@openvtc/trust-tasks 0.22.5 → 0.22.7

package/dist/vtc/roles/show/0.1/payload.d.ts

@@ -0,0 +1,651 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/roles/show/0.1/payload.schema.json
+ */
+import type { Capability_AclV0_2 as Capability, CapabilityRef, Ext, ResourceQualifier, RoleDefinition, RoleName } from "../../../../_shared/components.js";
+/**
+ * Fetch one administrative role of a VTC by name. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface VTCRolesShowPayload {
+    /**
+     * Name of the role, built-in or custom.
+     */
+    name: RoleName;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * The success response to a vtc/roles/show/0.1 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vtc/roles/show/0.1#response.
+ */
+export interface VTCRolesShowResponsePayload {
+    /**
+     * The role record.
+     */
+    role: RoleDefinition;
+    /**
+     * Optional: the number of ACL entries currently holding this role. A count, never a list of subjects. A VTC MAY omit it where the querying party may not learn it.
+     */
+    holders?: number;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Capability, CapabilityRef, Ext, ResourceQualifier, RoleDefinition, RoleName };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vtc/roles/show/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCRolesShowPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vtc/roles/show/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCRolesShowResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/vtc/roles/show/0.1";
+    readonly title: "VTC Roles — Show — payload";
+    readonly description: "Fetch one administrative role of a VTC by name. The outer document members are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["name"];
+    readonly properties: {
+        readonly name: {
+            readonly $ref: "#/$defs/RoleName";
+            readonly description: "Name of the role, built-in or custom.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTC Roles — Show — response payload";
+            readonly description: "The success response to a vtc/roles/show/0.1 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vtc/roles/show/0.1#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["role"];
+            readonly properties: {
+                readonly role: {
+                    readonly $ref: "#/$defs/RoleDefinition";
+                    readonly description: "The role record.";
+                };
+                readonly holders: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Optional: the number of ACL entries currently holding this role. A count, never a list of subjects. A VTC MAY omit it where the querying party may not learn it.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RoleDefinition: {
+            readonly title: "RoleDefinition";
+            readonly description: "One administrative role of a VTC: a name, the CEILING of capabilities an entry holding the role may hold, and the approve ceiling of capabilities it may approve.\n\nA ROLE IS A CEILING, NOT A GRANT. It states the most an entry with this role could be allowed; the entry's own `capabilities` say what it does hold, and may be narrower. An entry's effective capabilities are this whole `ceiling` where the entry states `capabilities: {scope: ceiling}`, nothing where it states `none`, and this `ceiling` ∩ its listed grants (plus any additive grant) where it states `listed`. Holding the role confers nothing an entry has not been granted. Likewise `approveScope` bounds what an entry may approve: the entry's `approveCapabilities` select from it (`ceiling` = all of it, `listed` = an intersection, absent or `none` = nothing), and the entry's `approve` scope must not be none for any of it to apply.\n\nNO WILDCARDS. A ceiling lists its capabilities explicitly, even where it is meant to be \"everything\"; a role whose ceiling is empty holds no capability, and one whose approve ceiling is empty approves none. Built-in roles whose intent is the whole registry enumerate it, and their records grow when the registry grows — by release, never by policy.\n\nBUILT-IN ROLES (`builtIn: true`) are fixed by the VTC implementation and MUST NOT be changed or deleted through vtc/roles/define or vtc/roles/delete. The built-in set, with the ceilings a VTC is expected to ship (descriptive; the authoritative ceiling is the record the VTC returns):\n- `community-admin` — ceiling: every `vtc.*` capability and `git.ns.admin` unqualified; approve ceiling: every capability. With its full ceiling it is the community's unrestricted administrator.\n- `moderator` — ceiling: `vtc.members.manage`, `vtc.join.decide`, `vtc.invitations.manage`; approve ceiling: the same.\n- `vetting-lead` — ceiling: `vtc.vetting.manage` (an entry may qualify it by criterion); approve ceiling: `vtc.vetting.manage`, so vetting leads approve vetter grants and other vetting leads at their qualifier.\n- `repo-manager` — ceiling: `git.repo.manage` and `git.ns.admin` (held qualified by namespace or repository); approve ceiling: the same, at the same qualifier.\n- `credential-officer` — ceiling: `vtc.credentials.issue`, `vtc.credentials.revoke`; approve ceiling: the same.\n- `auditor` — ceiling: `vtc.audit.read`; approve ceiling: none.\n- `approver` — ceiling: none (an entry holding it states `act: {scope: none}`); approve ceiling: every capability, narrowed by the entry's `approveCapabilities` — the least-privilege approver.\n\nCUSTOM ROLES (`builtIn: false`) are created, changed and deleted by a community through vtc/roles/define and vtc/roles/delete. A VTC implementing this family takes those changes only through an N-of-M approval among its administrators, never through policy (Rego or otherwise) — authority-defining records are host-enforced, and policy may only refuse. That is a description of the VTC's model, not a requirement this schema can carry. An entry holds at most one administrative role; a combination (repo manager AND vetting lead) is expressed as a custom role.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["name", "builtIn", "ceiling", "approveScope"];
