@openvtc/trust-tasks 0.19.7 → 0.19.9

package/dist/vta/did-templates/get/3.0/payload.d.ts

@@ -0,0 +1,742 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/did-templates/get/3.0/payload.schema.json
+ */
+import type { Builtin_VtaV0_1 as Builtin, Context_VtaV0_1 as Context, DidTemplateRecord_VtaV0_2 as DidTemplateRecord, Ext, Global_VtaV0_1 as Global, Scope_VtaV0_1 as Scope } from "../../../../_shared/components.js";
+/**
+ * Fetch one DID template on a VTA by name. Omit `contextId` to read from the global scope (any authenticated caller); set it to read a template scoped to that context (requires access to the context). The success response is the persisted DidTemplateRecord.
+ */
+export interface VTADIDTemplateGetPayload {
+    /**
+     * Scope selector. Absent: the global scope. Present: the context the template is scoped to; the caller MUST have access to that context.
+     */
+    contextId?: string;
+    /**
+     * Template name to fetch within the selected scope.
+     */
+    name: string;
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Builtin, Context, DidTemplateRecord, Ext, Global, Scope };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vta/did-templates/get/3.0";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTADIDTemplateGetPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vta/did-templates/get/3.0#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = DidTemplateRecord;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/vta/did-templates/get/3.0";
+    readonly title: "VTA DID-Template Get — payload";
+    readonly description: "Fetch one DID template on a VTA by name. Omit `contextId` to read from the global scope (any authenticated caller); set it to read a template scoped to that context (requires access to the context). The success response is the persisted DidTemplateRecord.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["name"];
+    readonly properties: {
+        readonly contextId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Scope selector. Absent: the global scope. Present: the context the template is scoped to; the caller MUST have access to that context.";
+        };
+        readonly name: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Template name to fetch within the selected scope.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTA DID-Template Get — response payload";
+            readonly description: "The persisted DidTemplateRecord. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by create/update.";
+            readonly $ref: "#/$defs/DidTemplateRecord";
+        };
+        readonly DidTemplateRecord: {
+            readonly title: "DidTemplateRecord";
+            readonly description: "A persisted template. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by get/create/update and carried per-item by list.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["schemaVersion", "name", "kind", "document", "scope", "createdAt", "updatedAt", "createdBy"];
+            readonly properties: {
+                readonly schemaVersion: {
+                    readonly type: "integer";
+                    readonly enum: readonly [1, 2];
+                    readonly description: "Template schema version. 1 is the historical shape, whose keys are implicitly an Ed25519 signing key and an X25519 key-agreement key. 2 adds the `keys` block, which makes those explicit and allows others.";
+                };
+                readonly name: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 64;
+                    readonly pattern: "^[a-z0-9-]+$";
+                };
+                readonly kind: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly description: {
+                    readonly type: readonly ["string", "null"];
+                    readonly maxLength: 1024;
+                };
+                readonly methods: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                };
+                readonly requiredVars: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                };
+                readonly optionalVars: {
+                    readonly type: "object";
+                    readonly additionalProperties: true;
+                };
+                readonly defaults: {
+                    readonly type: "object";
+                    readonly additionalProperties: true;
+                };
+                readonly keys: {
+                    readonly type: "object";
+                    readonly minProperties: 1;
+                    readonly additionalProperties: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["purpose", "algorithms"];
+                        readonly properties: {
+                            readonly purpose: {
+                                readonly type: "string";
+                                readonly enum: readonly ["signing", "keyAgreement"];
+                                readonly description: "What the key is for. Deliberately coarser than DID Core's five verification relationships: the template says what the key is, and the `document` body says where it appears. Encoding the relationship here as well would let the two disagree.";
+                            };
+                            readonly algorithms: {
+                                readonly type: "array";
+                                readonly minItems: 1;
+                                readonly items: {
+                                    readonly type: "string";
+                                    readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+                                };
+                                readonly description: "Acceptable algorithms, MOST PREFERRED FIRST. A list rather than a single value because a fleet does not migrate atomically: `[\"mldsa44\", \"ed25519\"]` means mint ML-DSA-44 where the implementation can and Ed25519 otherwise, so one template serves a VTA with post-quantum support and one without. An implementation MUST NOT substitute an algorithm absent from this list; running out of candidates is an error, never a silent downgrade — a deployment intended to be post-quantum would otherwise ship classical keys with nothing reporting it. `minItems: 1` for the same reason: an empty list would express no preference and inherit whatever the implementation defaulted to.";
+                            };
+                        };
+                    };
+                    readonly propertyNames: {
+                        readonly pattern: "^[a-z0-9-]+$";
+                    };
