@openvtc/trust-tasks 0.14.1 → 0.15.0

package/dist/_shared/components.d.ts

@@ -0,0 +1,3122 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ *
+ * Every definition a Trust Task payload schema reaches through a cross-file
+ * `$ref`, declared once. Spec modules import from here and re-export what they
+ * use under the definition's own name, so `Ext` is one type rather than one
+ * `Ext`, `Ext1` or `Ext2` per module.
+ *
+ * A name that denotes more than one shape across the registry — `VaultEntry`
+ * exists in three — is qualified with the family and version of the schema it
+ * came from. Every shape of such a name is qualified, including the oldest:
+ * there is no canonical `VaultEntry` to leave unmarked.
+ */
+/**
+ * The account's role at the mediator. `standard` is an ordinary served account; `admin`/`rootAdmin` may administer other accounts; `mediator` is the mediator's own account. Only a rootAdmin may assign or modify the rootAdmin role.
+ */
+export type AccountType = "standard" | "admin" | "rootAdmin" | "mediator";
+/**
+ * The kind of privileged change recorded in the audit log.
+ */
+export type AuditAction = "setAcl" | "accessListAdd" | "accessListRemove" | "accessListClear" | "accountAdd" | "accountRemove" | "accountChangeType" | "accountChangeQueueLimits" | "adminAdd" | "adminStrip";
+/**
+ * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each.
+ */
+export type Capability_DeviceV0_1 = "vault-read" | "vault-write" | "proxy-login" | "fill-release" | "policy-admin" | "device-admin" | "sign" | "key-mint";
+/**
+ * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each.
+ */
+export type Capability_DeviceV0_2 = "vaultRead" | "vaultWrite" | "proxyLogin" | "fillRelease" | "policyAdmin" | "deviceAdmin" | "sign" | "keyMint";
+/**
+ * Discriminator: is this consumer a user-driven Companion or a headless Service?
+ */
+export type ConsumerKind_DeviceV0_1 = Companion_DeviceV0_1 | Service_DeviceV0_1;
+/**
+ * Discriminator: is this consumer a user-driven Companion or a headless Service?
+ */
+export type ConsumerKind_DeviceV0_2 = Companion_DeviceV0_2 | Service_DeviceV0_2;
+/**
+ * Stable identifier for an issued credential — the handle for revocation and audit. Opaque to the holder: it MUST be echoed verbatim when revoking and MUST NOT be parsed.
+ */
+export type CredentialId = string;
+/**
+ * The approver's answer. `deny` aborts the pending request; a subsequent submit of the same task starts a fresh one.
+ */
+export type Decision = "approve" | "deny";
+/**
+ * Producer-supplied attestation at registration time, verifiable by the maintainer against the platform's attestation infrastructure. Tagged union over the discriminator `kind`.
+ */
+export type DeviceAttestation_DeviceV0_1 = WebAuthnAttestation_DeviceV0_1 | AppleAppAttest_DeviceV0_1 | PlayIntegrity_DeviceV0_1 | Tpm_DeviceV0_1 | NitroEnclave_DeviceV0_1 | NoAttestation_DeviceV0_1;
+/**
+ * Producer-supplied attestation at registration time, verifiable by the maintainer against the platform's attestation infrastructure. Tagged union over the discriminator `kind`.
+ */
+export type DeviceAttestation_DeviceV0_2 = WebAuthnAttestation_DeviceV0_2 | AppleAppAttest_DeviceV0_2 | PlayIntegrity_DeviceV0_2 | Tpm_DeviceV0_2 | NitroEnclave_DeviceV0_2 | NoAttestation_DeviceV0_2;
+/**
+ * A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.
+ *
+ * Multihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.
+ *
+ * This definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.
+ *
+ * Restricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that "interoperability is not guaranteed between implementations using such values", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.
+ */
+export type DigestMultibase = string;
+/**
+ * Whether the subject is permitted. The ABSENCE of any grant is treated as `deny` (default-deny).
+ */
+export type Effect_ConsentV0_1 = "allow" | "deny";
+/**
+ * Optimistic-concurrency precondition on a write. A positive value requires that the record's current `version` equals it exactly. Zero means "create only" — the write applies only if no LIVE record exists at the address, which is what makes lease acquisition safe: without it two instances can each read "absent", each write, and each believe it won. A tombstone is not a live record, so `expectedVersion: 0` succeeds over one; the created record takes the namespace's next counter value, which is necessarily greater than the tombstone's.
+ */
+export type ExpectedVersion = number;
+/**
+ * `issued` is outstanding and revocable; `consumed` and `expired` are terminal.
+ */
+export type InviteStatus = "issued" | "consumed" | "expired";
+/**
+ * Application-chosen identifier for a record within a namespace. Opaque to the maintainer: it MUST NOT be parsed, normalized, or case-folded, and prefix matching in `list` is a byte-prefix comparison over the UTF-8 encoding. Applications SHOULD use `/`-delimited hierarchical keys (`community/acme`, `contact/z6Mk…`) so that `prefix` can address a record family, but the delimiter is a convention between an application and itself — the maintainer attaches no meaning to it.
+ */
+export type Key = string;
+/**
+ * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.
+ */
+export type KeyOrigin = "derived" | "imported" | "internal";
+/**
+ * Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.
+ */
+export type KeyStatus = "active" | "revoked";
+/**
+ * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).
+ */
+export type KeyType = "ed25519" | "x25519" | "p256";
+/**
+ * The interaction kind: a 1:1 direct message, a multi-party group, or a broadcast channel.
+ */
+export type Kind = "dm" | "group" | "channel";
+/**
+ * Scopes one application's records within a context, so several tools can share a context without colliding — `openvtc`, `cnm`, an agent runtime. The maintainer MUST NOT interpret the value; it is an opaque partition name. Namespaces are first-come and unreserved, so an application SHOULD pick a stable, specific one: a future per-namespace ACL would grant on this exact string, which makes renaming a namespace a migration rather than an edit.
+ */
+export type Namespace = string;
+/**
+ * A device's platform push channel — the body the device registers with its push GATEWAY (push wake-up binding, https://trusttasks.org/binding/push/0.1; modeled on Aries RFC 0699/0734). The gateway holds this token and returns an opaque WakeHandle in exchange; the token is held by the gateway ONLY, never by the mediator or the maintainer/VTA. The gateway uses it to send a contentless wake-up when an authorized trigger asks — the push payload never carries Trust Task content. Tagged union over the discriminator `platform`.
+ */
+export type PushRegistration = Apns | Fcm | WebPush;
+/**
+ * Whether the record asserts an authorization or a recognition relationship.
+ */
+export type RecordType = "authorization" | "recognition";
+/**
+ * How a consent prompt reaches the approver: `wake` pushes to the approver's device for a DID-signed decision; `bridge-relay` renders it through an enrolled bridge (e.g. a numbered card in the operator's messaging app) for a bridge-attested decision.
+ */
+export type Route = "wake" | "bridge-relay";
+/**
+ * What the agent may do: `receive` = read inbound on this conversation; `converse` = read and reply.
+ */
+export type Scope_ConsentV0_1 = "receive" | "converse";
+/**
+ * Where a stored template lives. Tagged by `type`.
+ */
+export type Scope_VtaV0_1 = Builtin_VtaV0_1 | Global_VtaV0_1 | Context_VtaV0_1;
+/**
+ * Discriminated by `envelope`. Exactly one variant matches per document.
+ */
+export type SealedEnvelope_VaultV0_1 = DidcommAuthcryptEnvelope_VaultV0_1 | HpkeArmoredEnvelope_VaultV0_1 | TspMessageEnvelope_VaultV0_1;
+/**
+ * Discriminated by `envelope`. Exactly one variant matches per document.
+ */
+export type SealedEnvelope_VaultV0_2 = DidcommAuthcryptEnvelope_VaultV0_2 | HpkeArmoredEnvelope_VaultV0_2 | TspMessageEnvelope_VaultV0_2;
+/**
+ * Discriminator for the secret type stored in the entry. Definitions:
+ * - `password` — username + password (+ optional TOTP seed).
+ * - `passkey` — WebAuthn discoverable credential (private key + rpId + userHandle).
+ * - `oauth-tokens` — OAuth 2.0 refresh + access token bundle for a specific provider.
+ * - `did-self-issued` — Self-Issued OpenID Provider v2 (SIOP) credential: the entry points at a DID + signing key already managed by the VTA.
+ * - `didcomm-peer` — DIDComm peer identity used to authenticate against a DIDComm-speaking relying party.
+ * - `bearer-token` — opaque bearer token carried in a maintainer-named header (covers API tokens, long-lived JWTs, personal-access tokens).
+ * - `ssh-key` — SSH private key + comment.
+ * - `custom` — arbitrary structured fields; release-time consumer responsible for interpretation.
+ */
+export type SecretKind_VaultV0_1 = "password" | "passkey" | "oauth-tokens" | "did-self-issued" | "didcomm-peer" | "bearer-token" | "ssh-key" | "custom";
+/**
+ * Discriminator for the secret type stored in the entry. Definitions:
+ * - `password` — username + password (+ optional TOTP seed).
+ * - `passkey` — WebAuthn discoverable credential (private key + rpId + userHandle).
+ * - `oauthTokens` — OAuth 2.0 refresh + access token bundle for a specific provider.
+ * - `didSelfIssued` — Self-Issued OpenID Provider v2 (SIOP) credential: the entry points at a DID + signing key already managed by the VTA.
+ * - `didcommPeer` — DIDComm peer identity used to authenticate against a DIDComm-speaking relying party.
+ * - `bearerToken` — opaque bearer token carried in a maintainer-named header (covers API tokens, long-lived JWTs, personal-access tokens).
+ * - `sshKey` — SSH private key + comment.
+ * - `custom` — arbitrary structured fields; release-time consumer responsible for interpretation.
+ */
+export type SecretKind_VaultV0_2 = "password" | "passkey" | "oauthTokens" | "didSelfIssued" | "didcommPeer" | "bearerToken" | "sshKey" | "custom";
+/**
+ * Which transport a task is acting on. This is the discriminator: it selects which member of `config` is meaningful, and a payload naming one kind with another's config is malformed rather than merely ignored.
+ */
+export type ServiceKind = "didcomm" | "rest" | "tsp" | "webauthn";
+/**
+ * `EdDSA` pairs with an `ed25519` key; `ES256` pairs with a `p256` key. An `x25519` key performs key agreement and can sign nothing, so no algorithm here is valid for one. The enumeration is closed: an unrecognised algorithm is refused rather than silently substituted with a supported one.
+ */
+export type SignAlgorithm = "EdDSA" | "ES256";
+/**
+ * A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.
+ */
+export type SiteTarget_VaultV0_1 = WebOrigin_VaultV0_1 | Did_VaultV0_1 | IosApp_VaultV0_1 | AndroidApp_VaultV0_1;
+/**
+ * A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.
+ */
+export type SiteTarget_VaultV0_2 = WebOrigin_VaultV0_2 | Did_VaultV0_2 | IosApp_VaultV0_2 | AndroidApp_VaultV0_2;
+export type SyncEvent_SyncV0_1 = VaultUpsertedEvent_SyncV0_1 | VaultDeletedEvent_SyncV0_1 | AclChangedEvent_SyncV0_1 | PolicyChangedEvent_SyncV0_1;
+export type SyncEvent_SyncV0_2 = VaultUpsertedEvent_SyncV0_2 | VaultDeletedEvent_SyncV0_2 | AclChangedEvent_SyncV0_2 | PolicyChangedEvent_SyncV0_2;
+/**
+ * What the policy decided.
+ *
+ * `allow` — admitted. `deny` — refused, terminally for this submission. `refer` — parked for a human or quorum decision; the applicant is neither in nor out. `requestMore` — the policy cannot decide yet and names what further evidence it needs.
+ *
+ * The four are not reducible to a pending/decided pair. `refer` and `requestMore` are both 'not decided', but they place the next action with different parties: `refer` waits on the community, `requestMore` waits on the applicant. A consumer that cannot tell them apart cannot tell a user whether to wait or to act.
+ */
+export type VerdictEffect = "allow" | "deny" | "refer" | "requestMore";
+/**
+ * A value of the namespace's monotonic write counter (see this schema's description). Server-assigned; a producer never chooses one.
+ */
+export type Version = number;
+/**
+ * A Verifiable Identifier (SPEC §4.8). For a mediator-served account this is the account's controlling DID, carried verbatim and compared by exact string equality. For privacy — and because some mediators key accounts by a one-way hash and never hold the full DID — a stable hash of the DID (e.g. its SHA-256 digest) is an equally valid value here: producer and consumer simply agree on the same opaque identifier and compare by exact string equality. The field carries whichever form the issuing mediator uses.
+ */
+export type Vid = string;
+/**
+ * The mediator's view of one served account.
+ */
+export interface Account {
+    /**
+     * The account's controlling DID, or — for privacy, and for mediators that key accounts by a one-way hash and never hold the full DID — a stable hash of that DID (see `Vid`). Whichever form is used, it is the opaque account identifier the other `account/*`, `acl/*`, and `access-list/*` tasks accept.
+     */
+    did: Vid;
+    accountType: AccountType;
+    acl: MediatorAcl;
+    queueLimits?: QueueLimits;
+    /**
+     * Current count of queued send messages.
+     */
+    sendQueueCount?: number;
+    /**
+     * Current byte size of queued send messages.
+     */
+    sendQueueBytes?: number;
+    /**
+     * Current count of queued receive messages.
+     */
+    receiveQueueCount?: number;
+    /**
+     * Current byte size of queued receive messages.
+     */
+    receiveQueueBytes?: number;
+    /**
+     * Number of entries in the account's access list.
+     */
+    accessListCount?: number;
+}
+export interface AclChangedEvent_SyncV0_1 {
+    kind: "acl.changed";
+    seq: number;
+    occurredAt: string;
+    /**
+     * DID of the consumer whose ACL entry changed.
+     */
+    subject: string;
+    change: "granted" | "revoked" | "role_changed" | "swapped" | "device_disabled" | "device_wiped";
+}
+export interface AclChangedEvent_SyncV0_2 {
+    kind: "aclChanged";
+    seq: number;
+    occurredAt: string;
+    /**
+     * DID of the consumer whose ACL entry changed.
+     */
+    subject: string;
+    change: "granted" | "revoked" | "roleChanged" | "swapped" | "deviceDisabled" | "deviceWiped";
+}
+export interface AclEntry {
+    /**
+     * VID of the party in the ACL. Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.
+     */
+    subject: string;
+    /**
+     * Opaque role identifier interpreted by the ACL maintainer.
+     */
+    role: string;
+    /**
+     * Opaque scope identifiers (e.g. contexts, domains, resource prefixes).
+     */
+    scopes?: string[];
+    /**
+     * Key identifiers this subject may invoke the maintainer's signing oracle on. INTERSECTS WITH `scopes` — it can only narrow, never widen: a key named here that lies outside the entry's scopes remains unreachable, exactly as if it were not named. ABSENT means every key within the entry's scopes (the behaviour of entries that pre-date this member); explicit `null` is equivalent to absent, and producers SHOULD omit the member instead. PRESENT-BUT-EMPTY means authorized on NO keys — the opposite of absent, and deliberately so: emptiness is never a wildcard (CONVENTIONS.md §5). A consumer MUST preserve and enforce the absent-vs-empty distinction end to end; collapsing the two (e.g. by testing emptiness alone) re-creates the empty-means-unrestricted class of privilege-escalation defect this family's conventions exist to prevent.
+     */
+    allowedKeys?: string[] | null;
+    /**
+     * Optional human-readable label.
+     */
+    label?: string;
+    createdAt?: string;
+    /**
+     * VID of the party that originally added this entry.
+     */
+    createdBy?: string;
+    updatedAt?: string;
+    /**
+     * VID of the party that last modified this entry.
+     */
+    updatedBy?: string;
+    /**
+     * Optional time after which the entry is no longer effective.
