@ziffer-io/types 0.1.0

package/dist/generated.d.ts

@@ -0,0 +1,1696 @@
+/**
+ * AS0 software key · AS1 multi-factor-protected key · AS2 hardware-bound
+ * key. Ordered: AS0 < AS1 < AS2, and AT-10 compares an entry's level against
+ * the registry floor with >=, so the ordering is load-bearing — a chain like
+ * §4's custody tiers and floors' resource tiers, NOT like suites, whose
+ * floor is containment (CR-4) precisely because suites do not rank.
+ * Correspondence, stated so the M-A annex can cite it and a buyer can map
+ * it: AS1 is the arrangement NIST SP 800-63B calls AAL2 (multi-factor,
+ * software permitted), AS2 is AAL3's (hardware authenticator). The names are
+ * this specification's own because an external framework's labels move on
+ * that framework's schedule.
+ * Generated from attesters.schema.json#/$defs/assurance.
+ */
+export type Assurance = 'AS0' | 'AS1' | 'AS2';
+/**
+ * Assurance low to high, from the schema's declared order.
+ *
+ * TypeScript has no derived ordering, so the ladder is a value and the
+ * comparison is a function. §8.4 composes with max, so `max` is what
+ * callers need and index arithmetic is what they must not write.
+ */
+export declare const ASSURANCE_ORDER: readonly Assurance[];
+export declare function maxAssurance(a: Assurance, b: Assurance): Assurance;
+/**
+ * Which of the two acknowledgement duties an enrolled identity may
+ * discharge.
+ *
+ * Hoisted into `$defs` for the same reason `reversibility` was: an inline
+ * enum has no name, and a generator inventing one invents a name that
+ * drifts.
+ *
+ * DELIBERATELY NOT ORDERED. A confirmer does not outrank an approver; they
+ * are different duties, and DR-9's separation is enforced per action against
+ * the proposer rather than by comparing roles.
+ * Generated from attesters.schema.json#/$defs/attester_role.
+ */
+export type AttesterRole = 'approver' | 'confirmer';
+/**
+ * The credential's public key as a COSE_Key (RFC 9052) map, canonical CBOR,
+ * base64, holding EXACTLY the labels kty, crv, x and (for EC2) y and nothing
+ * else. Every real authenticator also returns label 3 (alg); the enrolling
+ * service strips it before the entry is written, because a key that admits
+ * two encodings is two `public_key` strings for one credential, and PB-7's
+ * distinctness over `public_key` would then see one holder as two. The
+ * verifier refuses label 3 at load as Malformed rather than tolerating it,
+ * so the one encoding is the one the registry can hold. Not re-encoded to a
+ * raw point either, for AB-1's reason: a re-encoding is a second definition
+ * of the key. The verifier decodes it (kty EC2 / P-256 for `webauthn-es256`;
+ * kty OKP / Ed25519 for `webauthn-ed25519`) and refuses at load a key whose
+ * kty/crv/alg do not match the entry's `alg`, a P-256 point not on the
+ * curve, or an Ed25519 point of small order (HM-5, PB-9).
+ * Generated from attesters.schema.json#/$defs/cose_key.
+ *
+ * The schema constrains this to `^[A-Za-z0-9+/]{40,}={0,2}$`, which is NOT enforced here.
+ */
+export type CoseKey = string;
+/**
+ * The authenticator's credential id from registration, base64 (the
+ * registry's encoding, as `ed25519_pub` and `mldsa65_pub` are). Not a secret
+ * and not a key: it names the credential, and the Consumption Ledger keys
+ * the signature counter on it (HM-4 (f)).
+ * Generated from attesters.schema.json#/$defs/credential_id.
+ *
+ * The schema constrains this to `^[A-Za-z0-9+/]{20,}={0,2}$`, which is NOT enforced here.
+ */
+export type CredentialId = string;
+/**
+ * Ed25519 verification key (RFC 8032), base64. 32 bytes raw; the decoded
+ * length is asserted in code, because a base64 string of the wrong length is
+ * well-formed JSON and a schema pattern alone would let a truncated key
+ * through.
+ * Generated from attesters.schema.json#/$defs/ed25519_pub.
+ *
+ * The schema constrains this to `^[A-Za-z0-9+/]{43}=$`, which is NOT enforced here.
+ */
+export type Ed25519PublicKey = string;
+/**
+ * F-HIGH: no free text reaches the Proposal; every field is a bounded
+ * scalar, constrained string, enum or fixed-shape nested model, so
+ * instruction injection into the Proposal is grammatically impossible.
+ * F-LOW: a translator model produced the Proposal from free text, injection
+ * into the TRANSLATION STEP is possible by construction, and containment
+ * rests on capability limits, confirmation and receipts -- never on ingress
+ * hygiene (FC-1, FC-3). Exactly one class per adapter.
+ *
+ * DELIBERATELY UNORDERED. There is no `x-acp-ordered` here and there must
+ * not be. The two classes are not ranked: FC-2 conditions on the class and
+ * requires confirmation for F-LOW at effective tier >= T2, which is a case
+ * distinction, not a comparison. An ordering invented for convenience would
+ * invite `>=` against a value that has no scale, which is the
+ * tier-versus-risk conflation this repository has already published a
+ * correction for -- and the names point the wrong way for a ladder, since
+ * here HIGH is the safer class.
+ *
+ * THIS IS ALSO THE WIRE ROOT'S `FidelityClass` (ACP-73). It was declared in
+ * `spec/schemas/wire/proposal.schema.json` until this table existed, and
+ * `proposal`, `decision_receipt` and `audit_record` now `$ref` this
+ * declaration across roots rather than restating it, for the reason
+ * `SuiteId` is homed in `signature.schema.json`: TR-8 compares the receipt's
+ * transmitted `fidelity` against the class registered HERE, and two enums
+ * that merely look alike is that comparison passing on a vocabulary nobody
+ * checked. The signed side owns the vocabulary; the wire carries it.
+ * Generated from adapters.schema.json#/$defs/fidelity_class.
+ */
+export type FidelityClass = 'F-HIGH' | 'F-LOW';
+/**
+ * ML-DSA-65 verification key (FIPS 204), base64. 1952 bytes raw. Its size is
+ * why hybrid receipts run 13.2 kB against 256 B classical-only — a 53x wire
+ * increase that is algorithm-bound and does not improve with a faster
+ * library.
+ * Generated from attesters.schema.json#/$defs/mldsa65_pub.
+ *
+ * The schema constrains this to `^[A-Za-z0-9+/]{2603}=$`, which is NOT enforced here.
+ */
+export type MlDsa65PublicKey = string;
+/**
+ * A primitive NAME as it appears on the wire.
+ *
+ * `pq-slh` is declared and NOT implemented. It keeps its own name and fails
+ * closed — aliasing it to `pq` would let a verifier report success for a
+ * primitive it cannot compute, which is the one thing an unimplemented
+ * primitive must never do.
+ * Generated from signature.schema.json#/$defs/primitive.
+ */
+export type PrimitiveName = 'classical' | 'pq' | 'pq-slh';
+/**
+ * Whether an action class can be undone.
+ *
+ * Hoisted out of `additionalProperties` into `$defs` so that it has a NAME.
+ * An inline enum is a type the generator has to invent a name for, and an
+ * invented name is a name that drifts — `floors.schema.json` already
+ * declared its values under `$defs.tier` and this file did not, which is a
+ * difference with no reason behind it.
+ *
+ * DELIBERATELY NOT ORDERED. REVERSIBLE and IRREVERSIBLE are two cases, not a
+ * scale; a generated `Ord` would invite `max` composition that means nothing
+ * here.
+ * Generated from reversibility.schema.json#/$defs/reversibility.
+ */
+export type Reversibility = 'REVERSIBLE' | 'IRREVERSIBLE';
+/**
+ * Ordered LOW < MEDIUM < HIGH. §8.4 composes with max.
+ *
+ * A RISK LEVEL IS NOT A RESOURCE TIER. This is a different ladder from
+ * `floors.schema.json`'s T0..T3, over a different subject, and §8.4 composes
+ * both with max — which is exactly why one type served for both until
+ * someone looked. The Rust and TypeScript definitions carried a single
+ * `RiskTier` enum whose doc comment cited RK-1's absent-⇒-T3 rule and whose
+ * values were LOW/MEDIUM/HIGH, so the fail-safe default was stated in the
+ * wrong domain in both. Generated separately, and named separately, for that
+ * reason.
+ * Generated from risk_functions.schema.json#/$defs/risk.
+ */
+export type Risk = 'LOW' | 'MEDIUM' | 'HIGH';
+/**
+ * Risk low to high, from the schema's declared order.
+ *
+ * TypeScript has no derived ordering, so the ladder is a value and the
+ * comparison is a function. §8.4 composes with max, so `max` is what
+ * callers need and index arithmetic is what they must not write.
+ */
+export declare const RISK_ORDER: readonly Risk[];
+export declare function maxRisk(a: Risk, b: Risk): Risk;
+/**
+ * The WebAuthn relying-party identifier the credential was created for: the
+ * approval page's host, lower-case, no scheme, no port, no path (e.g.
+ * `approve.example.com`). Stored PER ENTRY because that is what the
+ * credential itself is bound to; HM-4 (c) requires the assertion's origin to
+ * be exactly `https://` + this, and (d) requires `rpIdHash` = SHA-256 of it.
+ * Signed policy: an assertion for any other origin is an assertion made on
+ * another site, which is the phishing case this field refuses.
+ * Generated from attesters.schema.json#/$defs/rp_id.
+ *
+ * The schema constrains this to `^[a-z0-9]([a-z0-9-]{0,62}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,62}[a-z0-9])?)+$`, which is NOT enforced here.
+ */
+export type RpId = string;
+/**
+ * A suite NAME as it appears on the wire.
