@openvtc/trust-tasks 0.28.1 → 0.28.3

package/dist/vtc/members/role/set/0.1/payload.d.ts

@@ -0,0 +1,1867 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/members/role/set/0.1/payload.schema.json
+ */
+import type { AclEntry_AclV0_2 as AclEntry, Approval, ApproveCapabilityScope, ApproveCapabilityScopeListed, AuthorityScope, AuthorityScopeAll, AuthorityScopeContexts, AuthorityScopeNone, Capability_AclV0_2 as Capability, CapabilityGrant, CapabilityRef, CapabilityScope, CapabilityScopeCeiling, CapabilityScopeListed, CapabilityScopeNone, ContextPath, Ext, KeyScope, KeyScopeAll, KeyScopeListed, KeyScopeNone, ResourceQualifier } from "../../../../../_shared/components.js";
+/**
+ * An administrator moves a subject's community role from one role to another, with a compare-and-swap on the current role. The administrative authority the entry holds follows the move only where it is the authority the current community role implies. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface VTCMembersRoleSetPayload {
+    /**
+     * The DID whose community role moves. It holds an access-control entry at the community, of any community role but `application`.
+     */
+    subject: string;
+    /**
+     * The subject's current community role, in the community's wire form (`member`, `moderator`, `issuer`, `admin`, `custom:<name>`). The community refuses the move with `stateMismatch` when it differs from the role the entry holds.
+     */
+    fromRole: string;
+    /**
+     * The community role to move the subject to, in the same wire form. Never `application`, which marks a non-member rather than a role a member holds.
+     */
+    toRole: string;
+    /**
+     * Why, for the community's audit trail and for the administrators asked to approve the move if it is referred. Never published beyond the community.
+     */
+    reason?: string;
+    /**
+     * Ecosystem-defined extension members per SPEC §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * Success response to vtc/members/role/set/0.1: the subject's community role as it now stands, the access-control entry that holds it, and the role credential re-issued for it. Type https://trusttasks.org/spec/vtc/members/role/set/0.1#response — carried directly, or on the request's threadId when a parked move executes after its approval.
+ */
+export interface VTCMembersRoleSetResponsePayload {
+    /**
+     * The DID whose community role was set.
+     */
+    subject: string;
+    /**
+     * The community role the subject now holds. Equals the request's `toRole`.
+     */
+    role: string;
+    /**
+     * The community role the subject held before. Equals the request's `fromRole`.
+     */
+    previousRole: string;
+    /**
+     * False when `fromRole` equalled `toRole`: the subject already held the role, nothing was written and no credential was issued.
+     */
+    changed: boolean;
+    /**
+     * The access-control entry as it now stands, every authority axis explicit, so the requester can see what administrative authority the move did or did not carry.
+     */
+    entry: AclEntry;
+    /**
+     * The role credential issued at the new role: a Verifiable Authority Credential issued by the community whose `credentialSubject.authority` is `{ scope: <community DID>, actions: ["role:<name>"] }`, the shape vtc/join-requests/decide returns. Present exactly when the subject has a member record and `changed` is true; a subject holding an entry with no member record has no role credential to re-issue.
+     */
+    roleVac?: {};
+    /**
+     * How the move came to execute: `policyAllowed` at once, `approved` after a parked move was approved by other administrators, or `waived` by the community's single-administrator mode on the requester's own bound re-authentication. Absent when `changed` is false.
+     */
+    approval?: Approval;
+    /**
+     * Ecosystem-defined extension members per SPEC §4.5.1.
+     */
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AclEntry, Approval, ApproveCapabilityScope, ApproveCapabilityScopeListed, AuthorityScope, AuthorityScopeAll, AuthorityScopeContexts, AuthorityScopeNone, Capability, CapabilityGrant, CapabilityRef, CapabilityScope, CapabilityScopeCeiling, CapabilityScopeListed, CapabilityScopeNone, ContextPath, Ext, KeyScope, KeyScopeAll, KeyScopeListed, KeyScopeNone, ResourceQualifier };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vtc/members/role/set/0.1";
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export declare const EXTENDS: string | null;
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export declare const DEPRECATION: string | null;
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCMembersRoleSetPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vtc/members/role/set/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCMembersRoleSetResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/vtc/members/role/set/0.1";
+    readonly title: "VTC Members Role Set — payload";
+    readonly description: "An administrator moves a subject's community role from one role to another, with a compare-and-swap on the current role. The administrative authority the entry holds follows the move only where it is the authority the current community role implies. The outer document members are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["subject", "fromRole", "toRole"];
+    readonly properties: {
+        readonly subject: {
+            readonly type: "string";
+            readonly pattern: "^did:";
+            readonly maxLength: 2048;
+            readonly description: "The DID whose community role moves. It holds an access-control entry at the community, of any community role but `application`.";
+        };
+        readonly fromRole: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly description: "The subject's current community role, in the community's wire form (`member`, `moderator`, `issuer`, `admin`, `custom:<name>`). The community refuses the move with `stateMismatch` when it differs from the role the entry holds.";
+        };
+        readonly toRole: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly description: "The community role to move the subject to, in the same wire form. Never `application`, which marks a non-member rather than a role a member holds.";
+        };
+        readonly reason: {
+            readonly type: "string";
+            readonly maxLength: 1024;
+            readonly description: "Why, for the community's audit trail and for the administrators asked to approve the move if it is referred. Never published beyond the community.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTC Members Role Set — response payload";
+            readonly description: "Success response to vtc/members/role/set/0.1: the subject's community role as it now stands, the access-control entry that holds it, and the role credential re-issued for it. Type https://trusttasks.org/spec/vtc/members/role/set/0.1#response — carried directly, or on the request's threadId when a parked move executes after its approval.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "role", "previousRole", "changed", "entry"];
+            readonly properties: {
+                readonly subject: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                    readonly description: "The DID whose community role was set.";
+                };
+                readonly role: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "The community role the subject now holds. Equals the request's `toRole`.";
+                };
+                readonly previousRole: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "The community role the subject held before. Equals the request's `fromRole`.";
+                };
+                readonly changed: {
+                    readonly type: "boolean";
+                    readonly description: "False when `fromRole` equalled `toRole`: the subject already held the role, nothing was written and no credential was issued.";
+                };
+                readonly entry: {
+                    readonly $ref: "#/$defs/AclEntry";
+                    readonly description: "The access-control entry as it now stands, every authority axis explicit, so the requester can see what administrative authority the move did or did not carry.";
+                };
+                readonly roleVac: {
+                    readonly type: "object";
+                    readonly description: "The role credential issued at the new role: a Verifiable Authority Credential issued by the community whose `credentialSubject.authority` is `{ scope: <community DID>, actions: [\"role:<name>\"] }`, the shape vtc/join-requests/decide returns. Present exactly when the subject has a member record and `changed` is true; a subject holding an entry with no member record has no role credential to re-issue.";
+                };
+                readonly approval: {
+                    readonly $ref: "#/$defs/Approval";
+                    readonly description: "How the move came to execute: `policyAllowed` at once, `approved` after a parked move was approved by other administrators, or `waived` by the community's single-administrator mode on the requester's own bound re-authentication. Absent when `changed` is false.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC §4.5.1.";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Approval: {
+            readonly title: "Approval";
+            readonly type: "string";
+            readonly enum: readonly ["policyAllowed", "approved", "waived"];
+            readonly description: "How the admission came to execute. `policyAllowed`: the community's policy admitted it at once. `approved`: the policy referred it, the community parked it, and another administrator approved it. `waived`: the policy referred it, and the community's single-administrator mode waived the approval on the requester's own re-authentication bound to the operation.";
+        };
+        readonly AclEntry: {
+            readonly title: "AclEntry";
+            readonly description: "One access-control entry: who the grant is for (`subject`), the ceiling it is held under (`role`), where the subject may act (`act`) and approve (`approve`), and which capabilities it may exercise (`capabilities`) and approve (`approveCapabilities`).\n\nThe act axis and the approve axis are independent and a consumer MUST resolve them separately: `act` + `capabilities` (+ `keys`) answer \"may this subject do X\"; `approve` + `approveCapabilities` answer \"may this subject ratify someone else doing X\". Neither implies the other. An entry with `act: {scope: none}` and an approve scope other than none is a least-privilege approver — able to satisfy an approval and unable to initiate any change.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "role", "act", "keys", "capabilities"];
+            readonly properties: {
+                readonly subject: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.";
+                };
+                readonly role: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Opaque role identifier interpreted by the ACL maintainer. A role is a CEILING, never a grant: it bounds the capabilities the entry may hold and never adds to them. A consumer that does not recognise the role MUST treat the entry as conferring no authority and MUST NOT fall back to a default role. Act scope and role are independent members; a consumer MUST NOT compute either from the other.";
+                };
+                readonly act: {
+                    readonly $ref: "#/$defs/AuthorityScope";
