@openvtc/trust-tasks 0.8.2 → 0.10.0

package/dist/governance/capability/enable/0.1/payload.d.ts

@@ -132,16 +132,556 @@ export type Payload = GovernanceCapabilityEnablePayload;
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/governance/capability/enable/0.1#response";
 /** Stable alias for this specification's success-response payload shape. */
 export type Response = GovernanceCapabilityEnableResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/governance/capability/enable/0.1";
+    readonly title: "Governance Capability Enable — payload";
+    readonly description: "A community operator enables a pluggable capability for a community. Activation registers the capability's Trust Task handlers, advertises it in discovery, and starts its lifecycle hooks; a community with no enable record carries none of the capability's records, surfaces, or attack surface.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["capability", "version"];
+    readonly dependentRequired: {
+        readonly delegate: readonly ["manifest"];
+    };
+    readonly properties: {
+        readonly capability: {
+            readonly type: "string";
+            readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+            readonly description: "Namespace slug of the capability to enable, e.g. `git-trust`.";
+        };
+        readonly version: {
+            readonly type: "string";
+            readonly pattern: "^[0-9]+\\.[0-9]+$";
+            readonly description: "Capability version to enable.";
+        };
+        readonly config: {
+            readonly type: "object";
+            readonly description: "Per-community configuration. Opaque to the framework; the recipient MUST validate it against the schema named by the capability manifest's `configSchema` and reject `config_invalid` on mismatch.";
+        };
+        readonly delegate: {
+            readonly type: "string";
+            readonly description: "DID of the companion service that serves this capability, for capabilities not built into the host. When present, the host records a namespace delegation to this DID and `manifest` is REQUIRED (the host cannot know a companion's manifest a priori).";
+        };
+        readonly manifest: {
+            readonly $ref: "#/$defs/CapabilityManifest";
+            readonly description: "The capability's manifest. OPTIONAL for built-in capabilities (the host knows it); REQUIRED when `delegate` is present.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Governance Capability Enable — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability", "enabled"];
+            readonly properties: {
+                readonly capability: {
+                    readonly type: "string";
+                };
+                readonly version: {
+                    readonly type: "string";
+                };
+                readonly enabled: {
+                    readonly type: "boolean";
+                    readonly description: "True once the capability is active for the community.";
+                };
+                readonly enabledAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the enablement took effect, per the host clock.";
+                };
+                readonly message: {
+                    readonly type: "string";
+                    readonly description: "Additional human-readable detail.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly CapabilityManifest: {
+            readonly title: "CapabilityManifest";
+            readonly description: "The self-description of a pluggable community capability: the Trust Task families it serves, the trust-registry vocabulary it reads and writes, the roles that may operate it, the membership lifecycle hooks it consumes, and the external adapters that act on its decisions. The manifest is what governance approves, what discovery advertises, and what a management UX renders.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability", "version", "specs"];
+            readonly properties: {
+                readonly capability: {
+                    readonly type: "string";
+                    readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                    readonly description: "The capability's namespace slug, e.g. `git-trust`.";
+                };
+                readonly version: {
+                    readonly type: "string";
+                    readonly pattern: "^[0-9]+\\.[0-9]+$";
+                    readonly description: "Manifest/capability version, `MAJOR.MINOR`.";
+                };
+                readonly title: {
+                    readonly type: "string";
+                    readonly description: "Human-readable capability name for management surfaces.";
+                };
+                readonly description: {
+                    readonly type: "string";
+                    readonly description: "One-paragraph description for management surfaces.";
+                };
+                readonly specs: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Trust Task spec slugs (or `<family>/*` globs) this capability serves when enabled.";
+                };
+                readonly vocabulary: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly description: "The trust-registry tuple vocabulary this capability may read and write. A conforming host MUST reject writes by this capability whose `action` is not listed.";
+                    readonly required: readonly ["actions"];
+                    readonly properties: {
+                        readonly actions: {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                            readonly items: {
+                                readonly type: "string";
+                            };
+                            readonly description: "TRQP `action` values this capability owns, e.g. `git.commit.sign`.";
+                        };
+                        readonly resourcePattern: {
+                            readonly type: "string";
+                            readonly description: "Human-readable pattern of the `resource` values used, e.g. `<org>[/<repo>]`.";
+                        };
+                    };
+                };
+                readonly roles: {
+                    readonly type: "object";
+                    readonly additionalProperties: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                    };
+                    readonly description: "Map of capability operation (e.g. `grant`, `view`) to the community roles allowed to perform it.";
+                };
+                readonly lifecycleHooks: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Membership lifecycle events the capability consumes, e.g. `member.enrolled`, `member.revoked`, `role.changed`.";
+                };
+                readonly consentClass: {
+                    readonly type: "object";
+                    readonly additionalProperties: {
+                        readonly type: "string";
+                        readonly enum: readonly ["normal", "elevated", "destructive"];
+                    };
+                    readonly description: "Map of capability operation to the consent class its execution requires under the host's delegated-execution policy.";
+                };
+                readonly externalAdapters: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["kind", "ref"];