+     */
+    expiresAt?: string;
+    /**
+     * Per-entry authentication step-up configuration, consumed by the ACL maintainer when it gates an operation behind a step-up (see auth/step-up/policy/0.1). ADDITIVE-ONLY: a per-entry setting MAY raise the assurance required of this subject above the maintainer's system-wide floor, but MUST NOT lower it. The maintainer resolves the effective requirement as the strictest of (system floor, this entry).
+     */
+    stepUp?: {
+        /**
+         * VID authorized to ratify step-up for this subject — the `recipient` the maintainer addresses an auth/step-up/approve-request to (e.g. the holder's mobile authenticator or browser companion). Absent → the subject is its own approver (mode `self`) when it holds a usable authenticator; if neither an `approver` nor a self authenticator exists, no step-up method is available for this subject and the maintainer's fail-closed rule applies.
+         */
+        approver?: string;
+        /**
+         * Minimum step-up mode this subject MUST satisfy for gated operations, raising the system floor. `self` = the subject re-authenticates its own session; `delegated` = a separate `approver` MUST ratify. Omitted → the system floor applies unchanged. A value weaker than the resolved floor is ignored (additive-only).
+         */
+        require?: "self" | "delegated";
+    };
+    /**
+     * Approve-authority: what this subject may **confer on others** by ratifying an approval, as distinct from `scopes`, which is what it may **exercise itself**. The two axes are independent, and that independence is the point — it is what lets a maintainer configure a least-privilege approver who can authorize an operation in a scope it has no authority to perform.
+     *
+     * OMISSION MEANS NOTHING IS CONFERRED. An absent `approve`, an absent `all`, and an empty `scopes` are all equivalent to "this subject may ratify nothing". A consumer that does not implement this member therefore confers less than the producer intended rather than more, which is the direction a missed member has to fail in.
+     *
+     * A subject with approve-authority is NOT thereby authorized to act. Consumers MUST resolve the two axes separately: reading `approve` to answer "may this party ratify X" and `scopes` to answer "may this party do X". Collapsing them grants an approver the ability to perform what it was only meant to sign off on.
+     */
+    approve?: {
+        /**
+         * The subject may confer ANY scope. Takes precedence over `scopes`, which a consumer MUST ignore when this is true. Absent or false → only the scopes listed below, if any.
+         */
+        all?: boolean;
+        /**
+         * Opaque scope identifiers this subject may confer, drawn from the same vocabulary as the entry's own `scopes`. Where a maintainer's scopes are hierarchical, conferring a scope confers its descendants — the same containment rule the maintainer already applies to `scopes`, so the two axes cannot disagree about what a scope means. An empty array confers nothing; it is not a wildcard.
+         */
+        scopes?: string[];
+    };
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces.
+     */
+    ext?: Ext;
+}
+/**
+ * A privileged account at the mediator (an `admin` or `rootAdmin`).
+ */
+export interface AdminAccount {
+    /**
+     * The admin account's identifier — its DID or, for privacy, a stable hash of that DID (see `Vid`).
+     */
+    did: Vid;
+    /**
+     * The admin role; one of `admin` or `rootAdmin`.
+     */
+    accountType: AccountType;
+}
+/**
+ * An agent name bound to a DID. A name is only ever authoritative in the DID→name direction: the DID document's `alsoKnownAs` is what proves the binding, because anyone controlling a domain can point a name at somebody else's DID.
+ */
+export interface AgentNameEntry {
+    /**
+     * The name, without the host — the full form is `<host>/@<name>`.
+     */
+    name: string;
+    /**
+     * Whether the name currently resolves. A disabled name is still held — it is not available for anyone else to take.
+     */
+    enabled: boolean;
+    /**
+     * Unix epoch seconds.
+     */
+    createdAt?: number;
+    ext?: Ext;
+}
+/**
+ * A record as the maintainer holds it. `value` is absent in three distinct situations and a consumer MUST NOT conflate them: the record is a tombstone (`deleted` is true); the caller asked for a metadata-only view (`list` without `includeValues`); or the value genuinely is the JSON literal `null`, in which case `value` is PRESENT and null. This is why `deleted` is required rather than defaulted — a consumer that has to infer deletion from an absent value gets the tombstone case wrong exactly when convergence depends on it.
+ */
+export interface AppStateRecord {
+    /**
+     * The VTA context the record is scoped to; the isolation boundary.
+     */
+    contextId: string;
+    namespace: Namespace;
+    key: Key;
+    /**
+     * The namespace counter value this record's most recent write took. Supply it as `expectedVersion` on the next write to make that write conditional on nothing having changed in between.
+     */
+    version: Version;
+    /**
+     * The stored JSON, in whatever shape the owning application chose. Any JSON value, including `null`. The maintainer neither validates nor interprets it. Absent when this is a tombstone or a metadata-only view — see this definition's description for why that is not the same as a null value.
+     */
+    value?: {
+        [k: string]: unknown | undefined;
+    };
+    /**
+     * Size of the stored value in bytes, measured as the maintainer measures it for the per-record cap (see `vta/app-state/put`). Present in metadata-only views so a consumer can decide what to fetch without fetching it; absent on a tombstone.
+     */
+    valueBytes?: number;
+    /**
+     * True when this is a tombstone: the record was deleted, and this entry exists so that a consumer syncing incrementally learns of the deletion. Tombstones are reaped after the maintainer's retention window; see `vta/app-state/list`.
+     */
+    deleted: boolean;
+    /**
+     * When the record was first created at this address. MAY be absent on a tombstone whose body has been discarded.
+     */
+    createdAt?: string;
+    /**
+     * When the write that produced this `version` was applied. For a tombstone, when the delete was applied.
+     */
+    updatedAt: string;
+    /**
+     * When the record was deleted. Present only when `deleted` is true; equal to `updatedAt` for a tombstone the maintainer has not since rewritten.
+     */
+    deletedAt?: string;
+}
+/**
+ * Who approves inbound-messaging consent for a given platform within a VTA context, and how the prompt reaches them.
+ */
+export interface ApproverBinding {
+    /**
+     * Messaging-platform tag, e.g. "signal", "whatsapp", "slack".
+     */
+    platform: string;
+    /**
+     * The VTA context path this binding applies to.
+     */
+    context: string;
+    /**
+     * VID (DID) of the operator authorized to decide consent for this platform/context.
+     */
+    approver: string;
+    /**
+     * Optional. How to deliver the prompt; defaults to bridge-relay when omitted.
+     */
+    route?: Route;
+    /**
+     * Optional routing detail — e.g. the operator's opaque conversationRef for `bridge-relay`.
+     */
+    routeHint?: string;
+}
+export interface AttachmentRef_VaultV0_1 {
+    /**
+     * Opaque maintainer-assigned id for this attachment; used to fetch the blob via a separate mechanism.
+     */
+    id: string;
+    /**
+     * User-supplied filename (e.g. "recovery-codes.txt").
+     */
+    name: string;
+    /**
+     * Size of the encrypted blob in bytes. Maintainers MAY enforce a maximum per attachment and per entry.
+     */
+    sizeBytes: number;
+    /**
+     * Hex-encoded SHA-256 of the encrypted blob bytes (post-encryption). Lets the consumer verify integrity after fetch.
+     */
+    sha256: string;
+    /**
+     * Optional MIME type hint for the consumer UI (e.g. "text/plain", "application/x-pem-file").
+     */
+    contentType?: string;
+}
+export interface AttachmentRef_VaultV0_3 {
+    /**
+     * Opaque maintainer-assigned id for this attachment; used to fetch the blob via a separate mechanism.
+     */
+    id: string;
+    /**
+     * User-supplied filename (e.g. "recovery-codes.txt").
+     */
+    name: string;
+    /**
+     * Size of the encrypted blob in bytes. Maintainers MAY enforce a maximum per attachment and per entry.
+     */
+    sizeBytes: number;
+    /**
+     * Digest over the encrypted blob bytes (post-encryption), so the consumer can verify integrity after fetch. Taken over the bytes as stored, not over a canonicalization: the blob is an opaque artifact, not a JSON document.
+     */
+    digestMultibase: DigestMultibase;
+    /**
+     * Optional MIME type hint for the consumer UI (e.g. "text/plain", "application/x-pem-file").
+     */
+    contentType?: string;
+}
+/**
+ * One record in the mediator's privileged-change audit log: one change, by one actor, at one time.
+ */
+export interface AuditEntry {
+    /**
+     * Unix epoch seconds at which the change was recorded.
+     */
+    timestamp: number;
+    /**
+     * The authenticated account that made the change (an admin, or the owner for a self-service change).
+     */
+    actor: Vid;
+    /**
+     * The account whose record changed.
+     */
+    target: Vid;
+    action: AuditAction;
+    /**
+     * Short human-readable summary of the change; not machine-parsed.
+     */
+    detail?: string;
+}
+/**
+ * One entry in an append-only audit log. Only eventId/recordedAt/action are universal; every other field is populated by maintainers that track it. `prevHash`/`entryHash` are present on hash-chained logs (see audit/verify) and absent otherwise. Principal DIDs are plaintext and MAY be absent when a right-to-be-forgotten redaction has nulled them after the fact.
+ */
+export interface AuditEnvelope {
+    /**
+     * Stable identifier for this event. Also the tie-breaker component of a cursor's position key.
+     */
+    eventId: string;
+    /**
+     * Wall-clock time the entry was written. The primary ordering key.
+     */
+    recordedAt: string;
+    /**
+     * The operation this entry records — a maintainer-defined action name (e.g. `member.removed`, `policy.activated`). The discriminator for `detail`.
+     */
+    action: string;
+    /**
+     * How the operation resolved. Typically `success` or `denied`; a maintainer MAY use others. Absent for events that have no pass/fail sense.
+     */
+    outcome?: string;
+    /**
+     * DID of the principal that performed the action. `null` when a right-to-be-forgotten redaction has removed the plaintext; a maintainer that keeps a keyed hash of the actor for correlation carries it in `ext`, not here.
+     */
+    actor?: string | null;
+    /**
+     * DID of the principal the action acted upon, when the event has one. `null`/absent for events whose target is the maintainer itself. Same redaction semantics as `actor`.
+     */
+    target?: string | null;
+    /**
+     * Trust context the event occurred in, for a maintainer that partitions its log per context.
+     */
+    contextId?: string;
+    /**
+     * Envelope-shape version at the maintainer, for consumers that need to reason about wire-shape evolution.
+     */
+    schemaVersion?: number;
+    /**
+     * Hash-chain link: the `entryHash` of the immediately-preceding entry. Present only on chained logs; its integrity is what audit/verify checks. Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the predecessor's immutable content — the same derivation as `entryHash`, so a verifier recomputes both the same way.
+     */
+    prevHash?: DigestMultibase;
+    /**
+     * Hash-chain commitment over this entry's immutable content. The next entry's `prevHash` points here. Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of that content; the canonicalization is what makes the commitment reproducible by a verifier that did not write the entry.
+     */
+    entryHash?: DigestMultibase;
+    /**
+     * Event-specific payload, keyed by `action`. Opaque to the framework; a consumer that does not recognise the action treats it as an unstructured record.
+     */
+    detail?: {
+        [k: string]: unknown | undefined;
+    };
+    ext?: Ext;
+}
+/**
+ * The credential the client returns from `navigator.credentials.get`. Binary fields are base64url-encoded.
+ */
+export interface AuthenticatorAssertionResponseLogin {
+    id: string;
+    rawId: string;
+    type: "public-key";
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string | null;
+    };
+    authenticatorAttachment?: "platform" | "cross-platform";
+    clientExtensionResults?: {};
+}
+/**
+ * The credential the client returns from `navigator.credentials.create`. Binary fields are base64url-encoded.
+ */
+export interface AuthenticatorAttestationResponseRegistration {
+    id: string;
+    rawId: string;
+    type: "public-key";
+    response: {
+        clientDataJSON: string;
+        attestationObject: string;
+        transports?: string[];
+    };
+    authenticatorAttachment?: "platform" | "cross-platform";
+    clientExtensionResults?: {};
+}
+/**
+ * Unencrypted metadata plus the encrypted payload. The KDF and cipher parameters travel in the clear so a reader can decrypt without knowing this specification's defaults.
+ */
+export interface BackupEnvelope {
+    /**
+     * Envelope schema version.
+     */
+    version: number;
+    /**
+     * Envelope format tag, e.g. `vtc-backup-v1`.
+     */
+    format: string;
+    /**
+     * When the export was taken.
+     */
+    createdAt: string;
+    /**
+     * DID of the community exported from, when it has one. An import cross-checks this against the running community.
+     */
+    sourceDid?: string | null;
+    /**
+     * Version of the software that produced the envelope.
+     */
+    sourceVersion: string;
+    kdf: KdfParams;
+    encryption: EncryptionParams;
+    /**
+     * Whether the audit log and its signed checkpoints are inside `ciphertext`.
+     */
+    includesAudit: boolean;
+    /**
+     * base64url(AEAD(JSON(payload))).
+     */
+    ciphertext: string;
+}
+/**
+ * The self-description of a pluggable community capability: the Trust Task families it serves, the trust-registry vocabulary it reads and writes, the roles that may operate it, the membership lifecycle hooks it consumes, and the external adapters that act on its decisions. The manifest is what governance approves, what discovery advertises, and what a management UX renders.
+ */
+export interface CapabilityManifest {
+    /**
+     * The capability's namespace slug, e.g. `git-trust`.
+     */
+    capability: string;
+    /**
+     * Manifest/capability version, `MAJOR.MINOR`.
+     */
+    version: string;
+    /**
+     * Human-readable capability name for management surfaces.
+     */
+    title?: string;
+    /**
+     * One-paragraph description for management surfaces.
+     */
+    description?: string;
+    /**
+     * Trust Task spec slugs (or `<family>/*` globs) this capability serves when enabled.
+     *
+     * @minItems 1
+     */
+    specs: [string, ...string[]];
+    /**
+     * The trust-registry tuple vocabulary this capability may read and write. A conforming host MUST reject writes by this capability whose `action` is not listed.
+     */
+    vocabulary?: {
+        /**
+         * TRQP `action` values this capability owns, e.g. `git.commit.sign`.
+         *
+         * @minItems 1
+         */
+        actions: [string, ...string[]];
+        /**
+         * Human-readable pattern of the `resource` values used, e.g. `<org>[/<repo>]`.
+         */
+        resourcePattern?: string;
+    };
+    /**
+     * Map of capability operation (e.g. `grant`, `view`) to the community roles allowed to perform it.
+     */
+    roles?: {
+        [k: string]: string[] | undefined;
+    };
+    /**
+     * Membership lifecycle events the capability consumes, e.g. `member.enrolled`, `member.revoked`, `role.changed`.
+     */
+    lifecycleHooks?: string[];
+    /**
+     * Map of capability operation to the consent class its execution requires under the host's delegated-execution policy.
+     */
+    consentClass?: {
+        [k: string]: ("normal" | "elevated" | "destructive") | undefined;
+    };
+    /**
+     * Out-of-stack components that consume this capability's trust decisions.
+     */
+    externalAdapters?: {
+        /**
+         * Adapter type, e.g. `github-action`, `webhook`.
+         */
+        kind: string;
+        /**
+         * Where the adapter lives, e.g. a repository path or URL.
+         */
+        ref: string;
+    }[];
+    /**
+     * Spec slug of the JSON schema the per-community `config` document must validate against.
+     */
+    configSchema?: string;
+    ext?: Ext;
+}
+/**
+ * A community profile as a portable export carries it — the mutable profile members plus the immutable identity they belong to.
+ *
+ * Distinct from `vtc/_shared/community`'s `CommunityProfile`, which is the update-facing view and deliberately omits `communityDid` so that a patch cannot re-point a community's identity. Here the DID is REQUIRED and is the whole point: it is what lets an importing community refuse a document taken from a different one. `registryStatus` is absent because trust-registry reachability is a property of a running maintainer, not of exported state.
+ */
+export interface CommunityProfileSnapshot {
+    /**
+     * DID of the community this document was taken from. Immutable, set at install.