+                    readonly description: "REQUIRED explicit act scope: where this subject may make a change itself. Exactly one of `{\"scope\": \"all\"}` (unrestricted — every context the maintainer has), `{\"scope\": \"none\"}` (may act nowhere), or `{\"scope\": \"contexts\", \"contexts\": [...]}` with at least one context path (the named contexts and, where the maintainer's contexts are hierarchical, their descendants). There is no default and no implicit form: an entry without `act`, or with an empty `contexts` list, is malformed and MUST be refused, never read as `all` and never read as `none`. A maintainer that has no contexts (for example a community node that narrows authority with resource qualifiers instead) states `all` or `none` only. Replaces 0.1's `scopes`.";
+                };
+                readonly approve: {
+                    readonly $ref: "#/$defs/AuthorityScope";
+                    readonly description: "OPTIONAL approve scope: where this subject may ratify a change made by someone else (a step-up ratification, a consent decision, an N-of-M approval). Same three shapes as `act`, resolved independently of it. ABSENT MEANS NONE — the subject may ratify nothing — so a consumer that has not implemented the member confers less than the producer intended, never more. A producer SHOULD state `{\"scope\": \"none\"}` explicitly rather than rely on omission. A subject MUST NOT confer approve authority wider than the approve authority it holds itself (see acl/grant `approveWiderThanGranter`). Replaces 0.1's `approve {all, scopes}`.";
+                };
+                readonly capabilities: {
+                    readonly $ref: "#/$defs/CapabilityScope";
+                    readonly description: "REQUIRED explicit capability scope: which capabilities this entry holds. Exactly one of `{\"scope\": \"ceiling\"}` (the role's full ceiling, unnarrowed), `{\"scope\": \"none\"}` (no capabilities), or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityGrant. For `listed`, the EFFECTIVE set is (the role's ceiling ∩ the non-additive grants) ∪ the additive grants; it can only narrow the ceiling, except through an explicit additive grant, which only an unrestricted granter may make. There is no implicit form: an entry without `capabilities`, or with an empty `grants` list, is malformed and MUST be refused. A non-additive grant outside the role's ceiling is refused when written, never accepted with the capability silently dropped; a capability the consumer does not recognise is never treated as granted. Producers SHOULD NOT list the same (capability, resource) pair twice; a consumer MAY refuse a list that does.";
+                };
+                readonly approveCapabilities: {
+                    readonly $ref: "#/$defs/ApproveCapabilityScope";
+                    readonly description: "OPTIONAL explicit approvable-capability scope: which capabilities this subject may APPROVE an action needing — independent of what it may do itself, so an approver can ratify a capability it does not hold (the least-privilege approver). One of `{\"scope\": \"ceiling\"}` (the role's full approve ceiling; at a maintainer whose roles define no capability-level approve ceiling, any action within `approve`), `{\"scope\": \"none\"}`, or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityRef (intersected with the role's approve ceiling where one is defined). ABSENT MEANS NONE: the subject may approve no capability, because absence derives no authority. Bounded by `approve`: where `approve` is absent or `{\"scope\": \"none\"}` this member confers nothing whatever it states. A subject MUST NOT confer approvable capabilities it cannot itself approve.";
+                };
+                readonly delegatedBy: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the granter whose authority this entry was delegated from and is bounded by. The entry MUST NOT hold authority the granter did not hold when it was written, and MUST NOT retain authority the granter has since lost, so a maintainer re-evaluates it when the granter's own entry narrows or is removed. Distinct from `createdBy`, which records who wrote the entry: the two differ where an entry is written on a granter's behalf (for example after an N-of-M approval, or by an offline operator). Set by the maintainer from the granter it authorized; absent on an entry that derives from no granter's authority (the first administrator, an operator-written recovery entry).";
+                };
+                readonly keys: {
+                    readonly $ref: "#/$defs/KeyScope";
+                    readonly description: "REQUIRED explicit key scope: which keys this subject may invoke the maintainer's signing oracle on. Exactly one of `{\"scope\": \"all\"}` (every key the entry's act scope reaches), `{\"scope\": \"none\"}` (no keys), or `{\"scope\": \"listed\", \"keys\": [...]}` with at least one key identifier. INTERSECTS WITH `act` — it can only narrow, never widen: a listed key that lies outside the entry's act scope remains unreachable, exactly as if it were not listed. There is no implicit form: an entry without `keys`, or with an empty `keys` list, is malformed and MUST be refused. A maintainer that operates no signing oracle states `{\"scope\": \"none\"}`. Replaces 0.1's `allowedKeys`, whose absence meant every key.";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "Optional human-readable label. Confers nothing.";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly createdBy: {
+                    readonly type: "string";
+                    readonly description: "VID of the party that originally wrote this entry.";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedBy: {
+                    readonly type: "string";
+                    readonly description: "VID of the party that last modified this entry.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Optional time after which the entry confers no authority. Evaluated at every authorization decision, not only when a session is established.";
+                };
+                readonly stepUp: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly description: "Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry). Carried forward from 0.1 unchanged.";
+                    readonly properties: {
+                        readonly approver: {
+                            readonly type: "string";
+                            readonly description: "VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.";
+                        };
+                        readonly require: {
+                            readonly type: "string";
+                            readonly enum: readonly ["self", "delegated"];
+                            readonly description: "Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).";
+                        };
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces. An extension member MUST NOT be interpreted as conferring authority.";
+                };
+            };
+        };
+        readonly KeyScope: {
+            readonly title: "KeyScope";
+            readonly description: "An explicit key scope. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `listed` with a NON-EMPTY list of key identifiers. The empty list is invalid, not a fourth shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/KeyScopeAll";
+            }, {
+                readonly $ref: "#/$defs/KeyScopeNone";
+            }, {
+                readonly $ref: "#/$defs/KeyScopeListed";
+            }];
+        };
+        readonly KeyScopeListed: {
+            readonly title: "KeyScopeListed";
+            readonly description: "Exactly the listed keys, intersected with the entry's act scope.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "keys"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly keys: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                    };
+                    readonly description: "Non-empty set of key identifiers. An empty array is invalid (it is neither `all` nor `none`).";
+                };
+            };
+        };
+        readonly KeyScopeNone: {
+            readonly title: "KeyScopeNone";
+            readonly description: "No keys.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly KeyScopeAll: {
+            readonly title: "KeyScopeAll";
+            readonly description: "Every key the entry's act scope reaches.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "all";
+                };
+            };
+        };
+        readonly ApproveCapabilityScope: {
+            readonly title: "ApproveCapabilityScope";
+            readonly description: "An explicit statement of the capabilities a subject may approve. Exactly one of `ceiling` (the role's full approve ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityRef.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CapabilityScopeCeiling";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/ApproveCapabilityScopeListed";
+            }];
+        };
+        readonly ApproveCapabilityScopeListed: {
+            readonly title: "ApproveCapabilityScopeListed";
+            readonly description: "Exactly the listed capabilities, intersected with the role's approve ceiling where the maintainer's roles define one.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "grants"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly grants: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityRef";
+                    };
+                    readonly description: "Non-empty list of approvable capabilities. An empty array is invalid.";
+                };
+            };
+        };
+        readonly CapabilityRef: {
+            readonly title: "CapabilityRef";
+            readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+            };
+        };
+        readonly ResourceQualifier: {
+            readonly title: "ResourceQualifier";
+            readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly Capability: {
+            readonly title: "Capability";
+            readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+        };
+        readonly CapabilityScopeNone: {
+            readonly title: "CapabilityScopeNone";
+            readonly description: "No capabilities on this axis.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly CapabilityScopeCeiling: {
+            readonly title: "CapabilityScopeCeiling";
+            readonly description: "The role's full ceiling on this axis, unnarrowed: what the role admits, the entry holds (or, for approvable capabilities, may approve). Stated, not implied — it is the explicit spelling of \"no narrowing\".";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "ceiling";
+                };
+            };
+        };
+        readonly CapabilityScope: {
+            readonly title: "CapabilityScope";
+            readonly description: "An explicit statement of the capabilities an entry holds. Exactly one of three shapes, discriminated by `scope`: `ceiling` (the role's full ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityGrant. The empty list is invalid, not a fourth shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CapabilityScopeCeiling";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeListed";
+            }];
+        };
+        readonly CapabilityScopeListed: {
+            readonly title: "CapabilityScopeListed";
+            readonly description: "Exactly the listed grants: (role ceiling ∩ non-additive grants) ∪ additive grants.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "grants"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly grants: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityGrant";
+                    };
+                    readonly description: "Non-empty list of capability grants. An empty array is invalid (it is neither `ceiling` nor `none`).";
