@openvtc/trust-tasks 0.20.7 → 0.21.0

package/dist/vta/webvh/dids/keys/add/1.0/payload.d.ts

@@ -0,0 +1,1914 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/webvh/dids/keys/add/1.0/payload.schema.json
+ */
+import type { DidDocumentChange, DidDocumentPreview, DidVerificationRelationship, Ext, KeyOrigin, KeyRole, KeyRoleApprovalState, KeyRoleChangeOutcome, KeyType, RoleKey, RoleKeyCustody, RoleKeyState, RotationKind, RotationRecord, RotationState } from "../../../../../../_shared/components.js";
+/**
+ * Add a newly generated key to one role of a did:webvh, without removing any — a post-quantum key beside a classical one, or a second operational key.
+ */
+export interface VTAWebVHDIDsKeysAddPayload {
+    /**
+     * The DID whose keys change.
+     */
+    did: string;
+    /**
+     * The role the key joins. `update` keys are not added; they move by rotation.
+     */
+    role: "attestation" | "operational" | "messaging";
+    /**
+     * Algorithm of the key to generate. Must suit the role (CONVENTIONS.md §1 item 6).
+     */
+    keyType: KeyType;
+    /**
+     * Operator-facing label for the key. Never published.
+     */
+    label?: string;
+    /**
+     * Optimistic-concurrency precondition: the versionId the caller based this change on (for example `keys/list`'s `versionId`). The VTA MUST refuse the change with `vta/webvh/dids:versionConflict` if the DID's latest entry no longer matches.
+     */
+    expectedVersionId?: string;
+    /**
+     * Compute and return the preview without writing anything but the plan (CONVENTIONS.md §3.1). Absent reads as false.
+     */
+    dryRun?: boolean;
+    /**
+     * Apply exactly the plan a previous dry run of this same request returned. The VTA MUST apply that plan or nothing, and MUST refuse with `vta/webvh/dids:previewStale` if it has expired, the log has moved past its base, or this request differs from the one previewed. An approval (step-up or quorum) is bound to this identifier.
+     */
+    previewId?: string;
+    /**
+     * Why the change is being made, for the audit trail and for other approvers. Never published.
+     */
+    reason?: string;
+    ext?: Ext;
+}
+/**
+ * Success response. Type https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0#response. A refusal is a `trust-task-error` document, never this.
+ */
+export interface VTAWebVHDIDsKeysAddResponsePayload {
+    did: string;
+    outcome: KeyRoleChangeOutcome;
+    /**
+     * Present when `outcome` is `preview` or `pendingApproval`: the plan, and what an approval is bound to.
+     */
+    preview?: DidDocumentPreview;
+    /**
+     * Present when `outcome` is `applied`: the versionId of the appended entry. Pass it as the next change's `expectedVersionId`.
+     */
+    newVersionId?: string;
+    /**
+     * Every key whose state this change sets or would set, after the change.
+     */
+    keys: RoleKey[];
+    rotation?: RotationRecord;
+    /**
+     * Present when `outcome` is `pendingApproval`.
+     */
+    approvals?: KeyRoleApprovalState;
+    /**
+     * True when no hosting server holds this DID. The caller must publish `newLogEntry` itself; until it does, resolvers still see the previous version.
+     */
+    serverless?: boolean;
+    /**
+     * The appended entry as JSON text. Present when `serverless` is true.