+                        readonly properties: {
+                            readonly kind: {
+                                readonly type: "string";
+                                readonly description: "Adapter type, e.g. `github-action`, `webhook`.";
+                            };
+                            readonly ref: {
+                                readonly type: "string";
+                                readonly description: "Where the adapter lives, e.g. a repository path or URL.";
+                            };
+                        };
+                    };
+                    readonly description: "Out-of-stack components that consume this capability's trust decisions.";
+                };
+                readonly configSchema: {
+                    readonly type: "string";
+                    readonly description: "Spec slug of the JSON schema the per-community `config` document must validate against.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Governance Capability Enable — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability", "enabled"];
+            readonly properties: {
+                readonly capability: {
+                    readonly type: "string";
+                };
+                readonly version: {
+                    readonly type: "string";
+                };
+                readonly enabled: {
+                    readonly type: "boolean";
+                    readonly description: "True once the capability is active for the community.";
+                };
+                readonly enabledAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the enablement took effect, per the host clock.";
+                };
+                readonly message: {
+                    readonly type: "string";
+                    readonly description: "Additional human-readable detail.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly CapabilityManifest: {
+            readonly title: "CapabilityManifest";
+            readonly description: "The self-description of a pluggable community capability: the Trust Task families it serves, the trust-registry vocabulary it reads and writes, the roles that may operate it, the membership lifecycle hooks it consumes, and the external adapters that act on its decisions. The manifest is what governance approves, what discovery advertises, and what a management UX renders.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability", "version", "specs"];
+            readonly properties: {
+                readonly capability: {
+                    readonly type: "string";
+                    readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                    readonly description: "The capability's namespace slug, e.g. `git-trust`.";
+                };
+                readonly version: {
+                    readonly type: "string";
+                    readonly pattern: "^[0-9]+\\.[0-9]+$";
+                    readonly description: "Manifest/capability version, `MAJOR.MINOR`.";
+                };
+                readonly title: {
+                    readonly type: "string";
+                    readonly description: "Human-readable capability name for management surfaces.";
+                };
+                readonly description: {
+                    readonly type: "string";
+                    readonly description: "One-paragraph description for management surfaces.";
+                };
+                readonly specs: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Trust Task spec slugs (or `<family>/*` globs) this capability serves when enabled.";
+                };
+                readonly vocabulary: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly description: "The trust-registry tuple vocabulary this capability may read and write. A conforming host MUST reject writes by this capability whose `action` is not listed.";
+                    readonly required: readonly ["actions"];
+                    readonly properties: {
+                        readonly actions: {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                            readonly items: {
+                                readonly type: "string";
+                            };
+                            readonly description: "TRQP `action` values this capability owns, e.g. `git.commit.sign`.";
+                        };
+                        readonly resourcePattern: {
+                            readonly type: "string";
+                            readonly description: "Human-readable pattern of the `resource` values used, e.g. `<org>[/<repo>]`.";
+                        };
+                    };
+                };
+                readonly roles: {
+                    readonly type: "object";
+                    readonly additionalProperties: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                    };
+                    readonly description: "Map of capability operation (e.g. `grant`, `view`) to the community roles allowed to perform it.";
+                };
+                readonly lifecycleHooks: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Membership lifecycle events the capability consumes, e.g. `member.enrolled`, `member.revoked`, `role.changed`.";
+                };
+                readonly consentClass: {
+                    readonly type: "object";
+                    readonly additionalProperties: {
+                        readonly type: "string";
+                        readonly enum: readonly ["normal", "elevated", "destructive"];
+                    };
+                    readonly description: "Map of capability operation to the consent class its execution requires under the host's delegated-execution policy.";
+                };
+                readonly externalAdapters: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["kind", "ref"];
+                        readonly properties: {
+                            readonly kind: {
+                                readonly type: "string";
+                                readonly description: "Adapter type, e.g. `github-action`, `webhook`.";
+                            };
+                            readonly ref: {
+                                readonly type: "string";
+                                readonly description: "Where the adapter lives, e.g. a repository path or URL.";
+                            };
+                        };
+                    };
+                    readonly description: "Out-of-stack components that consume this capability's trust decisions.";
+                };
+                readonly configSchema: {
+                    readonly type: "string";
+                    readonly description: "Spec slug of the JSON schema the per-community `config` document must validate against.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+    };
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export declare const SPEC: {
     readonly typeUri: "https://trusttasks.org/spec/governance/capability/enable/0.1";
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/governance/capability/enable/0.1";
+        readonly title: "Governance Capability Enable — payload";