+                    readonly description: "The keys this template needs, by slot name. REQUIRES `schemaVersion` 2.\n\nA slot's name becomes a document placeholder by an explicit rule — uppercase, `-` to `_`, suffix `_KEY_MB` — so slot `signing` is rendered into `{SIGNING_KEY_MB}` and slot `ka` into `{KA_KEY_MB}`. Those are the two names a `schemaVersion` 1 template already uses, which is deliberate: a v1 template is exactly a v2 template whose `keys` block is `{signing: [ed25519], ka: [x25519]}`, so an implementation can read both through one path and raising the version cannot change how a v1 template renders.\n\nAn implementation MUST refuse a template that declares a slot whose placeholder never appears in `document` — the key would be minted and never published, so verifiers would continue to see only the keys that are, while the operator believes the template migrated. It MUST likewise refuse a slot placeholder in `document` that no slot declares, which would render as an unsubstituted literal.";
+                };
+                readonly document: {
+                    readonly type: "object";
+                };
+                readonly scope: {
+                    readonly $ref: "#/$defs/Scope";
+                    readonly description: "Resolved scope of the stored template.";
+                };
+                readonly createdAt: {
+                    readonly type: "integer";
+                    readonly description: "UTC unix-epoch seconds the template was first stored.";
+                };
+                readonly updatedAt: {
+                    readonly type: "integer";
+                    readonly description: "UTC unix-epoch seconds of the last write.";
+                };
+                readonly createdBy: {
+                    readonly type: "string";
+                    readonly description: "DID of the admin who last wrote the template.";
+                };
+            };
+        };
+        readonly Scope: {
+            readonly title: "Scope";
+            readonly description: "Where a stored template lives. Tagged by `type`.";
+            readonly type: "object";
+            readonly oneOf: readonly [{
+                readonly title: "Builtin";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "builtin";
+                    };
+                };
+            }, {
+                readonly title: "Global";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "global";
+                    };
+                };
+            }, {
+                readonly title: "Context";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "contextId"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "context";
+                    };
+                    readonly contextId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            }];
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTA DID-Template Get — response payload";
+            readonly description: "The persisted DidTemplateRecord. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by create/update.";
+            readonly $ref: "#/$defs/DidTemplateRecord";
+        };
+        readonly DidTemplateRecord: {
+            readonly title: "DidTemplateRecord";
+            readonly description: "A persisted template. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by get/create/update and carried per-item by list.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["schemaVersion", "name", "kind", "document", "scope", "createdAt", "updatedAt", "createdBy"];
+            readonly properties: {
+                readonly schemaVersion: {
+                    readonly type: "integer";
+                    readonly enum: readonly [1, 2];
+                    readonly description: "Template schema version. 1 is the historical shape, whose keys are implicitly an Ed25519 signing key and an X25519 key-agreement key. 2 adds the `keys` block, which makes those explicit and allows others.";
+                };
+                readonly name: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 64;
+                    readonly pattern: "^[a-z0-9-]+$";
+                };
+                readonly kind: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly description: {
+                    readonly type: readonly ["string", "null"];
+                    readonly maxLength: 1024;
+                };
+                readonly methods: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                };
+                readonly requiredVars: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                };
+                readonly optionalVars: {
+                    readonly type: "object";
+                    readonly additionalProperties: true;
+                };
+                readonly defaults: {
+                    readonly type: "object";
+                    readonly additionalProperties: true;
+                };
+                readonly keys: {
+                    readonly type: "object";
+                    readonly minProperties: 1;
+                    readonly additionalProperties: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["purpose", "algorithms"];
+                        readonly properties: {
+                            readonly purpose: {
+                                readonly type: "string";
+                                readonly enum: readonly ["signing", "keyAgreement"];
+                                readonly description: "What the key is for. Deliberately coarser than DID Core's five verification relationships: the template says what the key is, and the `document` body says where it appears. Encoding the relationship here as well would let the two disagree.";
+                            };
+                            readonly algorithms: {
+                                readonly type: "array";
+                                readonly minItems: 1;
+                                readonly items: {
+                                    readonly type: "string";
+                                    readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+                                };
+                                readonly description: "Acceptable algorithms, MOST PREFERRED FIRST. A list rather than a single value because a fleet does not migrate atomically: `[\"mldsa44\", \"ed25519\"]` means mint ML-DSA-44 where the implementation can and Ed25519 otherwise, so one template serves a VTA with post-quantum support and one without. An implementation MUST NOT substitute an algorithm absent from this list; running out of candidates is an error, never a silent downgrade — a deployment intended to be post-quantum would otherwise ship classical keys with nothing reporting it. `minItems: 1` for the same reason: an empty list would express no preference and inherit whatever the implementation defaulted to.";
