";
+            }, {
+                readonly $ref: "#/$defs/KeyScopeListed";
+            }];
+        };
+        readonly KeyScopeListed: {
+            readonly title: "KeyScopeListed";
+            readonly description: "Exactly the listed keys, intersected with the entry's act scope.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "keys"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly keys: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                    };
+                    readonly description: "Non-empty set of key identifiers. An empty array is invalid (it is neither `all` nor `none`).";
+                };
+            };
+        };
+        readonly KeyScopeNone: {
+            readonly title: "KeyScopeNone";
+            readonly description: "No keys.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly KeyScopeAll: {
+            readonly title: "KeyScopeAll";
+            readonly description: "Every key the entry's act scope reaches.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "all";
+                };
+            };
+        };
+        readonly ApproveCapabilityScope: {
+            readonly title: "ApproveCapabilityScope";
+            readonly description: "An explicit statement of the capabilities a subject may approve. Exactly one of `ceiling` (the role's full approve ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityRef.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CapabilityScopeCeiling";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/ApproveCapabilityScopeListed";
+            }];
+        };
+        readonly ApproveCapabilityScopeListed: {
+            readonly title: "ApproveCapabilityScopeListed";
+            readonly description: "Exactly the listed capabilities, intersected with the role's approve ceiling where the maintainer's roles define one.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "grants"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly grants: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityRef";
+                    };
+                    readonly description: "Non-empty list of approvable capabilities. An empty array is invalid.";
+                };
+            };
+        };
+        readonly CapabilityRef: {
+            readonly title: "CapabilityRef";
+            readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+            };
+        };
+        readonly ResourceQualifier: {
+            readonly title: "ResourceQualifier";
+            readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly Capability: {
+            readonly title: "Capability";
+            readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+        };
+        readonly CapabilityScopeNone: {
+            readonly title: "CapabilityScopeNone";
+            readonly description: "No capabilities on this axis.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly CapabilityScopeCeiling: {
+            readonly title: "CapabilityScopeCeiling";
+            readonly description: "The role's full ceiling on this axis, unnarrowed: what the role admits, the entry holds (or, for approvable capabilities, may approve). Stated, not implied — it is the explicit spelling of \"no narrowing\".";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "ceiling";
+                };
+            };
+        };
+        readonly CapabilityScope: {
+            readonly title: "CapabilityScope";
+            readonly description: "An explicit statement of the capabilities an entry holds. Exactly one of three shapes, discriminated by `scope`: `ceiling` (the role's full ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityGrant. The empty list is invalid, not a fourth shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CapabilityScopeCeiling";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeListed";
+            }];
+        };
+        readonly CapabilityScopeListed: {
+            readonly title: "CapabilityScopeListed";
+            readonly description: "Exactly the listed grants: (role ceiling ∩ non-additive grants) ∪ additive grants.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "grants"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly grants: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityGrant";
+                    };
+                    readonly description: "Non-empty list of capability grants. An empty array is invalid (it is neither `ceiling` nor `none`).";
+                };
+            };
+        };
+        readonly CapabilityGrant: {
+            readonly title: "CapabilityGrant";
+            readonly description: "A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+                readonly additive: {
+                    readonly type: "boolean";
+                    readonly description: "`true` declares an ADDITIVE grant: a capability no role implies, granted to this entry beside its role rather than through it, and therefore not intersected with the role's ceiling. Granting one requires unrestricted act authority (`act: {scope: all}`) of the granter, and an entry never acquires one by virtue of its role. Absent or `false` → an ordinary grant, intersected with the role's ceiling, and refused when written if it lies outside it. A consumer MUST refuse `additive: true` on a capability the role's ceiling already includes, so that the flag cannot be used to make an ordinary capability survive a later role change.";
+                };
+            };
+        };
+        readonly AuthorityScope: {
+            readonly title: "AuthorityScope";
+            readonly description: "An explicit authority scope — used for both the act scope and the approve scope of an entry. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `contexts` with a NON-EMPTY list. The empty list is not a fourth shape: it is invalid, so a serializer that drops or empties the list produces a document that fails validation rather than one that silently means something else.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/AuthorityScopeAll";
+            }, {
+                readonly $ref: "#/$defs/AuthorityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/AuthorityScopeContexts";
+            }];
+        };
+        readonly AuthorityScopeContexts: {
+            readonly title: "AuthorityScopeContexts";
+            readonly description: "The named contexts and, where the maintainer's contexts are hierarchical, every descendant of them — and nowhere else. `contexts` MUST carry at least one path.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "contexts"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "contexts";
+                };
+                readonly contexts: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/ContextPath";
+                    };
+                    readonly description: "Non-empty set of context paths. An empty array is invalid (it is neither `all` nor `none`).";
+                };
+            };
+        };
+        readonly ContextPath: {
+            readonly title: "ContextPath";
+            readonly description: "Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly AuthorityScopeNone: {
+            readonly title: "AuthorityScopeNone";
+            readonly description: "No authority on this axis. Stated, not implied: `none` is how an entry says it may not act (a least-privilege approver) or may not approve.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly AuthorityScopeAll: {
+            readonly title: "AuthorityScopeAll";
+            readonly description: "Unrestricted: every context the maintainer holds, present and future. On the act axis this is a super-administrator (or, at a maintainer without contexts, an entry whose authority is not narrowed by location).";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "all";
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "ACL Update 0.2 — response payload";
+            readonly description: "The success response to an acl/update/0.2 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/update/0.2#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["entry"];
+            readonly properties: {
+                readonly entry: {
+                    readonly $ref: "#/$defs/AclEntry";
+                    readonly description: "The realized entry the maintainer now holds, after the amendment.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AclEntry: {