+     */
+    newLogEntry?: string;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DidDocumentChange, DidDocumentPreview, DidVerificationRelationship, Ext, KeyOrigin, KeyRole, KeyRoleApprovalState, KeyRoleChangeOutcome, KeyType, RoleKey, RoleKeyCustody, RoleKeyState, RotationKind, RotationRecord, RotationState };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTAWebVHDIDsKeysAddPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTAWebVHDIDsKeysAddResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0";
+    readonly title: "VTA WebVH DIDs Keys Add — payload";
+    readonly description: "Add a newly generated key to one role of a did:webvh, without removing any — a post-quantum key beside a classical one, or a second operational key.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["did", "role", "keyType"];
+    readonly properties: {
+        readonly did: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "The DID whose keys change.";
+        };
+        readonly role: {
+            readonly type: "string";
+            readonly enum: readonly ["attestation", "operational", "messaging"];
+            readonly description: "The role the key joins. `update` keys are not added; they move by rotation.";
+        };
+        readonly keyType: {
+            readonly $ref: "#/$defs/KeyType";
+            readonly description: "Algorithm of the key to generate. Must suit the role (CONVENTIONS.md §1 item 6).";
+        };
+        readonly label: {
+            readonly type: "string";
+            readonly maxLength: 256;
+            readonly description: "Operator-facing label for the key. Never published.";
+        };
+        readonly expectedVersionId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Optimistic-concurrency precondition: the versionId the caller based this change on (for example `keys/list`'s `versionId`). The VTA MUST refuse the change with `vta/webvh/dids:versionConflict` if the DID's latest entry no longer matches.";
+        };
+        readonly dryRun: {
+            readonly type: "boolean";
+            readonly description: "Compute and return the preview without writing anything but the plan (CONVENTIONS.md §3.1). Absent reads as false.";
+        };
+        readonly previewId: {
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly description: "Apply exactly the plan a previous dry run of this same request returned. The VTA MUST apply that plan or nothing, and MUST refuse with `vta/webvh/dids:previewStale` if it has expired, the log has moved past its base, or this request differs from the one previewed. An approval (step-up or quorum) is bound to this identifier.";
+        };
+        readonly reason: {
+            readonly type: "string";
+            readonly maxLength: 1024;
+            readonly description: "Why the change is being made, for the audit trail and for other approvers. Never published.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTA WebVH DIDs Keys Add — response payload";
+            readonly description: "Success response. Type https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0#response. A refusal is a `trust-task-error` document, never this.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["did", "outcome", "keys"];
+            readonly properties: {
+                readonly did: {
+                    readonly type: "string";
+                };
+                readonly outcome: {
+                    readonly $ref: "#/$defs/KeyRoleChangeOutcome";
+                };
+                readonly preview: {
+                    readonly $ref: "#/$defs/DidDocumentPreview";
+                    readonly description: "Present when `outcome` is `preview` or `pendingApproval`: the plan, and what an approval is bound to.";
+                };
+                readonly newVersionId: {
+                    readonly type: "string";
+                    readonly description: "Present when `outcome` is `applied`: the versionId of the appended entry. Pass it as the next change's `expectedVersionId`.";
+                };
+                readonly keys: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/RoleKey";
+                    };
+                    readonly description: "Every key whose state this change sets or would set, after the change.";
+                };
+                readonly rotation: {
+                    readonly $ref: "#/$defs/RotationRecord";
+                };
+                readonly approvals: {
+                    readonly $ref: "#/$defs/KeyRoleApprovalState";
+                    readonly description: "Present when `outcome` is `pendingApproval`.";
+                };
+                readonly serverless: {
+                    readonly type: "boolean";
+                    readonly description: "True when no hosting server holds this DID. The caller must publish `newLogEntry` itself; until it does, resolvers still see the previous version.";
+                };
+                readonly newLogEntry: {
+                    readonly type: "string";
+                    readonly description: "The appended entry as JSON text. Present when `serverless` is true.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly KeyRoleApprovalState: {
+            readonly title: "KeyRoleApprovalState";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["required", "received", "expiresAt"];
+            readonly description: "Approval progress of a change the VTA's policy gates on more than one approval (CONVENTIONS.md §3.3).";
+            readonly properties: {
+                readonly required: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Distinct approvals the VTA's policy requires.";
+                };
+                readonly received: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Distinct approvals recorded so far, including the initiator's own.";
+                };
+                readonly approvers: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "VIDs whose approvals were recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                };
+            };
+        };
+        readonly RotationRecord: {
+            readonly title: "RotationRecord";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["rotationId", "role", "kind", "state"];
+            readonly description: "One change to a role's key set, from preview to completion. The rotation history of a DID is the list of these; the log is the authority for what was published, and this record adds what the log cannot say — which change was which, and (custody projection only) who asked, who approved, and why.";
+            readonly properties: {
+                readonly rotationId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/KeyRole";
+                };