+                };
+            };
+        };
+        readonly CapabilityGrant: {
+            readonly title: "CapabilityGrant";
+            readonly description: "A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+                readonly additive: {
+                    readonly type: "boolean";
+                    readonly description: "`true` declares an ADDITIVE grant: a capability no role implies, granted to this entry beside its role rather than through it, and therefore not intersected with the role's ceiling. Granting one requires unrestricted act authority (`act: {scope: all}`) of the granter, and an entry never acquires one by virtue of its role. Absent or `false` → an ordinary grant, intersected with the role's ceiling, and refused when written if it lies outside it. A consumer MUST refuse `additive: true` on a capability the role's ceiling already includes, so that the flag cannot be used to make an ordinary capability survive a later role change.";
+                };
+            };
+        };
+        readonly AuthorityScope: {
+            readonly title: "AuthorityScope";
+            readonly description: "An explicit authority scope — used for both the act scope and the approve scope of an entry. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `contexts` with a NON-EMPTY list. The empty list is not a fourth shape: it is invalid, so a serializer that drops or empties the list produces a document that fails validation rather than one that silently means something else.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/AuthorityScopeAll";
+            }, {
+                readonly $ref: "#/$defs/AuthorityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/AuthorityScopeContexts";
+            }];
+        };
+        readonly AuthorityScopeContexts: {
+            readonly title: "AuthorityScopeContexts";
+            readonly description: "The named contexts and, where the maintainer's contexts are hierarchical, every descendant of them — and nowhere else. `contexts` MUST carry at least one path.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "contexts"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "contexts";
+                };
+                readonly contexts: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/ContextPath";
+                    };
+                    readonly description: "Non-empty set of context paths. An empty array is invalid (it is neither `all` nor `none`).";
+                };
+            };
+        };
+        readonly ContextPath: {
+            readonly title: "ContextPath";
+            readonly description: "Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly AuthorityScopeNone: {
+            readonly title: "AuthorityScopeNone";
+            readonly description: "No authority on this axis. Stated, not implied: `none` is how an entry says it may not act (a least-privilege approver) or may not approve.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly AuthorityScopeAll: {
+            readonly title: "AuthorityScopeAll";
+            readonly description: "Unrestricted: every context the maintainer holds, present and future. On the act axis this is a super-administrator (or, at a maintainer without contexts, an entry whose authority is not narrowed by location).";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "all";
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTC Members Role Set — response payload";
+            readonly description: "Success response to vtc/members/role/set/0.1: the subject's community role as it now stands, the access-control entry that holds it, and the role credential re-issued for it. Type https://trusttasks.org/spec/vtc/members/role/set/0.1#response — carried directly, or on the request's threadId when a parked move executes after its approval.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "role", "previousRole", "changed", "entry"];
+            readonly properties: {
+                readonly subject: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                    readonly description: "The DID whose community role was set.";
+                };
+                readonly role: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "The community role the subject now holds. Equals the request's `toRole`.";
+                };
+                readonly previousRole: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "The community role the subject held before. Equals the request's `fromRole`.";
+                };
+                readonly changed: {
+                    readonly type: "boolean";
+                    readonly description: "False when `fromRole` equalled `toRole`: the subject already held the role, nothing was written and no credential was issued.";
+                };
+                readonly entry: {
+                    readonly $ref: "#/$defs/AclEntry";
+                    readonly description: "The access-control entry as it now stands, every authority axis explicit, so the requester can see what administrative authority the move did or did not carry.";
+                };
+                readonly roleVac: {
+                    readonly type: "object";
+                    readonly description: "The role credential issued at the new role: a Verifiable Authority Credential issued by the community whose `credentialSubject.authority` is `{ scope: <community DID>, actions: [\"role:<name>\"] }`, the shape vtc/join-requests/decide returns. Present exactly when the subject has a member record and `changed` is true; a subject holding an entry with no member record has no role credential to re-issue.";
+                };
+                readonly approval: {
+                    readonly $ref: "#/$defs/Approval";
+                    readonly description: "How the move came to execute: `policyAllowed` at once, `approved` after a parked move was approved by other administrators, or `waived` by the community's single-administrator mode on the requester's own bound re-authentication. Absent when `changed` is false.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC §4.5.1.";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Approval: {
+            readonly title: "Approval";
+            readonly type: "string";
+            readonly enum: readonly ["policyAllowed", "approved", "waived"];
+            readonly description: "How the admission came to execute. `policyAllowed`: the community's policy admitted it at once. `approved`: the policy referred it, the community parked it, and another administrator approved it. `waived`: the policy referred it, and the community's single-administrator mode waived the approval on the requester's own re-authentication bound to the operation.";
+        };
+        readonly AclEntry: {
+            readonly title: "AclEntry";
+            readonly description: "One access-control entry: who the grant is for (`subject`), the ceiling it is held under (`role`), where the subject may act (`act`) and approve (`approve`), and which capabilities it may exercise (`capabilities`) and approve (`approveCapabilities`).\n\nThe act axis and the approve axis are independent and a consumer MUST resolve them separately: `act` + `capabilities` (+ `keys`) answer \"may this subject do X\"; `approve` + `approveCapabilities` answer \"may this subject ratify someone else doing X\". Neither implies the other. An entry with `act: {scope: none}` and an approve scope other than none is a least-privilege approver — able to satisfy an approval and unable to initiate any change.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["subject", "role", "act", "keys", "capabilities"];
+            readonly properties: {
+                readonly subject: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.";
+                };
+                readonly role: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Opaque role identifier interpreted by the ACL maintainer. A role is a CEILING, never a grant: it bounds the capabilities the entry may hold and never adds to them. A consumer that does not recognise the role MUST treat the entry as conferring no authority and MUST NOT fall back to a default role. Act scope and role are independent members; a consumer MUST NOT compute either from the other.";
+                };
+                readonly act: {
+                    readonly $ref: "#/$defs/AuthorityScope";
+                    readonly description: "REQUIRED explicit act scope: where this subject may make a change itself. Exactly one of `{\"scope\": \"all\"}` (unrestricted — every context the maintainer has), `{\"scope\": \"none\"}` (may act nowhere), or `{\"scope\": \"contexts\", \"contexts\": [...]}` with at least one context path (the named contexts and, where the maintainer's contexts are hierarchical, their descendants). There is no default and no implicit form: an entry without `act`, or with an empty `contexts` list, is malformed and MUST be refused, never read as `all` and never read as `none`. A maintainer that has no contexts (for example a community node that narrows authority with resource qualifiers instead) states `all` or `none` only. Replaces 0.1's `scopes`.";
+                };
+                readonly approve: {
+                    readonly $ref: "#/$defs/AuthorityScope";
+                    readonly description: "OPTIONAL approve scope: where this subject may ratify a change made by someone else (a step-up ratification, a consent decision, an N-of-M approval). Same three shapes as `act`, resolved independently of it. ABSENT MEANS NONE — the subject may ratify nothing — so a consumer that has not implemented the member confers less than the producer intended, never more. A producer SHOULD state `{\"scope\": \"none\"}` explicitly rather than rely on omission. A subject MUST NOT confer approve authority wider than the approve authority it holds itself (see acl/grant `approveWiderThanGranter`). Replaces 0.1's `approve {all, scopes}`.";
+                };
+                readonly capabilities: {
+                    readonly $ref: "#/$defs/CapabilityScope";
+                    readonly description: "REQUIRED explicit capability scope: which capabilities this entry holds. Exactly one of `{\"scope\": \"ceiling\"}` (the role's full ceiling, unnarrowed), `{\"scope\": \"none\"}` (no capabilities), or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityGrant. For `listed`, the EFFECTIVE set is (the role's ceiling ∩ the non-additive grants) ∪ the additive grants; it can only narrow the ceiling, except through an explicit additive grant, which only an unrestricted granter may make. There is no implicit form: an entry without `capabilities`, or with an empty `grants` list, is malformed and MUST be refused. A non-additive grant outside the role's ceiling is refused when written, never accepted with the capability silently dropped; a capability the consumer does not recognise is never treated as granted. Producers SHOULD NOT list the same (capability, resource) pair twice; a consumer MAY refuse a list that does.";
+                };
+                readonly approveCapabilities: {
+                    readonly $ref: "#/$defs/ApproveCapabilityScope";
+                    readonly description: "OPTIONAL explicit approvable-capability scope: which capabilities this subject may APPROVE an action needing — independent of what it may do itself, so an approver can ratify a capability it does not hold (the least-privilege approver). One of `{\"scope\": \"ceiling\"}` (the role's full approve ceiling; at a maintainer whose roles define no capability-level approve ceiling, any action within `approve`), `{\"scope\": \"none\"}`, or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityRef (intersected with the role's approve ceiling where one is defined). ABSENT MEANS NONE: the subject may approve no capability, because absence derives no authority. Bounded by `approve`: where `approve` is absent or `{\"scope\": \"none\"}` this member confers nothing whatever it states. A subject MUST NOT confer approvable capabilities it cannot itself approve.";