+            readonly title: "AclEntry";
+            readonly description: "One access-control entry: who the grant is for (`subject`), the ceiling it is held under (`role`), where the subject may act (`act`) and approve (`approve`), and which capabilities it may exercise (`capabilities`) and approve (`approveCapabilities`).\n\nThe act axis and the approve axis are independent and a consumer MUST resolve them separately: `act` + `capabilities` (+ `keys`) answer \"may this subject do X\"; `approve` + `approveCapabilities` answer \"may this subject ratify someone else doing X\". Neither implies the other. An entry with `act: {scope: none}` and an approve scope other than none is a least-privilege approver — able to satisfy an approval and unable to initiate any change.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "role", "act", "keys", "capabilities"];
+            readonly properties: {
+                readonly subject: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.";
+                };
+                readonly role: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Opaque role identifier interpreted by the ACL maintainer. A role is a CEILING, never a grant: it bounds the capabilities the entry may hold and never adds to them. A consumer that does not recognise the role MUST treat the entry as conferring no authority and MUST NOT fall back to a default role. Act scope and role are independent members; a consumer MUST NOT compute either from the other.";
+                };
+                readonly act: {
+                    readonly $ref: "#/$defs/AuthorityScope";
+                    readonly description: "REQUIRED explicit act scope: where this subject may make a change itself. Exactly one of `{\"scope\": \"all\"}` (unrestricted — every context the maintainer has), `{\"scope\": \"none\"}` (may act nowhere), or `{\"scope\": \"contexts\", \"contexts\": [...]}` with at least one context path (the named contexts and, where the maintainer's contexts are hierarchical, their descendants). There is no default and no implicit form: an entry without `act`, or with an empty `contexts` list, is malformed and MUST be refused, never read as `all` and never read as `none`. A maintainer that has no contexts (for example a community node that narrows authority with resource qualifiers instead) states `all` or `none` only. Replaces 0.1's `scopes`.";
+                };
+                readonly approve: {
+                    readonly $ref: "#/$defs/AuthorityScope";
+                    readonly description: "OPTIONAL approve scope: where this subject may ratify a change made by someone else (a step-up ratification, a consent decision, an N-of-M approval). Same three shapes as `act`, resolved independently of it. ABSENT MEANS NONE — the subject may ratify nothing — so a consumer that has not implemented the member confers less than the producer intended, never more. A producer SHOULD state `{\"scope\": \"none\"}` explicitly rather than rely on omission. A subject MUST NOT confer approve authority wider than the approve authority it holds itself (see acl/grant `approveWiderThanGranter`). Replaces 0.1's `approve {all, scopes}`.";
+                };
+                readonly capabilities: {
+                    readonly $ref: "#/$defs/CapabilityScope";
+                    readonly description: "REQUIRED explicit capability scope: which capabilities this entry holds. Exactly one of `{\"scope\": \"ceiling\"}` (the role's full ceiling, unnarrowed), `{\"scope\": \"none\"}` (no capabilities), or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityGrant. For `listed`, the EFFECTIVE set is (the role's ceiling ∩ the non-additive grants) ∪ the additive grants; it can only narrow the ceiling, except through an explicit additive grant, which only an unrestricted granter may make. There is no implicit form: an entry without `capabilities`, or with an empty `grants` list, is malformed and MUST be refused. A non-additive grant outside the role's ceiling is refused when written, never accepted with the capability silently dropped; a capability the consumer does not recognise is never treated as granted. Producers SHOULD NOT list the same (capability, resource) pair twice; a consumer MAY refuse a list that does.";
+                };
+                readonly approveCapabilities: {
+                    readonly $ref: "#/$defs/ApproveCapabilityScope";
+                    readonly description: "OPTIONAL explicit approvable-capability scope: which capabilities this subject may APPROVE an action needing — independent of what it may do itself, so an approver can ratify a capability it does not hold (the least-privilege approver). One of `{\"scope\": \"ceiling\"}` (the role's full approve ceiling; at a maintainer whose roles define no capability-level approve ceiling, any action within `approve`), `{\"scope\": \"none\"}`, or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityRef (intersected with the role's approve ceiling where one is defined). ABSENT MEANS NONE: the subject may approve no capability, because absence derives no authority. Bounded by `approve`: where `approve` is absent or `{\"scope\": \"none\"}` this member confers nothing whatever it states. A subject MUST NOT confer approvable capabilities it cannot itself approve.";
+                };
+                readonly delegatedBy: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the granter whose authority this entry was delegated from and is bounded by. The entry MUST NOT hold authority the granter did not hold when it was written, and MUST NOT retain authority the granter has since lost, so a maintainer re-evaluates it when the granter's own entry narrows or is removed. Distinct from `createdBy`, which records who wrote the entry: the two differ where an entry is written on a granter's behalf (for example after an N-of-M approval, or by an offline operator). Set by the maintainer from the granter it authorized; absent on an entry that derives from no granter's authority (the first administrator, an operator-written recovery entry).";
+                };
+                readonly keys: {
+                    readonly $ref: "#/$defs/KeyScope";
+                    readonly description: "REQUIRED explicit key scope: which keys this subject may invoke the maintainer's signing oracle on. Exactly one of `{\"scope\": \"all\"}` (every key the entry's act scope reaches), `{\"scope\": \"none\"}` (no keys), or `{\"scope\": \"listed\", \"keys\": [...]}` with at least one key identifier. INTERSECTS WITH `act` — it can only narrow, never widen: a listed key that lies outside the entry's act scope remains unreachable, exactly as if it were not listed. There is no implicit form: an entry without `keys`, or with an empty `keys` list, is malformed and MUST be refused. A maintainer that operates no signing oracle states `{\"scope\": \"none\"}`. Replaces 0.1's `allowedKeys`, whose absence meant every key.";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "Optional human-readable label. Confers nothing.";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly createdBy: {
+                    readonly type: "string";
+                    readonly description: "VID of the party that originally wrote this entry.";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedBy: {
+                    readonly type: "string";
+                    readonly description: "VID of the party that last modified this entry.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Optional time after which the entry confers no authority. Evaluated at every authorization decision, not only when a session is established.";
+                };
+                readonly stepUp: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly description: "Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry). Carried forward from 0.1 unchanged.";
+                    readonly properties: {
+                        readonly approver: {
+                            readonly type: "string";
+                            readonly description: "VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.";
+                        };
+                        readonly require: {
+                            readonly type: "string";
+                            readonly enum: readonly ["self", "delegated"];
+                            readonly description: "Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).";