+            readonly properties: {
+                readonly name: {
+                    readonly $ref: "#/$defs/RoleName";
+                };
+                readonly builtIn: {
+                    readonly type: "boolean";
+                    readonly description: "`true` for a role fixed by the VTC implementation, which cannot be changed or deleted; `false` for a community-defined custom role.";
+                };
+                readonly description: {
+                    readonly type: "string";
+                    readonly maxLength: 512;
+                    readonly description: "Optional human-readable description. Confers nothing.";
+                };
+                readonly ceiling: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityRef";
+                    };
+                    readonly description: "The capabilities an entry holding this role MAY hold, each optionally qualified by a resource. An entry may hold a capability at a qualifier inside the ceiling's (a ceiling of `git.repo.manage` unqualified admits `git.repo.manage @ git-ns:github.com/acme`), never outside it. EMPTY means the role admits no capability. A capability the VTC classes as additive never appears in a ceiling — an additive capability is by definition one no role implies.";
+                };
+                readonly approveScope: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityRef";
+                    };
+                    readonly description: "The capabilities an entry holding this role MAY approve an action needing — the role's approve ceiling, independent of `ceiling`. An entry approves all of it with `approveCapabilities: {scope: ceiling}`, an intersection with `listed`, and nothing when `approveCapabilities` is absent or `none`; the entry's `approve` scope must be other than none for any of it to apply. EMPTY means the role approves nothing.";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly createdBy: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "VID of the administrator whose request created the role (for a custom role created by approval, the requester). Absent on a built-in role.";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedBy: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "VID of the administrator whose request last replaced the role. Absent on a built-in role and on a custom role never replaced.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. An extension member MUST NOT be interpreted as widening a ceiling.";
+                };
+            };
+        };
+        readonly RoleName: {
+            readonly title: "RoleName";
+            readonly description: "A role identifier: lowercase, hyphen-separated, at most 64 characters. Compared by exact string equality. It is the value an AclEntry 0.2 carries in `role`.";
+            readonly type: "string";
+            readonly pattern: "^[a-z][a-z0-9-]{0,63}$";
+        };
+        readonly CapabilityRef: {
+            readonly title: "CapabilityRef";
+            readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+            };
+        };
+        readonly ResourceQualifier: {
+            readonly title: "ResourceQualifier";
+            readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly Capability: {
+            readonly title: "Capability";
+            readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTC Roles — Show — response payload";
+            readonly description: "The success response to a vtc/roles/show/0.1 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vtc/roles/show/0.1#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["role"];
+            readonly properties: {
+                readonly role: {
+                    readonly $ref: "#/$defs/RoleDefinition";
+                    readonly description: "The role record.";
+                };
+                readonly holders: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Optional: the number of ACL entries currently holding this role. A count, never a list of subjects. A VTC MAY omit it where the querying party may not learn it.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly RoleDefinition: {
+            readonly title: "RoleDefinition";