+                };
+                readonly delegatedBy: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the granter whose authority this entry was delegated from and is bounded by. The entry MUST NOT hold authority the granter did not hold when it was written, and MUST NOT retain authority the granter has since lost, so a maintainer re-evaluates it when the granter's own entry narrows or is removed. Distinct from `createdBy`, which records who wrote the entry: the two differ where an entry is written on a granter's behalf (for example after an N-of-M approval, or by an offline operator). Set by the maintainer from the granter it authorized; absent on an entry that derives from no granter's authority (the first administrator, an operator-written recovery entry).";
+                };
+                readonly keys: {
+                    readonly $ref: "#/$defs/KeyScope";
+                    readonly description: "REQUIRED explicit key scope: which keys this subject may invoke the maintainer's signing oracle on. Exactly one of `{\"scope\": \"all\"}` (every key the entry's act scope reaches), `{\"scope\": \"none\"}` (no keys), or `{\"scope\": \"listed\", \"keys\": [...]}` with at least one key identifier. INTERSECTS WITH `act` — it can only narrow, never widen: a listed key that lies outside the entry's act scope remains unreachable, exactly as if it were not listed. There is no implicit form: an entry without `keys`, or with an empty `keys` list, is malformed and MUST be refused. A maintainer that operates no signing oracle states `{\"scope\": \"none\"}`. Replaces 0.1's `allowedKeys`, whose absence meant every key.";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "Optional human-readable label. Confers nothing.";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly createdBy: {
+                    readonly type: "string";
+                    readonly description: "VID of the party that originally wrote this entry.";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedBy: {
+                    readonly type: "string";
+                    readonly description: "VID of the party that last modified this entry.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Optional time after which the entry confers no authority. Evaluated at every authorization decision, not only when a session is established.";
+                };
+                readonly stepUp: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly description: "Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry). Carried forward from 0.1 unchanged.";
+                    readonly properties: {
+                        readonly approver: {
+                            readonly type: "string";
+                            readonly description: "VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.";
+                        };
+                        readonly require: {
+                            readonly type: "string";
+                            readonly enum: readonly ["self", "delegated"];
+                            readonly description: "Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).";
+                        };
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                    readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces. An extension member MUST NOT be interpreted as conferring authority.";
+                };
+            };
+        };
+        readonly KeyScope: {
+            readonly title: "KeyScope";
+            readonly description: "An explicit key scope. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `listed` with a NON-EMPTY list of key identifiers. The empty list is invalid, not a fourth shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/KeyScopeAll";
+            }, {
+                readonly $ref: "#/$defs/KeyScopeNone";
+            }, {
+                readonly $ref: "#/$defs/KeyScopeListed";
+            }];
+        };
+        readonly KeyScopeListed: {
+            readonly title: "KeyScopeListed";
+            readonly description: "Exactly the listed keys, intersected with the entry's act scope.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "keys"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly keys: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                    };
+                    readonly description: "Non-empty set of key identifiers. An empty array is invalid (it is neither `all` nor `none`).";
+                };
+            };
+        };
+        readonly KeyScopeNone: {
+            readonly title: "KeyScopeNone";
+            readonly description: "No keys.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly KeyScopeAll: {
+            readonly title: "KeyScopeAll";
+            readonly description: "Every key the entry's act scope reaches.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "all";
+                };
+            };
+        };
+        readonly ApproveCapabilityScope: {
+            readonly title: "ApproveCapabilityScope";
+            readonly description: "An explicit statement of the capabilities a subject may approve. Exactly one of `ceiling` (the role's full approve ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityRef.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CapabilityScopeCeiling";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/ApproveCapabilityScopeListed";
+            }];
+        };
+        readonly ApproveCapabilityScopeListed: {
+            readonly title: "ApproveCapabilityScopeListed";
+            readonly description: "Exactly the listed capabilities, intersected with the role's approve ceiling where the maintainer's roles define one.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "grants"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly grants: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityRef";
+                    };
+                    readonly description: "Non-empty list of approvable capabilities. An empty array is invalid.";
+                };
+            };
+        };
+        readonly CapabilityRef: {
+            readonly title: "CapabilityRef";
+            readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+            };
+        };
+        readonly ResourceQualifier: {
+            readonly title: "ResourceQualifier";
+            readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly Capability: {
+            readonly title: "Capability";
+            readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+        };
+        readonly CapabilityScopeNone: {
+            readonly title: "CapabilityScopeNone";
+            readonly description: "No capabilities on this axis.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly CapabilityScopeCeiling: {
+            readonly title: "CapabilityScopeCeiling";
+            readonly description: "The role's full ceiling on this axis, unnarrowed: what the role admits, the entry holds (or, for approvable capabilities, may approve). Stated, not implied — it is the explicit spelling of \"no narrowing\".";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "ceiling";
+                };
+            };
+        };
+        readonly CapabilityScope: {
+            readonly title: "CapabilityScope";
+            readonly description: "An explicit statement of the capabilities an entry holds. Exactly one of three shapes, discriminated by `scope`: `ceiling` (the role's full ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityGrant. The empty list is invalid, not a fourth shape.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/CapabilityScopeCeiling";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/CapabilityScopeListed";
+            }];
+        };
+        readonly CapabilityScopeListed: {
+            readonly title: "CapabilityScopeListed";
+            readonly description: "Exactly the listed grants: (role ceiling ∩ non-additive grants) ∪ additive grants.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "grants"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "listed";
+                };
+                readonly grants: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly $ref: "#/$defs/CapabilityGrant";
+                    };
+                    readonly description: "Non-empty list of capability grants. An empty array is invalid (it is neither `ceiling` nor `none`).";
+                };
+            };
+        };
+        readonly CapabilityGrant: {
+            readonly title: "CapabilityGrant";
+            readonly description: "A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability"];
+            readonly properties: {
+                readonly capability: {
+                    readonly $ref: "#/$defs/Capability";
+                };
+                readonly resource: {
+                    readonly $ref: "#/$defs/ResourceQualifier";
+                    readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                };
+                readonly additive: {
+                    readonly type: "boolean";
+                    readonly description: "`true` declares an ADDITIVE grant: a capability no role implies, granted to this entry beside its role rather than through it, and therefore not intersected with the role's ceiling. Granting one requires unrestricted act authority (`act: {scope: all}`) of the granter, and an entry never acquires one by virtue of its role. Absent or `false` → an ordinary grant, intersected with the role's ceiling, and refused when written if it lies outside it. A consumer MUST refuse `additive: true` on a capability the role's ceiling already includes, so that the flag cannot be used to make an ordinary capability survive a later role change.";
+                };
+            };
+        };
+        readonly AuthorityScope: {
+            readonly title: "AuthorityScope";
+            readonly description: "An explicit authority scope — used for both the act scope and the approve scope of an entry. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `contexts` with a NON-EMPTY list. The empty list is not a fourth shape: it is invalid, so a serializer that drops or empties the list produces a document that fails validation rather than one that silently means something else.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/AuthorityScopeAll";
+            }, {
+                readonly $ref: "#/$defs/AuthorityScopeNone";
+            }, {
+                readonly $ref: "#/$defs/AuthorityScopeContexts";
+            }];
+        };
+        readonly AuthorityScopeContexts: {
+            readonly title: "AuthorityScopeContexts";
+            readonly description: "The named contexts and, where the maintainer's contexts are hierarchical, every descendant of them — and nowhere else. `contexts` MUST carry at least one path.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope", "contexts"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "contexts";
+                };
+                readonly contexts: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/ContextPath";
+                    };
+                    readonly description: "Non-empty set of context paths. An empty array is invalid (it is neither `all` nor `none`).";
+                };
+            };
+        };
+        readonly ContextPath: {