+     */
+    communityDid: string;
+    name: string;
+    description?: string;
+    logoUrl?: string | null;
+    publicUrl?: string | null;
+    contactEmail?: string | null;
+    /**
+     * BCP 47 language tag.
+     */
+    language: string;
+    /**
+     * The community's declared relationship-identifier default, as defined on `CommunityProfile` in the `vtc/_shared/0.1/community` schema. Carried in a config export so a restore reproduces the declaration rather than silently reverting it to the implementation default.
+     */
+    relationshipIdentifierDefault?: "attributed" | "pairwise";
+    /**
+     * The community's published personhood position, carried so an export restores it. Governance state, not runtime state — unlike `registryStatus`, which is deliberately absent here because reachability belongs to a running maintainer rather than to exported state.
+     */
+    personhood?: PersonhoodGovernance;
+    /**
+     * Opaque community-defined extension bag.
+     */
+    extensions?: {};
+    /**
+     * When the community was created. Provenance only — an import never writes it.
+     */
+    createdAt?: string;
+}
+/**
+ * A community profile **as read**: every member of CommunityProfile, plus the immutable identity a reader needs and an update must never set.
+ *
+ * CommunityProfile is the update-facing view and omits `communityDid` on purpose, so that a patch cannot re-point a community's identity. That is right for a payload and wrong for a response: a client holding a profile has no other way to learn which DID to verify that community's credentials against, and `community/profile/show` returning the update-facing view left the one member a consumer most needs undefined.
+ *
+ * So reads get this and updates keep CommunityProfile. The split is the point — the immutability of `communityDid` is enforced by it being absent from the payload, not by prose asking implementers not to honour it.
+ */
+export interface CommunityProfileView {
+    /**
+     * The community's own DID — the identifier every credential it issues names as `issuer`, and the one a member's credential binds them to. Immutable: set when the community is created and not settable through an update.
+     */
+    communityDid: string;
+    /**
+     * When the community was created. Immutable, like `communityDid`.
+     */
+    createdAt?: string;
+    name: string;
+    description?: string;
+    logoUrl?: string | null;
+    publicUrl?: string | null;
+    contactEmail?: string | null;
+    language: string;
+    /**
+     * Which identifier form the community expects members to issue relationship credentials under. `attributed` means the member's membership DID, so an edge names them; `pairwise` means a relationship DID unique to each counterparty. A declaration, not an enforcement: the member still chooses per relationship, and a community that wants to require one form does so in its own policy. Absent means the community has not declared one; implementations default to `pairwise`, matching the DTG Credentials recommendation.
+     */
+    relationshipIdentifierDefault?: "attributed" | "pairwise";
+    /**
+     * Opaque community-defined extension bag.
+     */
+    extensions?: {};
+    /**
+     * Trust-registry reachability. Populated on reads; not settable.
+     */
+    registryStatus?: "active" | "degraded";
+    /**
+     * What this community's governance asserts about the personhood of its members.
+     */
+    personhood?: PersonhoodGovernance;
+}
+/**
+ * A community's portable configuration: its profile plus the configuration overrides a maintainer stores for itself. Deliberately excludes per-host layers (environment variables, on-disk config files) — those describe where a maintainer runs, not what the community is, and carrying them would make an import overwrite the target host's own deployment settings.
+ *
+ * This document is designed to survive a round-trip through a file. An operator exports it, keeps it, and feeds it back later — possibly to a different maintainer, possibly across a version boundary — so it is self-describing rather than relying on the Type URI of the envelope that happened to carry it.
+ */
+export interface ConfigExportDocument {
+    /**
+     * Version of this document's own shape. Not redundant with the Type URI version: once the document is written to a file it is bare JSON with no envelope, and this is the only thing a later reader has to check it against. A consumer MUST reject a version it does not implement rather than guess.
+     */
+    schemaVersion: number;
+    /**
+     * When the export was taken. Provenance for the operator; a consumer does not act on it.
+     */
+    exportedAt: string;
+    /**
+     * The community's profile at export time. Absent when the community has no profile yet — a maintainer exported before bootstrap.
+     */
+    communityProfile?: CommunityProfileSnapshot;
+    /**
+     * Stored configuration overrides as `key → value`, keyed by the maintainer's own configuration registry (the same keys `config/show` and `config/patch` use). An empty object is valid and means no overrides are set.
+     */
+    configOverrides: {
+        [k: string]: unknown | undefined;
+    };
+    ext?: Ext;
+}
+/**
+ * One runtime configuration key as the maintainer currently sees it, after resolving whatever layered overlay it uses.
+ */
+export interface ConfigField {
+    /**
+     * The configuration key, e.g. `server.port` or `log.level`.
+     */
+    key: string;
+    /**
+     * The effective value. Any JSON scalar the key holds (string, number, boolean, or null). A maintainer MUST redact the value of a secret-bearing key (see the spec) rather than return it here.
+     */
+    value: {
+        [k: string]: unknown | undefined;
+    };
+    /**
+     * Which layer supplied the effective value. An opaque maintainer-defined label — the framework does not enumerate it. A maintainer with a layered overlay reports the winning layer (e.g. `env`, `db`, `toml`, `default`); one without layers reports its single source.
+     */
+    source: string;
+    /**
+     * True when a change to this key takes effect only after a restart, rather than on the next read.
+     */
+    requiresRestart: boolean;
+}
+/**
+ * One field an import would change, or did.
+ *
+ * `oldValue` is absent when the field is not currently set — no profile yet, or no stored override for that key. `newValue` is absent when the imported document omits the field, which means "leave the live value alone" rather than "clear it"; a caller that intends to clear a nullable member sends an explicit `null`, which appears here as `newValue: null`. The two are different requests and a consumer MUST NOT conflate them.
+ */
+export interface ConfigFieldChange {
+    /**
+     * The profile member or configuration key, e.g. `name` or `log.level`.
+     */
+    key: string;
+    /**
+     * Value in force before the import. Absent when the field is unset.
+     */
+    oldValue?: {
+        [k: string]: unknown | undefined;
+    };
+    /**
+     * Value the imported document carries. Absent when the document omits the field.
+     */
+    newValue?: {
+        [k: string]: unknown | undefined;
+    };
+}
+/**
+ * A recorded consent decision over a ConsentSubject.
+ */
+export interface ConsentGrant {
+    subject: ConsentSubject;
+    effect: Effect_ConsentV0_1;
+    /**
+     * Granted scope. REQUIRED when `effect` is `allow`; absent for `deny`.
+     */
+    scope?: Scope_ConsentV0_1;
+    /**
+     * VID of the approver who made the decision.
+     */
+    grantedBy: string;
+    /**
+     * RFC 3339 time the decision was recorded.
+     */
+    grantedAt: string;
+    /**
+     * Optional. After this time the grant lapses and the subject must be re-consented.
+     */
+    expiresAt?: string;
+    /**
+     * How the decision was authorized — e.g. "did-signed" (approver's DID signed the consent/decision) or "bridge-attested" (an enrolled bridge relayed the operator's out-of-band choice).
+     */
+    evidence?: string;
+}
+/**
+ * The platform-agnostic identifier of WHAT is being consented to: one conversation, for one agent.
+ */
+export interface ConsentSubject {
+    /**
+     * Messaging-platform tag, e.g. "signal", "whatsapp", "slack".
+     */
+    platform: string;
+    /**
+     * The bridge's OPAQUE conversation handle (e.g. "sig-1a2b3c4d"). NEVER the raw platform address — the VTA never learns the phone number / chat id.
+     */
+    conversationRef: string;
+    kind: Kind;
+    /**
+     * VID (DID) of the AI agent the conversation would reach.
+     */
+    agent: string;
+}
+export interface ConsumerContext {
+    /**
+     * Device-binding id assigned at registration. The maintainer cross-checks this against the authenticated transport identity.
+     */
+    deviceId?: string;
+    /**
+     * Most recent local user-verification on the consumer device (WebAuthn UV, biometric unlock). The maintainer's policy may require this to be within N seconds.
+     */
+    lastUserVerificationAt?: string;
+    /**
+     * Producer-supplied network classification. Advisory.
+     */
+    networkClass?: "unknown" | "home" | "corp" | "public" | "vpn";
+}
+export interface Companion_DeviceV0_1 {
+    kind: "companion";
+    formFactor: "browser" | "mobile" | "desktop";
+}
+export interface Service_DeviceV0_1 {
+    kind: "service";
+    serviceKind: "mediator" | "ai-agent" | "daemon";
+}
+export interface Companion_DeviceV0_2 {
+    kind: "companion";
+    formFactor: "browser" | "mobile" | "desktop";
+}
+export interface Service_DeviceV0_2 {
+    kind: "service";
+    serviceKind: "mediator" | "aiAgent" | "daemon";
+}
+/**
+ * Per-context restrictions the VTA enforces. Every member is optional, and **absence means unrestricted, not empty** — a policy that omits `presentableTypes` permits every type, while one that sets it to `[]` permits none. The two are opposite instructions and a consumer MUST NOT collapse them.
+ */
+export interface ContextPolicy {
+    /**
+     * VIDs permitted to receive presentations from this context. Absent: any verifier. Present-but-empty: none.
+     */
+    trustedVerifiers?: string[];
+    /**
+     * Credential types that may be presented from this context. Absent: any type. Present-but-empty: none.
+     */
+    presentableTypes?: string[];
+    /**
+     * Key ids the signing oracle may be invoked on within this context. Absent: every key the context holds. Present-but-empty: no keys.
+     */
+    signableKeys?: string[];
+    /**
+     * Whether material in this context may leave it through an export. Defaults to true; set it to false for a context whose contents must not be extractable.
+     */
+    exportAllowed?: boolean;
+    /**
+     * Resource limits for the context. Shape is maintainer-defined.
+     */
+    quotas?: {
+        [k: string]: unknown | undefined;
+    };
+    ext?: Ext;
+}
+/**
+ * A context as the VTA holds it.
+ */
+export interface ContextRecord {
+    /**
+     * Context id. For a nested context this is the full path (`parent/leaf`), not the leaf alone — an ACL scope naming this context must use this value verbatim.
+     */
+    id: string;
+    /**
+     * Human-readable name. Operator-facing only; carries no authorization meaning, and two contexts may share a name.
+     */
+    name: string;
+    /**
+     * DID this context acts as, when one has been assigned. Absent means the context has no identity of its own yet — not that it has been denied one.
+     */
+    did?: string;
+    /**
+     * Free-form description.
+     */
+    description?: string;
+    /**
+     * Id of the context this one nests under. Absent for a top-level context. Authority granted at a parent reaches its children, so this member is load-bearing for anyone reasoning about scope.
+     */
+    parent?: string;
+    /**
+     * Resolved path from the root context, as the VTA derives it from the parent chain. Consumers MUST treat this as derived state: it is recomputed by the maintainer and is not independently settable.
+     */
+    basePath: string;
+    /**
+     * RFC 3339.
+     */
+    createdAt: string;
+    /**
+     * RFC 3339.
+     */
+    updatedAt: string;
+    ext?: Ext;
+}
+/**
+ * A pointer to an issued credential, without the credential itself.
+ *
+ * The counterpart to IssuedCredential, for the far more common case of *reading about* a credential rather than being handed one. A listing that embedded the signed credential in every row would grow with the size of the credentials rather than the number of them — a page of fifty is megabytes — and a reader that only needs to know a credential exists, when it lapses, and how to revoke it does not need the bytes.
+ *
+ * The holder can always fetch the credential itself by `credentialId`, and a verifier can check revocation from the row's status-list slot without either. Reach for IssuedCredential only at the moment of minting, where the caller has no other way to receive what was just made for them.
+ */
+export interface CredentialReference {
+    credentialId: CredentialId;
+    /**
+     * When the credential was minted.
+     */
+    issuedAt?: string;
+    /**
+     * When it lapses, or null when it does not.
+     */
+    expiresAt?: string | null;
+}
+/**
+ * One presentation request awaiting the holder's decision, as the approver sees it.
+ *
+ * This is deliberately **not** the stored record. A consumer also retains the original DCQL query so an approval can re-present byte-faithfully against the verifier's original nonce; that is machinery, not a decision input, and is not exposed here. What is exposed is exactly what an approver needs to answer "should I disclose this": who is asking, why, and precisely which claims of which held credentials would leave the wallet.
+ */
+export interface DeferredPresentation {
+    /**
+     * Approval handle for this deferral — the value `pending/approve` and `pending/deny` act on.
+     */
+    id: string;
+    /**
+     * The verifier that asked. An approved presentation binds to this audience, so approving is a decision about *this* party and not a standing permission.
+     */
+    verifierDid: string;
+    /**
+     * Every held credential the query would disclose, resolved against what the holder actually holds. This is the authorization surface: the approver is consenting to these claims leaving the wallet, not to the query in the abstract.
+     */
+    requested: RequestedCredential[];
+    /**
+     * The verifier's stated reason, carried through from the query. Purpose binding: an approver decides against a stated why, never a bare request.
+     */
+    purpose: string;
+    /**
+     * When the deferral was recorded.
+     */
+    createdAt: string;
+    /**
+     * After this the deferral is stale and approval MUST refuse — the verifier's nonce is no longer fresh, so any presentation minted against it would fail the verifier's own replay check.
+     */
+    expiresAt: string;
+}
+export interface WebAuthnAttestation_DeviceV0_1 {
+    kind: "webauthn";
+    /**
+     * WebAuthn Authenticator AAGUID (UUID).
+     */
+    aaguid: string;
+    /**
+     * Base64url-encoded WebAuthn attestation statement, when supplied by the platform.
+     */
+    attestationStatement?: string;
+}
+export interface AppleAppAttest_DeviceV0_1 {
+    kind: "apple-app-attest";
+    keyId: string;
+    attestation: string;
+}
+export interface PlayIntegrity_DeviceV0_1 {
+    kind: "play-integrity";
+    token: string;
+}
+export interface Tpm_DeviceV0_1 {
+    kind: "tpm";
+    quote: string;
+}
+export interface NitroEnclave_DeviceV0_1 {
+    kind: "nitro-enclave";
+    quote: string;
+}
+/**
+ * No device-level attestation is available. Maintainers MAY still register the device but SHOULD apply stricter policy (shorter session TTL, more frequent step-up).
+ */
+export interface NoAttestation_DeviceV0_1 {
+    kind: "none";
+}
+export interface WebAuthnAttestation_DeviceV0_2 {
+    kind: "webauthn";
+    /**
+     * WebAuthn Authenticator AAGUID (UUID).
+     */
+    aaguid: string;
+    /**
+     * Base64url-encoded WebAuthn attestation statement, when supplied by the platform.
+     */
+    attestationStatement?: string;
+}
+export interface AppleAppAttest_DeviceV0_2 {
+    kind: "appleAppAttest";
+    keyId: string;
+    attestation: string;
+}
+export interface PlayIntegrity_DeviceV0_2 {
+    kind: "playIntegrity";
+    token: string;
+}
+export interface Tpm_DeviceV0_2 {
+    kind: "tpm";
+    quote: string;
+}
+export interface NitroEnclave_DeviceV0_2 {
+    kind: "nitroEnclave";
+    quote: string;
+}
+/**
+ * No device-level attestation is available. Maintainers MAY still register the device but SHOULD apply stricter policy (shorter session TTL, more frequent step-up).
+ */
+export interface NoAttestation_DeviceV0_2 {
+    kind: "none";
+}
+export interface DeviceBinding_DeviceV0_1 {
+    /**
+     * Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.
+     */
+    deviceId: string;
+    /**
+     * The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.
+     */
+    consumerDid: string;
+    consumerKind: ConsumerKind_DeviceV0_1;
+    /**
+     * Human-readable name (e.g. "Glenn's MacBook — Chrome", "iPhone 17").
+     */
+    displayName: string;
+    /**
+     * Free-form platform descriptor (e.g. "macOS 16 / Chrome 142", "iOS 19.1", "Android 16", "Linux/x86_64"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.
+     */
+    platform?: string;
+    attestation?: DeviceAttestation_DeviceV0_1;
+    /**
+     * Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.