+                        };
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces. An extension member MUST NOT be interpreted as conferring authority.";
+                };
+            };
+        };
+        readonly KeyScope: {
+            readonly title: "KeyScope";
+            readonly description: "An explicit key scope. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `listed` with a NON-EMPTY list of key identifiers. The empty list is invalid, not a fourth shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/KeyScopeAll";
+            }, {
+                readonly $ref: "#/$defs/KeyScopeNone";
+            }, {
+                readonly $ref: "#/$defs/KeyScopeListed";
+            }];
+        };
+        readonly KeyScopeListed: {
+            readonly title: "KeyScopeListed";
+            readonly description: "Exactly the listed keys, intersected with the entry's act scope.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "keys"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly keys: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                    };
+                    readonly description: "Non-empty set of key identifiers. An empty array is invalid (it is neither `all` nor `none`).";
+                };
+            };
+        };
+        readonly KeyScopeNone: {
+            readonly title: "KeyScopeNone";
+            readonly description: "No keys.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly KeyScopeAll: {
+            readonly title: "KeyScopeAll";
+            readonly description: "Every key the entry's act scope reaches.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "all";
+                };
+            };
+        };
+        readonly ApproveCapabilityScope: {
+            readonly title: "ApproveCapabilityScope";
+            readonly description: "An explicit statement of the capabilities a subject may approve. Exactly one of `ceiling` (the role's full approve ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityRef.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CapabilityScopeCeiling";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/ApproveCapabilityScopeListed";
+            }];
+        };
+        readonly ApproveCapabilityScopeListed: {
+            readonly title: "ApproveCapabilityScopeListed";
+            readonly description: "Exactly the listed capabilities, intersected with the role's approve ceiling where the maintainer's roles define one.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "grants"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly grants: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityRef";
+                    };
+                    readonly description: "Non-empty list of approvable capabilities. An empty array is invalid.";
+                };
+            };
+        };
+        readonly CapabilityRef: {
+            readonly title: "CapabilityRef";
+            readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+            };
+        };
+        readonly ResourceQualifier: {
+            readonly title: "ResourceQualifier";
+            readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly Capability: {
+            readonly title: "Capability";
+            readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+        };
+        readonly CapabilityScopeNone: {
+            readonly title: "CapabilityScopeNone";
+            readonly description: "No capabilities on this axis.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly CapabilityScopeCeiling: {
+            readonly title: "CapabilityScopeCeiling";
+            readonly description: "The role's full ceiling on this axis, unnarrowed: what the role admits, the entry holds (or, for approvable capabilities, may approve). Stated, not implied — it is the explicit spelling of \"no narrowing\".";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "ceiling";
+                };
+            };
+        };
+        readonly CapabilityScope: {
+            readonly title: "CapabilityScope";
+            readonly description: "An explicit statement of the capabilities an entry holds. Exactly one of three shapes, discriminated by `scope`: `ceiling` (the role's full ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityGrant. The empty list is invalid, not a fourth shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CapabilityScopeCeiling";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeListed";
+            }];
+        };
+        readonly CapabilityScopeListed: {
+            readonly title: "CapabilityScopeListed";
+            readonly description: "Exactly the listed grants: (role ceiling ∩ non-additive grants) ∪ additive grants.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "grants"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly grants: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityGrant";
+                    };
+                    readonly description: "Non-empty list of capability grants. An empty array is invalid (it is neither `ceiling` nor `none`).";
+                };
+            };
+        };
+        readonly CapabilityGrant: {
+            readonly title: "CapabilityGrant";
+            readonly description: "A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+                readonly additive: {
+                    readonly type: "boolean";
+                    readonly description: "`true` declares an ADDITIVE grant: a capability no role implies, granted to this entry beside its role rather than through it, and therefore not intersected with the role's ceiling. Granting one requires unrestricted act authority (`act: {scope: all}`) of the granter, and an entry never acquires one by virtue of its role. Absent or `false` → an ordinary grant, intersected with the role's ceiling, and refused when written if it lies outside it. A consumer MUST refuse `additive: true` on a capability the role's ceiling already includes, so that the flag cannot be used to make an ordinary capability survive a later role change.";
+                };
+            };
+        };
+        readonly AuthorityScope: {
+            readonly title: "AuthorityScope";
+            readonly description: "An explicit authority scope — used for both the act scope and the approve scope of an entry. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `contexts` with a NON-EMPTY list. The empty list is not a fourth shape: it is invalid, so a serializer that drops or empties the list produces a document that fails validation rather than one that silently means something else.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/AuthorityScopeAll";
+            }, {
+                readonly $ref: "#/$defs/AuthorityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/AuthorityScopeContexts";
+            }];
+        };
+        readonly AuthorityScopeContexts: {
+            readonly title: "AuthorityScopeContexts";
+            readonly description: "The named contexts and, where the maintainer's contexts are hierarchical, every descendant of them — and nowhere else. `contexts` MUST carry at least one path.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "contexts"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "contexts";
+                };
+                readonly contexts: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/ContextPath";
+                    };
+                    readonly description: "Non-empty set of context paths. An empty array is invalid (it is neither `all` nor `none`).";
+                };
+            };
+        };
+        readonly ContextPath: {
+            readonly title: "ContextPath";
+            readonly description: "Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly AuthorityScopeNone: {
+            readonly title: "AuthorityScopeNone";
+            readonly description: "No authority on this axis. Stated, not implied: `none` is how an entry says it may not act (a least-privilege approver) or may not approve.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly AuthorityScopeAll: {
+            readonly title: "AuthorityScopeAll";
+            readonly description: "Unrestricted: every context the maintainer holds, present and future. On the act axis this is a super-administrator (or, at a maintainer without contexts, an entry whose authority is not narrowed by location).";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "all";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/acl/update/0.2";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/acl/update/0.2";