+                            };
+                        };
+                    };
+                    readonly propertyNames: {
+                        readonly pattern: "^[a-z0-9-]+$";
+                    };
+                    readonly description: "The keys this template needs, by slot name. REQUIRES `schemaVersion` 2.\n\nA slot's name becomes a document placeholder by an explicit rule — uppercase, `-` to `_`, suffix `_KEY_MB` — so slot `signing` is rendered into `{SIGNING_KEY_MB}` and slot `ka` into `{KA_KEY_MB}`. Those are the two names a `schemaVersion` 1 template already uses, which is deliberate: a v1 template is exactly a v2 template whose `keys` block is `{signing: [ed25519], ka: [x25519]}`, so an implementation can read both through one path and raising the version cannot change how a v1 template renders.\n\nAn implementation MUST refuse a template that declares a slot whose placeholder never appears in `document` — the key would be minted and never published, so verifiers would continue to see only the keys that are, while the operator believes the template migrated. It MUST likewise refuse a slot placeholder in `document` that no slot declares, which would render as an unsubstituted literal.";
+                };
+                readonly document: {
+                    readonly type: "object";
+                };
+                readonly scope: {
+                    readonly $ref: "#/$defs/Scope";
+                    readonly description: "Resolved scope of the stored template.";
+                };
+                readonly createdAt: {
+                    readonly type: "integer";
+                    readonly description: "UTC unix-epoch seconds the template was first stored.";
+                };
+                readonly updatedAt: {
+                    readonly type: "integer";
+                    readonly description: "UTC unix-epoch seconds of the last write.";
+                };
+                readonly createdBy: {
+                    readonly type: "string";
+                    readonly description: "DID of the admin who last wrote the template.";
+                };
+            };
+        };
+        readonly Scope: {
+            readonly title: "Scope";
+            readonly description: "Where a stored template lives. Tagged by `type`.";
+            readonly type: "object";
+            readonly oneOf: readonly [{
+                readonly title: "Builtin";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "builtin";
+                    };
+                };
+            }, {
+                readonly title: "Global";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "global";
+                    };
+                };
+            }, {
+                readonly title: "Context";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "contextId"];
+                readonly properties: {
+                    readonly type: {
+                        readonly const: "context";
+                    };
+                    readonly contextId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                };
+            }];
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/did-templates/get/3.0";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/vta/did-templates/get/3.0";
+        readonly title: "VTA DID-Template Get — payload";
+        readonly description: "Fetch one DID template on a VTA by name. Omit `contextId` to read from the global scope (any authenticated caller); set it to read a template scoped to that context (requires access to the context). The success response is the persisted DidTemplateRecord.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["name"];
+        readonly properties: {
+            readonly contextId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Scope selector. Absent: the global scope. Present: the context the template is scoped to; the caller MUST have access to that context.";
+            };
+            readonly name: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Template name to fetch within the selected scope.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTA DID-Template Get — response payload";
+                readonly description: "The persisted DidTemplateRecord. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by create/update.";
+                readonly $ref: "#/$defs/DidTemplateRecord";
+            };
+            readonly DidTemplateRecord: {
+                readonly title: "DidTemplateRecord";
+                readonly description: "A persisted template. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by get/create/update and carried per-item by list.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["schemaVersion", "name", "kind", "document", "scope", "createdAt", "updatedAt", "createdBy"];
+                readonly properties: {
+                    readonly schemaVersion: {
+                        readonly type: "integer";
+                        readonly enum: readonly [1, 2];
+                        readonly description: "Template schema version. 1 is the historical shape, whose keys are implicitly an Ed25519 signing key and an X25519 key-agreement key. 2 adds the `keys` block, which makes those explicit and allows others.";
+                    };
+                    readonly name: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly pattern: "^[a-z0-9-]+$";
+                    };
+                    readonly kind: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly description: {
+                        readonly type: readonly ["string", "null"];
+                        readonly maxLength: 1024;
+                    };
+                    readonly methods: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                    };
+                    readonly requiredVars: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                    };
+                    readonly optionalVars: {
+                        readonly type: "object";
+                        readonly additionalProperties: true;
+                    };
+                    readonly defaults: {
+                        readonly type: "object";
+                        readonly additionalProperties: true;
+                    };
+                    readonly keys: {
+                        readonly type: "object";
+                        readonly minProperties: 1;
+                        readonly additionalProperties: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["purpose", "algorithms"];