+ *
+ * DELIBERATELY NOT ORDERED. There is no `x-acp-ordered` here and there must
+ * not be one: CR-4's floor is satisfied by CONTAINMENT of primitives, not by
+ * rank. A generated `Ord` would make `declared >= floor` compile, and that
+ * comparison is the downgrade — `ed25519` and `slhdsa128s` are incomparable,
+ * not adjacent. The behavioural type is `acp_crypto::Suite`, which carries
+ * `satisfies_floor` and `primitives()`; this is the wire name and nothing
+ * more.
+ *
+ * NOT `const`. Listing only the hybrid suite would make a bundle signed
+ * under `ed25519` fail SHAPE validation, when the required outcome is a CR-4
+ * refusal naming the floor. Unknown names outside this list are refused
+ * under CR-1 by the loader, never defaulted to a known suite. THIS IS ALSO
+ * THE WIRE ROOT'S `SuiteId` (ACP-78 M1): the Decision Receipt's `alg`
+ * `$ref`s this declaration across roots. CR-4 compares a receipt's suite
+ * against the floor registered here, so the two artifacts must draw from ONE
+ * set -- two enums that merely look alike is the comparison passing on a
+ * vocabulary nobody checked.
+ * Generated from signature.schema.json#/$defs/suite_id.
+ */
+export type SuiteId = 'ed25519' | 'hybrid-ed25519-mldsa65' | 'slhdsa128s';
+/**
+ * One tenant, named once, in signed policy. Declared here and CARRIED by
+ * every wire message that names a tenant -- the receipt, the ledger claim,
+ * the pending-release record, the audit record and the anchor all `$ref`
+ * this definition -- because the bundle is what says which tenant a decision
+ * belongs to (RAD-5) and a message can only repeat it. Same direction as
+ * `SuiteId` and `Tier`: policy defines, messages carry. Through ACP-78 M1
+ * this was the wire root's one `TenantId`, homed on the ledger claim; it
+ * moved here with RAD-5 (v1.3.23) when the bundle gained the field, so that
+ * the manifest's copy and the messages' copies cannot be two types.
+ *
+ * IN A MESSAGE IT NAMES A NAMESPACE AND DOES NOT AUTHORISE ONE (RES-8). CL-5
+ * permits both topologies -- one ledger per tenant, or one ledger keyed by
+ * tenant -- and under the first this value is redundant with the instance
+ * the Executor is connected to. It is carried under both so that one claim
+ * has one encoding rather than two, which is the Z4 rule applied to a
+ * deployment choice. A ledger that RESOLVES which tenant's namespace to use
+ * from this field, rather than from the authenticated connection, has let
+ * the claimant pick its own scope; EX-1 scopes the Executor's credentials
+ * per tenant precisely so the connection is the thing that answers.
+ *
+ * THE MAXIMUM IS L-04's AND ITS SCOPE IS CONTESTED. This declaration is the
+ * wire root's one `TenantId`, and it was five declarations with three bounds
+ * before ACP-78 M1: unbounded here, 2,048 in the audit record and the
+ * anchor, 128 in the receipt and the pending-release record. Two lengths for
+ * one value means a tenant nameable in one artifact and unnameable in the
+ * artifact that produced it, so one bound was kept -- the only one any
+ * clause states. L-04 reads `max string field length 2,048 chars. No
+ * exceptions` with `Schema` as its enforcement point. It is applied here and
+ * the reading is disclosed rather than assumed: L-04's neighbours L-03,
+ * L-05, L-06 and L-07 are all about TENANT-REGISTERED schemas, so `Schema`
+ * may well scope it there, and read literally across every wire string it
+ * makes CR-6's hybrid floor unsatisfiable -- an ML-DSA-65 signature is 4,412
+ * base64 characters. AB-6's rationale separately treats `tenant_id` length
+ * as deployment-variable in as many words. Whichever way the document
+ * settles that, this file states one length rather than three.
+ * Generated from manifest.schema.json#/$defs/tenant_id.
+ */
+export type TenantId = string;
+/**
+ * T0 public/sandbox · T1 internal · T2 production · T3 privileged. Ordered:
+ * T0 < T1 < T2 < T3, and §8.4 composes tiers with max, so the ordering is
+ * load-bearing rather than cosmetic. THIS IS ALSO THE WIRE ROOT'S `Tier`
+ * (ACP-78 M1): `spec/schemas/wire/context_read.schema.json` `$ref`s this
+ * declaration across roots rather than restating it, because TR-3 composes
+ * the FLOOR from this table with the RAISE from the Context read using
+ * `max`, and a value nameable in one and not the other leaves that `max`
+ * undefined. It was declared in both roots until M1, character for
+ * character, each copy carrying a note saying the two must move together.
+ * Generated from floors.schema.json#/$defs/tier.
+ */
+export type Tier = 'T0' | 'T1' | 'T2' | 'T3';
+/**
+ * Tier low to high, from the schema's declared order.
+ *
+ * TypeScript has no derived ordering, so the ladder is a value and the
+ * comparison is a function. §8.4 composes with max, so `max` is what
+ * callers need and index arithmetic is what they must not write.
+ */
+export declare const TIER_ORDER: readonly Tier[];
+export declare function maxTier(a: Tier, b: Tier): Tier;
+/**
+ * Which key type HM-4 (e) verifies under: ES256 (ECDSA P-256 with SHA-256,
+ * DER-encoded, COSE alg -7 -- what every authenticator supports) or Ed25519
+ * (COSE alg -8, RFC 8032 under ACP-106's strict rule). An attestation-entry
+ * suite only: CR-8 forbids either as a bundle, receipt or door suite, and
+ * neither is compared against `min_suite` -- a human leg is outside the
+ * floor by construction, and HM-6 states the cost.
+ * Generated from attesters.schema.json#/$defs/webauthn_alg.
+ */
+export type WebauthnAlg = 'webauthn-es256' | 'webauthn-ed25519';
+/**
+ * Maps each registered `schema_id` to the fidelity class of the ingress
+ * adapter that produces Proposals under it. This is the "bundle-registered
+ * adapter binding" §9.3 step 7 tells the Executor to verify `fidelity`
+ * against, and it is the last bundle table on the decision path to get a
+ * schema (ACP-73).
+ *
+ * A CONTROL INPUT, NOT METADATA. The value looked up here is bound into the
+ * EL-1 environment as `fidelity` (`acp_executor.py`, `recompute_risk`), so
+ * any `raise_to` clause can read it and it can raise or fail to raise a
+ * grade; FC-2 keys the confirmation requirement on it; and §9.3 step 7a
+ * makes disagreement between this table and the receipt's transmitted
+ * `fidelity` a CRITICAL ALERT (T-18), which the reference raises at
+ * `acp_executor.py`'s `execute` under TR-8. It is inside the bundle hash
+ * (`Bundle.hash`), so it is signed policy, and PB-4 makes it read-only to
+ * the runtime by cryptography.
+ *
+ * ABSENCE IS REFUSED, NEVER DEFAULTED, AND JSON SCHEMA CANNOT SAY SO. The
+ * reference is `Bundle.recompute_fidelity`: a `schema_id` with no entry here
+ * raises `FailClosed("TR-8", "schema_id not bound to a registered
+ * adapter")`, and the simulation's Policy Engine turns the same refusal into
+ * a DENY at §8.4 step 2 (`sim/policy.py`). The rule is carried by the
+ * `x-acp-absent` annotation below and GENERATED into the accessor in both
+ * languages, the `RiskFunctions` / `NoticeTargets` shape rather than the
+ * `Floors` / `Reversibility` default-value shape, because there is no
+ * fail-safe class to fall back to: defaulting to F-HIGH suppresses FC-2's
+ * confirmation exactly as a forged stamp would (X1), and defaulting to F-LOW
+ * looks conservative but is a policy value the implementation invented for
+ * an adapter nobody registered. P-4: unknown is refused. The WHOLE table is
+ * likewise required, not optional -- the reference `Bundle` dataclass gives
+ * `adapters` no default, so a bundle without it fails to construct rather
+ * than acquiring an empty registry that refuses every Proposal for a reason
+ * nobody wrote down.
+ *
+ * WHY A MAP AND NOT A ROW ARRAY. FC-1 says every adapter declares EXACTLY
+ * ONE fidelity class. A map keyed by `schema_id` cannot carry two classes
+ * for one id, so the schema enforces FC-1 by shape; an array of `{schema_id,
+ * fidelity}` rows would need the loader's duplicate-key refusal that
+ * `risk_functions.json` needs for `applies_to`.
+ *
+ * WHAT THIS SCHEMA FOUND. Until it existed the TR-8 refusal was a
+ * hand-written `if` in the Python reference and a hand-written `let ...
+ * else` in `crates/acp-decision` (ACP-45 slice 3, disclosed there rather
+ * than typed), and `tools/codegen.sh` emitted no type and no accessor for
+ * the one table whose miss suppresses a confirmation. It also found that
+ * §8.2's bundle tree names NO FILE for this binding: `floors.json`,
+ * `reversibility.json`, `notice_targets.json` and `risk_functions.json` are
+ * listed and `adapters.json` is not, although §9.3 step 7 and FC-1 both
+ * require the binding to be bundle-registered. The file name here follows
+ * its four siblings; the §8.2 listing is reported as a normative gap, not
+ * silently closed by this file. And the fidelity vocabulary had been
+ * declared in the WIRE root (`proposal.schema.json`) with no signed table to
+ * draw from -- the value the Executor compares a receipt against lived only
+ * on the side being verified. It is declared once, below, and the wire root
+ * now `$ref`s it, exactly as `Tier` and `SuiteId` are homed in
+ * `floors.schema.json` and `signature.schema.json` (ACP-78 M1).
+ *
+ * A-7 applies here as it does to floors and reversibility: that an adapter's
+ * declared class is HONEST is conceded unprovable. An F-LOW adapter
+ * registered as F-HIGH defeats FC-2 with zero attack, and no verifier can
+ * tell from this file. Registration is the governance task; this file is
+ * where that risk concentrates.