+        readonly title: "ACL Update 0.2 — payload";
+        readonly description: "Amend the non-role attributes of an existing AclEntry 0.2: its act scope (widening only), approve scope, capability scope, approvable-capability scope, key scope, label, expiry or step-up requirement. Every member REPLACES the stored value; an omitted member leaves it unchanged. Role changes are NOT expressible here — they go through acl/change-role, which requires the current role as a compare-and-swap. `delegatedBy` and the provenance timestamps are maintainer-populated and not settable.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["subject"];
+        readonly properties: {
+            readonly subject: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "VID of the entry to amend. The entry MUST already exist; this task does not create one (use acl/grant).";
+            };
+            readonly act: {
+                readonly $ref: "#/$defs/AuthorityScope";
+                readonly description: "Replacement act scope, in the same explicit form as the entry's (`all`, `none`, or a non-empty context list). A replacement that WIDENS or equals the stored scope is accepted, subject to the granter bound. NARROWING THE ACT SCOPE IS A REVOCATION and a consumer MUST refuse it here with `narrowingNotPermitted`, directing the caller to acl/revoke, so that every removal of where a subject may act passes through the task that is audited and reasoned as a revocation.";
+            };
+            readonly approve: {
+                readonly $ref: "#/$defs/AuthorityScope";
+                readonly description: "Replacement approve scope. To withdraw approve authority entirely, send `{\"scope\": \"none\"}` — there is no null form, because the explicit value is the only spelling that cannot be misread. Widening is an escalation vector (a subject able to approve can ratify operations it could not authorize) and is bounded by the granter's own approve authority. Narrowing is accepted here and is a privilege reduction (see the specification).";
+            };
+            readonly capabilities: {
+                readonly $ref: "#/$defs/CapabilityScope";
+                readonly description: "Replacement capability scope, applied wholesale, in the same explicit form as the entry's. Omitted leaves it unchanged. `{\"scope\": \"ceiling\"}` returns the entry to its role's full ceiling — a privilege INCREASE, bounded and gated like any widening; `{\"scope\": \"none\"}` removes every capability; `listed` states the exact set. There is no null form. Every listed capability is checked as on a grant (registry, ceiling, additive, granter bound). A replacement that removes a capability the entry held is a privilege reduction.";
+            };
+            readonly approveCapabilities: {
+                readonly $ref: "#/$defs/ApproveCapabilityScope";
+                readonly description: "Replacement approvable-capability scope, applied wholesale. Omitted leaves it unchanged. `{\"scope\": \"ceiling\"}` lets the subject approve its role's full approve ceiling within its approve scope (a privilege increase); `{\"scope\": \"none\"}` withdraws it; `listed` states the exact set. There is no null form. Bounded by the granter's own approve authority.";
+            };
+            readonly keys: {
+                readonly $ref: "#/$defs/KeyScope";
+                readonly description: "Replacement key scope, applied wholesale. Omitted leaves it unchanged. `{\"scope\": \"all\"}` lets the subject reach every key within its act scope again — a privilege increase a consumer SHOULD gate like clearing `expiresAt`; `{\"scope\": \"none\"}` removes every key; `listed` states the exact set. There is no null form. A replacement that narrows the stored key scope IS a privilege reduction: it is accepted here, because acl/revoke/0.2 narrows only the act scope, but the consumer MUST audit it as a reduction and apply it at the subject's next authorization decision.";
+            };
+            readonly label: {
+                readonly type: readonly ["string", "null"];
+                readonly maxLength: 256;
+                readonly description: "Replacement human-readable label. Explicit `null` clears it. Omitted leaves it unchanged.";
+            };
+            readonly expiresAt: {
+                readonly type: readonly ["string", "null"];
+                readonly format: "date-time";
+                readonly description: "Replacement expiry. Explicit `null` makes the entry permanent — a privilege increase, which a consumer SHOULD gate at least as strictly as the original grant, and which is refused where the granter's own entry expires.";
+            };
+            readonly stepUp: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "Replacement per-entry step-up configuration. Same additive-only rule as on the entry itself: it MAY raise the assurance required of this subject above the system floor but MUST NOT lower it.";
+                readonly properties: {
+                    readonly approver: {
+                        readonly type: readonly ["string", "null"];
+                        readonly description: "VID that ratifies step-up for this subject. `null` clears it.";
+                    };
+                    readonly require: {
+                        readonly type: readonly ["string", "null"];
+                        readonly enum: readonly ["self", "delegated", null];
+                        readonly description: "Minimum step-up mode. `null` clears the per-entry override.";
+                    };
+                };
+            };
+            readonly reason: {
+                readonly type: "string";
+                readonly maxLength: 1024;
+                readonly description: "Optional human-readable rationale, recorded with the change.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "ACL Update 0.2 — response payload";
+                readonly description: "The success response to an acl/update/0.2 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/update/0.2#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["entry"];
+                readonly properties: {
+                    readonly entry: {
+                        readonly $ref: "#/$defs/AclEntry";
+                        readonly description: "The realized entry the maintainer now holds, after the amendment.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AclEntry: {
+                readonly title: "AclEntry";
+                readonly description: "One access-control entry: who the grant is for (`subject`), the ceiling it is held under (`role`), where the subject may act (`act`) and approve (`approve`), and which capabilities it may exercise (`capabilities`) and approve (`approveCapabilities`).\n\nThe act axis and the approve axis are independent and a consumer MUST resolve them separately: `act` + `capabilities` (+ `keys`) answer \"may this subject do X\"; `approve` + `approveCapabilities` answer \"may this subject ratify someone else doing X\". Neither implies the other. An entry with `act: {scope: none}` and an approve scope other than none is a least-privilege approver — able to satisfy an approval and unable to initiate any change.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "role", "act", "keys", "capabilities"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.";
+                    };
+                    readonly role: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Opaque role identifier interpreted by the ACL maintainer. A role is a CEILING, never a grant: it bounds the capabilities the entry may hold and never adds to them. A consumer that does not recognise the role MUST treat the entry as conferring no authority and MUST NOT fall back to a default role. Act scope and role are independent members; a consumer MUST NOT compute either from the other.";
+                    };
+                    readonly act: {
+                        readonly $ref: "#/$defs/AuthorityScope";