+            readonly description: "One administrative role of a VTC: a name, the CEILING of capabilities an entry holding the role may hold, and the approve ceiling of capabilities it may approve.\n\nA ROLE IS A CEILING, NOT A GRANT. It states the most an entry with this role could be allowed; the entry's own `capabilities` say what it does hold, and may be narrower. An entry's effective capabilities are this whole `ceiling` where the entry states `capabilities: {scope: ceiling}`, nothing where it states `none`, and this `ceiling` ∩ its listed grants (plus any additive grant) where it states `listed`. Holding the role confers nothing an entry has not been granted. Likewise `approveScope` bounds what an entry may approve: the entry's `approveCapabilities` select from it (`ceiling` = all of it, `listed` = an intersection, absent or `none` = nothing), and the entry's `approve` scope must not be none for any of it to apply.\n\nNO WILDCARDS. A ceiling lists its capabilities explicitly, even where it is meant to be \"everything\"; a role whose ceiling is empty holds no capability, and one whose approve ceiling is empty approves none. Built-in roles whose intent is the whole registry enumerate it, and their records grow when the registry grows — by release, never by policy.\n\nBUILT-IN ROLES (`builtIn: true`) are fixed by the VTC implementation and MUST NOT be changed or deleted through vtc/roles/define or vtc/roles/delete. The built-in set, with the ceilings a VTC is expected to ship (descriptive; the authoritative ceiling is the record the VTC returns):\n- `community-admin` — ceiling: every `vtc.*` capability and `git.ns.admin` unqualified; approve ceiling: every capability. With its full ceiling it is the community's unrestricted administrator.\n- `moderator` — ceiling: `vtc.members.manage`, `vtc.join.decide`, `vtc.invitations.manage`; approve ceiling: the same.\n- `vetting-lead` — ceiling: `vtc.vetting.manage` (an entry may qualify it by criterion); approve ceiling: `vtc.vetting.manage`, so vetting leads approve vetter grants and other vetting leads at their qualifier.\n- `repo-manager` — ceiling: `git.repo.manage` and `git.ns.admin` (held qualified by namespace or repository); approve ceiling: the same, at the same qualifier.\n- `credential-officer` — ceiling: `vtc.credentials.issue`, `vtc.credentials.revoke`; approve ceiling: the same.\n- `auditor` — ceiling: `vtc.audit.read`; approve ceiling: none.\n- `approver` — ceiling: none (an entry holding it states `act: {scope: none}`); approve ceiling: every capability, narrowed by the entry's `approveCapabilities` — the least-privilege approver.\n\nCUSTOM ROLES (`builtIn: false`) are created, changed and deleted by a community through vtc/roles/define and vtc/roles/delete. A VTC implementing this family takes those changes only through an N-of-M approval among its administrators, never through policy (Rego or otherwise) — authority-defining records are host-enforced, and policy may only refuse. That is a description of the VTC's model, not a requirement this schema can carry. An entry holds at most one administrative role; a combination (repo manager AND vetting lead) is expressed as a custom role.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["name", "builtIn", "ceiling", "approveScope"];
+            readonly properties: {
+                readonly name: {
+                    readonly $ref: "#/$defs/RoleName";
+                };
+                readonly builtIn: {
+                    readonly type: "boolean";
+                    readonly description: "`true` for a role fixed by the VTC implementation, which cannot be changed or deleted; `false` for a community-defined custom role.";
+                };
+                readonly description: {
+                    readonly type: "string";
+                    readonly maxLength: 512;
+                    readonly description: "Optional human-readable description. Confers nothing.";
+                };
+                readonly ceiling: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityRef";
+                    };
+                    readonly description: "The capabilities an entry holding this role MAY hold, each optionally qualified by a resource. An entry may hold a capability at a qualifier inside the ceiling's (a ceiling of `git.repo.manage` unqualified admits `git.repo.manage @ git-ns:github.com/acme`), never outside it. EMPTY means the role admits no capability. A capability the VTC classes as additive never appears in a ceiling — an additive capability is by definition one no role implies.";
+                };
+                readonly approveScope: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityRef";
+                    };
+                    readonly description: "The capabilities an entry holding this role MAY approve an action needing — the role's approve ceiling, independent of `ceiling`. An entry approves all of it with `approveCapabilities: {scope: ceiling}`, an intersection with `listed`, and nothing when `approveCapabilities` is absent or `none`; the entry's `approve` scope must be other than none for any of it to apply. EMPTY means the role approves nothing.";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly createdBy: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "VID of the administrator whose request created the role (for a custom role created by approval, the requester). Absent on a built-in role.";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedBy: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 2048;
+                    readonly description: "VID of the administrator whose request last replaced the role. Absent on a built-in role and on a custom role never replaced.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. An extension member MUST NOT be interpreted as widening a ceiling.";
+                };
+            };
+        };
+        readonly RoleName: {
+            readonly title: "RoleName";
+            readonly description: "A role identifier: lowercase, hyphen-separated, at most 64 characters. Compared by exact string equality. It is the value an AclEntry 0.2 carries in `role`.";
+            readonly type: "string";
+            readonly pattern: "^[a-z][a-z0-9-]{0,63}$";