+ * Generated from adapters.schema.json.
+ */
+export interface Adapters {
+    readonly schemaVersion: '1';
+    /**
+     * schema_id -> fidelity class. Open map (schemas are deployment-specific),
+     * closed values. The key space is the Proposal's `schema_id` (SR-1's
+     * identifier half) and is `$ref`d rather than restated so the two spellings
+     * cannot drift; note that `tools/codegen.sh` resolves the `$ref` under
+     * `propertyNames` (it halts on one it cannot resolve, ACP-128) and carries
+     * its description into both languages' doc comments, but still emits map
+     * keys as plain strings, so the key constraint is documentary until a
+     * validator reads it (ACP-52).
+     *
+     * Map keys: A registered `schema_id`, the same identifier a Proposal carries
+     * and the Executor looks this table up by (§9.3 step 7).
+     */
+    readonly adapters: Readonly<Record<string, FidelityClass>>;
+}
+/**
+ * Look up one entry in Adapters.adapters.
+ *
+ * TR-8: a schema_id bound to no registered adapter is REFUSED, never
+ * defaulted. `fidelity` is readable by any raise_to clause and FC-2 keys
+ * confirmation on it, so there is no fail-safe class to fall back to: F-HIGH
+ * suppresses the confirmation requirement exactly as a forged stamp would
+ * (X1, T-18), and F-LOW is a policy value the implementation invented for an
+ * adapter nobody registered. A lookup returning `Option` here would let a
+ * caller write `unwrap_or_default()` and grade a Proposal from an
+ * unregistered ingress on a class nobody signed.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export type AdaptersLookup = {
+    readonly present: true;
+    readonly value: FidelityClass;
+} | {
+    readonly present: false;
+    readonly clause: string;
+    readonly why: string;
+};
+export declare function adaptersLookup(table: Adapters, key: string): AdaptersLookup;
+/**
+ * The lenient projection of Adapters: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawAdapters {
+    readonly schemaVersion?: string;
+    readonly adapters?: Readonly<Record<string, string>>;
+}
+/**
+ * Maps each class of critical alert to the parties woken when one is raised.
+ * PB-10 (v1.3.23).
+ *
+ * WHY THIS FILE EXISTS. Twenty-odd sentences in ZIFFER-SPEC-001 end in 'with
+ * a critical alert' and, through v1.3.22, none said to whom. Every
+ * implementation therefore chose its own audience -- the notifier's
+ * configuration, the KMS's, the deployment's -- and a service that selects
+ * its own alert audience is certifying its own coverage: RES-8, and the
+ * exact shape of the still-open finding T-32 one component over. It surfaced
+ * while the KMS was built as a service, where every 'critical alert'
+ * sentence landed on a seam whose only implementation was a no-op (ACP-134).
+ *
+ * WHY THE MECHANISM IS notice_targets' AND NOT A NEW ONE. DR-13(2) already
+ * solved this problem for the fast-path notice: the recipient set is read
+ * from the signed bundle, keyed by class, inside policy_bundle_hash, and a
+ * class naming nobody fails closed because a notice with no addressee is not
+ * a detection channel. It is mutation-proven. Alerts take the identical
+ * mechanism -- two mechanisms for one problem is the two-definitions defect
+ * this repository has published corrections for three times -- and this file
+ * is notice_targets.schema.json with the key set changed.
+ *
+ * COMPLETENESS FAILS CLOSED AT LOAD, AND JSON SCHEMA CANNOT SAY SO. PB-10
+ * enumerates the alert classes and requires every one of them to name at
+ * least one recipient; a bundle missing any is invalid and MUST be refused
+ * at load by every consumer, on PB-1's footing. The list of classes is owned
+ * by the clause, not by this file -- a `required` list here would be a
+ * second definition of it -- so the enforcement point is the loader, as with
+ * PB-7 in attesters.schema.json. A normative rule with no enforcement point
+ * is a comment. Why load-time and not raise-time: a notice's 'fail closed'
+ * has an action to withhold, but an alert is raised on a path that has
+ * already failed, so refusing at raise time would withhold nothing. What can
+ * be withheld is the bundle: a deployment either names who is woken for each
+ * class, or it does not run.
+ *
+ * WHAT IS NOT DECIDED HERE: the transport of an alert (pager, queue,
+ * webhook) and what acknowledgement closes it. Those are deployment
+ * obligations in DR-12's shape -- silence as measurable debt -- and belong
+ * in ZIFFER-DEPLOY-001. Identities, not addresses, for notice_targets'
+ * reason: an address is a routing detail that changes without a policy
+ * review, and putting one under an offline signing key makes routine
+ * operations require RK-5.
+ * Generated from alert_targets.schema.json.
+ */
+export interface AlertTargets {
+    readonly schemaVersion: '1';
+    /**
+     * alert class -> recipient identities. Keys are the classes PB-10 enumerates
+     * (BUNDLE_INVALID, SIGNING_SUBSTRATE, RECEIPT_INVALID,
+     * RECOMPUTATION_MISMATCH, ATTESTATION_INVALID, LEDGER_REPLAY,
+     * SUITE_BELOW_FLOOR, DEFERRED_RELEASE, AUDIT_INTEGRITY,
+     * ATTESTATION_QUEUE_DEPTH, CONTEXT_STORE); the map is open here so that the
+     * clause, not this file, owns the list, and the loader refuses a bundle in
+     * which any of them is missing. Every value is a non-empty set: an empty
+     * array is REFUSED rather than read as 'wake nobody', because the two are
+     * indistinguishable at run time from an entry never written, and the
+     * fail-safe reading of both is refusal.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: values minItems 1, uniqueItems; values items minLength 1, maxLength
+     * 128.
+     */
+    readonly alertTargets: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * Look up one entry in AlertTargets.alert_targets.
+ *
+ * PB-10: an alert with no addressee is not a detection channel. PB-10
+ * requires every class to be present at load, so a miss here means a loader
+ * skipped PB-10 -- and the generated accessor refuses rather than returning
+ * an Option a caller could unwrap_or_default() into silence. Same rule as
+ * notice_targets, and deliberately not a value default: there is no
+ * fail-safe recipient.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export type AlertTargetsLookup = {
+    readonly present: true;
+    readonly value: readonly string[];
+} | {
+    readonly present: false;
+    readonly clause: string;
+    readonly why: string;
+};
+export declare function alertTargetsLookup(table: AlertTargets, key: string): AlertTargetsLookup;
+/**
+ * The lenient projection of AlertTargets: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawAlertTargets {
+    readonly schemaVersion?: string;
+    readonly alertTargets?: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * The approver and confirmer verification keys, and the quorum k.
+ *
+ * PUBLIC KEYS ONLY. This is not a stylistic constraint — it is the v1.3.14
+ * custody fix, and it closed a real hole. Through v1.3.13 the primitives
+ * were HMAC-SHA256, so verifying a signature required holding the key that
+ * made it: the Executor held every attester key and could therefore MINT ITS
+ * OWN QUORUM. INV-1-HIGH did not hold against the very adversary it names,
+ * and no protocol test could have found it, because the defect was key
+ * CUSTODY rather than control flow. Never reintroduce a symmetric primitive
+ * here, not even for tests.
+ *
+ * PB-KEY: this registry is INSIDE the bundle hash. A `policy_bundle_hash`
+ * that does not cover it lets two Executors trusting DIFFERENT attesters
+ * agree that they hold the same bundle — which is the encoding-split defect
+ * wearing a key registry as a hat.
+ *
+ * ACK-4 (reference-level, see reference/src/acp_ack.py — not a spec clause):
+ * an attester's identity is the one the SIGNATURE covers, never a
+ * transmitted `attester_id` field. This registry maps identity to key so
+ * that the signature can establish which of these entries signed. It does
+ * not authorise anyone to name themselves.
+ * Generated from attesters.schema.json.
+ */
+export interface AttesterRegistry {
+    readonly schemaVersion: '1';
+    /**
+     * How many DISTINCT attesters must sign the same canonical hash for a
+     * floor-HIGH action. INV-1-HIGH. k=1 is permitted by the schema and is a
+     * deployment choice, not a conformance failure — but it collapses the
+     * invariant to single-compromise, so a deployment choosing it should say so
+     * in its residual risk statement rather than discover it later.
+     *
+     * DR-9 is enforced separately and is not expressible here: whoever proposed
+     * the action can never be among the k.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: minimum 1.
+     */
+    readonly quorumK: number;
+    /**
+     * attester identity -> a machine's hybrid public key or a human's WebAuthn
+     * credential (`kind` tells which, HM-1, v1.3.30). Open map (people are
+     * deployment-specific), closed entries.
+     *
+     * PB-DISTINCT (NORMATIVE, and NOT EXPRESSIBLE HERE): no two identities may
+     * carry the same public key. `quorum_k` counts DISTINCT KEY HOLDERS; a
+     * registry mapping two names onto one key lets the holder of that one
+     * private key sign two objects with different nonces, label them with the
+     * two names, and satisfy a k=2 quorum alone. INV-1-HIGH broken by a single
+     * compromise, reached through the registry rather than through the
+     * threshold.
+     *
+     * JSON Schema cannot state this: `uniqueItems` applies to arrays, and there
+     * is no keyword for uniqueness across the VALUES of a map. The rule is
+     * therefore enforced by the LOADER, and a loader that does not enforce it is
+     * non-conformant however cleanly it validates. Reference implementation:
+     * `Bundle.__post_init__` in reference/src/acp_executor.py, which refuses at
+     * construction — a bundle whose registry cannot support its own quorum is
+     * malformed everywhere it is used, not only on the quorum path. Compare over
+     * the full hybrid identity, not the classical half alone; two identities
+     * sharing only an ML-DSA key is CR-3 undone at the registry.