+                readonly kind: {
+                    readonly $ref: "#/$defs/RotationKind";
+                };
+                readonly state: {
+                    readonly $ref: "#/$defs/RotationState";
+                };
+                readonly predecessors: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Verification-method identifiers (or, for `update`, public keys) leaving the role.";
+                };
+                readonly successors: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Verification-method identifiers (or, for `update`, public keys) entering the role.";
+                };
+                readonly startedInVersionId: {
+                    readonly type: "string";
+                };
+                readonly endedInVersionId: {
+                    readonly type: "string";
+                };
+                readonly startedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly overlapUntil: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Custody projection only. End of the overlap window.";
+                };
+                readonly autoRetire: {
+                    readonly type: "boolean";
+                    readonly description: "Custody projection only. Whether the VTA retires the predecessor itself at `overlapUntil`.";
+                };
+                readonly endedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly initiatedBy: {
+                    readonly type: "string";
+                    readonly description: "Custody projection only. VID of the administrator whose signed request started the change.";
+                };
+                readonly approvals: {
+                    readonly $ref: "#/$defs/KeyRoleApprovalState";
+                    readonly description: "Custody projection only.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "Custody projection only. The operator's stated reason. Never published.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+                readonly activatesAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the successor becomes `active` and the predecessor `retiring`; never before `cacheHorizonAt`.";
+                };
+                readonly cacheHorizonAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Planned rotations: the publishing entry's cache horizon — publication plus the longer of the document's TTL and the verifier cache cap (CONVENTIONS.md §11.1). The switch, and any retirement of the predecessor, happen no earlier. Public: it follows from the log and the published cap.";
+                };
+            };
+        };
+        readonly RotationState: {
+            readonly title: "RotationState";
+            readonly type: "string";
+            readonly enum: readonly ["pendingApproval", "staged", "overlapping", "completed", "aborted", "expired"];
+            readonly description: "`pendingApproval` — awaiting the approvals the VTA's policy requires; nothing is published. `staged` — successor published, not yet used; predecessor still active. `overlapping` — successor active, predecessor `retiring`. `completed` — every predecessor retired (or, for `compromise` and `addition`, the entry is published and any overlap it began has ended). `aborted` — the successor was retired instead of the predecessor, which stayed or returned to `active`. `expired` — approvals were not gathered before the preview expired; nothing was published.";
+        };
+        readonly RotationKind: {
+            readonly title: "RotationKind";
+            readonly type: "string";
+            readonly enum: readonly ["planned", "compromise", "addition"];
+            readonly description: "`planned` — a successor was staged, activated, and the predecessor retired on the operator's schedule. `compromise` — a key was revoked and, where the role would otherwise be empty, replaced in the same log entry. `addition` — a key was added to a role without anything leaving it (for example a post-quantum key alongside a classical one).";
+        };
+        readonly KeyRole: {
+            readonly title: "KeyRole";
+            readonly type: "string";
+            readonly enum: readonly ["attestation", "operational", "messaging", "update"];
+            readonly description: "The named key role a key occupies in the DID (VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the DID's attestation artefacts (membership and role credentials, endorsements, status lists, every other credential the node issues), through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP message signatures, invitations, notices, audit checkpoints) with proof purpose `authentication`. `messaging` — the only keys in `keyAgreement`; sign nothing. `update` — the keys that authorize appending to the DID's log (a did:webvh `updateKeys` entry) and the pre-rotation commitments that authorize the next ones; never a verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075); both are reserved for a future role. The mapping is normative and is set out in CONVENTIONS.md §1. The set is an extensible registry and growing it is a MINOR change: a consumer that receives a role it does not implement MUST refuse the document rather than map the key onto a role it does know.";
+        };
+        readonly RoleKey: {
+            readonly title: "RoleKey";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["role", "keyType", "publicKeyMultibase", "state"];
+            readonly description: "One key in one role. A key is in exactly one role for its whole life; a change of role is a retirement from one and an addition to another, under a new verification-method identifier.";
+            readonly properties: {
+                readonly verificationMethod: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The full verification-method identifier (`did#fragment`) the document publishes the key under, and lists in `keyRoles`. Absent only for `update` keys, which are published as log parameters and never as verification methods (VTI-KEY-093). A VTA minting a new method SHOULD derive its fragment from the key (VTI-KEY-150).";
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/KeyRole";
+                };
+                readonly relationships: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidVerificationRelationship";
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "The relationships the key is (or, while `pending`, will be) listed in. Always exactly its role's single relationship (CONVENTIONS.md §1) — carried so a caller can check it against the document rather than trusting it. Empty for `update`, `retired` and `revoked` keys.";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly publicKeyMultibase: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The public half, multibase-encoded, exactly as published.";