+            readonly title: "ContextPath";
+            readonly description: "Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 512;
+        };
+        readonly AuthorityScopeNone: {
+            readonly title: "AuthorityScopeNone";
+            readonly description: "No authority on this axis. Stated, not implied: `none` is how an entry says it may not act (a least-privilege approver) or may not approve.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "none";
+                };
+            };
+        };
+        readonly AuthorityScopeAll: {
+            readonly title: "AuthorityScopeAll";
+            readonly description: "Unrestricted: every context the maintainer holds, present and future. On the act axis this is a super-administrator (or, at a maintainer without contexts, an entry whose authority is not narrowed by location).";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["scope"];
+            readonly properties: {
+                readonly scope: {
+                    readonly const: "all";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/members/role/set/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/vtc/members/role/set/0.1";
+        readonly title: "VTC Members Role Set — payload";
+        readonly description: "An administrator moves a subject's community role from one role to another, with a compare-and-swap on the current role. The administrative authority the entry holds follows the move only where it is the authority the current community role implies. The outer document members are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["subject", "fromRole", "toRole"];
+        readonly properties: {
+            readonly subject: {
+                readonly type: "string";
+                readonly pattern: "^did:";
+                readonly maxLength: 2048;
+                readonly description: "The DID whose community role moves. It holds an access-control entry at the community, of any community role but `application`.";
+            };
+            readonly fromRole: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly description: "The subject's current community role, in the community's wire form (`member`, `moderator`, `issuer`, `admin`, `custom:<name>`). The community refuses the move with `stateMismatch` when it differs from the role the entry holds.";
+            };
+            readonly toRole: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly description: "The community role to move the subject to, in the same wire form. Never `application`, which marks a non-member rather than a role a member holds.";
+            };
+            readonly reason: {
+                readonly type: "string";
+                readonly maxLength: 1024;
+                readonly description: "Why, for the community's audit trail and for the administrators asked to approve the move if it is referred. Never published beyond the community.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTC Members Role Set — response payload";
+                readonly description: "Success response to vtc/members/role/set/0.1: the subject's community role as it now stands, the access-control entry that holds it, and the role credential re-issued for it. Type https://trusttasks.org/spec/vtc/members/role/set/0.1#response — carried directly, or on the request's threadId when a parked move executes after its approval.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "role", "previousRole", "changed", "entry"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                        readonly description: "The DID whose community role was set.";
+                    };
+                    readonly role: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "The community role the subject now holds. Equals the request's `toRole`.";
+                    };
+                    readonly previousRole: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "The community role the subject held before. Equals the request's `fromRole`.";
+                    };
+                    readonly changed: {
+                        readonly type: "boolean";
+                        readonly description: "False when `fromRole` equalled `toRole`: the subject already held the role, nothing was written and no credential was issued.";
+                    };
+                    readonly entry: {
+                        readonly $ref: "#/$defs/AclEntry";
+                        readonly description: "The access-control entry as it now stands, every authority axis explicit, so the requester can see what administrative authority the move did or did not carry.";
+                    };
+                    readonly roleVac: {
+                        readonly type: "object";
+                        readonly description: "The role credential issued at the new role: a Verifiable Authority Credential issued by the community whose `credentialSubject.authority` is `{ scope: <community DID>, actions: [\"role:<name>\"] }`, the shape vtc/join-requests/decide returns. Present exactly when the subject has a member record and `changed` is true; a subject holding an entry with no member record has no role credential to re-issue.";
+                    };
+                    readonly approval: {
+                        readonly $ref: "#/$defs/Approval";
+                        readonly description: "How the move came to execute: `policyAllowed` at once, `approved` after a parked move was approved by other administrators, or `waived` by the community's single-administrator mode on the requester's own bound re-authentication. Absent when `changed` is false.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC §4.5.1.";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Approval: {
+                readonly title: "Approval";
+                readonly type: "string";
+                readonly enum: readonly ["policyAllowed", "approved", "waived"];
+                readonly description: "How the admission came to execute. `policyAllowed`: the community's policy admitted it at once. `approved`: the policy referred it, the community parked it, and another administrator approved it. `waived`: the policy referred it, and the community's single-administrator mode waived the approval on the requester's own re-authentication bound to the operation.";
+            };
+            readonly AclEntry: {
+                readonly title: "AclEntry";
+                readonly description: "One access-control entry: who the grant is for (`subject`), the ceiling it is held under (`role`), where the subject may act (`act`) and approve (`approve`), and which capabilities it may exercise (`capabilities`) and approve (`approveCapabilities`).\n\nThe act axis and the approve axis are independent and a consumer MUST resolve them separately: `act` + `capabilities` (+ `keys`) answer \"may this subject do X\"; `approve` + `approveCapabilities` answer \"may this subject ratify someone else doing X\". Neither implies the other. An entry with `act: {scope: none}` and an approve scope other than none is a least-privilege approver — able to satisfy an approval and unable to initiate any change.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "role", "act", "keys", "capabilities"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.";
+                    };
+                    readonly role: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Opaque role identifier interpreted by the ACL maintainer. A role is a CEILING, never a grant: it bounds the capabilities the entry may hold and never adds to them. A consumer that does not recognise the role MUST treat the entry as conferring no authority and MUST NOT fall back to a default role. Act scope and role are independent members; a consumer MUST NOT compute either from the other.";
+                    };
+                    readonly act: {
+                        readonly $ref: "#/$defs/AuthorityScope";
+                        readonly description: "REQUIRED explicit act scope: where this subject may make a change itself. Exactly one of `{\"scope\": \"all\"}` (unrestricted — every context the maintainer has), `{\"scope\": \"none\"}` (may act nowhere), or `{\"scope\": \"contexts\", \"contexts\": [...]}` with at least one context path (the named contexts and, where the maintainer's contexts are hierarchical, their descendants). There is no default and no implicit form: an entry without `act`, or with an empty `contexts` list, is malformed and MUST be refused, never read as `all` and never read as `none`. A maintainer that has no contexts (for example a community node that narrows authority with resource qualifiers instead) states `all` or `none` only. Replaces 0.1's `scopes`.";
+                    };
+                    readonly approve: {
+                        readonly $ref: "#/$defs/AuthorityScope";
+                        readonly description: "OPTIONAL approve scope: where this subject may ratify a change made by someone else (a step-up ratification, a consent decision, an N-of-M approval). Same three shapes as `act`, resolved independently of it. ABSENT MEANS NONE — the subject may ratify nothing — so a consumer that has not implemented the member confers less than the producer intended, never more. A producer SHOULD state `{\"scope\": \"none\"}` explicitly rather than rely on omission. A subject MUST NOT confer approve authority wider than the approve authority it holds itself (see acl/grant `approveWiderThanGranter`). Replaces 0.1's `approve {all, scopes}`.";
+                    };
+                    readonly capabilities: {
+                        readonly $ref: "#/$defs/CapabilityScope";
+                        readonly description: "REQUIRED explicit capability scope: which capabilities this entry holds. Exactly one of `{\"scope\": \"ceiling\"}` (the role's full ceiling, unnarrowed), `{\"scope\": \"none\"}` (no capabilities), or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityGrant. For `listed`, the EFFECTIVE set is (the role's ceiling ∩ the non-additive grants) ∪ the additive grants; it can only narrow the ceiling, except through an explicit additive grant, which only an unrestricted granter may make. There is no implicit form: an entry without `capabilities`, or with an empty `grants` list, is malformed and MUST be refused. A non-additive grant outside the role's ceiling is refused when written, never accepted with the capability silently dropped; a capability the consumer does not recognise is never treated as granted. Producers SHOULD NOT list the same (capability, resource) pair twice; a consumer MAY refuse a list that does.";
+                    };
+                    readonly approveCapabilities: {
+                        readonly $ref: "#/$defs/ApproveCapabilityScope";
+                        readonly description: "OPTIONAL explicit approvable-capability scope: which capabilities this subject may APPROVE an action needing — independent of what it may do itself, so an approver can ratify a capability it does not hold (the least-privilege approver). One of `{\"scope\": \"ceiling\"}` (the role's full approve ceiling; at a maintainer whose roles define no capability-level approve ceiling, any action within `approve`), `{\"scope\": \"none\"}`, or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityRef (intersected with the role's approve ceiling where one is defined). ABSENT MEANS NONE: the subject may approve no capability, because absence derives no authority. Bounded by `approve`: where `approve` is absent or `{\"scope\": \"none\"}` this member confers nothing whatever it states. A subject MUST NOT confer approvable capabilities it cannot itself approve.";
+                    };