+        readonly description: "A community operator enables a pluggable capability for a community. Activation registers the capability's Trust Task handlers, advertises it in discovery, and starts its lifecycle hooks; a community with no enable record carries none of the capability's records, surfaces, or attack surface.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["capability", "version"];
+        readonly dependentRequired: {
+            readonly delegate: readonly ["manifest"];
+        };
+        readonly properties: {
+            readonly capability: {
+                readonly type: "string";
+                readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                readonly description: "Namespace slug of the capability to enable, e.g. `git-trust`.";
+            };
+            readonly version: {
+                readonly type: "string";
+                readonly pattern: "^[0-9]+\\.[0-9]+$";
+                readonly description: "Capability version to enable.";
+            };
+            readonly config: {
+                readonly type: "object";
+                readonly description: "Per-community configuration. Opaque to the framework; the recipient MUST validate it against the schema named by the capability manifest's `configSchema` and reject `config_invalid` on mismatch.";
+            };
+            readonly delegate: {
+                readonly type: "string";
+                readonly description: "DID of the companion service that serves this capability, for capabilities not built into the host. When present, the host records a namespace delegation to this DID and `manifest` is REQUIRED (the host cannot know a companion's manifest a priori).";
+            };
+            readonly manifest: {
+                readonly $ref: "#/$defs/CapabilityManifest";
+                readonly description: "The capability's manifest. OPTIONAL for built-in capabilities (the host knows it); REQUIRED when `delegate` is present.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Governance Capability Enable — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability", "enabled"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly type: "string";
+                    };
+                    readonly version: {
+                        readonly type: "string";
+                    };
+                    readonly enabled: {
+                        readonly type: "boolean";
+                        readonly description: "True once the capability is active for the community.";
+                    };
+                    readonly enabledAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the enablement took effect, per the host clock.";
+                    };
+                    readonly message: {
+                        readonly type: "string";
+                        readonly description: "Additional human-readable detail.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly CapabilityManifest: {
+                readonly title: "CapabilityManifest";
+                readonly description: "The self-description of a pluggable community capability: the Trust Task families it serves, the trust-registry vocabulary it reads and writes, the roles that may operate it, the membership lifecycle hooks it consumes, and the external adapters that act on its decisions. The manifest is what governance approves, what discovery advertises, and what a management UX renders.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability", "version", "specs"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly type: "string";
+                        readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                        readonly description: "The capability's namespace slug, e.g. `git-trust`.";
+                    };
+                    readonly version: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9]+\\.[0-9]+$";
+                        readonly description: "Manifest/capability version, `MAJOR.MINOR`.";
+                    };
+                    readonly title: {
+                        readonly type: "string";
+                        readonly description: "Human-readable capability name for management surfaces.";
+                    };
+                    readonly description: {
+                        readonly type: "string";
+                        readonly description: "One-paragraph description for management surfaces.";
+                    };
+                    readonly specs: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Trust Task spec slugs (or `<family>/*` globs) this capability serves when enabled.";
+                    };
+                    readonly vocabulary: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly description: "The trust-registry tuple vocabulary this capability may read and write. A conforming host MUST reject writes by this capability whose `action` is not listed.";
+                        readonly required: readonly ["actions"];
+                        readonly properties: {
+                            readonly actions: {
+                                readonly type: "array";
+                                readonly minItems: 1;
+                                readonly items: {
+                                    readonly type: "string";
+                                };
+                                readonly description: "TRQP `action` values this capability owns, e.g. `git.commit.sign`.";
+                            };
+                            readonly resourcePattern: {
+                                readonly type: "string";
+                                readonly description: "Human-readable pattern of the `resource` values used, e.g. `<org>[/<repo>]`.";
+                            };
+                        };
+                    };
+                    readonly roles: {
+                        readonly type: "object";
+                        readonly additionalProperties: {
+                            readonly type: "array";
+                            readonly items: {
+                                readonly type: "string";
+                            };
+                        };
+                        readonly description: "Map of capability operation (e.g. `grant`, `view`) to the community roles allowed to perform it.";
+                    };
+                    readonly lifecycleHooks: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Membership lifecycle events the capability consumes, e.g. `member.enrolled`, `member.revoked`, `role.changed`.";
+                    };
+                    readonly consentClass: {
+                        readonly type: "object";
+                        readonly additionalProperties: {
+                            readonly type: "string";
+                            readonly enum: readonly ["normal", "elevated", "destructive"];
+                        };
+                        readonly description: "Map of capability operation to the consent class its execution requires under the host's delegated-execution policy.";
+                    };
+                    readonly externalAdapters: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["kind", "ref"];
+                            readonly properties: {
+                                readonly kind: {
+                                    readonly type: "string";
+                                    readonly description: "Adapter type, e.g. `github-action`, `webhook`.";