+                };
+                readonly state: {
+                    readonly $ref: "#/$defs/RoleKeyState";
+                };
+                readonly publishedInVersionId: {
+                    readonly type: "string";
+                    readonly description: "versionId of the log entry that first published the key. Absent while `pending`.";
+                };
+                readonly removedInVersionId: {
+                    readonly type: "string";
+                    readonly description: "versionId of the log entry that retired or revoked the key.";
+                };
+                readonly retireAfter: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "For a `retiring` key: the end of its overlap window. Custody projection only.";
+                };
+                readonly compromisedSince: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "For a `revoked` key: the compromise time (VTI-KEY-121) — the earliest instant from which the key is treated as compromised. Where the operator cannot establish it, the time the key was first published. Published, because it is what a verifier needs.";
+                };
+                readonly rotationId: {
+                    readonly type: "string";
+                    readonly description: "The rotation this key was introduced or retired by, when it was.";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "Operator-facing label. Custody projection only.";
+                };
+                readonly custody: {
+                    readonly $ref: "#/$defs/RoleKeyCustody";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+                readonly activatesAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "For a `staged` key: when the VTA will begin using it — no earlier than the publishing entry's cache horizon (CONVENTIONS.md §11.1).";
+                };
+            };
+        };
+        readonly RoleKeyCustody: {
+            readonly title: "RoleKeyCustody";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["keyId", "exportable", "neverExportable", "inBackups"];
+            readonly description: "How the VTA holds a key. Present only in the custody projection. Carries no key material, and a conforming VTA MUST NOT place any in `ext`.";
+            readonly properties: {
+                readonly keyId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The custodian record identifier (`keys/*`'s `keyId`) behind this key.";
+                };
+                readonly origin: {
+                    readonly $ref: "#/$defs/KeyOrigin";
+                };
+                readonly exportable: {
+                    readonly type: "boolean";
+                    readonly description: "Whether the custodian would release the private half through `keys/export-secret`. Always `false` for `attestation` and `update` keys (CONVENTIONS.md §4). Stated explicitly — never absent — because this is the member an operator reads to confirm a role key cannot leave the VTA, and `keys/*`'s absent-means-exportable reading is the wrong default to leave them to infer.";
+                };
+                readonly neverExportable: {
+                    readonly type: "boolean";
+                    readonly description: "True when no authority can make the key exportable — the role forbids it, or the material exists only inside a module that cannot release it. `true` implies `exportable: false`.";
+                };
+                readonly hardwareBacked: {
+                    readonly type: "boolean";
+                    readonly description: "True when the private half is held by a hardware or enclave module that performs the operation without releasing it. Absent means the VTA does not say, not that it is false.";
+                };
+                readonly inBackups: {
+                    readonly type: "boolean";
+                    readonly description: "Whether the key, or material it can be re-derived from, is included in the VTA's backups or any state transfer. Always `false` for `attestation` and `update` keys (VTI-KEY-112): they are generated, not derived, so there is no seed that recovers them, and their loss is recovered by rotation, never by restore.";
+                };
+                readonly destroyed: {
+                    readonly type: "boolean";
+                    readonly description: "True once the private half has been destroyed — a retired `attestation` key (VTI-KEY-125). The record survives so the key's past signatures stay attributable.";
+                };
+            };
+        };
+        readonly KeyOrigin: {
+            readonly title: "KeyOrigin";
+            readonly type: "string";
+            readonly enum: readonly ["derived", "imported", "internal"];
+            readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.";
+            readonly default: "derived";
+        };
+        readonly RoleKeyState: {
+            readonly title: "RoleKeyState";
+            readonly type: "string";
+            readonly enum: readonly ["pending", "staged", "active", "retiring", "retired", "revoked"];
+            readonly description: "Where a key is in its role's lifecycle. `pending` — planned by a preview or a change awaiting approval; not published; custody projection only. `staged` — published and bound to its role, but not yet used: a planned rotation publishes the successor and waits until the entry's cache horizon — publication plus the longer of the document's TTL and the verifier cache cap (CONVENTIONS.md §11.1) — before the VTA first uses it, so that no verifier holding a cached document sees a signature by a key it has never seen (VTI-KEY-122). Becomes `active` at the rotation's `activatesAt`. `active` — the key the VTA uses for new signatures (or, for `messaging`, advertises for new sessions). `retiring` — still published so that what it signed and sessions keyed to it keep working, but never used again: from the successor's first use the VTA MUST NOT sign with it, while a retiring `messaging` key stays usable for decryption, and senders may still encrypt to it, until it is retired (CONVENTIONS.md §11.3). `retired` — removed by planned rotation; what it signed while published remains valid, judged against the DID version current at issuance (CONVENTIONS.md §7). A retired `attestation` or `messaging` key is destroyed at retirement. `revoked` — removed from every relationship and from `keyRoles` in one entry, without overlap, because it is or may be compromised; what it signed from `compromisedSince` onward establishes nothing. `retired` and `revoked` are terminal.";
+        };
+        readonly DidVerificationRelationship: {
+            readonly title: "DidVerificationRelationship";