+                    readonly delegatedBy: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the granter whose authority this entry was delegated from and is bounded by. The entry MUST NOT hold authority the granter did not hold when it was written, and MUST NOT retain authority the granter has since lost, so a maintainer re-evaluates it when the granter's own entry narrows or is removed. Distinct from `createdBy`, which records who wrote the entry: the two differ where an entry is written on a granter's behalf (for example after an N-of-M approval, or by an offline operator). Set by the maintainer from the granter it authorized; absent on an entry that derives from no granter's authority (the first administrator, an operator-written recovery entry).";
+                    };
+                    readonly keys: {
+                        readonly $ref: "#/$defs/KeyScope";
+                        readonly description: "REQUIRED explicit key scope: which keys this subject may invoke the maintainer's signing oracle on. Exactly one of `{\"scope\": \"all\"}` (every key the entry's act scope reaches), `{\"scope\": \"none\"}` (no keys), or `{\"scope\": \"listed\", \"keys\": [...]}` with at least one key identifier. INTERSECTS WITH `act` — it can only narrow, never widen: a listed key that lies outside the entry's act scope remains unreachable, exactly as if it were not listed. There is no implicit form: an entry without `keys`, or with an empty `keys` list, is malformed and MUST be refused. A maintainer that operates no signing oracle states `{\"scope\": \"none\"}`. Replaces 0.1's `allowedKeys`, whose absence meant every key.";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "Optional human-readable label. Confers nothing.";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly createdBy: {
+                        readonly type: "string";
+                        readonly description: "VID of the party that originally wrote this entry.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedBy: {
+                        readonly type: "string";
+                        readonly description: "VID of the party that last modified this entry.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Optional time after which the entry confers no authority. Evaluated at every authorization decision, not only when a session is established.";
+                    };
+                    readonly stepUp: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly description: "Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry). Carried forward from 0.1 unchanged.";
+                        readonly properties: {
+                            readonly approver: {
+                                readonly type: "string";
+                                readonly description: "VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.";
+                            };
+                            readonly require: {
+                                readonly type: "string";
+                                readonly enum: readonly ["self", "delegated"];
+                                readonly description: "Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).";
+                            };
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces. An extension member MUST NOT be interpreted as conferring authority.";
+                    };
+                };
+            };
+            readonly KeyScope: {
+                readonly title: "KeyScope";
+                readonly description: "An explicit key scope. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `listed` with a NON-EMPTY list of key identifiers. The empty list is invalid, not a fourth shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/KeyScopeAll";
+                }, {
+                    readonly $ref: "#/$defs/KeyScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/KeyScopeListed";
+                }];
+            };
+            readonly KeyScopeListed: {
+                readonly title: "KeyScopeListed";
+                readonly description: "Exactly the listed keys, intersected with the entry's act scope.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "keys"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly keys: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 512;
+                        };
+                        readonly description: "Non-empty set of key identifiers. An empty array is invalid (it is neither `all` nor `none`).";
+                    };
+                };
+            };
+            readonly KeyScopeNone: {
+                readonly title: "KeyScopeNone";
+                readonly description: "No keys.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly KeyScopeAll: {
+                readonly title: "KeyScopeAll";
+                readonly description: "Every key the entry's act scope reaches.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "all";
+                    };
+                };
+            };
+            readonly ApproveCapabilityScope: {
+                readonly title: "ApproveCapabilityScope";
+                readonly description: "An explicit statement of the capabilities a subject may approve. Exactly one of `ceiling` (the role's full approve ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityRef.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CapabilityScopeCeiling";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/ApproveCapabilityScopeListed";
+                }];
+            };
+            readonly ApproveCapabilityScopeListed: {
+                readonly title: "ApproveCapabilityScopeListed";
+                readonly description: "Exactly the listed capabilities, intersected with the role's approve ceiling where the maintainer's roles define one.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "grants"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly grants: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityRef";
+                        };
+                        readonly description: "Non-empty list of approvable capabilities. An empty array is invalid.";
+                    };
+                };
+            };
+            readonly CapabilityRef: {
+                readonly title: "CapabilityRef";
+                readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                };
+            };
+            readonly ResourceQualifier: {
+                readonly title: "ResourceQualifier";
+                readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly Capability: {
+                readonly title: "Capability";
+                readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+            };
+            readonly CapabilityScopeNone: {
+                readonly title: "CapabilityScopeNone";
+                readonly description: "No capabilities on this axis.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly CapabilityScopeCeiling: {
+                readonly title: "CapabilityScopeCeiling";
+                readonly description: "The role's full ceiling on this axis, unnarrowed: what the role admits, the entry holds (or, for approvable capabilities, may approve). Stated, not implied — it is the explicit spelling of \"no narrowing\".";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "ceiling";
+                    };
+                };
+            };
+            readonly CapabilityScope: {
+                readonly title: "CapabilityScope";
+                readonly description: "An explicit statement of the capabilities an entry holds. Exactly one of three shapes, discriminated by `scope`: `ceiling` (the role's full ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityGrant. The empty list is invalid, not a fourth shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CapabilityScopeCeiling";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeListed";
+                }];
+            };
+            readonly CapabilityScopeListed: {
+                readonly title: "CapabilityScopeListed";
+                readonly description: "Exactly the listed grants: (role ceiling ∩ non-additive grants) ∪ additive grants.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "grants"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly grants: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityGrant";
+                        };
+                        readonly description: "Non-empty list of capability grants. An empty array is invalid (it is neither `ceiling` nor `none`).";
+                    };
+                };
+            };
+            readonly CapabilityGrant: {
+                readonly title: "CapabilityGrant";
+                readonly description: "A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                    readonly additive: {
+                        readonly type: "boolean";
+                        readonly description: "`true` declares an ADDITIVE grant: a capability no role implies, granted to this entry beside its role rather than through it, and therefore not intersected with the role's ceiling. Granting one requires unrestricted act authority (`act: {scope: all}`) of the granter, and an entry never acquires one by virtue of its role. Absent or `false` → an ordinary grant, intersected with the role's ceiling, and refused when written if it lies outside it. A consumer MUST refuse `additive: true` on a capability the role's ceiling already includes, so that the flag cannot be used to make an ordinary capability survive a later role change.";
+                    };
+                };
+            };
+            readonly AuthorityScope: {
+                readonly title: "AuthorityScope";
+                readonly description: "An explicit authority scope — used for both the act scope and the approve scope of an entry. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `contexts` with a NON-EMPTY list. The empty list is not a fourth shape: it is invalid, so a serializer that drops or empties the list produces a document that fails validation rather than one that silently means something else.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/AuthorityScopeAll";
+                }, {
+                    readonly $ref: "#/$defs/AuthorityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/AuthorityScopeContexts";
+                }];
+            };
+            readonly AuthorityScopeContexts: {
+                readonly title: "AuthorityScopeContexts";
+                readonly description: "The named contexts and, where the maintainer's contexts are hierarchical, every descendant of them — and nowhere else. `contexts` MUST carry at least one path.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "contexts"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "contexts";
+                    };
+                    readonly contexts: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/ContextPath";
+                        };
+                        readonly description: "Non-empty set of context paths. An empty array is invalid (it is neither `all` nor `none`).";
+                    };
+                };
+            };
+            readonly ContextPath: {
+                readonly title: "ContextPath";
+                readonly description: "Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly AuthorityScopeNone: {
+                readonly title: "AuthorityScopeNone";
+                readonly description: "No authority on this axis. Stated, not implied: `none` is how an entry says it may not act (a least-privilege approver) or may not approve.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly AuthorityScopeAll: {
+                readonly title: "AuthorityScopeAll";