+     */
+    readonly attesters: Readonly<Record<string, Attester>>;
+    /**
+     * AT-10: the minimum authenticator assurance every attestation counted
+     * toward a quorum must clear. OPTIONAL, and absent means AS0 — the
+     * permissive reading, taken deliberately and disclosed in the same breath,
+     * exactly as `quorum_k: 1` is permitted and must be disclosed (PB-6): a
+     * floor nobody chose must not silently invalidate every registry written
+     * before the field existed, and AS0 is what those registries were already
+     * getting. A deployment claiming any Door A property stronger than key
+     * possession raises this floor; the EU AI Act Art. 14(5) reading of 'two
+     * natural persons' is not supported at AS0 and a deployment at AS0 should
+     * say so in its residual risk statement.
+     */
+    readonly minAttesterAssurance?: Assurance;
+    /**
+     * AT-10: attester identity -> the assurance level that identity's key was
+     * ENROLLED at, over $defs/assurance. A SEPARATE map beside `attesters`
+     * rather than a field inside each entry, deliberately: every implementation
+     * carries it this way on the wire (the reference Bundle's dict, the
+     * differential bridge, the Rust QuorumPolicy), and the map shape is what
+     * gives the generated fail-safe accessor an absent rule to answer with -- an
+     * identity missing from this map reads AS0, a claim's safe default, inverted
+     * from RK-1's floors: an entry claiming less than it has can only cause a
+     * refusal, one defaulting to more than it has is the attack. What no field
+     * here can carry is honesty: whether a key is REALLY hardware-bound is
+     * established at enrolment by humans, and a wrong label is A-7's conceded
+     * shape, stated at AT-10.
+     */
+    readonly assurance?: Readonly<Record<string, Assurance>>;
+}
+/**
+ * Look up one entry in AttesterRegistry.attesters.
+ *
+ * AT-9, PB-6: an identity absent from the signed registry is not an
+ * attester. Its signature verifies against no key here and counts toward no
+ * quorum, and resolving it to a default would let a name nobody enrolled
+ * satisfy INV-1-HIGH. ACK-4: identity is what the SIGNATURE covers, never a
+ * transmitted `attester_id` — this map is how a signature is resolved to an
+ * enrolled key, not how a name authorises itself.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export type AttesterRegistryLookup = {
+    readonly present: true;
+    readonly value: Attester;
+} | {
+    readonly present: false;
+    readonly clause: string;
+    readonly why: string;
+};
+export declare function attesterRegistryAttestersLookup(table: AttesterRegistry, key: string): AttesterRegistryLookup;
+/**
+ * Look up one entry in AttesterRegistry.assurance.
+ *
+ * AT-10: an identity with no recorded level is read as AS0 -- for a CLAIM
+ * the low default is the fail-safe one. Resolving it upward would let an
+ * unlabelled key satisfy a floor nobody vouched it for.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export declare function attesterRegistryAssuranceLookup(table: AttesterRegistry, key: string): Assurance;
+/**
+ * `AttesterRegistry.min_attester_assurance`, with the schema's absent rule
+ * applied.
+ *
+ * AT-10: the floor is POLICY, and its permissive default is taken openly and
+ * disclosed on PB-6's terms (quorum_k = 1): a floor nobody chose must not
+ * silently invalidate every registry written before the field existed. A
+ * deployment claiming any Door A property stronger than key possession
+ * raises it.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export declare function attesterRegistryMinAttesterAssurance(doc: AttesterRegistry): Assurance;
+/**
+ * The lenient projection of AttesterRegistry: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawAttesterRegistry {
+    readonly schemaVersion?: string;
+    readonly quorumK?: number;
+    readonly attesters?: Readonly<Record<string, string>>;
+    readonly minAttesterAssurance?: string;
+    readonly assurance?: Readonly<Record<string, string>>;
+}
+/**
+ * How the bundle signing key is held.
+ *
+ * CLASSIFIED **T** (trusted as transmitted) AND NOT A CONTROL INPUT. A
+ * verifier MUST NOT weight any decision on this object. A bundle asserting
+ * its own custody strength is the recurring defect RES-8/RES-9/RES-10 names:
+ * a verifier must never accept a derived security value from the party it is
+ * verifying. A compromised signer writes this object freely.
+ *
+ * It is recorded for humans — auditors, operators, and the reviewer named
+ * above — and for no other purpose. The real binding is that the verifier is
+ * configured out of band with the expected public key.
+ * Generated from manifest.schema.json#/$defs/custody.
+ */
+export interface Custody {
+    /**
+     * T0 development only; T1 encrypted key on an air-gapped host; T2
+     * non-exportable cloud KMS; T3 PKCS#11 HSM. Split custody reports the WEAKER
+     * of its two legs, because a claim should never round in the flattering
+     * direction.
+     *
+     * The SAME four values as a resource floor, drawn from `floors.schema.json`
+     * so there is one definition of the tier ladder. Note that the two uses are
+     * unrelated in meaning: a resource floor says how sensitive a thing is, a
+     * custody tier says how a key is held. They share a scale, not a subject.
+     */
+    readonly tier: Tier;
+    readonly classical: CustodyLeg;
+    readonly pq: CustodyLeg;
+}
+/**
+ * The lenient projection of Custody: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawCustody {
+    readonly tier?: string;
+    readonly classical?: RawCustodyLeg;
+    readonly pq?: RawCustodyLeg;
+}
+/**
+ * Custody of one primitive. The two legs may differ, and differing is not a
+ * weakness: verification is conjunctive (CR-3), so forging requires BOTH
+ * signatures and therefore BOTH keys. An attacker must defeat both
+ * mechanisms.
+ * Generated from manifest.schema.json#/$defs/custody_leg.
+ */
+export interface CustodyLeg {
+    readonly tier: Tier;
+    /**
+     * Free text naming the concrete mechanism, e.g. "YubiHSM2 slot 3" or
+     * "age-encrypted file, offline laptop". Human-readable only.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: minLength 1, maxLength 256.
+     */
+    readonly mechanism: string;
+}
+/**
+ * The lenient projection of CustodyLeg: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawCustodyLeg {
+    readonly tier?: string;
+    readonly mechanism?: string;
+}
+/**
+ * Names the two services whose summaries the Executor consumes during a
+ * deferred-release hold, each with the verification keys its Rendered
+ * Summary objects (DR-14; notification.schema.json `$defs/rendered_summary`)
+ * are signed under. PB-11 (v1.3.25).
+ *
+ * WHY THIS FILE EXISTS. From v1.3.6 to v1.3.24 the Executor established
+ * DR-2's independence -- the notification path shares no rendering code with
+ * the approval path -- by comparing two labels the notification service
+ * chose (`source_path`) and reading a boolean it set (`from_canonical`).
+ * Both were classified T in ACP-CLASS-001 (rows 24-25, finding T-32):
+ * evidence about a service, produced by that service. A compromised notifier
+ * that rendered through the approval path, labelled itself otherwise and
+ * reported full delivery passed every check, and
+ * `reference/suites/class_findings.py` demonstrated it for thirteen
+ * revisions. The structural reason was recorded in notification.schema.json:
+ * the notification was not a signed structure, so there were no bytes to
+ * verify. This file supplies the keys those bytes are now verified under.
+ *
+ * WHY THE MECHANISM IS THE ATTESTER REGISTRY'S AND NOT A NEW ONE. Who may
+ * speak for a door is the same kind of value as who may attest (PB-6, PB-7),
+ * who is told (DR-13) and who is woken (PB-10): a service that names its own
+ * identity is certifying its own independence, RES-8. So the identities sit
+ * in signed policy under RK-5 two-person control, in the attester registry's
+ * key shape -- one Ed25519 and one ML-DSA-65 verification key, the same
+ * named scalars -- and the loader applies PB-7's distinctness rule across
+ * the two: compared over the COMPLETE suite, because two identities sharing
+ * a post-quantum key are not distinct, and treating them as such is CR-3's
+ * conjunctive guarantee undone at the registry instead of at the verifier.
+ *
+ * DISTINCTNESS FAILS CLOSED AT LOAD, AND JSON SCHEMA CANNOT SAY SO.
+ * `presentation` and `notification` are both required here, so an absent one
+ * is a schema violation as well as a PB-11 refusal; but 'the two share no
+ * key' is a relation across two values, and there is no keyword for it. As
+ * with PB-7 in attesters.schema.json the enforcement point is the loader: a
+ * bundle in which either key of one door equals the corresponding key of the
+ * other is refused at load by every consumer, on PB-1's footing. A normative
+ * rule with no enforcement point is a comment.
+ *
+ * WHAT A KEY HERE DOES NOT PROVE. A Rendered Summary that verifies under the
+ * `notification` key was produced by the holder of that key, for the
+ * proposal hash it names. That the prose is faithful to those bytes is
+ * DR-2's STRUCTURAL requirement -- no shared rendering path, demonstrated at
+ * build time under conformance suite 3 -- and no signature supplies it. A
+ * signature over a lie is a signed lie; what it can no longer be is a lie
+ * told by the other door.
+ *
+ * WHAT IS DELIBERATELY NOT HERE. Addresses, endpoints, channels: identities
+ * rather than routing, for notice_targets' and alert_targets' reason -- a
+ * routing detail changes without a policy review, and putting one under an
+ * offline signing key makes routine operations require RK-5. And no third
+ * role: the fast-path notice (DR-13) is committed by the Executor to its own
+ * state and involves no service, so it needs no identity.
+ * Generated from door_identities.schema.json.
+ */
+export interface DoorIdentities {
+    readonly schemaVersion: '1';
+    /**
+     * The Attestation Presentation Service: the approval path, the door the
+     * attesters were shown the action through. Its key signs the approval
+     * summary the Executor compares against the notification at DR-14.
+     */
+    readonly presentation: DoorIdentity;
+    /**
+     * The notification service: DR-2's independent path, the door the
+     * out-of-band summary reaches the attesters and the operator through. Its
+     * key signs the Notification (DR-3 leg). A summary that verifies under this
+     * key was not produced by the presentation service -- which is the whole of
+     * what deferred release needs the second door for.