+            readonly type: "string";
+            readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+            readonly description: "A DID Core verification relationship.";
+        };
+        readonly KeyType: {
+            readonly title: "KeyType";
+            readonly type: "string";
+            readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+            readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+        };
+        readonly DidDocumentPreview: {
+            readonly title: "DidDocumentPreview";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["previewId", "baseVersionId", "expiresAt", "changes", "document", "updateKeyRotates"];
+            readonly description: "What a change would publish, computed by the VTA by running the handler it would run to apply it, and nothing else (CONVENTIONS.md §3.1). This is what a consent surface renders and what an approval is bound to.";
+            readonly properties: {
+                readonly previewId: {
+                    readonly type: "string";
+                    readonly minLength: 16;
+                    readonly description: "Opaque, unguessable identifier for this exact plan. Carried back by the apply request, and the thing every approval is bound to.";
+                };
+                readonly baseVersionId: {
+                    readonly type: "string";
+                    readonly description: "versionId of the log entry the plan was computed against. The plan is void once the log moves past it.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly changes: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidDocumentChange";
+                    };
+                    readonly description: "Every change the entry would make, including the ones the caller did not ask for — in particular `rotateUpdateKey`, which accompanies every entry appended under pre-rotation.";
+                };
+                readonly document: {
+                    readonly type: "object";
+                    readonly description: "The complete DID document the entry would publish. Public data by construction; no key material beyond public halves.";
+                };
+                readonly warnings: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                        readonly enum: readonly ["preRotationDisabled", "singleKeyRole", "algorithmNotInAcceptedSet", "roleWillHaveNoClassicalKey", "attestationReissuanceRequired", "serverless"];
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "Conditions a human should be shown before approving. `preRotationDisabled` — the entry leaves no committed successor, so a later update-key compromise can only end in deactivation. `singleKeyRole` — the role will hold one active key, so its next compromise empties it until replaced. `algorithmNotInAcceptedSet` — a verifier population the VTA knows of does not accept the new key's algorithm. `roleWillHaveNoClassicalKey` — every remaining key is post-quantum, which verifiers without post-quantum support cannot check. `attestationReissuanceRequired` — revoking this `attestation` key obliges the node to re-issue every attestation artefact still in force and re-sign every status list (VTI-KEY-133). `serverless` — the VTA will not publish the entry; the operator must.";
+                };
+                readonly updateKeyRotates: {
+                    readonly type: "boolean";
+                    readonly description: "True when appending this entry also moves the DID's update key to a committed successor. Stated as its own member, not left to be found in `changes`, because it is the consequence a reviewer most often misses.";
+                };
+            };
+        };
+        readonly DidDocumentChange: {
+            readonly title: "DidDocumentChange";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["op", "role"];
+            readonly properties: {
+                readonly op: {
+                    readonly type: "string";
+                    readonly enum: readonly ["addKey", "retireKey", "revokeKey", "rotateUpdateKey", "setPreRotation"];
+                    readonly description: "`addKey` — a verification method is added, listed in its role's relationship and in `keyRoles`. `retireKey` — a verification method leaves its relationship, `keyRoles` and the document. `revokeKey` — a verification method leaves its relationship and `keyRoles`, and the compromise is recorded (CONVENTIONS.md §7). `rotateUpdateKey` — the log's update key moves to a committed successor. `setPreRotation` — the number of successors committed changes.";
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/KeyRole";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly publicKeyMultibase: {
+                    readonly type: "string";
+                };
+                readonly relationships: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidVerificationRelationship";
+                    };
+                    readonly uniqueItems: true;
+                };
+                readonly preRotationCount: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                };
+            };
+        };
+        readonly KeyRoleChangeOutcome: {
+            readonly title: "KeyRoleChangeOutcome";
+            readonly type: "string";
+            readonly enum: readonly ["preview", "applied", "pendingApproval"];
+            readonly description: "`preview` — nothing was written; the response carries the plan. `applied` — the entry was appended (and published, unless `serverless`). `pendingApproval` — the plan is recorded and awaits further approvals; nothing is published until they arrive (CONVENTIONS.md §3.3).";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTA WebVH DIDs Keys Add — response payload";
+            readonly description: "Success response. Type https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0#response. A refusal is a `trust-task-error` document, never this.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["did", "outcome", "keys"];
+            readonly properties: {
+                readonly did: {
+                    readonly type: "string";
+                };
+                readonly outcome: {
+                    readonly $ref: "#/$defs/KeyRoleChangeOutcome";
+                };
+                readonly preview: {
+                    readonly $ref: "#/$defs/DidDocumentPreview";
+                    readonly description: "Present when `outcome` is `preview` or `pendingApproval`: the plan, and what an approval is bound to.";
+                };
+                readonly newVersionId: {
+                    readonly type: "string";