+     */
+    pushCapable?: boolean;
+    /**
+     * How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.
+     */
+    keyCustody?: KeyCustody;
+    /**
+     * Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.
+     */
+    capabilities?: Capability_DeviceV0_1[];
+    registeredAt: string;
+    /**
+     * Updated on every device/heartbeat and on any successful auth.
+     */
+    lastSeenAt?: string;
+    /**
+     * Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.
+     */
+    disabledAt?: string;
+    /**
+     * Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).
+     */
+    wipedAt?: string;
+    ext?: Ext;
+}
+export interface DeviceBinding_DeviceV0_2 {
+    /**
+     * Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.
+     */
+    deviceId: string;
+    /**
+     * The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.
+     */
+    consumerDid: string;
+    consumerKind: ConsumerKind_DeviceV0_2;
+    /**
+     * Human-readable name (e.g. "Glenn's MacBook — Chrome", "iPhone 17").
+     */
+    displayName: string;
+    /**
+     * Free-form platform descriptor (e.g. "macOS 16 / Chrome 142", "iOS 19.1", "Android 16", "Linux/x86_64"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.
+     */
+    platform?: string;
+    attestation?: DeviceAttestation_DeviceV0_2;
+    /**
+     * Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.
+     */
+    pushCapable?: boolean;
+    /**
+     * How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.
+     */
+    keyCustody?: KeyCustody;
+    /**
+     * Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.
+     */
+    capabilities?: Capability_DeviceV0_2[];
+    registeredAt: string;
+    /**
+     * Updated on every device/heartbeat and on any successful auth.
+     */
+    lastSeenAt?: string;
+    /**
+     * Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.
+     */
+    disabledAt?: string;
+    /**
+     * Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).
+     */
+    wipedAt?: string;
+    ext?: Ext;
+}
+export interface DidRecord {
+    /**
+     * Local path under which the DID is hosted (e.g. `alice`, `tenant/staff/alice`, `.well-known`). Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.
+     */
+    mnemonic: string;
+    /**
+     * VID of the party that currently owns the record. Authorization to mutate the record is anchored on this field.
+     */
+    owner: string;
+    /**
+     * RFC3339 timestamp of initial reservation.
+     */
+    createdAt: string;
+    /**
+     * RFC3339 timestamp of the most recent record mutation.
+     */
+    updatedAt: string;
+    /**
+     * Number of log entries the host currently holds for the DID. `0` indicates a reservation with no published log yet.
+     */
+    versionCount: number;
+    /**
+     * Fully-qualified DID identifier resolved from the most recent log entry (e.g. `did:webvh:<scid>:host:path`). Absent when `versionCount === 0`.
+     */
+    didId?: string;
+    /**
+     * Resolvable URL of the DID's log document (e.g. `https://did.example.com/alice/did.jsonl`). Stable across the record's lifetime: present from the initial reservation (`versionCount === 0`), it tells the owner where to publish the signed log and where resolvers fetch it. Distinct from `didId`, which only exists once a log entry has been published.
+     */
+    didUrl?: string;
+    /**
+     * DID method this record was registered under (e.g. `webvh`, `web`). When omitted, consumers MAY treat the record as legacy; SHOULD default to `webvh` only if their host predates the multi-method era.
+     */
+    method?: string;
+    /**
+     * Hosting domain (hostname) under which the DID resolves. Matches the host segment of the embedded DID identifier.
+     */
+    domain?: string;
+    /**
+     * When `true`, the DID is administratively disabled — the host serves a deactivation marker but retains content for recovery within the host's retention policy.
+     */
+    disabled?: boolean;
+    /**
+     * Lifetime resolve counter, when the host exposes per-DID statistics.
+     */
+    totalResolves?: number;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * Authored template shape: a DID document with `{TOKEN}` placeholders plus the variable contract the VTA's renderer enforces.
+ */
+export interface DidTemplate {
+    /**
+     * Template schema version. Currently always 1.
+     */
+    schemaVersion: 1;
+    /**
+     * Template id within its scope. Lowercase alphanumeric and hyphen only.
+     */
+    name: string;
+    /**
+     * Classification hint, e.g. `mediator`, `did-host-http`, `app`. Drives downstream provisioning behaviour.
+     */
+    kind: string;
+    /**
+     * Human-readable description of what the template provisions.
+     */
+    description?: string | null;
+    /**
+     * DID methods this template targets, e.g. ["webvh", "web"] for a hosted DID or ["key"] for a did:key.
+     */
+    methods?: string[];
+    /**
+     * Variables the caller MUST supply at render time. MUST NOT include reserved ambient names (DID, SIGNING_KEY_MB, KA_KEY_MB, VTA_DID, VTA_URL, CONTEXT_ID, CONTEXT_DID, NOW).
+     */
+    requiredVars?: string[];
+    /**
+     * Variables with default values, keyed by variable name.
+     */
+    optionalVars?: {
+        [k: string]: unknown | undefined;
+    };
+    /**
+     * Hints for CLI / setup wizards (e.g. preRotationCount, portable, addMediatorService).
+     */
+    defaults?: {
+        [k: string]: unknown | undefined;
+    };
+    /**
+     * The DID document body with `{TOKEN}` placeholders. `document.id` MUST contain the `{DID}` placeholder. Every `{TOKEN}` MUST be declared in requiredVars/optionalVars or be a reserved ambient name.
+     */
+    document: {};
+}
+/**
+ * A persisted template. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by get/create/update and carried per-item by list.
+ */
+export interface DidTemplateRecord {
+    schemaVersion: 1;
+    name: string;
+    kind: string;
+    description?: string | null;
+    methods?: string[];
+    requiredVars?: string[];
+    optionalVars?: {
+        [k: string]: unknown | undefined;
+    };
+    defaults?: {
+        [k: string]: unknown | undefined;
+    };
+    document: {};
+    /**
+     * Resolved scope of the stored template.
+     */
+    scope: Scope_VtaV0_1;
+    /**
+     * UTC unix-epoch seconds the template was first stored.
+     */
+    createdAt: number;
+    /**
+     * UTC unix-epoch seconds of the last write.
+     */
+    updatedAt: number;
+    /**
+     * DID of the admin who last wrote the template.
+     */
+    createdBy: string;
+}
+/**
+ * DIDComm v2 authcrypt JWE (ECDH-1PU + A256CBC-HS512, X25519/P-256 key agreement). Sender authentication is the JWE's `skid` — the producer's DID#keyAgreement. The maintainer's keyAgreement key is the recipient. Cleartext is JCS-canonical JSON of the variant's payload type.
+ *
+ * M2A is the only implementation today; this is also the canonical default for new code.
+ */
+export interface DidcommAuthcryptEnvelope_VaultV0_1 {
+    envelope: "didcomm-authcrypt";
+    /**
+     * Compact DIDComm v2 JWE (base64url-encoded, dot-separated). Unpacks via the framework's standard DIDComm machinery; cleartext is the payload-specific JSON.
+     */
+    jwe: string;
+}
+/**
+ * DIDComm v2 authcrypt JWE (ECDH-1PU + A256CBC-HS512, X25519/P-256 key agreement). Sender authentication is the JWE's `skid` — the producer's DID#keyAgreement. The maintainer's keyAgreement key is the recipient. Cleartext is JCS-canonical JSON of the variant's payload type.
+ *
+ * M2A is the only implementation today; this is also the canonical default for new code.
+ */
+export interface DidcommAuthcryptEnvelope_VaultV0_2 {
+    envelope: "didcommAuthcrypt";
+    /**
+     * Compact DIDComm v2 JWE (base64url-encoded, dot-separated). Unpacks via the framework's standard DIDComm machinery; cleartext is the payload-specific JSON.
+     */
+    jwe: string;
+}
+export interface DomainEntry {
+    /**
+     * Hosting domain name (e.g. `did.example.com`). Compared case-insensitively; producers SHOULD emit lowercase canonical form.
+     */
+    name: string;
+    /**
+     * Optional human-readable label.
+     */
+    label?: string;
+    /**
+     * Domain lifecycle state. A `disabled` domain still serves existing DIDs in read-only mode for the host's configured grace period before purge becomes eligible.
+     */
+    status: "active" | "disabled";
+    /**
+     * When `true`, this domain is the host's default — new DIDs created without an explicit domain are hosted here. Exactly one entry SHOULD carry `defaultDomain: true`.
+     */
+    defaultDomain?: boolean;
+    createdAt: string;
+    /**
+     * Present iff `status === "disabled"`.
+     */
+    disabledAt?: string;
+    /**
+     * Earliest RFC3339 timestamp at which the host's background sweep is allowed to purge content for a disabled domain. Operators with administrative authority MAY override the wait via `domain/purge`.
+     */
+    purgeAt?: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * A DIDComm mediator that is no longer advertised but is still accepting delivery, so in-flight messages routed through it are not stranded.
+ */
+export interface DrainEntry {
+    /**
+     * The mediator being drained.
+     */
+    mediatorDid: string;
+    /**
+     * Where it is still reachable for the remainder of the drain.
+     */
+    endpoint: string;
+    /**
+     * RFC 3339 instant after which the mediator is dropped and messages routed through it are lost.
+     */
+    drainsUntil: string;
+    ext?: Ext;
+}
+/**
+ * One consequence of executing the pending task, authored by the executor that is about to run it. An effect is produced by dry-running the real handler against the executor's own prior state — never by the requester, and never by re-implementing the handler's semantics elsewhere. A consent surface renders ONLY effects it received under the executor's signature.
+ */
+export interface Effect_TaskConsentV0_1 {
+    /**
+     * Machine discriminator for rich rendering. Well-known kinds are registered in the prose (`documentChange`, `keyRotation`, `preRotationRefresh`, `resourceDelete`, `disclosure`), but the set is OPEN: handlers evolve faster than this schema, and an executor MUST be able to describe a consequence this version does not name. A surface that does not recognise a `kind` MUST still render `summary`.
+     */
+    kind: string;
+    /**
+     * REQUIRED human-facing sentence describing this consequence, authored by the executor. This is the ONLY member a consent surface is guaranteed to be able to render, and it is what makes an unrecognised `kind` degrade to something truthful rather than something invisible. A surface MUST render it verbatim; it MUST NOT substitute its own prose.
+     */
+    summary: string;
+    /**
+     * OPTIONAL RFC 6901 JSON Pointer locating the change within the subject resource (e.g. `/service/0`).
+     */
+    path?: string;
+    /**
+     * OPTIONAL prior value at `path`, from the executor's authoritative state. ABSENT means there was no prior value (a creation); an explicit `null` is treated identically, so an executor MUST NOT rely on the two being distinguishable. Structured members are for rich rendering only — `summary` is what a surface is obliged to show, and it is where an executor states a distinction this shape cannot carry.
+     */
+    before?: {
+        [k: string]: unknown | undefined;
+    };
+    /**
+     * OPTIONAL resulting value at `path` once the task executes. ABSENT means the value is removed (a deletion), under the same rule as `before`.
+     */
+    after?: {
+        [k: string]: unknown | undefined;
+    };
+    /**
+     * OPTIONAL kind-specific structured extras (e.g. `{ "commitments": 2 }` for `preRotationRefresh`).
+     */
+    detail?: {
+        [k: string]: unknown | undefined;
+    };
+}
+export interface EncryptionParams {
+    /**
+     * AEAD identifier, e.g. `aes-256-gcm`.
+     */
+    algorithm: string;
+    /**
+     * base64url, 12 bytes.
+     */
+    nonce: string;
+}
+export interface Endorsement {
+    /**
+     * Community-scoped identifier for this endorsement row.
+     */
+    endorsementId: string;
+    /**
+     * The registered endorsement type this VEC asserts; see vtc/endorsement-types/*.
+     */
+    typeUri: string;
+    /**
+     * DID of the endorsement's subject (becomes credentialSubject.id).
+     */
+    subjectDid: string;
+    /**
+     * The attested claim body, validated against the endorsement type's claimSchema when it declares one.
+     */
+    claim?: {};
+    /**
+     * A pointer to the issued VEC — its identifier and lifetime, not its bytes. `endorsements/issue` additionally returns the credential itself, because that is the one call whose caller has no other way to receive it.
+     */
+    issued: CredentialReference;
+    /**
+     * The endorsement's slot on the community's shared Revocation status list. Published, so a foreign verifier can check revocation without contacting this community.
+     */
+    statusListIndex: number;
+    /**
+     * When the endorsement was revoked, or null while live.
+     */
+    revokedAt?: string | null;
+}
+export interface EndorsementType {
+    /**
+     * The endorsement type's URI. Community-scoped; workspace-reserved URIs (e.g. CommunityRole) are refused at registration.
+     */
+    typeUri: string;
+    description?: string;
+    /**
+     * Optional JSON Schema the endorsement's claims must satisfy (opaque here).
+     */
+    claimSchema?: {};
+    createdAt?: string;
+    /**
+     * The member who registered this endorsement type. An endorsement vocabulary is community-defined and shapes what every later endorsement can claim, so who introduced a type is audit-relevant in a way its creation time alone is not.
+     */
+    createdByDid?: string;
+}
+/**
+ * The authoritative SPEC §7.3 item 14 exposure class of the pending task, derived by the executor from the compiled handler it is about to invoke — never from the registry's declared value.
+ */
+export interface Exposure {
+    /**
+     * Sensitivity of data the task returns to its caller.
+     */
+    discloses: "none" | "metadata" | "secret";
+    /**
+     * Whether execution exercises the subject's own authority to produce an attributable effect in the subject's name.
+     */
+    actsAsSubject: boolean;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext {
+    [k: string]: unknown | undefined;
+}
+/**
+ * OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`did-signed` / `attested` / `pinned-only`) is the integrity / authenticity anchor.
+ *
+ * No open-source implementation reads this yet outside vta-sdk's `sealed_transfer` crate; new code SHOULD prefer the DIDComm variant. Defined here for parity with the existing offline-bundle / cross-VTA workflows that the design plan reserves for M5+.
+ */
+export interface HpkeArmoredEnvelope_VaultV0_1 {
+    envelope: "hpke-armored";
+    /**
+     * ASCII-armored bundle text. Multi-line base64 with framing headers + CRC24.
+     */
+    armored: string;
+    /**
+     * did:key identifier of the X25519 public key the envelope was sealed to. The recipient uses this to select the matching private key.
+     */
+    recipientKeyId: string;
+    /**
+     * Producer-assertion mode per the sealed-transfer framework. `did-signed` = Ed25519 signature by issuer; `attested` = TEE attestation quote (e.g. Nitro); `pinned-only` = OOB SHA-256 digest only (dev/test, NOT for production).
+     */
+    producerAssertion?: "did-signed" | "attested" | "pinned-only";
+}
+/**
+ * OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`didSigned` / `attested` / `pinnedOnly`) is the integrity / authenticity anchor.
+ *
+ * No open-source implementation reads this yet outside vta-sdk's `sealed_transfer` crate; new code SHOULD prefer the DIDComm variant. Defined here for parity with the existing offline-bundle / cross-VTA workflows that the design plan reserves for M5+.
+ */
+export interface HpkeArmoredEnvelope_VaultV0_2 {
+    envelope: "hpkeArmored";
+    /**
+     * ASCII-armored bundle text. Multi-line base64 with framing headers + CRC24.
+     */
+    armored: string;
+    /**
+     * did:key identifier of the X25519 public key the envelope was sealed to. The recipient uses this to select the matching private key.
+     */
+    recipientKeyId: string;
+    /**
+     * Producer-assertion mode per the sealed-transfer framework. `didSigned` = Ed25519 signature by issuer; `attested` = TEE attestation quote (e.g. Nitro); `pinnedOnly` = OOB SHA-256 digest only (dev/test, NOT for production).
+     */
+    producerAssertion?: "didSigned" | "attested" | "pinnedOnly";
+}
+/**
+ * Registry view of one issued Invitation Credential. Carries no credential material — the VIC itself is returned only once, by `issue`.
+ */
+export interface InvitationSummary {
+    /**
+     * VIC identifier; the revoke target.