+     */
+    readonly notification: DoorIdentity;
+}
+/**
+ * The lenient projection of DoorIdentities: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawDoorIdentities {
+    readonly schemaVersion?: string;
+    readonly presentation?: RawDoorIdentity;
+    readonly notification?: RawDoorIdentity;
+}
+/**
+ * `DoorIdentity`.
+ * Generated from door_identities.schema.json#/$defs/door.
+ */
+export interface DoorIdentity {
+    /**
+     * The identity's name, for the audit record and the alert. NOT what the
+     * Executor resolves a signature by -- ACK-4's rule applies here too:
+     * identity is what the signature verifies under, and this name is a label
+     * for the key beside it, never a way for a name to authorise itself.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: minLength 1, maxLength 128.
+     */
+    readonly name: string;
+    /**
+     * The door's Ed25519 verification key. The attester registry's named scalar,
+     * referenced rather than re-declared: one definition of a key encoding.
+     */
+    readonly classical: Ed25519PublicKey;
+    /**
+     * The door's ML-DSA-65 verification key. Both legs are required because CR-3
+     * is conjunctive and the bundle's suite names both; a door registered with
+     * one leg would be a door whose summaries can never verify.
+     */
+    readonly pq: MlDsa65PublicKey;
+}
+/**
+ * The lenient projection of DoorIdentity: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawDoorIdentity {
+    readonly name?: string;
+    readonly classical?: string;
+    readonly pq?: string;
+}
+/**
+ * Maps each governable resource to its floor tier.
+ *
+ * RK-1: a resource ABSENT from this file MUST be treated as T3. That rule
+ * cannot be expressed in JSON Schema — a schema constrains what is present,
+ * never what is missing — so it is carried instead by the `x-acp-absent`
+ * annotation on `floors` below, which `tools/codegen.sh` reads to GENERATE
+ * the fail-safe direction into `Tier::for_unclassified()` (crates/acp-core)
+ * and its TypeScript equivalent. The Python reference spells the same
+ * default at `acp_executor.py`. A conformance case asserts it, because a
+ * fail-safe default that only exists in a comment is not a control — and
+ * stating it only in this prose is what let the Rust and TypeScript versions
+ * return HIGH, a RISK LEVEL, where a TIER was required.
+ *
+ * RES-1 (A-7): the architecture guarantees no runtime component evaluates a
+ * resource BELOW its signed floor. It cannot know whether the floor was set
+ * correctly. A production database labelled T0 defeats the design with zero
+ * attack. Floor maintenance is the highest-leverage governance task in the
+ * system and is structurally unprovable — this file is where that risk
+ * concentrates.
+ * Generated from floors.schema.json.
+ */
+export interface Floors {
+    readonly schemaVersion: '1';
+    /**
+     * resource identifier -> floor tier. Deliberately an open map: resources are
+     * deployment-specific. The VALUES are closed.
+     */
+    readonly floors: Readonly<Record<string, Tier>>;
+}
+/**
+ * Look up one entry in Floors.floors.
+ *
+ * RK-1: absent means unknown, and unknown is the HIGHEST tier, not the
+ * lowest (P-4). Returning T0 or T1 here is the whole class of defect this
+ * specification exists to prevent, and it is the direction a lookup
+ * returning `Option` invites.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export declare function floorsLookup(table: Floors, key: string): Tier;
+/**
+ * The lenient projection of Floors: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawFloors {
+    readonly schemaVersion?: string;
+    readonly floors?: Readonly<Record<string, string>>;
+}
+/**
+ * A human attester (HM-1, v1.3.30): a person who enrolled a WebAuthn
+ * credential -- a passkey on their phone or laptop, or a hardware security
+ * key -- through a registration ceremony with user verification required and
+ * attestation requested. Their signature is a WebAuthn assertion over the
+ * same bytes a machine signs (HM-2), verified under HM-4; it is classical,
+ * and HM-6 says what that costs. The level recorded for this identity in
+ * `assurance` is DERIVED from the authenticator (platform + UV = AS1,
+ * roaming hardware = AS2) and an entry at AS0 or with no level is an invalid
+ * bundle.
+ * Generated from attesters.schema.json#/$defs/human_attester.
+ */
+export interface HumanAttester {
+    /**
+     * The discriminator. `webauthn`: this identity is a person holding an
+     * authenticator; the entry's signature is an assertion, never a hybrid pair.
+     */
+    readonly kind: 'webauthn';
+    /**
+     * approver signs for authorisation; confirmer provides the non-operator
+     * positive acknowledgement DR-9 requires for irreversible actions. One
+     * person MAY hold both roles in the registry — DR-9 is enforced per action
+     * against the proposer, not by role exclusion here.
+     */
+    readonly role: AttesterRole;
+    readonly rpId: RpId;
+    readonly credentialId: CredentialId;
+    readonly publicKey: CoseKey;
+    readonly alg: WebauthnAlg;
+}
+/**
+ * The lenient projection of HumanAttester: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawHumanAttester {
+    readonly kind?: string;
+    readonly role?: string;
+    readonly rpId?: string;
+    readonly credentialId?: string;
+    readonly publicKey?: string;
+    readonly alg?: string;
+}
+/**
+ * `Identity`.
+ * Generated from manifest.schema.json#/$defs/identity.
+ */
+export interface Identity {
+    /**
+     * Stable identifier. Compared byte-for-byte for PB-2; display_name is never
+     * used for the comparison because two people can share a display name.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: minLength 1, maxLength 128.
+     */
+    readonly id: string;
+    /**
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: minLength 1, maxLength 256.
+     */
+    readonly displayName: string;
+}
+/**
+ * The lenient projection of Identity: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawIdentity {
+    readonly id?: string;
+    readonly displayName?: string;
+}
+/**
+ * The three numbers this document calls policy and no member carried: how
+ * long a human has to approve (L-15), how long a floor-HIGH action is held
+ * before release (DR-1, L-28), and what fraction of reversible releases
+ * draws a mandatory confirmation (DR-10, L-29). Signed, inside the tree
+ * hash, read by the issuer of each: the Policy Engine sets an Attestation
+ * Object's `expires_at` from `attestation_window_seconds`; the Executor
+ * builds its deferred door from the other two.
+ *
+ * WHY THIS MEMBER EXISTS (ACP-287, v1.3.30). DR-1 and DR-10 said
+ * `bundle-configured` since v1.3.7 and no schema had a field for either, so
+ * every implementation read the hold window and the sampling rate from its
+ * own environment -- a number this document calls signed policy, set per
+ * process by whoever runs it. L-15 gave the attestation window a ceiling and
+ * no home at all, so the one engine that issues attestations used the
+ * ceiling as the window and said so in its module note: shortening it would
+ * be that binary choosing how long a human has to approve. It was right. The
+ * place the number lives is here.
+ *
+ * EVERY FIELD IS OPTIONAL, AND ABSENT MEANS THE DOCUMENT'S OWN DEFAULT --
+ * the AT-10 precedent (`min_attester_assurance`, absent ⇒ AS0): a permissive
+ * reading taken openly, so that no bundle written before this member existed
+ * is invalidated by it, and a bundle that omits the file altogether reads as
+ * every field at its default. The defaults are this document's numbers and
+ * not an implementation's: 3600 s is L-15's ceiling and what every
+ * deployment had; 60 s and 10 % are the values DR-1 and DR-10 state. A
+ * deployment that wants the document's defaults may say nothing; one that
+ * wants anything else must sign it here.
+ *
+ * BOUNDS ARE REFUSALS, NOT CLAMPS. A value outside its declared range is an
+ * invalid bundle under PB-1 (`LimitOutOfBounds`), refused at load by every
+ * consumer and never rounded to the nearest legal value -- a clamped limit
+ * is a limit nobody chose. The bounds are the document's: L-15's ceiling,
+ * L-28's floor and DR-6's ceiling (a hold at or above L-14's 120 s receipt
+ * validity is an unsatisfiable configuration), and a percentage. A present
+ * file that is not an object, or a field of the wrong type, is `Malformed`.
+ *
+ * INTEGERS ONLY. A float in a signed policy file is a canonicalisation
+ * question -- AT-8a forbids one in a canonical structure for the reason
+ * `canon()` cannot encode it deterministically -- and DR-10's own unit is a
+ * percentage, so the fraction is carried as an integer percent. One-percent
+ * resolution is deliberate and disclosed: DR-10 exists to keep the detection
+ * channel live, not to meter it.
+ *
+ * WHAT IS NOT HERE, AND WHY. L-25 (DS-6e, the re-drive maximum,
+ * `bundle-configured, default 3`) and L-23 (AQ-3, queue depth per attester)
+ * are also called bundle-configured and have no reader in any
+ * implementation; a field nothing reads is documentation shaped like a
+ * control (the RV-1 lesson, v1.3.15), so each joins this member with its
+ * first reader and not before. The Executor cannot VERIFY the attestation
+ * window either: AT-1's object carries `expires_at` and no issue instant, so
+ * only the issuer knows the length. The declared value governs the issuer,
+ * and the bundle is signed.
+ * Generated from limits.schema.json.
+ */
+export interface Limits {
+    readonly schemaVersion: '1';
+    /**
+     * AT-1 / L-15: the Attestation Object's `expires_at` is its issue instant
+     * plus this many seconds. At most 3600, L-15's ceiling. Absent ⇒ 3600, which
+     * is what every deployment had before this field existed and the only number
+     * the document stated.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: minimum 1, maximum 3600.
+     */
+    readonly attestationWindowSeconds?: number;
+    /**
+     * DR-1 / L-28: how long a floor-HIGH action is held in `pending_release`
+     * before it may release. At least 30 (L-28's floor: a hold too short for a
+     * human to read the summary is not a detection channel), and below 120
+     * (DR-6: L-14 caps receipt validity at 120 s, and a hold that can outlive
+     * its receipt is an unsatisfiable configuration, refused rather than
+     * silently never releasing). Absent ⇒ 60, DR-1's default.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: minimum 30, maximum 119.