+                    readonly description: "Present when `outcome` is `applied`: the versionId of the appended entry. Pass it as the next change's `expectedVersionId`.";
+                };
+                readonly keys: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/RoleKey";
+                    };
+                    readonly description: "Every key whose state this change sets or would set, after the change.";
+                };
+                readonly rotation: {
+                    readonly $ref: "#/$defs/RotationRecord";
+                };
+                readonly approvals: {
+                    readonly $ref: "#/$defs/KeyRoleApprovalState";
+                    readonly description: "Present when `outcome` is `pendingApproval`.";
+                };
+                readonly serverless: {
+                    readonly type: "boolean";
+                    readonly description: "True when no hosting server holds this DID. The caller must publish `newLogEntry` itself; until it does, resolvers still see the previous version.";
+                };
+                readonly newLogEntry: {
+                    readonly type: "string";
+                    readonly description: "The appended entry as JSON text. Present when `serverless` is true.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly KeyRoleApprovalState: {
+            readonly title: "KeyRoleApprovalState";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["required", "received", "expiresAt"];
+            readonly description: "Approval progress of a change the VTA's policy gates on more than one approval (CONVENTIONS.md §3.3).";
+            readonly properties: {
+                readonly required: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Distinct approvals the VTA's policy requires.";
+                };
+                readonly received: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Distinct approvals recorded so far, including the initiator's own.";
+                };
+                readonly approvers: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "VIDs whose approvals were recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                };
+            };
+        };
+        readonly RotationRecord: {
+            readonly title: "RotationRecord";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["rotationId", "role", "kind", "state"];
+            readonly description: "One change to a role's key set, from preview to completion. The rotation history of a DID is the list of these; the log is the authority for what was published, and this record adds what the log cannot say — which change was which, and (custody projection only) who asked, who approved, and why.";
+            readonly properties: {
+                readonly rotationId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/KeyRole";
+                };
+                readonly kind: {
+                    readonly $ref: "#/$defs/RotationKind";
+                };
+                readonly state: {
+                    readonly $ref: "#/$defs/RotationState";
+                };
+                readonly predecessors: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Verification-method identifiers (or, for `update`, public keys) leaving the role.";
+                };
+                readonly successors: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Verification-method identifiers (or, for `update`, public keys) entering the role.";
+                };
+                readonly startedInVersionId: {
+                    readonly type: "string";
+                };
+                readonly endedInVersionId: {
+                    readonly type: "string";
+                };
+                readonly startedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly overlapUntil: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Custody projection only. End of the overlap window.";
+                };
+                readonly autoRetire: {
+                    readonly type: "boolean";
+                    readonly description: "Custody projection only. Whether the VTA retires the predecessor itself at `overlapUntil`.";
+                };
+                readonly endedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly initiatedBy: {
+                    readonly type: "string";
+                    readonly description: "Custody projection only. VID of the administrator whose signed request started the change.";
+                };
+                readonly approvals: {
+                    readonly $ref: "#/$defs/KeyRoleApprovalState";
+                    readonly description: "Custody projection only.";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "Custody projection only. The operator's stated reason. Never published.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+                readonly activatesAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the successor becomes `active` and the predecessor `retiring`; never before `cacheHorizonAt`.";
+                };
+                readonly cacheHorizonAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Planned rotations: the publishing entry's cache horizon — publication plus the longer of the document's TTL and the verifier cache cap (CONVENTIONS.md §11.1). The switch, and any retirement of the predecessor, happen no earlier. Public: it follows from the log and the published cap.";
+                };
+            };
+        };
+        readonly RotationState: {
+            readonly title: "RotationState";
+            readonly type: "string";
+            readonly enum: readonly ["pendingApproval", "staged", "overlapping", "completed", "aborted", "expired"];
+            readonly description: "`pendingApproval` — awaiting the approvals the VTA's policy requires; nothing is published. `staged` — successor published, not yet used; predecessor still active. `overlapping` — successor active, predecessor `retiring`. `completed` — every predecessor retired (or, for `compromise` and `addition`, the entry is published and any overlap it began has ended). `aborted` — the successor was retired instead of the predecessor, which stayed or returned to `active`. `expired` — approvals were not gathered before the preview expired; nothing was published.";
+        };
+        readonly RotationKind: {
+            readonly title: "RotationKind";
+            readonly type: "string";
+            readonly enum: readonly ["planned", "compromise", "addition"];
+            readonly description: "`planned` — a successor was staged, activated, and the predecessor retired on the operator's schedule. `compromise` — a key was revoked and, where the role would otherwise be empty, replaced in the same log entry. `addition` — a key was added to a role without anything leaving it (for example a post-quantum key alongside a classical one).";