+                        readonly description: "REQUIRED explicit act scope: where this subject may make a change itself. Exactly one of `{\"scope\": \"all\"}` (unrestricted — every context the maintainer has), `{\"scope\": \"none\"}` (may act nowhere), or `{\"scope\": \"contexts\", \"contexts\": [...]}` with at least one context path (the named contexts and, where the maintainer's contexts are hierarchical, their descendants). There is no default and no implicit form: an entry without `act`, or with an empty `contexts` list, is malformed and MUST be refused, never read as `all` and never read as `none`. A maintainer that has no contexts (for example a community node that narrows authority with resource qualifiers instead) states `all` or `none` only. Replaces 0.1's `scopes`.";
+                    };
+                    readonly approve: {
+                        readonly $ref: "#/$defs/AuthorityScope";
+                        readonly description: "OPTIONAL approve scope: where this subject may ratify a change made by someone else (a step-up ratification, a consent decision, an N-of-M approval). Same three shapes as `act`, resolved independently of it. ABSENT MEANS NONE — the subject may ratify nothing — so a consumer that has not implemented the member confers less than the producer intended, never more. A producer SHOULD state `{\"scope\": \"none\"}` explicitly rather than rely on omission. A subject MUST NOT confer approve authority wider than the approve authority it holds itself (see acl/grant `approveWiderThanGranter`). Replaces 0.1's `approve {all, scopes}`.";
+                    };
+                    readonly capabilities: {
+                        readonly $ref: "#/$defs/CapabilityScope";
+                        readonly description: "REQUIRED explicit capability scope: which capabilities this entry holds. Exactly one of `{\"scope\": \"ceiling\"}` (the role's full ceiling, unnarrowed), `{\"scope\": \"none\"}` (no capabilities), or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityGrant. For `listed`, the EFFECTIVE set is (the role's ceiling ∩ the non-additive grants) ∪ the additive grants; it can only narrow the ceiling, except through an explicit additive grant, which only an unrestricted granter may make. There is no implicit form: an entry without `capabilities`, or with an empty `grants` list, is malformed and MUST be refused. A non-additive grant outside the role's ceiling is refused when written, never accepted with the capability silently dropped; a capability the consumer does not recognise is never treated as granted. Producers SHOULD NOT list the same (capability, resource) pair twice; a consumer MAY refuse a list that does.";
+                    };
+                    readonly approveCapabilities: {
+                        readonly $ref: "#/$defs/ApproveCapabilityScope";
+                        readonly description: "OPTIONAL explicit approvable-capability scope: which capabilities this subject may APPROVE an action needing — independent of what it may do itself, so an approver can ratify a capability it does not hold (the least-privilege approver). One of `{\"scope\": \"ceiling\"}` (the role's full approve ceiling; at a maintainer whose roles define no capability-level approve ceiling, any action within `approve`), `{\"scope\": \"none\"}`, or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityRef (intersected with the role's approve ceiling where one is defined). ABSENT MEANS NONE: the subject may approve no capability, because absence derives no authority. Bounded by `approve`: where `approve` is absent or `{\"scope\": \"none\"}` this member confers nothing whatever it states. A subject MUST NOT confer approvable capabilities it cannot itself approve.";
+                    };
+                    readonly delegatedBy: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the granter whose authority this entry was delegated from and is bounded by. The entry MUST NOT hold authority the granter did not hold when it was written, and MUST NOT retain authority the granter has since lost, so a maintainer re-evaluates it when the granter's own entry narrows or is removed. Distinct from `createdBy`, which records who wrote the entry: the two differ where an entry is written on a granter's behalf (for example after an N-of-M approval, or by an offline operator). Set by the maintainer from the granter it authorized; absent on an entry that derives from no granter's authority (the first administrator, an operator-written recovery entry).";
+                    };
+                    readonly keys: {
+                        readonly $ref: "#/$defs/KeyScope";
+                        readonly description: "REQUIRED explicit key scope: which keys this subject may invoke the maintainer's signing oracle on. Exactly one of `{\"scope\": \"all\"}` (every key the entry's act scope reaches), `{\"scope\": \"none\"}` (no keys), or `{\"scope\": \"listed\", \"keys\": [...]}` with at least one key identifier. INTERSECTS WITH `act` — it can only narrow, never widen: a listed key that lies outside the entry's act scope remains unreachable, exactly as if it were not listed. There is no implicit form: an entry without `keys`, or with an empty `keys` list, is malformed and MUST be refused. A maintainer that operates no signing oracle states `{\"scope\": \"none\"}`. Replaces 0.1's `allowedKeys`, whose absence meant every key.";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "Optional human-readable label. Confers nothing.";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly createdBy: {
+                        readonly type: "string";
+                        readonly description: "VID of the party that originally wrote this entry.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedBy: {
+                        readonly type: "string";
+                        readonly description: "VID of the party that last modified this entry.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Optional time after which the entry confers no authority. Evaluated at every authorization decision, not only when a session is established.";
+                    };
+                    readonly stepUp: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly description: "Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry). Carried forward from 0.1 unchanged.";
+                        readonly properties: {
+                            readonly approver: {
+                                readonly type: "string";
+                                readonly description: "VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.";
+                            };
+                            readonly require: {
+                                readonly type: "string";
+                                readonly enum: readonly ["self", "delegated"];
+                                readonly description: "Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).";
+                            };
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces. An extension member MUST NOT be interpreted as conferring authority.";
+                    };
+                };
+            };
+            readonly KeyScope: {
+                readonly title: "KeyScope";
+                readonly description: "An explicit key scope. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `listed` with a NON-EMPTY list of key identifiers. The empty list is invalid, not a fourth shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/KeyScopeAll";
+                }, {
+                    readonly $ref: "#/$defs/KeyScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/KeyScopeListed";
+                }];
+            };
+            readonly KeyScopeListed: {
+                readonly title: "KeyScopeListed";
+                readonly description: "Exactly the listed keys, intersected with the entry's act scope.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "keys"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly keys: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 512;
+                        };
+                        readonly description: "Non-empty set of key identifiers. An empty array is invalid (it is neither `all` nor `none`).";
+                    };
+                };
+            };
+            readonly KeyScopeNone: {
+                readonly title: "KeyScopeNone";
+                readonly description: "No keys.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly KeyScopeAll: {
+                readonly title: "KeyScopeAll";
+                readonly description: "Every key the entry's act scope reaches.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "all";