+     */
+    id: string;
+    /**
+     * DID the invitation admits.
+     */
+    subjectDid: string;
+    /**
+     * Role granted on redemption, when the invitation names one.
+     */
+    role?: string;
+    /**
+     * DID of the operator who issued it.
+     */
+    issuedBy: string;
+    /**
+     * When it was issued.
+     */
+    issuedAt: string;
+    /**
+     * Expiry, when the invitation is time-bounded.
+     */
+    validUntil?: string;
+    /**
+     * When it was revoked; absent while live.
+     */
+    revokedAt?: string;
+}
+/**
+ * One outstanding or historical admin invite. Consumed rows are retained as audit history and cannot be revoked.
+ */
+export interface InviteSummary {
+    /**
+     * Unique invite identifier; the revoke target.
+     */
+    jti: string;
+    status: InviteStatus;
+    /**
+     * The admin DID this invite enrols a passkey for.
+     */
+    targetDid?: string;
+    /**
+     * When an `issued` invite lapses.
+     */
+    expiresAt?: string;
+    /**
+     * When the invite was redeemed, if it was.
+     */
+    consumedAt?: string;
+}
+/**
+ * The members of an issuance receipt, deliberately left **open** so a consuming specification can `$ref` it under `allOf` and add its own, then close the result with `unevaluatedProperties: false`.
+ *
+ * A closure inside this definition would defeat that. Both `additionalProperties` and `unevaluatedProperties` are evaluated against the whole instance from within the subschema that declares them, and neither can see members the *outer* schema matched — so either one here rejects the consumer's extras. Only an `unevaluatedProperties` at the outer level sees everything the composition matched. Use `IssuedCredential` where a closed standalone shape is wanted.
+ */
+export interface IssuedCredentialBase {
+    credentialId: CredentialId;
+    /**
+     * The issued Verifiable Credential (W3C VC Data Model 2.0), signed by the issuer's key. Opaque to the framework.
+     */
+    credential: {};
+    /**
+     * When the credential was minted.
+     */
+    issuedAt?: string;
+    /**
+     * When the credential's validUntil falls due.
+     */
+    expiresAt: string;
+}
+/**
+ * One application to join a Verifiable Trust Community.
+ */
+export interface JoinRequest {
+    /**
+     * Stable id of this join request (a UUID).
+     */
+    id: string;
+    /**
+     * DID of the applicant.
+     */
+    applicantDid: string;
+    /**
+     * The W3C Verifiable Presentation the applicant submitted (opaque here).
+     */
+    vp: {};
+    /**
+     * Canonical projection of `vp`, extracted when the request was submitted and used as the input the community's join policy reads. Carried on the row so an approval does not have to re-extract it, and opaque here: its members are whatever the community's policy asks of an applicant. `null` on a request recorded before a community began extracting one.
+     */
+    vpClaims?: {} | null;
+    submittedAt: string;
+    status: "pending" | "approved" | "rejected" | "withdrawn" | "deferred";
+    /**
+     * The community policy verdict recorded for this request (opaque here); absent while pending.
+     */
+    policyDecision?: {};
+    /**
+     * Why this request was refused, in terms meant for the applicant rather than the operator. `null` unless the request was rejected.
+     *
+     * Distinct from `policyDecision`, which records the community's internal verdict: both rejection paths — a policy auto-deny at submit and an admin's later refusal — write this one, so a client reads a single shape instead of reconciling two.
+     */
+    decision?: {
+        /**
+         * Stable refusal code, safe to branch on.
+         */
+        code: string;
+        /**
+         * Elaboration in prose, when the decider gave one.
+         */
+        reason?: string | null;
+        /**
+         * When the decision was taken — not when the poll answering it was produced. On an admin refusal the two diverge by however long the applicant takes to ask.
+         */
+        decidedAt: string;
+    } | null;
+    /**
+     * Whether the applicant consented to trust-registry publication.
+     */
+    registryConsent?: boolean;
+    /**
+     * Opaque community-defined extension bag.
+     */
+    extensions?: {};
+}
+export interface KdfParams {
+    /**
+     * KDF identifier, e.g. `argon2id`.
+     */
+    algorithm: string;
+    /**
+     * base64url, 32 bytes.
+     */
+    salt: string;
+    /**
+     * Argon2id memory cost (KiB).
+     */
+    mCost: number;
+    /**
+     * Argon2id time cost (iterations).
+     */
+    tCost: number;
+    /**
+     * Argon2id parallelism.
+     */
+    pCost: number;
+}
+/**
+ * How a device custodies its private key material — maintainer policy input, mirroring `attestation`. See docs/design-notes/mobile-key-custody-profile.md.
+ */
+export interface KeyCustody {
+    /**
+     * `hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.
+     */
+    tier: "hardware" | "software";
+    /**
+     * JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).
+     */
+    signingAlg?: string;
+    /**
+     * Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).
+     */
+    keyAgreementCurve?: string;
+}
+export interface KeyRecord {
+    /**
+     * Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.
+     */
+    keyId: string;
+    keyType: KeyType;
+    status: KeyStatus;
+    /**
+     * The public half, multibase-encoded. The private half is never carried by any keys/* response.
+     */
+    publicKey: string;
+    /**
+     * Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.
+     */
+    derivationPath?: string;
+    /**
+     * Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.
+     */
+    seedId?: number;
+    origin?: KeyOrigin;
+    /**
+     * Optional human-readable label. Operator-facing only; carries no authorization meaning.
+     */
+    label?: string;
+    /**
+     * Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.
+     */
+    contextId?: string;
+    /**
+     * RFC 3339 timestamp at which the key was created or imported.
+     */
+    createdAt: string;
+    /**
+     * RFC 3339 timestamp of the last change to the record (rename, revocation).
+     */
+    updatedAt?: string;
+    ext?: Ext;
+}
+/**
+ * The mediator's per-account access-control capability set, expressed as named booleans (the transport-agnostic form of the mediator's internal capability flags). On a set request, members omitted are left unchanged; a get/response carries the full realized set.
+ */
+export interface MediatorAcl {
+    /**
+     * How the account's access list is interpreted. `explicitAllow` = an allowlist (empty denies everyone); `explicitDeny` = a denylist (empty allows everyone).
+     */
+    accessListMode?: "explicitAllow" | "explicitDeny";
+    /**
+     * The account is blocked from authenticating and transacting.
+     */
+    blocked?: boolean;
+    /**
+     * Messages for this account may be stored locally at this mediator for pickup.
+     */
+    local?: boolean;
+    /**
+     * May send direct messages through the mediator.
+     */
+    sendMessages?: boolean;
+    /**
+     * May receive direct messages.
+     */
+    receiveMessages?: boolean;
+    /**
+     * May send routing/forward (relay) messages.
+     */
+    sendForwarded?: boolean;
+    /**
+     * May be the next hop of a forwarded message.
+     */
+    receiveForwarded?: boolean;
+    /**
+     * May create out-of-band invitations.
+     */
+    createInvites?: boolean;
+    /**
+     * Accepts anonymous (no authenticated sender) messages.
+     */
+    anonReceive?: boolean;
+    /**
+     * May self-manage its own access list.
+     */
+    selfManageList?: boolean;
+    /**
+     * May self-manage its own send-queue limit.
+     */
+    selfManageSendQueueLimit?: boolean;
+    /**
+     * May self-manage its own receive-queue limit.
+     */
+    selfManageReceiveQueueLimit?: boolean;
+    /**
+     * The account accepts DIDComm-protocol delivery. Default true; set false for a TSP-only node.
+     */
+    didcommEnabled?: boolean;
+    /**
+     * The account accepts TSP-protocol delivery. Default true; set false for a DIDComm-only node.
+     */
+    tspEnabled?: boolean;
+}
+/**
+ * One community member as the maintainer sees it: the membership record joined with its ACL role.
+ */
+export interface MemberResponse {
+    /**
+     * The member's DID.
+     */
+    did: string;
+    /**
+     * The member's role in wire form (e.g. `admin`, `moderator`, `custom:editor`).
+     */
+    role: string;
+    /**
+     * Optional human-readable label.
+     */
+    label?: string | null;
+    joinedAt: string;
+    /**
+     * Whether the member consented to being published in the community directory.
+     */
+    publishConsent: boolean;
+    /**
+     * How the member's record is handled on departure.
+     */
+    departurePreference: "purge" | "tombstone" | "historical" | "policydefault";
+    /**
+     * The member's slot on the community's membership status list, when allocated.
+     */
+    statusListIndex?: number | null;
+    /**
+     * Id of the member's current Verifiable Membership Credential, if issued.
+     */
+    currentVmcId?: string | null;
+    /**
+     * Id of the member's current role Verifiable Endorsement Credential, if issued.
+     */
+    currentRoleVecId?: string | null;
+    /**
+     * Whether the community has asserted that this member is a distinct real person. Read-only here: it is set and cleared by the personhood verbs, and cleared by a renewal-policy downgrade. Load-bearing rather than informational — a community that recognises members of another community may gate on it, so a consumer that cannot read it cannot make that decision.
+     */
+    personhood?: boolean;
+    /**
+     * When personhood was most recently asserted. Absent where it never has been. Operator-facing: it belongs on admin-gated reads, and a member's own view of themselves need carry only the flag.
+     */
+    personhoodAssertedAt?: string | null;
+    /**
+     * Whether this member joined by presenting an invitation credential rather than by an admin's decision on an open request. The two routes to membership carry different evidence, and an operator reviewing a roster can otherwise not tell them apart.
+     */
+    joinedViaInvitation?: boolean;
+    /**
+     * `id` of the member-issued reciprocal membership credential — the member half of the pair — once the member has sent it. Absent until then, which is the useful signal: it distinguishes a membership the community has asserted from one the member has acknowledged. The credential body is not echoed here.
+     */
+    memberVmcId?: string | null;
+    /**
+     * When that reciprocal credential was received. Paired with `memberVmcId`.
+     */
+    memberVmcReceivedAt?: string | null;
+    /**
+     * Opaque community-defined extension bag. Keys are maintainer-defined; the maintainer caps its size (16 KiB in the reference implementation).
+     */
+    extensions: {};
+}
+export interface PasskeyVerificationMethod {
+    /**
+     * The verificationMethod id as it appears in the DID document: `<did>#passkey-<base64url(sha256(credentialId))>`. The fragment is content-derived so a verifier can locate this VM by recomputing `sha256(credential.id)`.
+     */
+    id: string;
+    /**
+     * Always `Multikey`. The WebAuthn public key is published in W3C Multikey form so DID resolvers and verifiers need no WebAuthn-specific knowledge to consume it.
+     */
+    type: "Multikey";
+    /**
+     * The DID this verificationMethod is published on (the DID being augmented).
+     */
+    controller: string;
+    /**
+     * W3C Multikey (multibase) encoding of the WebAuthn credential public key. This is the value a verifier validates a WebAuthn assertion against. Re-derived server-side from the attestation at enrolment — never trusted from the browser (see vta/passkey-vms/enroll-submit).
+     */
+    publicKeyMultibase: string;
+    /**
+     * The WebAuthn `credential.id` (base64url, no padding). Lets a verifier recompute `sha256(credentialId)` and match the assertion to this VM's `id` fragment.
+     */
+    webauthnCredentialId: string;
+    /**
+     * Transport hints reported by the authenticator (e.g. `internal`, `hybrid`, `usb`, `nfc`, `ble`). Advisory only — verifiers MUST NOT make trust decisions based on transport hints.
+     */
+    webauthnTransports?: string[];
+    /**
+     * Optional operator-supplied human-readable label (e.g. "MacBook Touch ID"). Informational; not authoritative and not a security input.
+     */
+    label?: string;
+}
+/**
+ * A community's published position on personhood.
+ *
+ * DTG Credentials §Personhood Credentials places PHC status here rather than in the credential — "PHC status is determined by governance and trust registries, not by credential structure" — so a verifier deciding whether a VMC carries personhood weight reads this, not the credential's type array. §Governance Considerations item 1 makes the acceptable-IDVP list the community's to define and publish.
+ *
+ * Every member is a declaration, not an enforcement: what a community actually accepts is decided by its own policy. Absent means the community has not published a position, which is not the same as asserting the negative.
+ */
+export interface PersonhoodGovernance {
+    /**
+     * Governance requires that members are real humans. Defaults to `false` when absent: a community that has not considered the question asserts nothing, which is the only safe default for a claim a verifier may rely on.
+     */
+    realHuman?: boolean;
+    /**
+     * Governance requires that each person holds at most one membership in **this** community. Per-community by definition — the glossary says "exactly one membership in that VTC" — so a single community can satisfy it without any network above it.
+     */
+    singleMembership?: boolean;
+    /**
+     * DIDs of the identity-verification providers whose credentials this community accepts as personhood evidence. A community that vets its own members in person lists its own community DID here — it is acting as its own IDVP, which §IDVC permits. An empty list means no list has been published, not that everything is accepted.
+     */
+    acceptedIdvps?: string[];
+    /**
+     * Where the governance framework these assertions refer to can be read.
+     */
+    governanceFrameworkUrl?: string | null;
+}
+export interface PolicyChangedEvent_SyncV0_1 {
+    kind: "policy.changed";
+    seq: number;
+    occurredAt: string;
+    policyId: string;
+    change: "created" | "updated" | "deleted";
+}
+export interface PolicyChangedEvent_SyncV0_2 {
+    kind: "policyChanged";
+    seq: number;
+    occurredAt: string;
+    policyId: string;
+    change: "created" | "updated" | "deleted";
+}
+export interface PolicyDecision_PolicyV0_1 {
+    decision: "allow" | "deny" | "require_step_up";
+    /**
+     * When decision == "allow", whether the maintainer should proxy-login or release-for-fill. Default: proxy.
+     */
+    mode?: "proxy" | "fill";
+    /**
+     * When decision == "require_step_up", which method to demand.
+     */
+    stepUp?: {
+        method: "webauthn-uv" | "push-approval" | "totp";
+        ttlSeconds?: number;
+    };
+    /**
+     * When decision == "allow", maximum lifetime of the issued session blob / released secret.
+     */
+    ttlSecondsCap?: number;
+    /**
+     * Human-readable explanation for diagnostic display.
+     */
+    explanation?: string;
+}
+export interface PolicyDecision_PolicyV0_2 {
+    decision: "allow" | "deny" | "requireStepUp";
+    /**
+     * When decision == "allow", whether the maintainer should proxy-login or release-for-fill. Default: proxy.
+     */
+    mode?: "proxy" | "fill";
+    /**
+     * When decision == "require_step_up", which method to demand.
+     */
+    stepUp?: {
+        method: "webauthnUv" | "pushApproval" | "totp";
+        ttlSeconds?: number;
+    };
+    /**
+     * When decision == "allow", maximum lifetime of the issued session blob / released secret.
+     */
+    ttlSecondsCap?: number;
+    /**
+     * Human-readable explanation for diagnostic display.
+     */
+    explanation?: string;
+}
+export interface PolicyDecision_PolicyV0_3 {
+    decision: "allow" | "deny" | "requireStepUp" | "requireConsent";
+    /**
+     * Vault-flow-specific. When decision == "allow" for a proxy-login/release request, whether the maintainer should proxy-login or release-for-fill. Default: proxy. Ignored for other task kinds.
+     */
+    mode?: "proxy" | "fill";
+    /**
+     * When decision == "requireStepUp", which method to demand.
+     */
+    stepUp?: {
+        method: "webauthnUv" | "pushApproval" | "totp";
+        ttlSeconds?: number;
+    };
+    /**
+     * When decision == "requireConsent", the approver constraint the enforcement point MUST satisfy — a signed consent decision from the named set, bound to the request's payloadDigest — before executing.
+     */
+    requireConsent?: {
+        /**
+         * Named set of enrolled approver devices permitted to approve this task (resolved by the enforcement point against its device registry).
+         */
+        approverSet: string;
+        /**
+         * When true, the device that issued the request MUST NOT be accepted as the approver — forcing cross-device approval so a compromised requesting device cannot self-approve.