+        };
+        readonly CapabilityRef: {
+            readonly title: "CapabilityRef";
+            readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+            };
+        };
+        readonly ResourceQualifier: {
+            readonly title: "ResourceQualifier";
+            readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly Capability: {
+            readonly title: "Capability";
+            readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/roles/show/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/vtc/roles/show/0.1";
+        readonly title: "VTC Roles — Show — payload";
+        readonly description: "Fetch one administrative role of a VTC by name. The outer document members are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["name"];
+        readonly properties: {
+            readonly name: {
+                readonly $ref: "#/$defs/RoleName";
+                readonly description: "Name of the role, built-in or custom.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTC Roles — Show — response payload";
+                readonly description: "The success response to a vtc/roles/show/0.1 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vtc/roles/show/0.1#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["role"];
+                readonly properties: {
+                    readonly role: {
+                        readonly $ref: "#/$defs/RoleDefinition";
+                        readonly description: "The role record.";
+                    };
+                    readonly holders: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Optional: the number of ACL entries currently holding this role. A count, never a list of subjects. A VTC MAY omit it where the querying party may not learn it.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RoleDefinition: {
+                readonly title: "RoleDefinition";
+                readonly description: "One administrative role of a VTC: a name, the CEILING of capabilities an entry holding the role may hold, and the approve ceiling of capabilities it may approve.\n\nA ROLE IS A CEILING, NOT A GRANT. It states the most an entry with this role could be allowed; the entry's own `capabilities` say what it does hold, and may be narrower. An entry's effective capabilities are this whole `ceiling` where the entry states `capabilities: {scope: ceiling}`, nothing where it states `none`, and this `ceiling` ∩ its listed grants (plus any additive grant) where it states `listed`. Holding the role confers nothing an entry has not been granted. Likewise `approveScope` bounds what an entry may approve: the entry's `approveCapabilities` select from it (`ceiling` = all of it, `listed` = an intersection, absent or `none` = nothing), and the entry's `approve` scope must not be none for any of it to apply.\n\nNO WILDCARDS. A ceiling lists its capabilities explicitly, even where it is meant to be \"everything\"; a role whose ceiling is empty holds no capability, and one whose approve ceiling is empty approves none. Built-in roles whose intent is the whole registry enumerate it, and their records grow when the registry grows — by release, never by policy.\n\nBUILT-IN ROLES (`builtIn: true`) are fixed by the VTC implementation and MUST NOT be changed or deleted through vtc/roles/define or vtc/roles/delete. The built-in set, with the ceilings a VTC is expected to ship (descriptive; the authoritative ceiling is the record the VTC returns):\n- `community-admin` — ceiling: every `vtc.*` capability and `git.ns.admin` unqualified; approve ceiling: every capability. With its full ceiling it is the community's unrestricted administrator.\n- `moderator` — ceiling: `vtc.members.manage`, `vtc.join.decide`, `vtc.invitations.manage`; approve ceiling: the same.\n- `vetting-lead` — ceiling: `vtc.vetting.manage` (an entry may qualify it by criterion); approve ceiling: `vtc.vetting.manage`, so vetting leads approve vetter grants and other vetting leads at their qualifier.\n- `repo-manager` — ceiling: `git.repo.manage` and `git.ns.admin` (held qualified by namespace or repository); approve ceiling: the same, at the same qualifier.\n- `credential-officer` — ceiling: `vtc.credentials.issue`, `vtc.credentials.revoke`; approve ceiling: the same.\n- `auditor` — ceiling: `vtc.audit.read`; approve ceiling: none.\n- `approver` — ceiling: none (an entry holding it states `act: {scope: none}`); approve ceiling: every capability, narrowed by the entry's `approveCapabilities` — the least-privilege approver.\n\nCUSTOM ROLES (`builtIn: false`) are created, changed and deleted by a community through vtc/roles/define and vtc/roles/delete. A VTC implementing this family takes those changes only through an N-of-M approval among its administrators, never through policy (Rego or otherwise) — authority-defining records are host-enforced, and policy may only refuse. That is a description of the VTC's model, not a requirement this schema can carry. An entry holds at most one administrative role; a combination (repo manager AND vetting lead) is expressed as a custom role.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["name", "builtIn", "ceiling", "approveScope"];
+                readonly properties: {
+                    readonly name: {
+                        readonly $ref: "#/$defs/RoleName";
+                    };
+                    readonly builtIn: {
+                        readonly type: "boolean";