+                readonly description: "Unrestricted: every context the maintainer holds, present and future. On the act axis this is a super-administrator (or, at a maintainer without contexts, an entry whose authority is not narrowed by location).";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "all";
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/members/role/set/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTC Members Role Set — response payload";
+                readonly description: "Success response to vtc/members/role/set/0.1: the subject's community role as it now stands, the access-control entry that holds it, and the role credential re-issued for it. Type https://trusttasks.org/spec/vtc/members/role/set/0.1#response — carried directly, or on the request's threadId when a parked move executes after its approval.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "role", "previousRole", "changed", "entry"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                        readonly description: "The DID whose community role was set.";
+                    };
+                    readonly role: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "The community role the subject now holds. Equals the request's `toRole`.";
+                    };
+                    readonly previousRole: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "The community role the subject held before. Equals the request's `fromRole`.";
+                    };
+                    readonly changed: {
+                        readonly type: "boolean";
+                        readonly description: "False when `fromRole` equalled `toRole`: the subject already held the role, nothing was written and no credential was issued.";
+                    };
+                    readonly entry: {
+                        readonly $ref: "#/$defs/AclEntry";
+                        readonly description: "The access-control entry as it now stands, every authority axis explicit, so the requester can see what administrative authority the move did or did not carry.";
+                    };
+                    readonly roleVac: {
+                        readonly type: "object";
+                        readonly description: "The role credential issued at the new role: a Verifiable Authority Credential issued by the community whose `credentialSubject.authority` is `{ scope: <community DID>, actions: [\"role:<name>\"] }`, the shape vtc/join-requests/decide returns. Present exactly when the subject has a member record and `changed` is true; a subject holding an entry with no member record has no role credential to re-issue.";
+                    };
+                    readonly approval: {
+                        readonly $ref: "#/$defs/Approval";
+                        readonly description: "How the move came to execute: `policyAllowed` at once, `approved` after a parked move was approved by other administrators, or `waived` by the community's single-administrator mode on the requester's own bound re-authentication. Absent when `changed` is false.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC §4.5.1.";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Approval: {
+                readonly title: "Approval";
+                readonly type: "string";
+                readonly enum: readonly ["policyAllowed", "approved", "waived"];
+                readonly description: "How the admission came to execute. `policyAllowed`: the community's policy admitted it at once. `approved`: the policy referred it, the community parked it, and another administrator approved it. `waived`: the policy referred it, and the community's single-administrator mode waived the approval on the requester's own re-authentication bound to the operation.";
+            };
+            readonly AclEntry: {
+                readonly title: "AclEntry";
+                readonly description: "One access-control entry: who the grant is for (`subject`), the ceiling it is held under (`role`), where the subject may act (`act`) and approve (`approve`), and which capabilities it may exercise (`capabilities`) and approve (`approveCapabilities`).\n\nThe act axis and the approve axis are independent and a consumer MUST resolve them separately: `act` + `capabilities` (+ `keys`) answer \"may this subject do X\"; `approve` + `approveCapabilities` answer \"may this subject ratify someone else doing X\". Neither implies the other. An entry with `act: {scope: none}` and an approve scope other than none is a least-privilege approver — able to satisfy an approval and unable to initiate any change.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["subject", "role", "act", "keys", "capabilities"];
+                readonly properties: {
+                    readonly subject: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.";
+                    };
+                    readonly role: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Opaque role identifier interpreted by the ACL maintainer. A role is a CEILING, never a grant: it bounds the capabilities the entry may hold and never adds to them. A consumer that does not recognise the role MUST treat the entry as conferring no authority and MUST NOT fall back to a default role. Act scope and role are independent members; a consumer MUST NOT compute either from the other.";
+                    };
+                    readonly act: {
+                        readonly $ref: "#/$defs/AuthorityScope";
+                        readonly description: "REQUIRED explicit act scope: where this subject may make a change itself. Exactly one of `{\"scope\": \"all\"}` (unrestricted — every context the maintainer has), `{\"scope\": \"none\"}` (may act nowhere), or `{\"scope\": \"contexts\", \"contexts\": [...]}` with at least one context path (the named contexts and, where the maintainer's contexts are hierarchical, their descendants). There is no default and no implicit form: an entry without `act`, or with an empty `contexts` list, is malformed and MUST be refused, never read as `all` and never read as `none`. A maintainer that has no contexts (for example a community node that narrows authority with resource qualifiers instead) states `all` or `none` only. Replaces 0.1's `scopes`.";
+                    };
+                    readonly approve: {
+                        readonly $ref: "#/$defs/AuthorityScope";
+                        readonly description: "OPTIONAL approve scope: where this subject may ratify a change made by someone else (a step-up ratification, a consent decision, an N-of-M approval). Same three shapes as `act`, resolved independently of it. ABSENT MEANS NONE — the subject may ratify nothing — so a consumer that has not implemented the member confers less than the producer intended, never more. A producer SHOULD state `{\"scope\": \"none\"}` explicitly rather than rely on omission. A subject MUST NOT confer approve authority wider than the approve authority it holds itself (see acl/grant `approveWiderThanGranter`). Replaces 0.1's `approve {all, scopes}`.";
+                    };
+                    readonly capabilities: {
+                        readonly $ref: "#/$defs/CapabilityScope";
+                        readonly description: "REQUIRED explicit capability scope: which capabilities this entry holds. Exactly one of `{\"scope\": \"ceiling\"}` (the role's full ceiling, unnarrowed), `{\"scope\": \"none\"}` (no capabilities), or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityGrant. For `listed`, the EFFECTIVE set is (the role's ceiling ∩ the non-additive grants) ∪ the additive grants; it can only narrow the ceiling, except through an explicit additive grant, which only an unrestricted granter may make. There is no implicit form: an entry without `capabilities`, or with an empty `grants` list, is malformed and MUST be refused. A non-additive grant outside the role's ceiling is refused when written, never accepted with the capability silently dropped; a capability the consumer does not recognise is never treated as granted. Producers SHOULD NOT list the same (capability, resource) pair twice; a consumer MAY refuse a list that does.";
+                    };
+                    readonly approveCapabilities: {
+                        readonly $ref: "#/$defs/ApproveCapabilityScope";
+                        readonly description: "OPTIONAL explicit approvable-capability scope: which capabilities this subject may APPROVE an action needing — independent of what it may do itself, so an approver can ratify a capability it does not hold (the least-privilege approver). One of `{\"scope\": \"ceiling\"}` (the role's full approve ceiling; at a maintainer whose roles define no capability-level approve ceiling, any action within `approve`), `{\"scope\": \"none\"}`, or `{\"scope\": \"listed\", \"grants\": [...]}` with at least one CapabilityRef (intersected with the role's approve ceiling where one is defined). ABSENT MEANS NONE: the subject may approve no capability, because absence derives no authority. Bounded by `approve`: where `approve` is absent or `{\"scope\": \"none\"}` this member confers nothing whatever it states. A subject MUST NOT confer approvable capabilities it cannot itself approve.";
+                    };
+                    readonly delegatedBy: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the granter whose authority this entry was delegated from and is bounded by. The entry MUST NOT hold authority the granter did not hold when it was written, and MUST NOT retain authority the granter has since lost, so a maintainer re-evaluates it when the granter's own entry narrows or is removed. Distinct from `createdBy`, which records who wrote the entry: the two differ where an entry is written on a granter's behalf (for example after an N-of-M approval, or by an offline operator). Set by the maintainer from the granter it authorized; absent on an entry that derives from no granter's authority (the first administrator, an operator-written recovery entry).";
+                    };
+                    readonly keys: {
+                        readonly $ref: "#/$defs/KeyScope";
+                        readonly description: "REQUIRED explicit key scope: which keys this subject may invoke the maintainer's signing oracle on. Exactly one of `{\"scope\": \"all\"}` (every key the entry's act scope reaches), `{\"scope\": \"none\"}` (no keys), or `{\"scope\": \"listed\", \"keys\": [...]}` with at least one key identifier. INTERSECTS WITH `act` — it can only narrow, never widen: a listed key that lies outside the entry's act scope remains unreachable, exactly as if it were not listed. There is no implicit form: an entry without `keys`, or with an empty `keys` list, is malformed and MUST be refused. A maintainer that operates no signing oracle states `{\"scope\": \"none\"}`. Replaces 0.1's `allowedKeys`, whose absence meant every key.";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "Optional human-readable label. Confers nothing.";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly createdBy: {
+                        readonly type: "string";
+                        readonly description: "VID of the party that originally wrote this entry.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedBy: {
+                        readonly type: "string";
+                        readonly description: "VID of the party that last modified this entry.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Optional time after which the entry confers no authority. Evaluated at every authorization decision, not only when a session is established.";
+                    };