+         */
+        excludeRequester?: boolean;
+        /**
+         * Number of distinct approvers from the set required before the task may execute.
+         */
+        minApprovals?: number;
+    };
+    /**
+     * When decision == "allow", maximum lifetime of any issued session blob / released secret.
+     */
+    ttlSecondsCap?: number;
+    /**
+     * Human-readable explanation for diagnostic display.
+     */
+    explanation?: string;
+}
+/**
+ * The structured input fed to a policy evaluator on every vault/proxy-login, vault/release, and policy/evaluate call.
+ */
+export interface PolicyInput_PolicyV0_1 {
+    request: {
+        kind: "proxy_login" | "release" | "step_up_response";
+    };
+    site: SiteTarget_VaultV0_1;
+    contextId: string;
+    consumer: {
+        did: string;
+        kind?: ConsumerKind_DeviceV0_1;
+        deviceId?: string;
+        lastUserVerificationAt?: string;
+        networkClass?: "unknown" | "home" | "corp" | "public" | "vpn";
+    };
+}
+/**
+ * The structured input fed to a policy evaluator on every vault/proxy-login, vault/release, and policy/evaluate call.
+ */
+export interface PolicyInput_PolicyV0_2 {
+    request: {
+        kind: "proxyLogin" | "release" | "stepUpResponse";
+    };
+    site: SiteTarget_VaultV0_2;
+    contextId: string;
+    consumer: {
+        did: string;
+        kind?: ConsumerKind_DeviceV0_2;
+        deviceId?: string;
+        lastUserVerificationAt?: string;
+        networkClass?: "unknown" | "home" | "corp" | "public" | "vpn";
+    };
+}
+/**
+ * The structured input fed to a policy evaluator before dispatching a task. Generalised in 0.3 from the vault-flow triad to any Trust Task: `request.typeUri` identifies the task and `request.sideEffects` / `request.exposure` carry the authoritative SPEC §7.3 classifications the evaluator derives from the compiled handler.
+ */
+export interface PolicyInput_PolicyV0_3 {
+    request: {
+        /**
+         * Type URI of the task being authorized — the evaluator's primary discriminator (e.g. https://trusttasks.org/spec/did-management/did/delete/0.1).
+         */
+        typeUri: string;
+        /**
+         * Optional coarse category retained from 0.2 (`proxyLogin` | `release` | `stepUpResponse` | …) for policies that switch on it. `typeUri` is authoritative in 0.3.
+         */
+        kind?: string;
+        /**
+         * The identifier the task acts on — the value at the spec's `subjectPath` (usually a DID). The evaluator checks the consumer's authority to act on this subject. Absent for subjectless tasks (discovery, list).
+         */
+        subject?: string;
+        /**
+         * Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the payload, salted with the request challenge, present when a delegated-execution consent flow must bind approval to this exact payload. Absent when no consent binding is in play.
+         */
+        payloadDigest?: DigestMultibase;
+        /**
+         * Authoritative integrity class (SPEC §7.3 item 13). The evaluator MUST derive this from the compiled handler it is about to invoke, not from the wire — the registry's declared value is advisory only.
+         */
+        sideEffects: "none" | "mutating" | "destructive";
+        /**
+         * Authoritative exposure class (SPEC §7.3 item 14), likewise derived from the compiled handler. `discloses` is the sensitivity of returned data; `actsAsSubject` is whether the subject's authority is exercised.
+         */
+        exposure: {
+            discloses: "none" | "metadata" | "secret";
+            actsAsSubject: boolean;
+        };
+    };
+    site: SiteTarget_VaultV0_2;
+    contextId: string;
+    consumer: {
+        did: string;
+        kind?: ConsumerKind_DeviceV0_2;
+        deviceId?: string;
+        lastUserVerificationAt?: string;
+        networkClass?: "unknown" | "home" | "corp" | "public" | "vpn";
+    };
+}
+export interface PolicyModule {
+    id: string;
+    /**
+     * Human-readable name (e.g. "default vault policy", "bank-site step-up").
+     */
+    name: string;
+    description?: string;
+    /**
+     * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
+     */
+    module: string;
+    /**
+     * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
+     */
+    appliesTo?: string[];
+    /**
+     * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
+     */
+    priority?: number;
+    enabled?: boolean;
+    version: number;
+    createdAt: string;
+    updatedAt: string;
+    ext?: Ext;
+}
+/**
+ * Server-issued options for `navigator.credentials.create({ publicKey: ... })`. Mirrors the WebAuthn Level 2 `PublicKeyCredentialCreationOptions` dictionary; binary fields are base64url-encoded strings (rather than ArrayBuffers) so the value is JSON-safe over the wire.
+ */
+export interface PublicKeyCredentialCreationOptions {
+    /**
+     * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
+     *
+     * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
+     *
+     * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+     */
+    extensions?: {};
+    /**
+     * base64url-encoded one-time nonce.
+     */
+    challenge: string;
+    rp: {
+        id: string;
+        name: string;
+    };
+    user: {
+        /**
+         * base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.
+         */
+        id: string;
+        name: string;
+        displayName: string;
+    };
+    /**
+     * @minItems 1
+     */
+    pubKeyCredParams: [
+        {
+            type: "public-key";
+            /**
+             * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
+             */
+            alg: number;
+        },
+        ...{
+            type: "public-key";
+            /**
+             * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
+             */
+            alg: number;
+        }[]
+    ];
+    timeout?: number;
+    excludeCredentials?: PublicKeyCredentialDescriptor[];
+    authenticatorSelection?: {
+        authenticatorAttachment?: "platform" | "cross-platform";
+        requireResidentKey?: boolean;
+        residentKey?: "discouraged" | "preferred" | "required";
+        userVerification?: "discouraged" | "preferred" | "required";
+    };
+    attestation?: "none" | "indirect" | "direct" | "enterprise";
+}
+export interface PublicKeyCredentialDescriptor {
+    type: "public-key";
+    /**
+     * base64url-encoded credential id.
+     */
+    id: string;
+    transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
+}
+/**
+ * Server-issued options for `navigator.credentials.get({ publicKey: ... })`.
+ */
+export interface PublicKeyCredentialRequestOptions {
+    /**
+     * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
+     *
+     * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
+     *
+     * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+     */
+    extensions?: {};
+    /**
+     * base64url-encoded one-time nonce.
+     */
+    challenge: string;
+    timeout?: number;
+    rpId?: string;
+    allowCredentials?: PublicKeyCredentialDescriptor[];
+    userVerification?: "discouraged" | "preferred" | "required";
+}
+export interface Apns {
+    platform: "apns";
+    /**
+     * APNs device token (hex string issued by Apple Push Notification service).
+     */
+    token: string;
+    /**
+     * APNs topic — typically the app bundle identifier the gateway pushes to.
+     */
+    topic: string;
+    /**
+     * Which APNs environment issued the token. Maintainers route to the matching APNs endpoint.
+     */
+    environment?: "sandbox" | "production";
+}
+export interface Fcm {
+    platform: "fcm";
+    /**
+     * Firebase Cloud Messaging registration token. The gateway sends a data message (not a notification message) so the app controls wake and display.
+     */
+    token: string;
+}
+export interface WebPush {
+    platform: "webpush";
+    /**
+     * RFC 8030 Web Push subscription endpoint.
+     */
+    endpoint: string;
+    /**
+     * Web Push (RFC 8291) encryption keys. Note: per the push binding the payload remains contentless regardless of this encryption.
+     */
+    keys: {
+        /**
+         * base64url-encoded P-256 ECDH public key.
+         */
+        p256dh: string;
+        /**
+         * base64url-encoded auth secret.
+         */
+        auth: string;
+    };
+}
+/**
+ * Optional TRQP query context. `time` requests evaluation as of a given instant; `locator` is an authority-defined hint for locating records.
+ */
+export interface QueryContext {
+    /**
+     * Evaluate the query as of this RFC3339 (Z offset) instant. Blank/absent uses current server time.
+     */
+    time?: string;
+    /**
+     * Optional hint for systems that need extra information to locate the records in question (authorization queries).
+     */
+    locator?: string;
+    [k: string]: string | undefined;
+}
+/**
+ * Per-account queued-message limits. A value of -1 means unlimited; a member omitted on a change request leaves that limit unchanged.
+ */
+export interface QueueLimits {
+    /**
+     * Maximum queued send messages; -1 = unlimited.
+     */
+    sendQueueLimit?: number;
+    /**
+     * Maximum queued receive messages; -1 = unlimited.
+     */
+    receiveQueueLimit?: number;
+}
+/**
+ * A passkey already bound to a subject, as listed by `auth/passkey/list` and targeted by `auth/passkey/revoke/*`. This is the auth service's own management view of a credential — not a WebAuthn dictionary — so its members are camelCase per SPEC.md §4.10. The exception is `transports`, whose values are the externally-owned WebAuthn transport tokens and are carried verbatim.
+ */
+export interface RegisteredCredential {
+    /**
+     * Durable identifier for this credential, as issued by `auth/passkey/enroll/finish`: the base64url-encoded WebAuthn credential id. Opaque to the producer — it MUST be echoed verbatim when revoking and MUST NOT be parsed.
+     */
+    credentialId: string;
+    /**
+     * Operator-facing label captured at enrollment (e.g. "Alice's MacBook Pro"). Absent when the subject enrolled without one. Consumers MUST NOT synthesize a label, because an invented one is indistinguishable from a chosen one to somebody deciding which credential to revoke.
+     */
+    deviceLabel?: string;
+    /**
+     * WebAuthn transport hints reported by the authenticator at enrollment (`usb`, `nfc`, `ble`, `internal`, `hybrid`, …). Externally owned and carried verbatim. Deliberately not an enum — unlike `CredentialDescriptor.transports`, which the consumer itself emits, these values were reported by a third-party authenticator, the WebAuthn transport registry grows independently of this specification, and an unrecognized token here is a display concern rather than a validation failure.
+     */
+    transports?: string[];
+    /**
+     * When the credential was bound to the subject.
+     */
+    registeredAt: string;
+    /**
+     * When this credential last completed an assertion. Absent if it never has, or if the consumer does not track usage. Those two cases are deliberately NOT distinguished: a nullable variant cannot survive the round-trip through generated bindings, which map absent and null onto the same optional, so a distinction stated here would not be one any conforming implementation could rely on. Consumers that need to advertise "usage is not tracked" SHOULD say so under `ext`.
+     */
+    lastUsedAt?: string;
+}
+/**
+ * A key a patch declined to apply, with the reason.
+ */
+export interface RejectedKey {
+    key: string;
+    /**
+     * Why the key was rejected — unknown key, wrong type, out-of-range, allowlist mismatch, etc.
+     */
+    reason: string;
+}
+/**
+ * One held credential a deferred query asked for, and the claims of it that would be disclosed.
+ */
+export interface RequestedCredential {
+    /**
+     * The DCQL `credential_query_id` this held credential satisfied.
+     */
+    credentialQueryId: string;
+    /**
+     * The held credential that would satisfy it.
+     */
+    credentialId: string;
+    /**
+     * The claims the query asks to disclose from this credential. An empty array means the query matched the credential without naming claims — a consumer SHOULD treat that as a request for the whole credential and present it to the approver as such.
+     */
+    claims: string[];
+}
+/**
+ * The receipt for a successful revocation. Consumers MUST report the family's `alreadyRevoked` / `already_revoked` error when the credential was already revoked, rather than returning a second receipt silently — the caller has to be able to distinguish "I revoked it now" from "it was already gone".
+ *
+ * The counterpart to IssuedCredential: both concern a credential's lifecycle at its issuer.
+ */
+export interface RevocationReceipt {
+    credentialId: CredentialId;
+    /**
+     * When the revocation was recorded.
+     */
+    revokedAt: string;
+}
+/**
+ * The outcome of a rollback. Distinct from ServiceMutationResult because a rollback can legitimately publish nothing: if the previous state already equals the current one there is no change to write, and `kind: "noOp"` says so with `logEntryVersionId` absent. Treating that as a failure would be wrong — the requested state holds — and treating it as an ordinary success would report a log entry that does not exist.
+ */
+export interface RollbackResult {
+    /**
+     * What the rollback did. `disabled` re-disabled the transport, `enabled` re-advertised it at its prior settings, `updated` restored prior settings on an entry that stayed advertised, and `noOp` means the previous state already matched — nothing was written.
+     */
+    kind: "disabled" | "enabled" | "updated" | "noOp";
+    /**
+     * Version id of the log entry the rollback wrote. **Absent when `kind` is `noOp`**, and present otherwise.
+     */
+    logEntryVersionId?: string;
+    /**
+     * RFC 3339 instant the rollback took effect. Absent for `noOp`.
+     */
+    effectiveAt?: string;
+    /**
+     * Present when rolling back DIDComm left a mediator draining.
+     */
+    drainingMediator?: string;
+    /**
+     * When that drain completes.
+     */
+    drainUntil?: string;
+    /**
+     * The agent's own DID.
+     */
+    vtaDid?: string;
+    /**
+     * True when the entry was written locally but not published — the operator must redeploy before any verifier sees it.
+     */
+    serverless?: boolean;
+    ext?: Ext;
+}
+export interface Builtin_VtaV0_1 {
+    type: "builtin";
+}
+export interface Global_VtaV0_1 {
+    type: "global";
+}
+export interface Context_VtaV0_1 {
+    type: "context";
+    contextId: string;
+}
+export interface ServiceInstance {
+    /**
+     * Stable identifier the control plane uses for this instance. SHOULD be derived from the instance's DID (e.g. `did:web:host.example` → `did_web_host_example`) so it survives restarts.
+     */
+    instanceId: string;
+    /**
+     * VID identifying the registered service.
+     */
+    did: string;
+    label?: string;
+    publicUrl?: string;
+    /**
+     * Hosting domains this instance currently serves. Updated by `domain/assign` / `domain/unassign` ack flow.
+     */
+    servedDomains?: string[];
+    lastSeen?: string;
+    ext?: Ext;
+}
+/**
+ * The outcome of a change to an advertised service. Every member describes the **log entry the change produced**, because that is what the change actually is: the agent's DID document is the record, and a consumer that treats the response as a mere acknowledgement will miss that a redeploy may be required.
+ */
+export interface ServiceMutationResult {
+    /**
+     * Version id of the new did:webvh log entry this change wrote. Joins the change to the document's history.
+     */
+    logEntryVersionId: string;
+    /**
+     * RFC 3339 instant the change took effect — the same instant stamped on the new log entry.
+     */
+    effectiveAt: string;
+    /**
+     * Present when the change scheduled a DIDComm drain. Its absence means no drain was scheduled, NOT that a drain finished instantly: a consumer reporting 'done' on an absent value would be right, and one reporting it on a present value would be wrong.
+     */
+    drainUntil?: string;
+    /**
+     * The mediator being drained, when `drainUntil` is present.
+     */
+    drainingMediator?: string;
+    /**
+     * The agent's own DID — subject of the log entry this change wrote. Carried so a caller can follow up without a second round trip.
+     */
+    vtaDid?: string;
+    /**
+     * True when the agent's DID is self-hosted. **The change is persisted locally but NOT published**: the operator must fetch the updated `did.jsonl` and redeploy before any verifier sees it. A consumer that ignores this reports success for a change no one else can observe yet.
+     */
+    serverless?: boolean;
+    ext?: Ext;
+}
+/**
+ * What the agent currently advertises for one service. `enabled` is the only member every kind carries; the rest are kind-specific and absent when they do not apply. Note that `enabled: false` and an absent entry are different: the first says the agent knows about this transport and is not advertising it, the second says it has never been configured.
+ */
+export interface ServiceState {
+    kind: ServiceKind;
+    /**
+     * Whether the agent currently advertises this transport in its DID document.
+     */
+    enabled: boolean;
+    /**
+     * The mediator this transport routes through. Present for `didcomm` and `tsp`.
+     */
+    mediatorDid?: string;
+    /**
+     * The advertised endpoint. Present for `rest` and `webauthn`.