+                                };
+                                readonly ref: {
+                                    readonly type: "string";
+                                    readonly description: "Where the adapter lives, e.g. a repository path or URL.";
+                                };
+                            };
+                        };
+                        readonly description: "Out-of-stack components that consume this capability's trust decisions.";
+                    };
+                    readonly configSchema: {
+                        readonly type: "string";
+                        readonly description: "Spec slug of the JSON schema the per-community `config` document must validate against.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+        };
+    };
 };
 /**
  * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
@@ -153,5 +693,158 @@ export declare const RESPONSE_SPEC: {
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Governance Capability Enable — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability", "enabled"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly type: "string";
+                    };
+                    readonly version: {
+                        readonly type: "string";
+                    };
+                    readonly enabled: {
+                        readonly type: "boolean";
+                        readonly description: "True once the capability is active for the community.";
+                    };
+                    readonly enabledAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the enablement took effect, per the host clock.";
+                    };
+                    readonly message: {
+                        readonly type: "string";
+                        readonly description: "Additional human-readable detail.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly CapabilityManifest: {
+                readonly title: "CapabilityManifest";
+                readonly description: "The self-description of a pluggable community capability: the Trust Task families it serves, the trust-registry vocabulary it reads and writes, the roles that may operate it, the membership lifecycle hooks it consumes, and the external adapters that act on its decisions. The manifest is what governance approves, what discovery advertises, and what a management UX renders.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability", "version", "specs"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly type: "string";
+                        readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                        readonly description: "The capability's namespace slug, e.g. `git-trust`.";
+                    };
+                    readonly version: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9]+\\.[0-9]+$";
+                        readonly description: "Manifest/capability version, `MAJOR.MINOR`.";
+                    };
+                    readonly title: {
+                        readonly type: "string";
+                        readonly description: "Human-readable capability name for management surfaces.";
+                    };
+                    readonly description: {
+                        readonly type: "string";
+                        readonly description: "One-paragraph description for management surfaces.";
+                    };
+                    readonly specs: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Trust Task spec slugs (or `<family>/*` globs) this capability serves when enabled.";
+                    };
+                    readonly vocabulary: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly description: "The trust-registry tuple vocabulary this capability may read and write. A conforming host MUST reject writes by this capability whose `action` is not listed.";
+                        readonly required: readonly ["actions"];
+                        readonly properties: {
+                            readonly actions: {
+                                readonly type: "array";
+                                readonly minItems: 1;
+                                readonly items: {
+                                    readonly type: "string";
+                                };
+                                readonly description: "TRQP `action` values this capability owns, e.g. `git.commit.sign`.";
+                            };
+                            readonly resourcePattern: {
+                                readonly type: "string";
+                                readonly description: "Human-readable pattern of the `resource` values used, e.g. `<org>[/<repo>]`.";
+                            };
+                        };
+                    };
+                    readonly roles: {
+                        readonly type: "object";
+                        readonly additionalProperties: {
+                            readonly type: "array";
+                            readonly items: {
+                                readonly type: "string";
+                            };
+                        };
+                        readonly description: "Map of capability operation (e.g. `grant`, `view`) to the community roles allowed to perform it.";
+                    };
+                    readonly lifecycleHooks: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Membership lifecycle events the capability consumes, e.g. `member.enrolled`, `member.revoked`, `role.changed`.";
+                    };
+                    readonly consentClass: {
+                        readonly type: "object";
+                        readonly additionalProperties: {
+                            readonly type: "string";
+                            readonly enum: readonly ["normal", "elevated", "destructive"];
+                        };
+                        readonly description: "Map of capability operation to the consent class its execution requires under the host's delegated-execution policy.";
+                    };
+                    readonly externalAdapters: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["kind", "ref"];
+                            readonly properties: {
+                                readonly kind: {
+                                    readonly type: "string";
+                                    readonly description: "Adapter type, e.g. `github-action`, `webhook`.";
+                                };
+                                readonly ref: {
+                                    readonly type: "string";
+                                    readonly description: "Where the adapter lives, e.g. a repository path or URL.";
+                                };
+                            };
+                        };
+                        readonly description: "Out-of-stack components that consume this capability's trust decisions.";
+                    };
+                    readonly configSchema: {
+                        readonly type: "string";
+                        readonly description: "Spec slug of the JSON schema the per-community `config` document must validate against.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+        };
+    };
 };
 //# sourceMappingURL=payload.d.ts.map