+                    };
+                };
+            };
+            readonly ApproveCapabilityScope: {
+                readonly title: "ApproveCapabilityScope";
+                readonly description: "An explicit statement of the capabilities a subject may approve. Exactly one of `ceiling` (the role's full approve ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityRef.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CapabilityScopeCeiling";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/ApproveCapabilityScopeListed";
+                }];
+            };
+            readonly ApproveCapabilityScopeListed: {
+                readonly title: "ApproveCapabilityScopeListed";
+                readonly description: "Exactly the listed capabilities, intersected with the role's approve ceiling where the maintainer's roles define one.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "grants"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly grants: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityRef";
+                        };
+                        readonly description: "Non-empty list of approvable capabilities. An empty array is invalid.";
+                    };
+                };
+            };
+            readonly CapabilityRef: {
+                readonly title: "CapabilityRef";
+                readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                };
+            };
+            readonly ResourceQualifier: {
+                readonly title: "ResourceQualifier";
+                readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly Capability: {
+                readonly title: "Capability";
+                readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+            };
+            readonly CapabilityScopeNone: {
+                readonly title: "CapabilityScopeNone";
+                readonly description: "No capabilities on this axis.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly CapabilityScopeCeiling: {
+                readonly title: "CapabilityScopeCeiling";
+                readonly description: "The role's full ceiling on this axis, unnarrowed: what the role admits, the entry holds (or, for approvable capabilities, may approve). Stated, not implied — it is the explicit spelling of \"no narrowing\".";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "ceiling";
+                    };
+                };
+            };
+            readonly CapabilityScope: {
+                readonly title: "CapabilityScope";
+                readonly description: "An explicit statement of the capabilities an entry holds. Exactly one of three shapes, discriminated by `scope`: `ceiling` (the role's full ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityGrant. The empty list is invalid, not a fourth shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CapabilityScopeCeiling";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeListed";
+                }];
+            };
+            readonly CapabilityScopeListed: {
+                readonly title: "CapabilityScopeListed";
+                readonly description: "Exactly the listed grants: (role ceiling ∩ non-additive grants) ∪ additive grants.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "grants"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly grants: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityGrant";
+                        };
+                        readonly description: "Non-empty list of capability grants. An empty array is invalid (it is neither `ceiling` nor `none`).";
+                    };
+                };
+            };
+            readonly CapabilityGrant: {
+                readonly title: "CapabilityGrant";
+                readonly description: "A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                    readonly additive: {
+                        readonly type: "boolean";
+                        readonly description: "`true` declares an ADDITIVE grant: a capability no role implies, granted to this entry beside its role rather than through it, and therefore not intersected with the role's ceiling. Granting one requires unrestricted act authority (`act: {scope: all}`) of the granter, and an entry never acquires one by virtue of its role. Absent or `false` → an ordinary grant, intersected with the role's ceiling, and refused when written if it lies outside it. A consumer MUST refuse `additive: true` on a capability the role's ceiling already includes, so that the flag cannot be used to make an ordinary capability survive a later role change.";
+                    };
+                };
+            };
+            readonly AuthorityScope: {
+                readonly title: "AuthorityScope";
+                readonly description: "An explicit authority scope — used for both the act scope and the approve scope of an entry. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `contexts` with a NON-EMPTY list. The empty list is not a fourth shape: it is invalid, so a serializer that drops or empties the list produces a document that fails validation rather than one that silently means something else.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/AuthorityScopeAll";
+                }, {
+                    readonly $ref: "#/$defs/AuthorityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/AuthorityScopeContexts";
+                }];
+            };
+            readonly AuthorityScopeContexts: {
+                readonly title: "AuthorityScopeContexts";
+                readonly description: "The named contexts and, where the maintainer's contexts are hierarchical, every descendant of them — and nowhere else. `contexts` MUST carry at least one path.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "contexts"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "contexts";
+                    };
+                    readonly contexts: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/ContextPath";
+                        };
+                        readonly description: "Non-empty set of context paths. An empty array is invalid (it is neither `all` nor `none`).";
+                    };
+                };
+            };
+            readonly ContextPath: {
+                readonly title: "ContextPath";
+                readonly description: "Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly AuthorityScopeNone: {
+                readonly title: "AuthorityScopeNone";
+                readonly description: "No authority on this axis. Stated, not implied: `none` is how an entry says it may not act (a least-privilege approver) or may not approve.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly AuthorityScopeAll: {
+                readonly title: "AuthorityScopeAll";
+                readonly description: "Unrestricted: every context the maintainer holds, present and future. On the act axis this is a super-administrator (or, at a maintainer without contexts, an entry whose authority is not narrowed by location).";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "all";
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/acl/update/0.2#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "ACL Update 0.2 — response payload";
+                readonly description: "The success response to an acl/update/0.2 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/acl/update/0.2#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["entry"];
+                readonly properties: {
+                    readonly entry: {
+                        readonly $ref: "#/$defs/AclEntry";
+                        readonly description: "The realized entry the maintainer now holds, after the amendment.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AclEntry: {
+                readonly title: "AclEntry";
+                readonly description: "One access-control entry: who the grant is for (`subject`), the ceiling it is held under (`role`), where the subject may act (`act`) and approve (`approve`), and which capabilities it may exercise (`capabilities`) and approve (`approveCapabilities`).\n\nThe act axis and the approve axis are independent and a consumer MUST resolve them separately: `act` + `capabilities` (+ `keys`) answer \"may this subject do X\"; `approve` + `approveCapabilities` answer \"may this subject ratify someone else doing X\". Neither implies the other. An entry with `act: {scope: none}` and an approve scope other than none is a least-privilege approver — able to satisfy an approval and unable to initiate any change.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "role", "act", "keys", "capabilities"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.";
