@openvtc/trust-tasks 0.8.2 → 0.10.0

package/dist/governance/capability/list/0.1/payload.d.ts

@@ -117,16 +117,532 @@ export type Payload = GovernanceCapabilityListPayload;
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/governance/capability/list/0.1#response";
 /** Stable alias for this specification's success-response payload shape. */
 export type Response = GovernanceCapabilityListResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/governance/capability/list/0.1";
+    readonly title: "Governance Capability List — payload";
+    readonly description: "List a community's capabilities and their manifests — the query behind a capability management surface. Defaults to enabled capabilities only.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly properties: {
+        readonly status: {
+            readonly type: "string";
+            readonly enum: readonly ["enabled", "available", "all"];
+            readonly description: "Which capabilities to list: `enabled` (the default when absent), `available` (known to the host but not enabled), or `all`.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Governance Capability List — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capabilities"];
+            readonly properties: {
+                readonly capabilities: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["manifest", "enabled"];
+                        readonly properties: {
+                            readonly manifest: {
+                                readonly $ref: "#/$defs/CapabilityManifest";
+                            };
+                            readonly enabled: {
+                                readonly type: "boolean";
+                            };
+                            readonly enabledAt: {
+                                readonly type: "string";
+                                readonly format: "date-time";
+                                readonly description: "When the capability was enabled, for enabled entries.";
+                            };
+                            readonly delegate: {
+                                readonly type: "string";
+                                readonly description: "DID of the companion serving this capability, when not built in.";
+                            };
+                        };
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly CapabilityManifest: {
+            readonly title: "CapabilityManifest";
+            readonly description: "The self-description of a pluggable community capability: the Trust Task families it serves, the trust-registry vocabulary it reads and writes, the roles that may operate it, the membership lifecycle hooks it consumes, and the external adapters that act on its decisions. The manifest is what governance approves, what discovery advertises, and what a management UX renders.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability", "version", "specs"];
+            readonly properties: {
+                readonly capability: {
+                    readonly type: "string";
+                    readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                    readonly description: "The capability's namespace slug, e.g. `git-trust`.";
+                };
+                readonly version: {
+                    readonly type: "string";
+                    readonly pattern: "^[0-9]+\\.[0-9]+$";
+                    readonly description: "Manifest/capability version, `MAJOR.MINOR`.";
+                };
+                readonly title: {
+                    readonly type: "string";
+                    readonly description: "Human-readable capability name for management surfaces.";
+                };
+                readonly description: {
+                    readonly type: "string";
+                    readonly description: "One-paragraph description for management surfaces.";
+                };
+                readonly specs: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Trust Task spec slugs (or `<family>/*` globs) this capability serves when enabled.";
+                };
+                readonly vocabulary: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly description: "The trust-registry tuple vocabulary this capability may read and write. A conforming host MUST reject writes by this capability whose `action` is not listed.";
+                    readonly required: readonly ["actions"];
+                    readonly properties: {
+                        readonly actions: {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                            readonly items: {
+                                readonly type: "string";
+                            };
+                            readonly description: "TRQP `action` values this capability owns, e.g. `git.commit.sign`.";
+                        };
+                        readonly resourcePattern: {
+                            readonly type: "string";
+                            readonly description: "Human-readable pattern of the `resource` values used, e.g. `<org>[/<repo>]`.";
+                        };
+                    };
+                };
+                readonly roles: {
+                    readonly type: "object";
+                    readonly additionalProperties: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                    };
+                    readonly description: "Map of capability operation (e.g. `grant`, `view`) to the community roles allowed to perform it.";
+                };
+                readonly lifecycleHooks: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Membership lifecycle events the capability consumes, e.g. `member.enrolled`, `member.revoked`, `role.changed`.";
+                };
+                readonly consentClass: {
+                    readonly type: "object";
+                    readonly additionalProperties: {
+                        readonly type: "string";
+                        readonly enum: readonly ["normal", "elevated", "destructive"];
+                    };
+                    readonly description: "Map of capability operation to the consent class its execution requires under the host's delegated-execution policy.";
+                };
+                readonly externalAdapters: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["kind", "ref"];
+                        readonly properties: {
+                            readonly kind: {
+                                readonly type: "string";
+                                readonly description: "Adapter type, e.g. `github-action`, `webhook`.";
+                            };
+                            readonly ref: {
+                                readonly type: "string";
+                                readonly description: "Where the adapter lives, e.g. a repository path or URL.";
+                            };
+                        };
+                    };
+                    readonly description: "Out-of-stack components that consume this capability's trust decisions.";
+                };