+                    readonly stepUp: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly description: "Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry). Carried forward from 0.1 unchanged.";
+                        readonly properties: {
+                            readonly approver: {
+                                readonly type: "string";
+                                readonly description: "VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.";
+                            };
+                            readonly require: {
+                                readonly type: "string";
+                                readonly enum: readonly ["self", "delegated"];
+                                readonly description: "Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).";
+                            };
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                        readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces. An extension member MUST NOT be interpreted as conferring authority.";
+                    };
+                };
+            };
+            readonly KeyScope: {
+                readonly title: "KeyScope";
+                readonly description: "An explicit key scope. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `listed` with a NON-EMPTY list of key identifiers. The empty list is invalid, not a fourth shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/KeyScopeAll";
+                }, {
+                    readonly $ref: "#/$defs/KeyScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/KeyScopeListed";
+                }];
+            };
+            readonly KeyScopeListed: {
+                readonly title: "KeyScopeListed";
+                readonly description: "Exactly the listed keys, intersected with the entry's act scope.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "keys"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly keys: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 512;
+                        };
+                        readonly description: "Non-empty set of key identifiers. An empty array is invalid (it is neither `all` nor `none`).";
+                    };
+                };
+            };
+            readonly KeyScopeNone: {
+                readonly title: "KeyScopeNone";
+                readonly description: "No keys.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly KeyScopeAll: {
+                readonly title: "KeyScopeAll";
+                readonly description: "Every key the entry's act scope reaches.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "all";
+                    };
+                };
+            };
+            readonly ApproveCapabilityScope: {
+                readonly title: "ApproveCapabilityScope";
+                readonly description: "An explicit statement of the capabilities a subject may approve. Exactly one of `ceiling` (the role's full approve ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityRef.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CapabilityScopeCeiling";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/ApproveCapabilityScopeListed";
+                }];
+            };
+            readonly ApproveCapabilityScopeListed: {
+                readonly title: "ApproveCapabilityScopeListed";
+                readonly description: "Exactly the listed capabilities, intersected with the role's approve ceiling where the maintainer's roles define one.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "grants"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly grants: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityRef";
+                        };
+                        readonly description: "Non-empty list of approvable capabilities. An empty array is invalid.";
+                    };
+                };
+            };
+            readonly CapabilityRef: {
+                readonly title: "CapabilityRef";
+                readonly description: "A capability, optionally qualified by a resource. Used where a capability is named but not granted — a role's ceiling, a role's approve ceiling, an entry's approvable capabilities. An unqualified reference covers every resource of the capability's kind.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                };
+            };
+            readonly ResourceQualifier: {
+                readonly title: "ResourceQualifier";
+                readonly description: "Opaque qualifier naming the part of the maintainer's resources a capability applies to (e.g. `git-ns:github.com/acme`, `git-repo:github.com/acme/r#4211`, `policy:join`). Its grammar and containment rule are the maintainer's: a qualified capability covers the named resource and the resources inside it. A qualifier MUST NOT be read as widening the entry's act scope.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly Capability: {
+                readonly title: "Capability";
+                readonly description: "Opaque identifier of one administrative power in the maintainer's capability registry — lowercase dot-separated segments (e.g. `keys.sign`, `vtc.roles.assign`, `git.repo.manage`). A consumer MUST NOT treat a capability it does not recognise as granted.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)*$";
+            };
+            readonly CapabilityScopeNone: {
+                readonly title: "CapabilityScopeNone";
+                readonly description: "No capabilities on this axis.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly CapabilityScopeCeiling: {
+                readonly title: "CapabilityScopeCeiling";
+                readonly description: "The role's full ceiling on this axis, unnarrowed: what the role admits, the entry holds (or, for approvable capabilities, may approve). Stated, not implied — it is the explicit spelling of \"no narrowing\".";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "ceiling";
+                    };
+                };
+            };
+            readonly CapabilityScope: {
+                readonly title: "CapabilityScope";
+                readonly description: "An explicit statement of the capabilities an entry holds. Exactly one of three shapes, discriminated by `scope`: `ceiling` (the role's full ceiling), `none`, or `listed` with a NON-EMPTY list of CapabilityGrant. The empty list is invalid, not a fourth shape.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/CapabilityScopeCeiling";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/CapabilityScopeListed";
+                }];
+            };
+            readonly CapabilityScopeListed: {
+                readonly title: "CapabilityScopeListed";
+                readonly description: "Exactly the listed grants: (role ceiling ∩ non-additive grants) ∪ additive grants.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "grants"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "listed";
+                    };
+                    readonly grants: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly $ref: "#/$defs/CapabilityGrant";
+                        };
+                        readonly description: "Non-empty list of capability grants. An empty array is invalid (it is neither `ceiling` nor `none`).";
+                    };
+                };
+            };
+            readonly CapabilityGrant: {
+                readonly title: "CapabilityGrant";
+                readonly description: "A capability held by an entry, optionally qualified by a resource, optionally marked additive. A qualified grant confers nothing without a live entry for the same subject, and is bounded as delegated authority is.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly $ref: "#/$defs/Capability";
+                    };
+                    readonly resource: {
+                        readonly $ref: "#/$defs/ResourceQualifier";
+                        readonly description: "Optional qualifier. Absent covers every resource of the capability's kind.";
+                    };
+                    readonly additive: {
+                        readonly type: "boolean";
+                        readonly description: "`true` declares an ADDITIVE grant: a capability no role implies, granted to this entry beside its role rather than through it, and therefore not intersected with the role's ceiling. Granting one requires unrestricted act authority (`act: {scope: all}`) of the granter, and an entry never acquires one by virtue of its role. Absent or `false` → an ordinary grant, intersected with the role's ceiling, and refused when written if it lies outside it. A consumer MUST refuse `additive: true` on a capability the role's ceiling already includes, so that the flag cannot be used to make an ordinary capability survive a later role change.";
+                    };
+                };
+            };
+            readonly AuthorityScope: {
+                readonly title: "AuthorityScope";
+                readonly description: "An explicit authority scope — used for both the act scope and the approve scope of an entry. Exactly one of three shapes, discriminated by `scope`: `all`, `none`, or `contexts` with a NON-EMPTY list. The empty list is not a fourth shape: it is invalid, so a serializer that drops or empties the list produces a document that fails validation rather than one that silently means something else.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/AuthorityScopeAll";
+                }, {
+                    readonly $ref: "#/$defs/AuthorityScopeNone";
+                }, {
+                    readonly $ref: "#/$defs/AuthorityScopeContexts";
+                }];
+            };
+            readonly AuthorityScopeContexts: {
+                readonly title: "AuthorityScopeContexts";
+                readonly description: "The named contexts and, where the maintainer's contexts are hierarchical, every descendant of them — and nowhere else. `contexts` MUST carry at least one path.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope", "contexts"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "contexts";
+                    };
+                    readonly contexts: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/ContextPath";
+                        };
+                        readonly description: "Non-empty set of context paths. An empty array is invalid (it is neither `all` nor `none`).";
+                    };
+                };
+            };
+            readonly ContextPath: {
+                readonly title: "ContextPath";
+                readonly description: "Opaque identifier of one of the maintainer's contexts, compared by the maintainer's own ancestry predicate. Its grammar is the maintainer's.";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 512;
+            };
+            readonly AuthorityScopeNone: {
+                readonly title: "AuthorityScopeNone";
+                readonly description: "No authority on this axis. Stated, not implied: `none` is how an entry says it may not act (a least-privilege approver) or may not approve.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "none";
+                    };
+                };
+            };
+            readonly AuthorityScopeAll: {
+                readonly title: "AuthorityScopeAll";
+                readonly description: "Unrestricted: every context the maintainer holds, present and future. On the act axis this is a super-administrator (or, at a maintainer without contexts, an entry whose authority is not narrowed by location).";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["scope"];
+                readonly properties: {
+                    readonly scope: {
+                        readonly const: "all";
+                    };
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map