+                    };
+                    readonly role: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Opaque role identifier interpreted by the ACL maintainer. A role is a CEILING, never a grant: it bounds the capabilities the entry may hold and never adds to them. A consumer that does not recognise the role MUST treat the entry as conferring no authority and MUST NOT fall back to a default role. Act scope and role are independent members; a consumer MUST NOT compute either from the other.";
+                    };
+                    readonly act: {
+                        readonly $ref: "#/$defs/AuthorityScope";
+                        readonly description: "REQUIRED explicit act scope: where this subject may make a change itself. Exactly one of `{\"scope\": \"all\"}` (unrestricted — every context the maintainer has), `{\"scope\": \"none\"}` (may act nowhere), or `{\"scope\": \"contexts\", \"contexts\": [...]}` with at least one context path (the named contexts and, where the maintainer's contexts are hierarchical, their descendants). There is no default and no implicit form: an entry without `act`, or with an empty `contexts` list, is malformed and MUST be refused, never read as `all` and never read as `none`. A maintainer that has no contexts (for example a community node that narrows authority with resource qualifiers instead) states `all` or `none` only. Replaces 0.1's `scopes`.";
+                    };
+                    readonly approve: {
+                        readonly $ref: "#/$defs/AuthorityScope";
+                        readonly description: "OPTIONAL approve scope: where this subject may ratify a change made by someone else (a step-up ratification, a consent decision, an N-of-M approval). Same three shapes as `act`, resolved independently of it. ABSENT MEANS NONE — the subject may ratify nothing — so a consumer that has not implemented the member confers less than the producer intended, never more. A producer SHOULD state `{\"scope\": \"none\"}` explicitly rather than rely on omission. A subject MUST NOT confer approve authority wider than the approve authority it holds itself (see acl/grant `approveWiderThanGranter`). Replaces 0.1's `approve {all, scopes}`.";
+                    };
+                    readonly capabilities: {
+                        readonly $ref: "#/$defs/CapabilityScope";
+                        readonly description: "REQUIRED explicit capability scope: which capabilities this entry holds. Exactly one of `{\"scope\": \"ceiling\"}` (the role's full ceiling, unnarrowed), `{\"scope\": \"none\"}` (no capabilities), or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityGrant. For `listed`, the EFFECTIVE set is (the role's ceiling ∩ the non-additive grants) ∪ the additive grants; it can only narrow the ceiling, except through an explicit additive grant, which only an unrestricted granter may make. There is no implicit form: an entry without `capabilities`, or with an empty `grants` list, is malformed and MUST be refused. A non-additive grant outside the role's ceiling is refused when written, never accepted with the capability silently dropped; a capability the consumer does not recognise is never treated as granted. Producers SHOULD NOT list the same (capability, resource) pair twice; a consumer MAY refuse a list that does.";
+                    };
+                    readonly approveCapabilities: {
+                        readonly $ref: "#/$defs/ApproveCapabilityScope";
+                        readonly description: "OPTIONAL explicit approvable-capability scope: which capabilities this subject may APPROVE an action needing — independent of what it may do itself, so an approver can ratify a capability it does not hold (the least-privilege approver). One of `{\"scope\": \"ceiling\"}` (the role's full approve ceiling; at a maintainer whose roles define no capability-level approve ceiling, any action within `approve`), `{\"scope\": \"none\"}`, or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityRef (intersected with the role's approve ceiling where one is defined). ABSENT MEANS NONE: the subject may approve no capability, because absence derives no authority. Bounded by `approve`: where `approve` is absent or `{\"scope\": \"none\"}` this member confers nothing whatever it states. A subject MUST NOT confer approvable capabilities it cannot itself approve.";
+                    };
+                    readonly delegatedBy: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the granter whose authority this entry was delegated from and is bounded by. The entry MUST NOT hold authority the granter did not hold when it was written, and MUST NOT retain authority the granter has since lost, so a maintainer re-evaluates it when the granter's own entry narrows or is removed. Distinct from `createdBy`, which records who wrote the entry: the two differ where an entry is written on a granter's behalf (for example after an N-of-M approval, or by an offline operator). Set by the maintainer from the granter it authorized; absent on an entry that derives from no granter's authority (the first administrator, an operator-written recovery entry).";
+                    };
+                    readonly keys: {
+                        readonly $ref: "#/$defs/KeyScope";
+                        readonly description: "REQUIRED explicit key scope: which keys this subject may invoke the maintainer's signing oracle on. Exactly one of `{\"scope\": \"all\"}` (every key the entry's act scope reaches), `{\"scope\": \"none\"}` (no keys), or `{\"scope\": \"listed\", \"keys\": [...]}` with at least one key identifier. INTERSECTS WITH `act` — it can only narrow, never widen: a listed key that lies outside the entry's act scope remains unreachable, exactly as if it were not listed. There is no implicit form: an entry without `keys`, or with an empty `keys` list, is malformed and MUST be refused. A maintainer that operates no signing oracle states `{\"scope\": \"none\"}`. Replaces 0.1's `allowedKeys`, whose absence meant every key.";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "Optional human-readable label. Confers nothing.";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly createdBy: {
+                        readonly type: "string";
+                        readonly description: "VID of the party that originally wrote this entry.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedBy: {
+                        readonly type: "string";
+                        readonly description: "VID of the party that last modified this entry.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Optional time after which the entry confers no authority. Evaluated at every authorization decision, not only when a session is established.";
+                    };
+                    readonly stepUp: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly description: "Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry). Carried forward from 0.1 unchanged.";
+                        readonly properties: {
+                            readonly approver: {
+                                readonly type: "string";
+                                readonly description: "VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.";
+                            };
+                            readonly require: {
+                                readonly type: "string";
+                                readonly enum: readonly ["self", "delegated"];
+                                readonly description: "Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).";
+                            };
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces. An extension member MUST NOT be interpreted as conferring authority.";
+                    };
+                };
+            };
+            readonly KeyScope: {
+                readonly title: "KeyScope";
+                readonly description: "An explicit key scope. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `listed` with a NON-EMPTY list of key identifiers. The empty list is invalid, not a fourth shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/KeyScopeAll";