+                            readonly properties: {
+                                readonly purpose: {
+                                    readonly type: "string";
+                                    readonly enum: readonly ["signing", "keyAgreement"];
+                                    readonly description: "What the key is for. Deliberately coarser than DID Core's five verification relationships: the template says what the key is, and the `document` body says where it appears. Encoding the relationship here as well would let the two disagree.";
+                                };
+                                readonly algorithms: {
+                                    readonly type: "array";
+                                    readonly minItems: 1;
+                                    readonly items: {
+                                        readonly type: "string";
+                                        readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+                                    };
+                                    readonly description: "Acceptable algorithms, MOST PREFERRED FIRST. A list rather than a single value because a fleet does not migrate atomically: `[\"mldsa44\", \"ed25519\"]` means mint ML-DSA-44 where the implementation can and Ed25519 otherwise, so one template serves a VTA with post-quantum support and one without. An implementation MUST NOT substitute an algorithm absent from this list; running out of candidates is an error, never a silent downgrade — a deployment intended to be post-quantum would otherwise ship classical keys with nothing reporting it. `minItems: 1` for the same reason: an empty list would express no preference and inherit whatever the implementation defaulted to.";
+                                };
+                            };
+                        };
+                        readonly propertyNames: {
+                            readonly pattern: "^[a-z0-9-]+$";
+                        };
+                        readonly description: "The keys this template needs, by slot name. REQUIRES `schemaVersion` 2.\n\nA slot's name becomes a document placeholder by an explicit rule — uppercase, `-` to `_`, suffix `_KEY_MB` — so slot `signing` is rendered into `{SIGNING_KEY_MB}` and slot `ka` into `{KA_KEY_MB}`. Those are the two names a `schemaVersion` 1 template already uses, which is deliberate: a v1 template is exactly a v2 template whose `keys` block is `{signing: [ed25519], ka: [x25519]}`, so an implementation can read both through one path and raising the version cannot change how a v1 template renders.\n\nAn implementation MUST refuse a template that declares a slot whose placeholder never appears in `document` — the key would be minted and never published, so verifiers would continue to see only the keys that are, while the operator believes the template migrated. It MUST likewise refuse a slot placeholder in `document` that no slot declares, which would render as an unsubstituted literal.";
+                    };
+                    readonly document: {
+                        readonly type: "object";
+                    };
+                    readonly scope: {
+                        readonly $ref: "#/$defs/Scope";
+                        readonly description: "Resolved scope of the stored template.";
+                    };
+                    readonly createdAt: {
+                        readonly type: "integer";
+                        readonly description: "UTC unix-epoch seconds the template was first stored.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "integer";
+                        readonly description: "UTC unix-epoch seconds of the last write.";
+                    };
+                    readonly createdBy: {
+                        readonly type: "string";
+                        readonly description: "DID of the admin who last wrote the template.";
+                    };
+                };
+            };
+            readonly Scope: {
+                readonly title: "Scope";
+                readonly description: "Where a stored template lives. Tagged by `type`.";
+                readonly type: "object";
+                readonly oneOf: readonly [{
+                    readonly title: "Builtin";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["type"];
+                    readonly properties: {
+                        readonly type: {
+                            readonly const: "builtin";
+                        };
+                    };
+                }, {
+                    readonly title: "Global";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["type"];
+                    readonly properties: {
+                        readonly type: {
+                            readonly const: "global";
+                        };
+                    };
+                }, {
+                    readonly title: "Context";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["type", "contextId"];
+                    readonly properties: {
+                        readonly type: {
+                            readonly const: "context";
+                        };
+                        readonly contextId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                }];
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/did-templates/get/3.0#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTA DID-Template Get — response payload";
+                readonly description: "The persisted DidTemplateRecord. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by create/update.";
+                readonly $ref: "#/$defs/DidTemplateRecord";
+            };
+            readonly DidTemplateRecord: {
+                readonly title: "DidTemplateRecord";
+                readonly description: "A persisted template. The DidTemplate fields are flattened at the top level alongside the resolved scope and provenance metadata. Same shape returned by get/create/update and carried per-item by list.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["schemaVersion", "name", "kind", "document", "scope", "createdAt", "updatedAt", "createdBy"];
+                readonly properties: {
+                    readonly schemaVersion: {
+                        readonly type: "integer";
+                        readonly enum: readonly [1, 2];
+                        readonly description: "Template schema version. 1 is the historical shape, whose keys are implicitly an Ed25519 signing key and an X25519 key-agreement key. 2 adds the `keys` block, which makes those explicit and allows others.";
+                    };