+                        readonly description: "`true` for a role fixed by the VTC implementation, which cannot be changed or deleted; `false` for a community-defined custom role.";
+                    };
+                    readonly description: {
+                        readonly type: "string";
+                        readonly maxLength: 512;
+                        readonly description: "Optional human-readable description. Confers nothing.";
+                    };
+                    readonly ceiling: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityRef";
+                        };
+                        readonly description: "The capabilities an entry holding this role MAY hold, each optionally qualified by a resource. An entry may hold a capability at a qualifier inside the ceiling's (a ceiling of `git.repo.manage` unqualified admits `git.repo.manage @ git-ns:github.com/acme`), never outside it. EMPTY means the role admits no capability. A capability the VTC classes as additive never appears in a ceiling — an additive capability is by definition one no role implies.";
+                    };
+                    readonly approveScope: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityRef";
+                        };
+                        readonly description: "The capabilities an entry holding this role MAY approve an action needing — the role's approve ceiling, independent of `ceiling`. An entry approves all of it with `approveCapabilities: {scope: ceiling}`, an intersection with `listed`, and nothing when `approveCapabilities` is absent or `none`; the entry's `approve` scope must be other than none for any of it to apply. EMPTY means the role approves nothing.";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly createdBy: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "VID of the administrator whose request created the role (for a custom role created by approval, the requester). Absent on a built-in role.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedBy: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "VID of the administrator whose request last replaced the role. Absent on a built-in role and on a custom role never replaced.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. An extension member MUST NOT be interpreted as widening a ceiling.";
+                    };
+                };
+            };
+            readonly RoleName: {
+                readonly title: "RoleName";
+                readonly description: "A role identifier: lowercase, hyphen-separated, at most 64 characters. Compared by exact string equality. It is the value an AclEntry 0.2 carries in `role`.";
+                readonly type: "string";
+                readonly pattern: "^[a-z][a-z0-9-]{0,63}$";
+            };
+            readonly CapabilityRef: {
+                readonly title: "CapabilityRef";
+                readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                };
+            };
+            readonly ResourceQualifier: {
+                readonly title: "ResourceQualifier";
+                readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly Capability: {
+                readonly title: "Capability";
+                readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/roles/show/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTC Roles — Show — response payload";
+                readonly description: "The success response to a vtc/roles/show/0.1 request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/vtc/roles/show/0.1#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["role"];
+                readonly properties: {
+                    readonly role: {
+                        readonly $ref: "#/$defs/RoleDefinition";
+                        readonly description: "The role record.";
+                    };
+                    readonly holders: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Optional: the number of ACL entries currently holding this role. A count, never a list of subjects. A VTC MAY omit it where the querying party may not learn it.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly RoleDefinition: {
+                readonly title: "RoleDefinition";
+                readonly description: "One administrative role of a VTC: a name, the CEILING of capabilities an entry holding the role may hold, and the approve ceiling of capabilities it may approve.\n\nA ROLE IS A CEILING, NOT A GRANT. It states the most an entry with this role could be allowed; the entry's own `capabilities` say what it does hold, and may be narrower. An entry's effective capabilities are this whole `ceiling` where the entry states `capabilities: {scope: ceiling}`, nothing where it states `none`, and this `ceiling` ∩ its listed grants (plus any additive grant) where it states `listed`. Holding the role confers nothing an entry has not been granted. Likewise `approveScope` bounds what an entry may approve: the entry's `approveCapabilities` select from it (`ceiling` = all of it, `listed` = an intersection, absent or `none` = nothing), and the entry's `approve` scope must not be none for any of it to apply.\n\nNO WILDCARDS. A ceiling lists its capabilities explicitly, even where it is meant to be \"everything\"; a role whose ceiling is empty holds no capability, and one whose approve ceiling is empty approves none. Built-in roles whose intent is the whole registry enumerate it, and their records grow when the registry grows — by release, never by policy.