+                readonly configSchema: {
+                    readonly type: "string";
+                    readonly description: "Spec slug of the JSON schema the per-community `config` document must validate against.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Governance Capability List — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capabilities"];
+            readonly properties: {
+                readonly capabilities: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["manifest", "enabled"];
+                        readonly properties: {
+                            readonly manifest: {
+                                readonly $ref: "#/$defs/CapabilityManifest";
+                            };
+                            readonly enabled: {
+                                readonly type: "boolean";
+                            };
+                            readonly enabledAt: {
+                                readonly type: "string";
+                                readonly format: "date-time";
+                                readonly description: "When the capability was enabled, for enabled entries.";
+                            };
+                            readonly delegate: {
+                                readonly type: "string";
+                                readonly description: "DID of the companion serving this capability, when not built in.";
+                            };
+                        };
+                    };
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly CapabilityManifest: {
+            readonly title: "CapabilityManifest";
+            readonly description: "The self-description of a pluggable community capability: the Trust Task families it serves, the trust-registry vocabulary it reads and writes, the roles that may operate it, the membership lifecycle hooks it consumes, and the external adapters that act on its decisions. The manifest is what governance approves, what discovery advertises, and what a management UX renders.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["capability", "version", "specs"];
+            readonly properties: {
+                readonly capability: {
+                    readonly type: "string";
+                    readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                    readonly description: "The capability's namespace slug, e.g. `git-trust`.";
+                };
+                readonly version: {
+                    readonly type: "string";
+                    readonly pattern: "^[0-9]+\\.[0-9]+$";
+                    readonly description: "Manifest/capability version, `MAJOR.MINOR`.";
+                };
+                readonly title: {
+                    readonly type: "string";
+                    readonly description: "Human-readable capability name for management surfaces.";
+                };
+                readonly description: {
+                    readonly type: "string";
+                    readonly description: "One-paragraph description for management surfaces.";
+                };
+                readonly specs: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Trust Task spec slugs (or `<family>/*` globs) this capability serves when enabled.";
+                };
+                readonly vocabulary: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly description: "The trust-registry tuple vocabulary this capability may read and write. A conforming host MUST reject writes by this capability whose `action` is not listed.";
+                    readonly required: readonly ["actions"];
+                    readonly properties: {
+                        readonly actions: {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                            readonly items: {
+                                readonly type: "string";
+                            };
+                            readonly description: "TRQP `action` values this capability owns, e.g. `git.commit.sign`.";
+                        };
+                        readonly resourcePattern: {
+                            readonly type: "string";
+                            readonly description: "Human-readable pattern of the `resource` values used, e.g. `<org>[/<repo>]`.";
+                        };
+                    };
+                };
+                readonly roles: {
+                    readonly type: "object";
+                    readonly additionalProperties: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                    };
+                    readonly description: "Map of capability operation (e.g. `grant`, `view`) to the community roles allowed to perform it.";
+                };
+                readonly lifecycleHooks: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Membership lifecycle events the capability consumes, e.g. `member.enrolled`, `member.revoked`, `role.changed`.";
+                };
+                readonly consentClass: {
+                    readonly type: "object";
+                    readonly additionalProperties: {
+                        readonly type: "string";
+                        readonly enum: readonly ["normal", "elevated", "destructive"];
+                    };
+                    readonly description: "Map of capability operation to the consent class its execution requires under the host's delegated-execution policy.";
+                };
+                readonly externalAdapters: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["kind", "ref"];
+                        readonly properties: {
+                            readonly kind: {
+                                readonly type: "string";
+                                readonly description: "Adapter type, e.g. `github-action`, `webhook`.";
+                            };
+                            readonly ref: {
+                                readonly type: "string";
+                                readonly description: "Where the adapter lives, e.g. a repository path or URL.";
+                            };
+                        };
+                    };
+                    readonly description: "Out-of-stack components that consume this capability's trust decisions.";
+                };
+                readonly configSchema: {
+                    readonly type: "string";
+                    readonly description: "Spec slug of the JSON schema the per-community `config` document must validate against.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+    };
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export declare const SPEC: {
     readonly typeUri: "https://trusttasks.org/spec/governance/capability/list/0.1";
     readonly isBearer: false;
     readonly isProofRequired: false;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/governance/capability/list/0.1";
+        readonly title: "Governance Capability List — payload";
+        readonly description: "List a community's capabilities and their manifests — the query behind a capability management surface. Defaults to enabled capabilities only.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly properties: {