+        };
+        readonly KeyRole: {
+            readonly title: "KeyRole";
+            readonly type: "string";
+            readonly enum: readonly ["attestation", "operational", "messaging", "update"];
+            readonly description: "The named key role a key occupies in the DID (VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the DID's attestation artefacts (membership and role credentials, endorsements, status lists, every other credential the node issues), through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP message signatures, invitations, notices, audit checkpoints) with proof purpose `authentication`. `messaging` — the only keys in `keyAgreement`; sign nothing. `update` — the keys that authorize appending to the DID's log (a did:webvh `updateKeys` entry) and the pre-rotation commitments that authorize the next ones; never a verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075); both are reserved for a future role. The mapping is normative and is set out in CONVENTIONS.md §1. The set is an extensible registry and growing it is a MINOR change: a consumer that receives a role it does not implement MUST refuse the document rather than map the key onto a role it does know.";
+        };
+        readonly RoleKey: {
+            readonly title: "RoleKey";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["role", "keyType", "publicKeyMultibase", "state"];
+            readonly description: "One key in one role. A key is in exactly one role for its whole life; a change of role is a retirement from one and an addition to another, under a new verification-method identifier.";
+            readonly properties: {
+                readonly verificationMethod: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The full verification-method identifier (`did#fragment`) the document publishes the key under, and lists in `keyRoles`. Absent only for `update` keys, which are published as log parameters and never as verification methods (VTI-KEY-093). A VTA minting a new method SHOULD derive its fragment from the key (VTI-KEY-150).";
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/KeyRole";
+                };
+                readonly relationships: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidVerificationRelationship";
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "The relationships the key is (or, while `pending`, will be) listed in. Always exactly its role's single relationship (CONVENTIONS.md §1) — carried so a caller can check it against the document rather than trusting it. Empty for `update`, `retired` and `revoked` keys.";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly publicKeyMultibase: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The public half, multibase-encoded, exactly as published.";
+                };
+                readonly state: {
+                    readonly $ref: "#/$defs/RoleKeyState";
+                };
+                readonly publishedInVersionId: {
+                    readonly type: "string";
+                    readonly description: "versionId of the log entry that first published the key. Absent while `pending`.";
+                };
+                readonly removedInVersionId: {
+                    readonly type: "string";
+                    readonly description: "versionId of the log entry that retired or revoked the key.";
+                };
+                readonly retireAfter: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "For a `retiring` key: the end of its overlap window. Custody projection only.";
+                };
+                readonly compromisedSince: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "For a `revoked` key: the compromise time (VTI-KEY-121) — the earliest instant from which the key is treated as compromised. Where the operator cannot establish it, the time the key was first published. Published, because it is what a verifier needs.";
+                };
+                readonly rotationId: {
+                    readonly type: "string";
+                    readonly description: "The rotation this key was introduced or retired by, when it was.";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "Operator-facing label. Custody projection only.";
+                };
+                readonly custody: {
+                    readonly $ref: "#/$defs/RoleKeyCustody";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+                readonly activatesAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "For a `staged` key: when the VTA will begin using it — no earlier than the publishing entry's cache horizon (CONVENTIONS.md §11.1).";
+                };
+            };
+        };
+        readonly RoleKeyCustody: {
+            readonly title: "RoleKeyCustody";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["keyId", "exportable", "neverExportable", "inBackups"];
+            readonly description: "How the VTA holds a key. Present only in the custody projection. Carries no key material, and a conforming VTA MUST NOT place any in `ext`.";
+            readonly properties: {
+                readonly keyId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The custodian record identifier (`keys/*`'s `keyId`) behind this key.";
+                };
+                readonly origin: {
+                    readonly $ref: "#/$defs/KeyOrigin";
+                };
+                readonly exportable: {
+                    readonly type: "boolean";
+                    readonly description: "Whether the custodian would release the private half through `keys/export-secret`. Always `false` for `attestation` and `update` keys (CONVENTIONS.md §4). Stated explicitly — never absent — because this is the member an operator reads to confirm a role key cannot leave the VTA, and `keys/*`'s absent-means-exportable reading is the wrong default to leave them to infer.";
+                };
+                readonly neverExportable: {
+                    readonly type: "boolean";
+                    readonly description: "True when no authority can make the key exportable — the role forbids it, or the material exists only inside a module that cannot release it. `true` implies `exportable: false`.";
+                };
+                readonly hardwareBacked: {
+                    readonly type: "boolean";
+                    readonly description: "True when the private half is held by a hardware or enclave module that performs the operation without releasing it. Absent means the VTA does not say, not that it is false.";
+                };
+                readonly inBackups: {
+                    readonly type: "boolean";