+     */
+    readonly holdWindowSeconds?: number;
+    /**
+     * DR-10 / L-29: the percentage of REVERSIBLE floor-HIGH actions selected for
+     * mandatory acknowledgement under the DR-9 rule, drawn by the Executor from
+     * a CSPRNG (DR-11). 0 is permitted by the schema and is a deployment choice
+     * that switches the sampled channel off; a deployment choosing it should say
+     * so in its residual risk statement. Absent ⇒ 10, DR-10's default.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: minimum 0, maximum 100.
+     */
+    readonly samplePercent?: number;
+}
+/**
+ * `Limits.attestation_window_seconds`, with the schema's absent rule
+ * applied.
+ *
+ * L-15: the ceiling is the document's own number and the behaviour every
+ * deployment had; a shorter window is a deployment's choice and must be
+ * signed here to take effect.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export declare function limitsAttestationWindowSeconds(doc: Limits): number;
+/**
+ * `Limits.hold_window_seconds`, with the schema's absent rule applied.
+ *
+ * DR-1: DR-1 states the default; a bundle that says nothing gets the
+ * document's number and not a process's environment.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export declare function limitsHoldWindowSeconds(doc: Limits): number;
+/**
+ * `Limits.sample_percent`, with the schema's absent rule applied.
+ *
+ * DR-10: DR-10 states the default; a bundle that says nothing gets the
+ * document's number.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export declare function limitsSamplePercent(doc: Limits): number;
+/**
+ * The lenient projection of Limits: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawLimits {
+    readonly schemaVersion?: string;
+    readonly attestationWindowSeconds?: number;
+    readonly holdWindowSeconds?: number;
+    readonly samplePercent?: number;
+}
+/**
+ * A machine attester: a service that signs with a hybrid key pair -- the
+ * sandbox robot, a confirmer that is a system. The shape every registry
+ * entry had before v1.3.30, plus `kind`, which every entry now carries so
+ * that a human and a machine are told apart by a signed tag and never by
+ * which fields happen to be present (HM-1).
+ * Generated from attesters.schema.json#/$defs/machine_attester.
+ */
+export interface MachineAttester {
+    /**
+     * The discriminator. `hybrid`: this identity signs with the two-primitive
+     * pair below and is held to CR-3/CR-4.
+     */
+    readonly kind: 'hybrid';
+    /**
+     * approver signs for authorisation; confirmer provides the non-operator
+     * positive acknowledgement DR-9 requires for irreversible actions. One
+     * person MAY hold both roles in the registry — DR-9 is enforced per action
+     * against the proposer, not by role exclusion here.
+     */
+    readonly role: AttesterRole;
+    readonly classical: Ed25519PublicKey;
+    readonly pq: MlDsa65PublicKey;
+}
+/**
+ * The lenient projection of MachineAttester: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawMachineAttester {
+    readonly kind?: string;
+    readonly role?: string;
+    readonly classical?: string;
+    readonly pq?: string;
+}
+/**
+ * Identity and provenance of one signed policy bundle. PB-5: bundle_epoch is
+ * strictly increasing and never reused or decreased. PB-2: author and
+ * reviewer identities MUST differ — asserted by the signer, because a schema
+ * cannot express a comparison between two of its own fields.
+ * Generated from manifest.schema.json.
+ */
+export interface Manifest {
+    /**
+     * Version of this manifest schema. Present so a decoder can refuse a bundle
+     * it does not fully understand rather than ignoring fields it does not
+     * recognise.
+     */
+    readonly schemaVersion: '1';
+    /**
+     * RAD-5 (v1.3.23). The tenant this bundle governs, inside the tree hash
+     * because every member is. This is the value the KMS binds a signing request
+     * to (§9.1.1 step 5a) and the Executor binds a receipt to (§9.3 step 8): a
+     * request or a receipt naming any other tenant is refused. Through v1.3.22
+     * no bundle named its tenant, so the KMS chose which tenant's receipt key
+     * signs from `tenant_id` in the request body -- a value the Policy Engine
+     * wrote, i.e. the party under verification, classified T -- and the only
+     * thing between tenant A's bundle and tenant B's key was a repository
+     * partition a verifier cannot inspect (ACP-139). This is PB-6's move:
+     * `quorum_k` went into signed policy as the only authoritative source, and
+     * the tenant goes in for the same reason.
+     *
+     * REQUIRED, AND ABSENCE IS REFUSAL. A manifest naming no tenant is an
+     * invalid bundle under PB-1 and is refused at load by every consumer -- the
+     * KMS under RAD-4, the Policy Engine under PB-1, the Executor at §9.3 step
+     * 4. There is no default tenant to fall back to, for the reason there is no
+     * default notice recipient (DR-13): the fail-safe reading of 'no tenant' is
+     * 'no bundle', never 'any tenant'. Not derived from the transport either:
+     * the control plane is multi-tenant, so the Policy Engine's mTLS identity is
+     * not the tenant's.
+     */
+    readonly tenantId: TenantId;
+    /**
+     * PB-5. Strictly increasing integer. Never reused, never decreased. The
+     * Executor keeps a high-water mark indefinitely (CL-4) — an expiring epoch
+     * mark would reopen rollback.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: minimum 0.
+     */
+    readonly bundleEpoch: number;
+    /**
+     * RFC 3339 UTC. Informational: freshness is enforced by expires_at and by
+     * the epoch, never by comparing this to a local clock.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: format `date-time`.
+     */
+    readonly createdAt: string;
+    /**
+     * Who wrote this bundle. PB-2: MUST differ from reviewer.
+     */
+    readonly author: Identity;
+    /**
+     * Who reviewed it. PB-2: MUST differ from author. Two-person integrity on
+     * the highest-leverage governance artifact in the system — RES-1 names floor
+     * maintenance as exactly that.
+     */
+    readonly reviewer: Identity;
+    /**
+     * RFC 3339 UTC. PB-1: the engine MUST refuse to serve an expired bundle. A
+     * deployment MAY configure a grace window during which all Decisions are
+     * capped at ATTEST — it may not configure one that serves the bundle
+     * normally.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: format `date-time`.
+     */
+    readonly expiresAt: string;
+    /**
+     * CR-4. The signed floor on signature suites. A receipt or attestation
+     * declaring a weaker suite is refused. This is in the signed bundle
+     * precisely so a downgrade cannot be negotiated at runtime.
+     *
+     * It is NOT this bundle's own floor. It floors the suites of downstream
+     * receipts and attestations; the floor THIS bundle must clear is configured
+     * out of band in the verifier, because a floor a bundle can lower is not a
+     * floor (RES-8). Wiring this field in as the bundle's own floor looks like
+     * an improvement and is the recurring defect.
+     *
+     * Drawn from `signature.schema.json` rather than restated, so that one edit
+     * to the suite list cannot leave the two spellings disagreeing.
+     */
+    readonly minSuite: SuiteId;
+    readonly custody: Custody;
+}
+/**
+ * The lenient projection of Manifest: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawManifest {
+    readonly schemaVersion?: string;
+    readonly tenantId?: string;
+    readonly bundleEpoch?: number;
+    readonly createdAt?: string;
+    readonly author?: RawIdentity;
+    readonly reviewer?: RawIdentity;
+    readonly expiresAt?: string;
+    readonly minSuite?: string;
+    readonly custody?: RawCustody;
+}
+/**
+ * Maps each action class to the parties told when an IRREVERSIBLE action of
+ * that class executes BELOW floor-HIGH.
+ *
+ * WHY THIS FILE EXISTS. Risk is recomputed from the target resource's tier
+ * floor; reversibility is a property of the action class. They are
+ * orthogonal, so an action can be IRREVERSIBLE and LOW at the same time —
+ * and every clause governing irreversible actions lived behind DR-1, which
+ * scopes the deferred-release gate to floor-HIGH. Below HIGH the Executor
+ * computed the reversibility class and discarded it: the action executed
+ * with no notification, no acknowledgement, and no record that a human
+ * existed. RV-1's fail-safe default set a value nothing on that path read.
+ * Mail exfiltration is exactly this shape — floor an inbox at T1, which is
+ * the natural choice because reading mail is routine, and an injected
+ * send_email goes out unseen.
+ *
+ * WHY THE RECIPIENTS ARE HERE AND NOT IN THE NOTIFIER'S CONFIGURATION. A
+ * notification service that selects its own audience is certifying its own
+ * coverage. That is RES-8 — a verifier must never accept a derived security
+ * value from the party it is verifying — and it is the exact shape of the
+ * still-open finding T-32, where note.source_path, note.from_canonical and
+ * delivered are all classified T. Naming recipients in the signed bundle
+ * puts the audience under RK-5 two-person offline control alongside the
+ * floors it complements, and makes "who would have found out" a property an
+ * auditor reads off signed policy rather than asks the notifier about.
+ *
+ * ABSENCE FAILS CLOSED, AND JSON SCHEMA CANNOT SAY SO. An action class that
+ * is IRREVERSIBLE, graded below HIGH, and absent from this file MUST cause
+ * the Executor to refuse the action: a notice with no addressee is not a
+ * detection channel, and DR-8's rule — executing while the detection channel
+ * is absent is executing unwatched — does not become false because the risk
+ * grade is lower. The condition spans three files (this one,
+ * reversibility.json, and the risk grading over floors.json), so no schema
+ * keyword can express it. The rule is normative in §9.6 DR-13 and its
+ * enforcement point is the Executor, as with PB-7 in attesters.schema.json.
+ * A normative rule with no enforcement point is a comment.