+            readonly status: {
+                readonly type: "string";
+                readonly enum: readonly ["enabled", "available", "all"];
+                readonly description: "Which capabilities to list: `enabled` (the default when absent), `available` (known to the host but not enabled), or `all`.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Governance Capability List — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capabilities"];
+                readonly properties: {
+                    readonly capabilities: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["manifest", "enabled"];
+                            readonly properties: {
+                                readonly manifest: {
+                                    readonly $ref: "#/$defs/CapabilityManifest";
+                                };
+                                readonly enabled: {
+                                    readonly type: "boolean";
+                                };
+                                readonly enabledAt: {
+                                    readonly type: "string";
+                                    readonly format: "date-time";
+                                    readonly description: "When the capability was enabled, for enabled entries.";
+                                };
+                                readonly delegate: {
+                                    readonly type: "string";
+                                    readonly description: "DID of the companion serving this capability, when not built in.";
+                                };
+                            };
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly CapabilityManifest: {
+                readonly title: "CapabilityManifest";
+                readonly description: "The self-description of a pluggable community capability: the Trust Task families it serves, the trust-registry vocabulary it reads and writes, the roles that may operate it, the membership lifecycle hooks it consumes, and the external adapters that act on its decisions. The manifest is what governance approves, what discovery advertises, and what a management UX renders.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability", "version", "specs"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly type: "string";
+                        readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                        readonly description: "The capability's namespace slug, e.g. `git-trust`.";
+                    };
+                    readonly version: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9]+\\.[0-9]+$";
+                        readonly description: "Manifest/capability version, `MAJOR.MINOR`.";
+                    };
+                    readonly title: {
+                        readonly type: "string";
+                        readonly description: "Human-readable capability name for management surfaces.";
+                    };
+                    readonly description: {
+                        readonly type: "string";
+                        readonly description: "One-paragraph description for management surfaces.";
+                    };
+                    readonly specs: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Trust Task spec slugs (or `<family>/*` globs) this capability serves when enabled.";
+                    };
+                    readonly vocabulary: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly description: "The trust-registry tuple vocabulary this capability may read and write. A conforming host MUST reject writes by this capability whose `action` is not listed.";
+                        readonly required: readonly ["actions"];
+                        readonly properties: {
+                            readonly actions: {
+                                readonly type: "array";
+                                readonly minItems: 1;
+                                readonly items: {
+                                    readonly type: "string";
+                                };
+                                readonly description: "TRQP `action` values this capability owns, e.g. `git.commit.sign`.";
+                            };
+                            readonly resourcePattern: {
+                                readonly type: "string";
+                                readonly description: "Human-readable pattern of the `resource` values used, e.g. `<org>[/<repo>]`.";
+                            };
+                        };
+                    };
+                    readonly roles: {
+                        readonly type: "object";
+                        readonly additionalProperties: {
+                            readonly type: "array";
+                            readonly items: {
+                                readonly type: "string";
+                            };
+                        };
+                        readonly description: "Map of capability operation (e.g. `grant`, `view`) to the community roles allowed to perform it.";
+                    };
+                    readonly lifecycleHooks: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Membership lifecycle events the capability consumes, e.g. `member.enrolled`, `member.revoked`, `role.changed`.";
+                    };
+                    readonly consentClass: {
+                        readonly type: "object";
+                        readonly additionalProperties: {
+                            readonly type: "string";
+                            readonly enum: readonly ["normal", "elevated", "destructive"];
+                        };
+                        readonly description: "Map of capability operation to the consent class its execution requires under the host's delegated-execution policy.";
+                    };
+                    readonly externalAdapters: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["kind", "ref"];
+                            readonly properties: {
+                                readonly kind: {
+                                    readonly type: "string";
+                                    readonly description: "Adapter type, e.g. `github-action`, `webhook`.";
+                                };
+                                readonly ref: {
+                                    readonly type: "string";
+                                    readonly description: "Where the adapter lives, e.g. a repository path or URL.";
+                                };
+                            };
+                        };
+                        readonly description: "Out-of-stack components that consume this capability's trust decisions.";
+                    };
+                    readonly configSchema: {
+                        readonly type: "string";
+                        readonly description: "Spec slug of the JSON schema the per-community `config` document must validate against.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+        };