+                }, {
+                    readonly $ref: "#/$defs/KeyScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/KeyScopeListed";
+                }];
+            };
+            readonly KeyScopeListed: {
+                readonly title: "KeyScopeListed";
+                readonly description: "Exactly the listed keys, intersected with the entry's act scope.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "keys"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly keys: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 512;
+                        };
+                        readonly description: "Non-empty set of key identifiers. An empty array is invalid (it is neither `all` nor `none`).";
+                    };
+                };
+            };
+            readonly KeyScopeNone: {
+                readonly title: "KeyScopeNone";
+                readonly description: "No keys.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly KeyScopeAll: {
+                readonly title: "KeyScopeAll";
+                readonly description: "Every key the entry's act scope reaches.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "all";
+                    };
+                };
+            };
+            readonly ApproveCapabilityScope: {
+                readonly title: "ApproveCapabilityScope";
+                readonly description: "An explicit statement of the capabilities a subject may approve. Exactly one of `ceiling` (the role's full approve ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityRef.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CapabilityScopeCeiling";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/ApproveCapabilityScopeListed";
+                }];
+            };
+            readonly ApproveCapabilityScopeListed: {
+                readonly title: "ApproveCapabilityScopeListed";
+                readonly description: "Exactly the listed capabilities, intersected with the role's approve ceiling where the maintainer's roles define one.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "grants"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly grants: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityRef";
+                        };
+                        readonly description: "Non-empty list of approvable capabilities. An empty array is invalid.";
+                    };
+                };
+            };
+            readonly CapabilityRef: {
+                readonly title: "CapabilityRef";
+                readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                };
+            };
+            readonly ResourceQualifier: {
+                readonly title: "ResourceQualifier";
+                readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly Capability: {
+                readonly title: "Capability";
+                readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+            };
+            readonly CapabilityScopeNone: {
+                readonly title: "CapabilityScopeNone";
+                readonly description: "No capabilities on this axis.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly CapabilityScopeCeiling: {
+                readonly title: "CapabilityScopeCeiling";
+                readonly description: "The role's full ceiling on this axis, unnarrowed: what the role admits, the entry holds (or, for approvable capabilities, may approve). Stated, not implied — it is the explicit spelling of \"no narrowing\".";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "ceiling";
+                    };
+                };
+            };
+            readonly CapabilityScope: {
+                readonly title: "CapabilityScope";
+                readonly description: "An explicit statement of the capabilities an entry holds. Exactly one of three shapes, discriminated by `scope`: `ceiling` (the role's full ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityGrant. The empty list is invalid, not a fourth shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CapabilityScopeCeiling";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeListed";
+                }];
+            };
+            readonly CapabilityScopeListed: {
+                readonly title: "CapabilityScopeListed";
+                readonly description: "Exactly the listed grants: (role ceiling ∩ non-additive grants) ∪ additive grants.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "grants"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly grants: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityGrant";
+                        };
+                        readonly description: "Non-empty list of capability grants. An empty array is invalid (it is neither `ceiling` nor `none`).";
+                    };
+                };
+            };
+            readonly CapabilityGrant: {
+                readonly title: "CapabilityGrant";
+                readonly description: "A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                    readonly additive: {
+                        readonly type: "boolean";
+                        readonly description: "`true` declares an ADDITIVE grant: a capability no role implies, granted to this entry beside its role rather than through it, and therefore not intersected with the role's ceiling. Granting one requires unrestricted act authority (`act: {scope: all}`) of the granter, and an entry never acquires one by virtue of its role. Absent or `false` → an ordinary grant, intersected with the role's ceiling, and refused when written if it lies outside it. A consumer MUST refuse `additive: true` on a capability the role's ceiling already includes, so that the flag cannot be used to make an ordinary capability survive a later role change.";
+                    };
+                };
+            };
+            readonly AuthorityScope: {
+                readonly title: "AuthorityScope";
+                readonly description: "An explicit authority scope — used for both the act scope and the approve scope of an entry. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `contexts` with a NON-EMPTY list. The empty list is not a fourth shape: it is invalid, so a serializer that drops or empties the list produces a document that fails validation rather than one that silently means something else.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/AuthorityScopeAll";
+                }, {
+                    readonly $ref: "#/$defs/AuthorityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/AuthorityScopeContexts";
+                }];
+            };
+            readonly AuthorityScopeContexts: {
+                readonly title: "AuthorityScopeContexts";
+                readonly description: "The named contexts and, where the maintainer's contexts are hierarchical, every descendant of them — and nowhere else. `contexts` MUST carry at least one path.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "contexts"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "contexts";
+                    };
+                    readonly contexts: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/ContextPath";
+                        };
+                        readonly description: "Non-empty set of context paths. An empty array is invalid (it is neither `all` nor `none`).";
+                    };
+                };
+            };
+            readonly ContextPath: {
+                readonly title: "ContextPath";
+                readonly description: "Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly AuthorityScopeNone: {
+                readonly title: "AuthorityScopeNone";
+                readonly description: "No authority on this axis. Stated, not implied: `none` is how an entry says it may not act (a least-privilege approver) or may not approve.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly AuthorityScopeAll: {
+                readonly title: "AuthorityScopeAll";
+                readonly description: "Unrestricted: every context the maintainer holds, present and future. On the act axis this is a super-administrator (or, at a maintainer without contexts, an entry whose authority is not narrowed by location).";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "all";
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map