+ *
+ * WHAT IS NOT REQUIRED: acknowledgement. DR-9's friction is affordable at
+ * floor-HIGH because a human quorum has already been paid for. Below HIGH
+ * there is no quorum and the traffic is the bulk of a deployment, so
+ * demanding acknowledgement would page a human for routine work at volume —
+ * T-26 habituation and AT-7 rubber-stamping, and W2 already recorded that
+ * saturating approvers produces assent rather than refusal. DR-13 buys
+ * detection, not prevention, and is stated as the weaker guarantee it is.
+ *
+ * DELIVERY IS NOT A PRECONDITION OF EXECUTION. EO-2 budgets 25 ms p99
+ * end-to-end for LOW and MEDIUM decisions and a synchronous confirmed
+ * delivery does not fit inside it — two normative requirements that cannot
+ * both hold, which is the DR-6 defect class. What DR-13 requires before
+ * execution is the durable local commit of the notice. A notice committed
+ * and never delivered leaves an audit record and no human; that residual is
+ * disclosed as RES-P6, and reconciling committed notices against delivery
+ * outcomes is a deployment obligation.
+ *
+ * A-7 applies here as it does to floors and to reversibility: that a
+ * deployment named the RIGHT recipients is conceded unprovable. Deployments
+ * SHOULD floor action classes that are both irreversible and externally
+ * visible at T2 or above, which moves them onto the deferred path under
+ * DR-9; this file is what holds when they have not.
+ * Generated from notice_targets.schema.json.
+ */
+export interface NoticeTargets {
+    readonly schemaVersion: '1';
+    /**
+     * action class -> recipient identities. Open map (actions are
+     * deployment-specific), and every value is a non-empty set. An empty array
+     * is REFUSED rather than treated as 'notify nobody': the two are
+     * indistinguishable at run time from an entry that was never written, and
+     * the fail-safe reading of both is refusal. Making the empty case invalid
+     * here means a deployment that wants no notice channel for a class must say
+     * so by floor policy — raise the class to T2+ and let DR-9 govern it —
+     * rather than by writing a control that looks configured and does nothing.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: values minItems 1, uniqueItems; values items minLength 1, maxLength
+     * 128.
+     */
+    readonly noticeTargets: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * Look up one entry in NoticeTargets.notice_targets.
+ *
+ * DR-13: a notice with no addressee is not a detection channel, and DR-8's
+ * rule — executing while the detection channel is absent is executing
+ * unwatched — does not become false because the risk grade is lower. This is
+ * the one absent-rule of the three that is NOT a default value: there is no
+ * fail-safe recipient to fall back to, so the fail-safe outcome is that the
+ * action does not run. A lookup returning `Option` here would let a caller
+ * write `unwrap_or_default()` and execute unwatched with an empty audience.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export type NoticeTargetsLookup = {
+    readonly present: true;
+    readonly value: readonly string[];
+} | {
+    readonly present: false;
+    readonly clause: string;
+    readonly why: string;
+};
+export declare function noticeTargetsLookup(table: NoticeTargets, key: string): NoticeTargetsLookup;
+/**
+ * The lenient projection of NoticeTargets: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawNoticeTargets {
+    readonly schemaVersion?: string;
+    readonly noticeTargets?: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * `RaiseClause`.
+ * Generated from risk_functions.schema.json#/$defs/raise_clause.
+ */
+export interface RaiseClause {
+    /**
+     * An EL-1 expression. EL-1 is deliberately minimal, TOTAL (no expression can
+     * fail to evaluate, so there is no error path to fall open through) and
+     * monotone.
+     *
+     * PRECEDENCE IS NORMATIVE: `&&` binds tighter than `||`. That sentence
+     * exists because its absence WAS a defect — Z1, found by building two
+     * evaluators from the prose alone and running 10,000 differential cases
+     * until they disagreed. An implementation that leaves precedence to its host
+     * language reproduces the ambiguity.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: minLength 1, maxLength 1024.
+     */
+    readonly if: string;
+    readonly then: Risk;
+}
+/**
+ * The lenient projection of RaiseClause: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawRaiseClause {
+    readonly if?: string;
+    readonly then?: string;
+}
+/**
+ * The tenant's receipt verification keys -- the public half of the
+ * `receipt_signing_key` the KMS holds (§4, EX-4) -- one per primitive of the
+ * bundle's suite, named by the signed bundle. PB-12 (v1.3.27).
+ *
+ * WHY THIS FILE EXISTS. §9.3 step 1 has read, since v1.3.0, `Signature valid
+ * under the current receipt_signing_key (public key from the signed
+ * bundle)`, and §8.2's tree named no member that could carry it. Every
+ * implementation therefore took the key from somewhere else: the Python
+ * reference held it as a field of its modelled bundle (and hashed it there,
+ * so `policy_bundle_hash` covered a value the on-disk tree did not), the
+ * Rust differential passed it in beside the bundle, and the first Executor
+ * process (M7) would have read it from its own configuration -- a verifier
+ * trusting its deployment's description of the party it verifies, which is
+ * the T-32 shape one level below the bundle. This file is the member step
+ * 1's words had always assumed, and the on-disk tree now covers what the
+ * reference's hash already did.
+ *
+ * WHY THE MECHANISM IS THE DOORS' AND THE REGISTRY'S. Who signs receipts is
+ * the same kind of value as who may attest (PB-6, PB-7) and who speaks for a
+ * door (PB-11): an identity a runtime component supplied about itself would
+ * be RES-8. So it sits in signed policy under RK-5 two-person control, in
+ * the attester registry's key shape -- one Ed25519 and one ML-DSA-65
+ * verification key, the same named scalars -- and both legs are REQUIRED
+ * because CR-3 is conjunctive: a receipt key registered with one leg is a
+ * key under which no receipt can ever verify.
+ *
+ * WHAT THE LOADER CHECKS, AND WHAT IT DELIBERATELY DOES NOT. Present, both
+ * legs at their declared lengths, and the classical leg not a small-order
+ * point (PB-9's rule, the same predicate the registry and the doors are held
+ * to) -- else the bundle is refused at load by every consumer, on PB-1's
+ * footing, under one name (`ReceiptIdentityAbsent` for a member that is
+ * missing, one leg short or not a key). NO distinctness bar against the
+ * attester registry or the two doors, and that is a decision rather than an
+ * omission: at any k >= 2 a KMS that also held one attester key still needs
+ * a second approver, so INV-1-HIGH is not broken by that component alone and
+ * the bar would remove no compromise while dressing an arbitrary rule as a
+ * control -- the reference has recorded that reasoning beside its door check
+ * since PB-11 landed, and it applies unchanged here. EX-4's rule that no
+ * component HOLDS private keys from more than one class is custody, enforced
+ * at the KMS and not by comparing public keys in a file.
+ *
+ * WHAT THE KMS DOES WITH IT. §9.1.1 step 4: the KMS compares the identity it
+ * holds for the tenant against this member of the bundle it independently
+ * verified, and answers `SIGNING_DENIED` on a mismatch -- RAD-5's shape (the
+ * bundle and the signer agree, and the bundle is the byte the ceremony
+ * covered) applied to the key rather than to the tenant. A bundle that names
+ * a key the KMS does not hold is a bundle under which nothing will ever be
+ * signed, and refusing at the signer says so where an operator can read it
+ * instead of at the Executor's step 1 at 03:00.
+ *
+ * WHAT IS DELIBERATELY NOT HERE. Custody metadata: the tier the key is held
+ * at is the manifest's `custody` (§4) and belongs beside the epoch, not
+ * beside the key. Rotation: a new receipt identity is a new bundle epoch
+ * (PB-5), which is what makes the old key's receipts refuse at step 4 before
+ * they can fail at step 1.
+ * Generated from receipt_identity.schema.json.
+ */
+export interface ReceiptIdentity {
+    readonly schemaVersion: '1';
+    /**
+     * The identity's name, for the audit record and the alert -- a label for the
+     * keys beside it, never what the Executor resolves a signature by (ACK-4's
+     * rule, as for the doors).
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: minLength 1, maxLength 128.
+     */
+    readonly name: string;
+    /**
+     * The Ed25519 verification key. The attester registry's named scalar,
+     * referenced rather than re-declared: one definition of a key encoding. Held
+     * to PB-9 at load: a small-order point here is a key under which one
+     * signature verifies every message.
+     */
+    readonly classical: Ed25519PublicKey;
+    /**
+     * The ML-DSA-65 verification key. Required because CR-3 is conjunctive and
+     * the bundle's suite names both primitives; a receipt verifies only when
+     * every leg does.
+     */
+    readonly pq: MlDsa65PublicKey;
+}
+/**
+ * The lenient projection of ReceiptIdentity: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawReceiptIdentity {
+    readonly schemaVersion?: string;
+    readonly name?: string;
+    readonly classical?: string;
+    readonly pq?: string;
+}
+/**
+ * Maps each action class to whether it can be undone.
+ *
+ * RV-1: an action ABSENT from this file MUST be treated as IRREVERSIBLE. As
+ * with floors, JSON Schema cannot express absence, so the rule is carried by
+ * the `x-acp-absent` annotation below and GENERATED into the type: `impl
+ * Default for Reversibility` returns `Irreversible` in crates/acp-core, and
+ * the lookup on the table returns it directly, so a struct update, a
+ * deserialisation gap, or an `Option` a caller unwraps cannot silently
+ * produce the permissive value.
+ *
+ * Why this matters more than it looks: reversibility selects the
+ * acknowledgement regime. IRREVERSIBLE at floor-HIGH demands positive
+ * acknowledgement from a non-operator (DR-9) — silence is not consent.
+ * Getting this entry wrong in the permissive direction converts a held
+ * action into a released one.
+ *
+ * RV-3 is the reason the value is recomputed here and never read from a
+ * receipt: a compromised issuer claiming REVERSIBLE otherwise obtains Silent
+ * mode. Proven in reference/proofs/binding.dfy as
+ * `RV3_TrustedModeAcceptsDowngrade`.