\n\nBUILT-IN ROLES (`builtIn: true`) are fixed by the VTC implementation and MUST NOT be changed or deleted through vtc/roles/define or vtc/roles/delete. The built-in set, with the ceilings a VTC is expected to ship (descriptive; the authoritative ceiling is the record the VTC returns):\n- `community-admin` — ceiling: every `vtc.*` capability and `git.ns.admin` unqualified; approve ceiling: every capability. With its full ceiling it is the community's unrestricted administrator.\n- `moderator` — ceiling: `vtc.members.manage`, `vtc.join.decide`, `vtc.invitations.manage`; approve ceiling: the same.\n- `vetting-lead` — ceiling: `vtc.vetting.manage` (an entry may qualify it by criterion); approve ceiling: `vtc.vetting.manage`, so vetting leads approve vetter grants and other vetting leads at their qualifier.\n- `repo-manager` — ceiling: `git.repo.manage` and `git.ns.admin` (held qualified by namespace or repository); approve ceiling: the same, at the same qualifier.\n- `credential-officer` — ceiling: `vtc.credentials.issue`, `vtc.credentials.revoke`; approve ceiling: the same.\n- `auditor` — ceiling: `vtc.audit.read`; approve ceiling: none.\n- `approver` — ceiling: none (an entry holding it states `act: {scope: none}`); approve ceiling: every capability, narrowed by the entry's `approveCapabilities` — the least-privilege approver.\n\nCUSTOM ROLES (`builtIn: false`) are created, changed and deleted by a community through vtc/roles/define and vtc/roles/delete. A VTC implementing this family takes those changes only through an N-of-M approval among its administrators, never through policy (Rego or otherwise) — authority-defining records are host-enforced, and policy may only refuse. That is a description of the VTC's model, not a requirement this schema can carry. An entry holds at most one administrative role; a combination (repo manager AND vetting lead) is expressed as a custom role.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["name", "builtIn", "ceiling", "approveScope"];
+                readonly properties: {
+                    readonly name: {
+                        readonly $ref: "#/$defs/RoleName";
+                    };
+                    readonly builtIn: {
+                        readonly type: "boolean";
+                        readonly description: "`true` for a role fixed by the VTC implementation, which cannot be changed or deleted; `false` for a community-defined custom role.";
+                    };
+                    readonly description: {
+                        readonly type: "string";
+                        readonly maxLength: 512;
+                        readonly description: "Optional human-readable description. Confers nothing.";
+                    };
+                    readonly ceiling: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityRef";
+                        };
+                        readonly description: "The capabilities an entry holding this role MAY hold, each optionally qualified by a resource. An entry may hold a capability at a qualifier inside the ceiling's (a ceiling of `git.repo.manage` unqualified admits `git.repo.manage @ git-ns:github.com/acme`), never outside it. EMPTY means the role admits no capability. A capability the VTC classes as additive never appears in a ceiling — an additive capability is by definition one no role implies.";
+                    };
+                    readonly approveScope: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityRef";
+                        };
+                        readonly description: "The capabilities an entry holding this role MAY approve an action needing — the role's approve ceiling, independent of `ceiling`. An entry approves all of it with `approveCapabilities: {scope: ceiling}`, an intersection with `listed`, and nothing when `approveCapabilities` is absent or `none`; the entry's `approve` scope must be other than none for any of it to apply. EMPTY means the role approves nothing.";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly createdBy: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "VID of the administrator whose request created the role (for a custom role created by approval, the requester). Absent on a built-in role.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedBy: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 2048;
+                        readonly description: "VID of the administrator whose request last replaced the role. Absent on a built-in role and on a custom role never replaced.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. An extension member MUST NOT be interpreted as widening a ceiling.";
+                    };
+                };
+            };
+            readonly RoleName: {
+                readonly title: "RoleName";
+                readonly description: "A role identifier: lowercase, hyphen-separated, at most 64 characters. Compared by exact string equality. It is the value an AclEntry 0.2 carries in `role`.";
+                readonly type: "string";
+                readonly pattern: "^[a-z][a-z0-9-]{0,63}$";
+            };
+            readonly CapabilityRef: {
+                readonly title: "CapabilityRef";
+                readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                };
+            };
+            readonly ResourceQualifier: {
+                readonly title: "ResourceQualifier";
+                readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly Capability: {
+                readonly title: "Capability";
+                readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map