+     */
+    url?: string;
+    /**
+     * RFC 3339 instant at which a scheduled drain completes. Present only while a `didcomm` mediator is draining — see `vta/services/drain/list`.
+     */
+    drainsUntil?: string;
+    ext?: Ext;
+}
+/**
+ * A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).
+ */
+export interface Session {
+    /**
+     * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
+     */
+    id: string;
+    /**
+     * The authenticated party's VID (typically a DID URL).
+     */
+    subject: string;
+    /**
+     * ISO-8601 timestamp when the session was created.
+     */
+    issuedAt: string;
+    /**
+     * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
+     */
+    expiresAt: string;
+    /**
+     * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
+     *
+     * @minItems 1
+     */
+    amr?: [string, ...string[]];
+    /**
+     * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
+     */
+    acr?: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+export interface WebOrigin_VaultV0_1 {
+    kind: "web-origin";
+    /**
+     * Web origin per RFC 6454 (scheme + host + optional port), e.g. "https://github.com". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.
+     */
+    origin: string;
+}
+export interface Did_VaultV0_1 {
+    kind: "did";
+    /**
+     * DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.
+     */
+    did: string;
+}
+export interface IosApp_VaultV0_1 {
+    kind: "ios-app";
+    /**
+     * iOS bundle identifier in reverse-DNS form (e.g. "com.github.stwalkerster.codehub"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).
+     */
+    bundleId: string;
+    /**
+     * Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.
+     */
+    teamId?: string;
+}
+export interface AndroidApp_VaultV0_1 {
+    kind: "android-app";
+    /**
+     * Android package name in reverse-DNS form (e.g. "com.github.android").
+     */
+    packageName: string;
+    /**
+     * SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).
+     *
+     * @minItems 1
+     */
+    sha256CertFingerprints: [string, ...string[]];
+}
+export interface WebOrigin_VaultV0_2 {
+    kind: "webOrigin";
+    /**
+     * Web origin per RFC 6454 (scheme + host + optional port), e.g. "https://github.com". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.
+     */
+    origin: string;
+}
+export interface Did_VaultV0_2 {
+    kind: "did";
+    /**
+     * DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.
+     */
+    did: string;
+}
+export interface IosApp_VaultV0_2 {
+    kind: "iosApp";
+    /**
+     * iOS bundle identifier in reverse-DNS form (e.g. "com.github.stwalkerster.codehub"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).
+     */
+    bundleId: string;
+    /**
+     * Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.
+     */
+    teamId?: string;
+}
+export interface AndroidApp_VaultV0_2 {
+    kind: "androidApp";
+    /**
+     * Android package name in reverse-DNS form (e.g. "com.github.android").
+     */
+    packageName: string;
+    /**
+     * SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).
+     *
+     * @minItems 1
+     */
+    sha256CertFingerprints: [string, ...string[]];
+}
+/**
+ * The prior state the effects were computed against. A human in the loop makes the approval window minutes wide, so the state can move underneath a pending approval. The executor asserts this pin still holds at execution and refuses otherwise — without it, a lost update silently executes against state the approver never saw.
+ */
+export interface StatePin {
+    /**
+     * Identifier of the pinned resource (usually the subject DID).
+     */
+    resource: string;
+    /**
+     * Opaque version identifier of the prior state (e.g. a did:webvh `versionId`). Compared for equality at execution; the executor MUST NOT attempt to order or interpret it.
+     */
+    version: string;
+}
+export interface StepUpProof_VaultV0_1 {
+    kind: "webauthn-uv" | "push-approval" | "totp";
+    /**
+     * Format depends on kind: WebAuthn assertion (base64url), DIDComm approval-response message id, or 6–8-digit TOTP code.
+     */
+    proof: string;
+    /**
+     * Maintainer-issued challenge id the proof responds to.
+     */
+    challengeId: string;
+}
+export interface StepUpProof_VaultV0_2 {
+    kind: "webauthnUv" | "pushApproval" | "totp";
+    /**
+     * Format depends on kind: WebAuthn assertion (base64url), DIDComm approval-response message id, or 6–8-digit TOTP code.
+     */
+    proof: string;
+    /**
+     * Maintainer-issued challenge id the proof responds to.
+     */
+    challengeId: string;
+}
+/**
+ * An access token (typically short-lived JWT) paired with an optional refresh token (typically long-lived opaque string). The shapes follow OAuth 2.0 (RFC 6749 §5.1) conventions but are not coupled to any particular OAuth profile.
+ */
+export interface TokenBundle {
+    /**
+     * Bearer-style access token. Consumers presenting this token to downstream services prove the holder of the original session. Format is consumer-defined — JWT is common, but opaque strings are also valid.
+     */
+    accessToken: string;
+    /**
+     * Long-lived token redeemable via auth/refresh for a new access token. MAY be absent when the issuer does not support refresh.
+     */
+    refreshToken?: string;
+    /**
+     * Token presentation scheme. Almost always "Bearer"; reserved for future schemes.
+     */
+    tokenType: string;
+    /**
+     * Seconds from issuance until the access token expires.
+     */
+    expiresIn: number;
+    /**
+     * Seconds from issuance until the refresh token expires, when one was issued.
+     */
+    refreshExpiresIn?: number;
+    /**
+     * Capability tags effective on this token. Format is consumer-defined; the framework imposes no syntax.
+     */
+    scope?: string[];
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+export interface TrustRecord {
+    entity_id: string;
+    authority_id: string;
+    action: string;
+    resource: string;
+    /**
+     * Present on recognition records: whether the action+resource is recognised.
+     */
+    recognized?: boolean;
+    /**
+     * Present on authorization records: whether the action+resource authorization is confirmed.
+     */
+    authorized?: boolean;
+    /**
+     * Opaque governance context attached to the record.
+     */
+    context?: {
+        [k: string]: unknown | undefined;
+    };
+    record_type: RecordType;
+}
+/**
+ * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tsp-message` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
+ */
+export interface TspMessageEnvelope_VaultV0_1 {
+    envelope: "tsp-message";
+    /**
+     * Base64url-encoded TSP message bytes. Format reference: https://trustoverip.github.io/tswg-tsp-specification/#message-format
+     */
+    message: string;
+}
+/**
+ * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tspMessage` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
+ */
+export interface TspMessageEnvelope_VaultV0_2 {
+    envelope: "tspMessage";
+    /**
+     * Base64url-encoded TSP message bytes. Format reference: https://trustoverip.github.io/tswg-tsp-specification/#message-format
+     */
+    message: string;
+}
+export interface VaultDeletedEvent_SyncV0_1 {
+    kind: "vault.deleted";
+    seq: number;
+    occurredAt: string;
+    id: string;
+    contextId: string;
+    graceUntil: string;
+}
+export interface VaultDeletedEvent_SyncV0_2 {
+    kind: "vaultDeleted";
+    seq: number;
+    occurredAt: string;
+    id: string;
+    contextId: string;
+    graceUntil: string;
+}
+export interface VaultEntry_VaultV0_1 {
+    /**
+     * Opaque vault-maintainer-assigned identifier for the entry. ULID/UUID/base32 are common; the wire spec only requires non-empty string equality.
+     */
+    id: string;
+    /**
+     * Identifier of the trust context (persona) the entry belongs to. Opaque string interpreted by the vault maintainer; corresponds to a single ContextRecord on the VTA side.
+     */
+    contextId: string;
+    /**
+     * One or more binding targets — web origins, mobile app identifiers, and/or DIDs — that this credential applies to. A request from any matching target uses this entry. A typical entry for a service that exists as both a website and mobile apps will list a web origin, an iOS bundle id, and an Android package id; passkeys for that service typically list only the origin (because iOS Associated Domains and Android Asset Links bind apps to the domain at the OS level).
+     *
+     * @minItems 1
+     */
+    targets: [SiteTarget_VaultV0_1, ...SiteTarget_VaultV0_1[]];
+    /**
+     * Human-readable display name (e.g. "Work GitHub", "Personal bank — checking"). Maintainers MAY enforce a maximum length; the wire spec does not.
+     */
+    label: string;
+    /**
+     * Discriminator for the kind of secret this entry holds. The secret material itself is NEVER returned in metadata views; the kind is exposed so consumers can render an appropriate UI affordance and so policy decisions can route by kind.
+     */
+    secretKind: SecretKind_VaultV0_1;
+    /**
+     * User-defined tags for organisation and filtering (e.g. ["family", "finance"]). Maintainers MAY enforce a maximum count; the wire spec does not.
+     */
+    tags?: string[];
+    /**
+     * Non-sensitive notes the user attached to the entry. Visible in metadata view (suitable for support contact, account number, expiry policy memos). SENSITIVE notes belong in the secret payload as a `secureNotes` field — those are only released by vault/release/0.1.
+     */
+    notes?: string;
+    /**
+     * Optional URI of an icon to display in the consumer UI. Maintainers MAY fetch and cache; consumers SHOULD treat as untrusted content and fetch via a sandboxed pipeline.
+     */
+    favicon?: string;
+    /**
+     * Opaque maintainer-defined selector strings fed to the policy engine when this entry is requested (e.g. "recent_uv_required", "network_class=corp", "step_up_push"). Consumers MUST treat selectors as opaque; they exist for policy authoring on the maintainer side.
+     */
+    selectors?: string[];
+    /**
+     * Names of additional fields the user has attached (e.g. ["security-question-1", "account-number"]). The VALUES live in the secret payload and are only delivered by vault/release/0.1. Exposing names in metadata lets the consumer render the right form layout before requesting release.
+     */
+    customFieldNames?: string[];
+    /**
+     * References to encrypted blobs associated with the entry (recovery codes, PEM files, screenshots of authenticator setup). The blobs themselves are fetched via a separate mechanism the maintainer documents; metadata view exposes only the descriptor.
+     */
+    attachments?: AttachmentRef_VaultV0_1[];
+    /**
+     * Optional time after which the credential is no longer expected to be valid (e.g. an OAuth refresh token's known expiry, a time-limited API token, an enterprise password rotation policy). Maintainers MAY surface this in the consumer UI as a warning.
+     */
+    expiresAt?: string;
+    /**
+     * Set by the maintainer (via HIBP integration or equivalent) when the password material associated with this entry is known to appear in a public breach. Consumers SHOULD surface this prominently. Cleared when the user rotates the password and the new password is not in any known breach.
+     */
+    breachedAt?: string;
+    /**
+     * Set whenever the password component of the secret payload is rotated. Maintainers MUST update this on every secret-material change for entries of kind `password` (or any kind that carries a password component). Used by consumers to surface rotation-overdue warnings.
+     */
+    passwordChangedAt?: string;
+    createdAt: string;
+    /**
+     * VID of the consumer that originally created the entry.
+     */
+    createdBy?: string;
+    updatedAt: string;
+    /**
+     * VID of the consumer that last modified the entry.
+     */
+    updatedBy?: string;
+    /**
+     * Most recent time the entry was used (either released or proxy-login performed). Maintainers MAY return this with reduced precision (e.g. hour-floored) when releasing to a less-trusted consumer.
+     */
+    lastUsedAt?: string;
+    /**
+     * Monotonic version counter incremented on every mutation. Used by consumers for optimistic-concurrency checks on vault/upsert and as the seq baseline for vault/sync.
+     */
+    version: number;
+    /**
+     * Optional cached DID the entry will act AS for DID-shaped flows — mirrors the `did` field of the entry's secret payload when `secretKind` carries one (`did-self-issued`, `didcomm-peer`). Absent for kinds that have no DID concept (`password`, `passkey`, `oauth-tokens`, `bearer-token`, `ssh-key`, `custom`). MAINTAINER-DERIVED, NOT CONSUMER-SUPPLIED: the maintainer MUST recompute this from the canonical secret at every upsert / secret rotation; a producer-supplied value on `vault/upsert/0.1` MUST be ignored (no error, but no honour). Read-only on the wire, present in metadata views so consumers can drive RP-side flows (e.g. fetch `/auth/challenge` keyed on the principal DID before requesting a proxy-login) without releasing the secret.
+     */
+    principalDid?: string;
+    /**
+     * Archival-lifecycle state of this entry. Absent means `active`, so a maintainer that models no lifecycle omits it and every existing document stays valid. Deliberately carries no JSON Schema `default`: a declared default is materialised by generated bindings, which would make an absent `status` reappear as an explicit `"active"` on re-serialisation and break round-trip idempotence for every existing document. This member is what makes `vault/list`'s `status: "all"` selector usable: that view returns entries in every state by design, and without a state on the entry itself a consumer cannot tell which is which. An `archived` entry is hidden from ordinary listings but intact; a `deleted` entry is a tombstone inside its grace window, still restorable until `graceUntil` passes.
+     */
+    status?: "active" | "archived" | "deleted";
+    /**
+     * When the entry was archived. Present iff `status` is `archived`.
+     */
+    archivedAt?: string;
+    /**
+     * When the entry was soft-deleted. Present iff `status` is `deleted`. A soft delete is reversible: this records when the grace window opened, not when the entry ceased to exist.
+     */
+    deletedAt?: string;
+    /**
+     * Deadline after which a `deleted` entry is irreversibly purged. Present iff `status` is `deleted`. It is the one member a consumer showing a trash view actually needs — "deleted" without a deadline cannot be distinguished from "gone", and the difference is whether the holder can still get their credential back.
+     */
+    graceUntil?: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces.
+     */
+    ext?: Ext;
+}
+export interface VaultEntry_VaultV0_2 {
+    /**
+     * Opaque vault-maintainer-assigned identifier for the entry. ULID/UUID/base32 are common; the wire spec only requires non-empty string equality.
+     */
+    id: string;
+    /**
+     * Identifier of the trust context (persona) the entry belongs to. Opaque string interpreted by the vault maintainer; corresponds to a single ContextRecord on the VTA side.
+     */
+    contextId: string;
+    /**
+     * One or more binding targets — web origins, mobile app identifiers, and/or DIDs — that this credential applies to. A request from any matching target uses this entry. A typical entry for a service that exists as both a website and mobile apps will list a web origin, an iOS bundle id, and an Android package id; passkeys for that service typically list only the origin (because iOS Associated Domains and Android Asset Links bind apps to the domain at the OS level).
+     *
+     * @minItems 1
+     */
+    targets: [SiteTarget_VaultV0_2, ...SiteTarget_VaultV0_2[]];
+    /**
+     * Human-readable display name (e.g. "Work GitHub", "Personal bank — checking"). Maintainers MAY enforce a maximum length; the wire spec does not.
+     */
+    label: string;
+    /**
+     * Discriminator for the kind of secret this entry holds. The secret material itself is NEVER returned in metadata views; the kind is exposed so consumers can render an appropriate UI affordance and so policy decisions can route by kind.
+     */
+    secretKind: SecretKind_VaultV0_2;
+    /**
+     * User-defined tags for organisation and filtering (e.g. ["family", "finance"]). Maintainers MAY enforce a maximum count; the wire spec does not.
+     */
+    tags?: string[];
+    /**
+     * Non-sensitive notes the user attached to the entry. Visible in metadata view (suitable for support contact, account number, expiry policy memos). SENSITIVE notes belong in the secret payload as a `secureNotes` field — those are only released by vault/release/0.1.
+     */
+    notes?: string;
+    /**
+     * Optional URI of an icon to display in the consumer UI. Maintainers MAY fetch and cache; consumers SHOULD treat as untrusted content and fetch via a sandboxed pipeline.
+     */
+    favicon?: string;
+    /**
+     * Opaque maintainer-defined selector strings fed to the policy engine when this entry is requested (e.g. "recent_uv_required", "network_class=corp", "step_up_push"). Consumers MUST treat selectors as opaque; they exist for policy authoring on the maintainer side.
+     */
+    selectors?: string[];
+    /**
+     * Names of additional fields the user has attached (e.g. ["security-question-1", "account-number"]). The VALUES live in the secret payload and are only delivered by vault/release/0.1. Exposing names in metadata lets the consumer render the right form layout before requesting release.