+ *
+ * A-7 applies here exactly as it does to floors: that a classification is
+ * HONEST is conceded unprovable.
+ * Generated from reversibility.schema.json.
+ */
+export interface ReversibilityTable {
+    readonly schemaVersion: '1';
+    /**
+     * action class -> reversibility. Open map (actions are deployment-specific),
+     * closed values.
+     */
+    readonly reversibility: Readonly<Record<string, Reversibility>>;
+}
+/**
+ * Look up one entry in ReversibilityTable.reversibility.
+ *
+ * RV-1: reversibility selects the acknowledgement regime, so the permissive
+ * default converts a held action into a released one. An action nobody
+ * classified is one nobody thought about, and the fail-safe reading of that
+ * is that it cannot be undone.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export declare function reversibilityTableLookup(table: ReversibilityTable, key: string): Reversibility;
+/**
+ * The lenient projection of ReversibilityTable: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawReversibilityTable {
+    readonly schemaVersion?: string;
+    readonly reversibility?: Readonly<Record<string, string>>;
+}
+/**
+ * `RiskFunction`.
+ * Generated from risk_functions.schema.json#/$defs/risk_function.
+ */
+export interface RiskFunction {
+    /**
+     * Action class this function grades. At most one function per action class —
+     * two functions for one class is an ambiguity, not a merge, and the loader
+     * refuses it.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: minLength 1, maxLength 128.
+     */
+    readonly appliesTo: string;
+    readonly base: Risk;
+    /**
+     * Clauses evaluated in order. MONOTONE BY CONSTRUCTION: a clause can only
+     * raise the level, never lower it, which is why the field is `raise_to` and
+     * there is no `lower_to`. Monotonicity is what makes the Dafny proof that
+     * floors dominate raises tractable — a lowering clause would let a crafted
+     * parameter walk a HIGH action down to LOW.
+     */
+    readonly raiseTo: readonly RaiseClause[];
+}
+/**
+ * The lenient projection of RiskFunction: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawRiskFunction {
+    readonly appliesTo?: string;
+    readonly base?: string;
+    readonly raiseTo?: readonly RawRaiseClause[];
+}
+/**
+ * Deterministic functions from a Proposal's parameters and its targets'
+ * effective tiers to a risk level.
+ *
+ * RK-2 exists because static per-action risk is insufficient:
+ * `modify_firewall_rule = HIGH` says nothing useful, since risk is a
+ * function of PARAMETERS and TARGETS, not action names.
+ *
+ * THE ABSENT CASE DIFFERS FROM floors AND reversibility. An action with no
+ * risk function is REFUSED at §8.4 step 3 — it is NOT graded HIGH. Refusing
+ * and grading-HIGH are different behaviours: grading HIGH would route an
+ * unknown action into the human quorum, which looks conservative but
+ * silently teaches approvers to rubber-stamp things the policy author never
+ * considered. P-4: unknown is never LOW, and here it is not HIGH either — it
+ * is a refusal.
+ *
+ * TR-8: these functions are evaluated by the Executor over the INDEPENDENTLY
+ * RECEIVED canonical Proposal and the trusted bundle, ignoring every
+ * Context-Store raise and ignoring any risk value asserted in the receipt.
+ * The recomputed value is what all subsequent attestation requirements key
+ * on.
+ * Generated from risk_functions.schema.json.
+ */
+export interface RiskFunctions {
+    readonly schemaVersion: '1';
+    readonly riskFunctions: readonly RiskFunction[];
+}
+/**
+ * Look up one entry in RiskFunctions.risk_functions.
+ *
+ * 8.4-3: THE ABSENT CASE HERE IS NOT THE ABSENT CASE IN floors OR
+ * reversibility. An action with no risk function is REFUSED, not graded
+ * HIGH. Grading HIGH would route an unknown action into the human quorum,
+ * which looks conservative and is worse: it teaches approvers to
+ * rubber-stamp things the policy author never considered (T-26 habituation,
+ * AT-7). P-4 says unknown is never LOW; here it is not HIGH either. A lookup
+ * returning `Option` would let a caller reach for HIGH as the obvious safe
+ * default and get this exactly wrong.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export type RiskFunctionsLookup = {
+    readonly present: true;
+    readonly value: RiskFunction;
+} | {
+    readonly present: false;
+    readonly clause: string;
+    readonly why: string;
+};
+export declare function riskFunctionsLookup(table: RiskFunctions, key: string): RiskFunctionsLookup;
+/**
+ * The lenient projection of RiskFunctions: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawRiskFunctions {
+    readonly schemaVersion?: string;
+    readonly riskFunctions?: readonly RawRiskFunction[];
+}
+/**
+ * The `SIGNATURE` file at the bundle root: the declared suite, and one
+ * signature value per primitive that suite requires, over SHA-256 of the
+ * canonical bundle tree.
+ *
+ * A CORRECTION IS RECORDED HERE. Until this revision this file was named
+ * `bundle.schema.json` and described a *tree index* — `schema_version`, a
+ * `members` array of path+digest pairs, and a `signature` object carrying
+ * two fixed base64 fields named `classical` and `pq`. None of that artifact
+ * exists. §8.2's file listing contains no index file; the covered set is
+ * established by the CANONICAL WALK (`walk_bundle`, in both
+ * implementations), which is what makes "the tree" a fact rather than a
+ * convention. And PB-8, added in v1.3.15 when the offline signer turned the
+ * format from a diagram into bytes, specifies the file as a suite plus ONE
+ * VALUE PER PRIMITIVE — a map keyed by primitive name, hex-encoded — which
+ * is not the fixed pair the old schema declared.
+ *
+ * So the normative source held two descriptions of one object, and they
+ * disagreed: the encoding-split defect arriving inside the document that
+ * exists to prevent it. It survived because NOTHING READ THE SCHEMAS. They
+ * were normative and unexecuted, and the first consumer — `tools/codegen.sh`
+ * — found this on its first run. That is the same shape as `sim/bundle.py`
+ * silently dropping three fields from a hash for several releases: a
+ * load-bearing artifact with no gate line.
+ *
+ * WHY THE MEMBERS INDEX IS NOT COMING BACK. The old rationale was real —
+ * without an explicit list, a verifier that skipped a file and a signer that
+ * included it compute different hashes and neither can tell which is wrong.
+ * The adopted answer is to make the WALK normative rather than to ship a
+ * list: it refuses symlinks, refuses unrecognised file types, and orders
+ * byte-wise, so two conformant implementations enumerate the same set. A
+ * committed index would be a second statement of the same fact, and this
+ * file exists because of what happens to the second statement.
+ * Generated from signature.schema.json.
+ */
+export interface SignatureEnvelope {
+    /**
+     * The suite this signature was produced under. PB-8: it MUST be inside the
+     * tree hash. Outside it, an attacker relabels a hybrid bundle as classical,
+     * the verifier obligingly requires one primitive, and the CR-3 downgrade
+     * costs nothing.
+     */
+    readonly suite: SuiteId;
+    /**
+     * primitive name -> signature value, lowercase hex.
+     *
+     * CR-3, CONJUNCTIVE: the values present MUST be exactly those the declared
+     * suite requires, and every one of them MUST verify. Not "at least": a value
+     * for a primitive the suite does not declare is as much a refusal as a
+     * missing one, because an `any`-shaped check lets an attacker strip the
+     * post-quantum leg, present a genuine classical signature, and be accepted.
+     *
+     * Hex rather than base64, matching what both implementations write.
+     * Per-primitive lengths (Ed25519 64 bytes, ML-DSA-65 3309) are asserted in
+     * code and not here: `parts` is keyed by primitive, so no single value
+     * pattern can express a length that depends on its own key.
+     *
+     * Schema constraints, carried as documentation and NOT enforced by this
+     * type: values pattern `^[0-9a-f]+$`.
+     */
+    readonly parts: Readonly<Record<string, string>>;
+}
+/**
+ * Look up one entry in SignatureEnvelope.parts.
+ *
+ * CR-3, PB-8: a primitive the declared suite requires and this file does not
+ * carry is a stripped leg, and a stripped leg is the downgrade the hybrid
+ * suite exists to prevent. Absent is refused, never treated as 'not
+ * applicable'.
+ *
+ * Generated from the schema's `x-acp-absent` rule. It is not restated here.
+ */
+export type SignatureEnvelopeLookup = {
+    readonly present: true;
+    readonly value: string;
+} | {
+    readonly present: false;
+    readonly clause: string;
+    readonly why: string;
+};
+export declare function signatureEnvelopeLookup(table: SignatureEnvelope, key: string): SignatureEnvelopeLookup;
+/**
+ * The lenient projection of SignatureEnvelope: every field optional, every enum
+ * degraded to `string`. What a verifier parses. Never make a decision on
+ * one — the fail-safe lookups live on the strict type only.
+ */
+export interface RawSignatureEnvelope {
+    readonly suite?: string;
+    readonly parts?: Readonly<Record<string, string>>;
+}
+/**
+ * One registry entry: a machine (`kind: hybrid`) or a human (`kind:
+ * webauthn`). A TAGGED union, deliberately: the generator refuses an
+ * untagged `oneOf` because 'first branch that parses' is how a document
+ * meant as one thing is read as another, and a key kind guessed from which
+ * fields are present is exactly that guess. Every entry carries `kind`; one
+ * without it is `Malformed` at load (HM-1).
+ * Generated from attesters.schema.json#/$defs/attester.
+ *
+ * A DISCRIMINATED union over `kind`, which every branch pins to a literal.
+ * Narrow it by switching on that field; a `default` arm that accepts an
+ * unrecognised value is a branch this union does not have, and the fail-safe
+ * answer there is to refuse. There is no `Raw` union: with every field
+ * optional each branch would accept every other document and the tag would
+ * decide nothing.
+ */
+export type Attester = MachineAttester | HumanAttester;
+//# sourceMappingURL=generated.d.ts.map