+    };
 };
 /**
  * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
@@ -138,5 +654,164 @@ export declare const RESPONSE_SPEC: {
     readonly isBearer: false;
     readonly isProofRequired: false;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Governance Capability List — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capabilities"];
+                readonly properties: {
+                    readonly capabilities: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["manifest", "enabled"];
+                            readonly properties: {
+                                readonly manifest: {
+                                    readonly $ref: "#/$defs/CapabilityManifest";
+                                };
+                                readonly enabled: {
+                                    readonly type: "boolean";
+                                };
+                                readonly enabledAt: {
+                                    readonly type: "string";
+                                    readonly format: "date-time";
+                                    readonly description: "When the capability was enabled, for enabled entries.";
+                                };
+                                readonly delegate: {
+                                    readonly type: "string";
+                                    readonly description: "DID of the companion serving this capability, when not built in.";
+                                };
+                            };
+                        };
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly CapabilityManifest: {
+                readonly title: "CapabilityManifest";
+                readonly description: "The self-description of a pluggable community capability: the Trust Task families it serves, the trust-registry vocabulary it reads and writes, the roles that may operate it, the membership lifecycle hooks it consumes, and the external adapters that act on its decisions. The manifest is what governance approves, what discovery advertises, and what a management UX renders.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["capability", "version", "specs"];
+                readonly properties: {
+                    readonly capability: {
+                        readonly type: "string";
+                        readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                        readonly description: "The capability's namespace slug, e.g. `git-trust`.";
+                    };
+                    readonly version: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9]+\\.[0-9]+$";
+                        readonly description: "Manifest/capability version, `MAJOR.MINOR`.";
+                    };
+                    readonly title: {
+                        readonly type: "string";
+                        readonly description: "Human-readable capability name for management surfaces.";
+                    };
+                    readonly description: {
+                        readonly type: "string";
+                        readonly description: "One-paragraph description for management surfaces.";
+                    };
+                    readonly specs: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Trust Task spec slugs (or `<family>/*` globs) this capability serves when enabled.";
+                    };
+                    readonly vocabulary: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly description: "The trust-registry tuple vocabulary this capability may read and write. A conforming host MUST reject writes by this capability whose `action` is not listed.";
+                        readonly required: readonly ["actions"];
+                        readonly properties: {
+                            readonly actions: {
+                                readonly type: "array";
+                                readonly minItems: 1;
+                                readonly items: {
+                                    readonly type: "string";
+                                };
+                                readonly description: "TRQP `action` values this capability owns, e.g. `git.commit.sign`.";
+                            };
+                            readonly resourcePattern: {
+                                readonly type: "string";
+                                readonly description: "Human-readable pattern of the `resource` values used, e.g. `<org>[/<repo>]`.";
+                            };
+                        };
+                    };
+                    readonly roles: {
+                        readonly type: "object";
+                        readonly additionalProperties: {
+                            readonly type: "array";
+                            readonly items: {
+                                readonly type: "string";
+                            };
+                        };
+                        readonly description: "Map of capability operation (e.g. `grant`, `view`) to the community roles allowed to perform it.";
+                    };
+                    readonly lifecycleHooks: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Membership lifecycle events the capability consumes, e.g. `member.enrolled`, `member.revoked`, `role.changed`.";
+                    };
+                    readonly consentClass: {
+                        readonly type: "object";
+                        readonly additionalProperties: {
+                            readonly type: "string";
+                            readonly enum: readonly ["normal", "elevated", "destructive"];
+                        };
+                        readonly description: "Map of capability operation to the consent class its execution requires under the host's delegated-execution policy.";
+                    };
+                    readonly externalAdapters: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["kind", "ref"];
+                            readonly properties: {
+                                readonly kind: {
+                                    readonly type: "string";
+                                    readonly description: "Adapter type, e.g. `github-action`, `webhook`.";
+                                };
+                                readonly ref: {
+                                    readonly type: "string";
+                                    readonly description: "Where the adapter lives, e.g. a repository path or URL.";
+                                };
+                            };
+                        };
+                        readonly description: "Out-of-stack components that consume this capability's trust decisions.";
+                    };
+                    readonly configSchema: {
+                        readonly type: "string";
+                        readonly description: "Spec slug of the JSON schema the per-community `config` document must validate against.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+        };
+    };
 };
 //# sourceMappingURL=payload.d.ts.map