+     */
+    customFieldNames?: string[];
+    /**
+     * References to encrypted blobs associated with the entry (recovery codes, PEM files, screenshots of authenticator setup). The blobs themselves are fetched via a separate mechanism the maintainer documents; metadata view exposes only the descriptor.
+     */
+    attachments?: AttachmentRef_VaultV0_1[];
+    /**
+     * Optional time after which the credential is no longer expected to be valid (e.g. an OAuth refresh token's known expiry, a time-limited API token, an enterprise password rotation policy). Maintainers MAY surface this in the consumer UI as a warning.
+     */
+    expiresAt?: string;
+    /**
+     * Set by the maintainer (via HIBP integration or equivalent) when the password material associated with this entry is known to appear in a public breach. Consumers SHOULD surface this prominently. Cleared when the user rotates the password and the new password is not in any known breach.
+     */
+    breachedAt?: string;
+    /**
+     * Set whenever the password component of the secret payload is rotated. Maintainers MUST update this on every secret-material change for entries of kind `password` (or any kind that carries a password component). Used by consumers to surface rotation-overdue warnings.
+     */
+    passwordChangedAt?: string;
+    createdAt: string;
+    /**
+     * VID of the consumer that originally created the entry.
+     */
+    createdBy?: string;
+    updatedAt: string;
+    /**
+     * VID of the consumer that last modified the entry.
+     */
+    updatedBy?: string;
+    /**
+     * Most recent time the entry was used (either released or proxy-login performed). Maintainers MAY return this with reduced precision (e.g. hour-floored) when releasing to a less-trusted consumer.
+     */
+    lastUsedAt?: string;
+    /**
+     * Monotonic version counter incremented on every mutation. Used by consumers for optimistic-concurrency checks on vault/upsert and as the seq baseline for vault/sync.
+     */
+    version: number;
+    /**
+     * Optional cached DID the entry will act AS for DID-shaped flows — mirrors the `did` field of the entry's secret payload when `secretKind` carries one (`didSelfIssued`, `didcommPeer`). Absent for kinds that have no DID concept (`password`, `passkey`, `oauthTokens`, `bearerToken`, `sshKey`, `custom`). MAINTAINER-DERIVED, NOT CONSUMER-SUPPLIED: the maintainer MUST recompute this from the canonical secret at every upsert / secret rotation; a producer-supplied value on `vault/upsert/0.1` MUST be ignored (no error, but no honour). Read-only on the wire, present in metadata views so consumers can drive RP-side flows (e.g. fetch `/auth/challenge` keyed on the principal DID before requesting a proxy-login) without releasing the secret.
+     */
+    principalDid?: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces.
+     */
+    ext?: Ext;
+}
+export interface VaultEntry_VaultV0_3 {
+    /**
+     * Opaque vault-maintainer-assigned identifier for the entry. ULID/UUID/base32 are common; the wire spec only requires non-empty string equality.
+     */
+    id: string;
+    /**
+     * Identifier of the trust context (persona) the entry belongs to. Opaque string interpreted by the vault maintainer; corresponds to a single ContextRecord on the VTA side.
+     */
+    contextId: string;
+    /**
+     * One or more binding targets — web origins, mobile app identifiers, and/or DIDs — that this credential applies to. A request from any matching target uses this entry. A typical entry for a service that exists as both a website and mobile apps will list a web origin, an iOS bundle id, and an Android package id; passkeys for that service typically list only the origin (because iOS Associated Domains and Android Asset Links bind apps to the domain at the OS level).
+     *
+     * @minItems 1
+     */
+    targets: [SiteTarget_VaultV0_2, ...SiteTarget_VaultV0_2[]];
+    /**
+     * Human-readable display name (e.g. "Work GitHub", "Personal bank — checking"). Maintainers MAY enforce a maximum length; the wire spec does not.
+     */
+    label: string;
+    /**
+     * Discriminator for the kind of secret this entry holds. The secret material itself is NEVER returned in metadata views; the kind is exposed so consumers can render an appropriate UI affordance and so policy decisions can route by kind.
+     */
+    secretKind: SecretKind_VaultV0_2;
+    /**
+     * User-defined tags for organisation and filtering (e.g. ["family", "finance"]). Maintainers MAY enforce a maximum count; the wire spec does not.
+     */
+    tags?: string[];
+    /**
+     * Non-sensitive notes the user attached to the entry. Visible in metadata view (suitable for support contact, account number, expiry policy memos). SENSITIVE notes belong in the secret payload as a `secureNotes` field — those are only released by vault/release/0.1.
+     */
+    notes?: string;
+    /**
+     * Optional URI of an icon to display in the consumer UI. Maintainers MAY fetch and cache; consumers SHOULD treat as untrusted content and fetch via a sandboxed pipeline.
+     */
+    favicon?: string;
+    /**
+     * Opaque maintainer-defined selector strings fed to the policy engine when this entry is requested (e.g. "recent_uv_required", "network_class=corp", "step_up_push"). Consumers MUST treat selectors as opaque; they exist for policy authoring on the maintainer side.
+     */
+    selectors?: string[];
+    /**
+     * Names of additional fields the user has attached (e.g. ["security-question-1", "account-number"]). The VALUES live in the secret payload and are only delivered by vault/release/0.1. Exposing names in metadata lets the consumer render the right form layout before requesting release.
+     */
+    customFieldNames?: string[];
+    /**
+     * References to encrypted blobs associated with the entry (recovery codes, PEM files, screenshots of authenticator setup). The blobs themselves are fetched via a separate mechanism the maintainer documents; metadata view exposes only the descriptor.
+     */
+    attachments?: AttachmentRef_VaultV0_3[];
+    /**
+     * Optional time after which the credential is no longer expected to be valid (e.g. an OAuth refresh token's known expiry, a time-limited API token, an enterprise password rotation policy). Maintainers MAY surface this in the consumer UI as a warning.
+     */
+    expiresAt?: string;
+    /**
+     * Set by the maintainer (via HIBP integration or equivalent) when the password material associated with this entry is known to appear in a public breach. Consumers SHOULD surface this prominently. Cleared when the user rotates the password and the new password is not in any known breach.
+     */
+    breachedAt?: string;
+    /**
+     * Set whenever the password component of the secret payload is rotated. Maintainers MUST update this on every secret-material change for entries of kind `password` (or any kind that carries a password component). Used by consumers to surface rotation-overdue warnings.
+     */
+    passwordChangedAt?: string;
+    createdAt: string;
+    /**
+     * VID of the consumer that originally created the entry.
+     */
+    createdBy?: string;
+    updatedAt: string;
+    /**
+     * VID of the consumer that last modified the entry.
+     */
+    updatedBy?: string;
+    /**
+     * Most recent time the entry was used (either released or proxy-login performed). Maintainers MAY return this with reduced precision (e.g. hour-floored) when releasing to a less-trusted consumer.
+     */
+    lastUsedAt?: string;
+    /**
+     * Monotonic version counter incremented on every mutation. Used by consumers for optimistic-concurrency checks on vault/upsert and as the seq baseline for vault/sync.
+     */
+    version: number;
+    /**
+     * Optional cached DID the entry will act AS for DID-shaped flows — mirrors the `did` field of the entry's secret payload when `secretKind` carries one (`didSelfIssued`, `didcommPeer`). Absent for kinds that have no DID concept (`password`, `passkey`, `oauthTokens`, `bearerToken`, `sshKey`, `custom`). MAINTAINER-DERIVED, NOT CONSUMER-SUPPLIED: the maintainer MUST recompute this from the canonical secret at every upsert / secret rotation; a producer-supplied value on `vault/upsert/0.1` MUST be ignored (no error, but no honour). Read-only on the wire, present in metadata views so consumers can drive RP-side flows (e.g. fetch `/auth/challenge` keyed on the principal DID before requesting a proxy-login) without releasing the secret.
+     */
+    principalDid?: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1. Reverse-DNS-namespaced; consumers MUST ignore unrecognized namespaces.
+     */
+    ext?: Ext;
+}
+export interface VaultUpsertedEvent_SyncV0_1 {
+    kind: "vault.upserted";
+    seq: number;
+    occurredAt: string;
+    entry: VaultEntry_VaultV0_1;
+}
+export interface VaultUpsertedEvent_SyncV0_2 {
+    kind: "vaultUpserted";
+    seq: number;
+    occurredAt: string;
+    entry: VaultEntry_VaultV0_2;
+}
+/**
+ * A ceremony decision: the effect, plus its effect-dependent detail.
+ */
+export interface Verdict {
+    effect: VerdictEffect;
+    with: VerdictWith;
+}
+/**
+ * The effect-dependent detail of a verdict.
+ *
+ * Every member is optional at the schema level and which ones are meaningful depends on `effect`: `role` / `obligations` / `bundleRef` on `allow`, `code` / `reason` on `deny`, `queue` / `reason` on `refer`, `needs` / `presentationDefinition` on `requestMore`. The dependency is stated here rather than enforced by `if`/`then` per effect, so that the shape stays a single flat object a generated type can carry without a discriminated union per family — a deliberate trade of schema strictness for implementability, and the reason a consumer MUST branch on `effect` rather than on which members happen to be present.
+ */
+export interface VerdictWith {
+    /**
+     * The granted local role. `allow` only.
+     */
+    role?: string;
+    /**
+     * Conditions attached to the grant. `allow` only.
+     */
+    obligations?: {};
+    /**
+     * Pointer to a sealed credential bundle, added by the community where issuance occurred rather than emitted by the policy. `allow` only.
+     */
+    bundleRef?: {};
+    /**
+     * Stable refusal code, safe to branch on. `deny` only.
+     */
+    code?: string;
+    /**
+     * Elaboration in prose, when the decider gave one. `deny` and `refer`.
+     */
+    reason?: string | null;
+    /**
+     * Which review queue the decision was parked in, so an applicant can be told who now holds it. `refer` only.
+     */
+    queue?: string;
+    /**
+     * What further evidence is required, named so the applicant can act without a support conversation. `requestMore` only.
+     */
+    needs?: string[];
+    /**
+     * A machine-readable statement of the same request, so a wallet can satisfy it without a human reading `needs`. `requestMore` only.
+     */
+    presentationDefinition?: {};
+}
+/**
+ * An opaque, gateway-issued reference to a device's push channel (push wake-up binding, https://trusttasks.org/binding/push/0.1). The push gateway returns it to the device at registration; the device conveys it to its VTA (device/set-wake), and the VTA provisions it to authorized triggers (its mediator and/or itself). The raw platform push token (APNs/FCM/WebPush) is held ONLY by the gateway and is never represented here — the handle abstracts the platform, so adding new push methods (e.g. PWA Web Push) needs no change to triggers or VTA config. A handle is a bearer capability to *request* a wake (subject to the gateway's allowlist), never to read the channel.
+ */
+export interface WakeHandle {
+    /**
+     * The push gateway that issued this handle and acts on it — a DID (DIDComm-reachable gateway) or an https URL (REST gateway). A trigger sends its contentless wake request here.
+     */
+    gateway: string;
+    /**
+     * Opaque gateway-issued identifier for the device's push channel. Reveals no platform token. Rotates whenever the device re-registers a new platform token with the gateway; the device then re-conveys the fresh handle via device/set-wake.
+     */
+    handle: string;
+}
+/**
+ * VTA-owned allowlist of the DIDs permitted to trigger a wake for a given WakeHandle (push wake-up binding, https://trusttasks.org/binding/push/0.1). The VTA is the source of truth for this policy — all device config state resides at the VTA — and provisions it to the gateway, which ENFORCES it: a wake request from a DID not on the list is refused. Typically holds the device's mediator DID (queue-driven wake, where the mediator alone knows the device is offline) and/or the VTA's own DID (policy-driven wake, e.g. a step-up the VTA is delegating to this device).
+ */
+export interface WakeTriggerPolicy {
+    /**
+     * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
+     */
+    allowedTriggers: string[];
+}
+/**
+ * A did:webvh DID as the VTA holds it. The DID document itself is not here — it lives in the log, which `vta/webvh/dids/get` returns on request.
+ */
+export interface WebvhDidRecord {
+    /**
+     * The DID, e.g. `did:webvh:<scid>:example.com:alice`.
+     */
+    did: string;
+    /**
+     * Id of the hosting server serving this DID's log. Empty for a serverless DID, whose location comes from the URL it was created with.
+     */
+    serverId: string;
+    /**
+     * The hosting server's handle for the record. Unrelated to a BIP-39 phrase; the collision of terms is historical.
+     */
+    mnemonic: string;
+    /**
+     * Self-certifying identifier: the hash committing to the log's first entry. It is what makes the DID's history tamper-evident, and it changes only when the log is re-created — never in place.
+     */
+    scid: string;
+    /**
+     * Context this DID belongs to. Deleting that context destroys this DID.
+     */
+    contextId: string;
+    /**
+     * Whether the DID may be moved to another domain without losing its identity. Fixed at creation: a DID created non-portable cannot be made portable later, because portability is a commitment recorded in the log's first entry.
+     */
+    portable: boolean;
+    /**
+     * Number of entries in the log.
+     */
+    logEntryCount: number;
+    /**
+     * Pre-rotation keys committed by the most recent entry. `0` means pre-rotation is disabled — a compromise of the current key is then unrecoverable by rotation, because the successor was never committed in advance.
+     */
+    preRotationCount?: number;
+    /**
+     * Next `#key-{n}` fragment id to mint. Monotonic and never decremented, so a fragment is never reused for a different key.
+     */
+    nextFragmentId?: number;
+    createdAt: string;
+    updatedAt: string;
+    ext?: Ext;
+}
+/**
+ * A hosting server the VTA is registered with. Carries no credential: what the VTA holds to authenticate against the server is never part of this record and never leaves it.
+ */
+export interface WebvhServerRecord {
+    /**
+     * Local id for the server, chosen by the operator.
+     */
+    id: string;
+    /**
+     * The server's own DID, used to authenticate it.
+     */
+    did: string;
+    label?: string;
+    createdAt: string;
+    updatedAt: string;
+    ext?: Ext;
+}
+/**
+ * The outcome of one write within a `vta/app-state/put-many` batch. Per-record rather than per-batch, because the default batch mode applies each write on its own merits: a caller flushing ten unrelated edits needs to know which one conflicted, not merely that something did.
+ */
+export interface WriteResult {
+    key: Key;
+    /**
+     * `written`: applied, and `version` carries the new value. `conflict`: `expectedVersion` did not match; `currentVersion`, `currentValue` and `currentDeleted` carry the maintainer's view so the caller can resolve without a re-read. `tooLarge`: the value exceeded the per-record cap; `limitBytes` and `actualBytes` say by how much. `notFound`: a `mergePatch` write named an address with no live record. `skipped`: atomic mode only — this write was not attempted because another in the batch failed.
+     */
+    outcome: "written" | "conflict" | "tooLarge" | "notFound" | "skipped";
+    /**
+     * The new version, on `written`.
+     */
+    version?: Version;
+    /**
+     * On `written`: true when no live record existed at the address beforehand.
+     */
+    created?: boolean;
+    /**
+     * On `conflict`: the version the maintainer actually holds. Absent when the conflict is that no record exists (`expectedVersion` was positive and the address is empty).
+     */
+    currentVersion?: Version;
+    /**
+     * On `conflict`: the value the maintainer actually holds, returned WITH the rejection rather than left for the caller to re-read. A bare rejection has no fixed point under contention — between the rejection and the re-read the record can change again — so returning the winner's view removes the race rather than narrowing it. Absent when `currentDeleted` is true or no record exists.
+     */
+    currentValue?: {
+        [k: string]: unknown | undefined;
+    };
+    /**
+     * On `conflict`: true when the address holds a tombstone rather than a live record.
+     */
+    currentDeleted?: boolean;
+    /**
+     * On `tooLarge`: the maintainer's per-record cap in bytes.
+     */
+    limitBytes?: number;
+    /**
+     * On `tooLarge`: the size of the rejected value in bytes.
+     */
+    actualBytes?: number;
+}
+//# sourceMappingURL=components.d.ts.map