+                    readonly name: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly pattern: "^[a-z0-9-]+$";
+                    };
+                    readonly kind: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly description: {
+                        readonly type: readonly ["string", "null"];
+                        readonly maxLength: 1024;
+                    };
+                    readonly methods: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                    };
+                    readonly requiredVars: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                    };
+                    readonly optionalVars: {
+                        readonly type: "object";
+                        readonly additionalProperties: true;
+                    };
+                    readonly defaults: {
+                        readonly type: "object";
+                        readonly additionalProperties: true;
+                    };
+                    readonly keys: {
+                        readonly type: "object";
+                        readonly minProperties: 1;
+                        readonly additionalProperties: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["purpose", "algorithms"];
+                            readonly properties: {
+                                readonly purpose: {
+                                    readonly type: "string";
+                                    readonly enum: readonly ["signing", "keyAgreement"];
+                                    readonly description: "What the key is for. Deliberately coarser than DID Core's five verification relationships: the template says what the key is, and the `document` body says where it appears. Encoding the relationship here as well would let the two disagree.";
+                                };
+                                readonly algorithms: {
+                                    readonly type: "array";
+                                    readonly minItems: 1;
+                                    readonly items: {
+                                        readonly type: "string";
+                                        readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+                                    };
+                                    readonly description: "Acceptable algorithms, MOST PREFERRED FIRST. A list rather than a single value because a fleet does not migrate atomically: `[\"mldsa44\", \"ed25519\"]` means mint ML-DSA-44 where the implementation can and Ed25519 otherwise, so one template serves a VTA with post-quantum support and one without. An implementation MUST NOT substitute an algorithm absent from this list; running out of candidates is an error, never a silent downgrade — a deployment intended to be post-quantum would otherwise ship classical keys with nothing reporting it. `minItems: 1` for the same reason: an empty list would express no preference and inherit whatever the implementation defaulted to.";
+                                };
+                            };
+                        };
+                        readonly propertyNames: {
+                            readonly pattern: "^[a-z0-9-]+$";
+                        };
+                        readonly description: "The keys this template needs, by slot name. REQUIRES `schemaVersion` 2.\n\nA slot's name becomes a document placeholder by an explicit rule — uppercase, `-` to `_`, suffix `_KEY_MB` — so slot `signing` is rendered into `{SIGNING_KEY_MB}` and slot `ka` into `{KA_KEY_MB}`. Those are the two names a `schemaVersion` 1 template already uses, which is deliberate: a v1 template is exactly a v2 template whose `keys` block is `{signing: [ed25519], ka: [x25519]}`, so an implementation can read both through one path and raising the version cannot change how a v1 template renders.\n\nAn implementation MUST refuse a template that declares a slot whose placeholder never appears in `document` — the key would be minted and never published, so verifiers would continue to see only the keys that are, while the operator believes the template migrated. It MUST likewise refuse a slot placeholder in `document` that no slot declares, which would render as an unsubstituted literal.";
+                    };
+                    readonly document: {
+                        readonly type: "object";
+                    };
+                    readonly scope: {
+                        readonly $ref: "#/$defs/Scope";
+                        readonly description: "Resolved scope of the stored template.";
+                    };
+                    readonly createdAt: {
+                        readonly type: "integer";
+                        readonly description: "UTC unix-epoch seconds the template was first stored.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "integer";
+                        readonly description: "UTC unix-epoch seconds of the last write.";
+                    };
+                    readonly createdBy: {
+                        readonly type: "string";
+                        readonly description: "DID of the admin who last wrote the template.";
+                    };
+                };
+            };
+            readonly Scope: {
+                readonly title: "Scope";
+                readonly description: "Where a stored template lives. Tagged by `type`.";
+                readonly type: "object";
+                readonly oneOf: readonly [{
+                    readonly title: "Builtin";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["type"];
+                    readonly properties: {
+                        readonly type: {
+                            readonly const: "builtin";
+                        };
+                    };
+                }, {
+                    readonly title: "Global";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["type"];
+                    readonly properties: {
+                        readonly type: {
+                            readonly const: "global";
+                        };
+                    };
+                }, {
+                    readonly title: "Context";
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["type", "contextId"];
+                    readonly properties: {
+                        readonly type: {
+                            readonly const: "context";
+                        };
+                        readonly contextId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                        };
+                    };
+                }];
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map