+                    readonly description: "Whether the key, or material it can be re-derived from, is included in the VTA's backups or any state transfer. Always `false` for `attestation` and `update` keys (VTI-KEY-112): they are generated, not derived, so there is no seed that recovers them, and their loss is recovered by rotation, never by restore.";
+                };
+                readonly destroyed: {
+                    readonly type: "boolean";
+                    readonly description: "True once the private half has been destroyed — a retired `attestation` key (VTI-KEY-125). The record survives so the key's past signatures stay attributable.";
+                };
+            };
+        };
+        readonly KeyOrigin: {
+            readonly title: "KeyOrigin";
+            readonly type: "string";
+            readonly enum: readonly ["derived", "imported", "internal"];
+            readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.";
+            readonly default: "derived";
+        };
+        readonly RoleKeyState: {
+            readonly title: "RoleKeyState";
+            readonly type: "string";
+            readonly enum: readonly ["pending", "staged", "active", "retiring", "retired", "revoked"];
+            readonly description: "Where a key is in its role's lifecycle. `pending` — planned by a preview or a change awaiting approval; not published; custody projection only. `staged` — published and bound to its role, but not yet used: a planned rotation publishes the successor and waits until the entry's cache horizon — publication plus the longer of the document's TTL and the verifier cache cap (CONVENTIONS.md §11.1) — before the VTA first uses it, so that no verifier holding a cached document sees a signature by a key it has never seen (VTI-KEY-122). Becomes `active` at the rotation's `activatesAt`. `active` — the key the VTA uses for new signatures (or, for `messaging`, advertises for new sessions). `retiring` — still published so that what it signed and sessions keyed to it keep working, but never used again: from the successor's first use the VTA MUST NOT sign with it, while a retiring `messaging` key stays usable for decryption, and senders may still encrypt to it, until it is retired (CONVENTIONS.md §11.3). `retired` — removed by planned rotation; what it signed while published remains valid, judged against the DID version current at issuance (CONVENTIONS.md §7). A retired `attestation` or `messaging` key is destroyed at retirement. `revoked` — removed from every relationship and from `keyRoles` in one entry, without overlap, because it is or may be compromised; what it signed from `compromisedSince` onward establishes nothing. `retired` and `revoked` are terminal.";
+        };
+        readonly DidVerificationRelationship: {
+            readonly title: "DidVerificationRelationship";
+            readonly type: "string";
+            readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+            readonly description: "A DID Core verification relationship.";
+        };
+        readonly KeyType: {
+            readonly title: "KeyType";
+            readonly type: "string";
+            readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+            readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+        };
+        readonly DidDocumentPreview: {
+            readonly title: "DidDocumentPreview";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["previewId", "baseVersionId", "expiresAt", "changes", "document", "updateKeyRotates"];
+            readonly description: "What a change would publish, computed by the VTA by running the handler it would run to apply it, and nothing else (CONVENTIONS.md §3.1). This is what a consent surface renders and what an approval is bound to.";
+            readonly properties: {
+                readonly previewId: {
+                    readonly type: "string";
+                    readonly minLength: 16;
+                    readonly description: "Opaque, unguessable identifier for this exact plan. Carried back by the apply request, and the thing every approval is bound to.";
+                };
+                readonly baseVersionId: {
+                    readonly type: "string";
+                    readonly description: "versionId of the log entry the plan was computed against. The plan is void once the log moves past it.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly changes: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidDocumentChange";
+                    };
+                    readonly description: "Every change the entry would make, including the ones the caller did not ask for — in particular `rotateUpdateKey`, which accompanies every entry appended under pre-rotation.";
+                };
+                readonly document: {
+                    readonly type: "object";
+                    readonly description: "The complete DID document the entry would publish. Public data by construction; no key material beyond public halves.";
+                };
+                readonly warnings: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                        readonly enum: readonly ["preRotationDisabled", "singleKeyRole", "algorithmNotInAcceptedSet", "roleWillHaveNoClassicalKey", "attestationReissuanceRequired", "serverless"];
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "Conditions a human should be shown before approving. `preRotationDisabled` — the entry leaves no committed successor, so a later update-key compromise can only end in deactivation. `singleKeyRole` — the role will hold one active key, so its next compromise empties it until replaced. `algorithmNotInAcceptedSet` — a verifier population the VTA knows of does not accept the new key's algorithm. `roleWillHaveNoClassicalKey` — every remaining key is post-quantum, which verifiers without post-quantum support cannot check. `attestationReissuanceRequired` — revoking this `attestation` key obliges the node to re-issue every attestation artefact still in force and re-sign every status list (VTI-KEY-133). `serverless` — the VTA will not publish the entry; the operator must.";
+                };
+                readonly updateKeyRotates: {
+                    readonly type: "boolean";
+                    readonly description: "True when appending this entry also moves the DID's update key to a committed successor. Stated as its own member, not left to be found in `changes`, because it is the consequence a reviewer most often misses.";
+                };
+            };
+        };
+        readonly DidDocumentChange: {
+            readonly title: "DidDocumentChange";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["op", "role"];
+            readonly properties: {
+                readonly op: {
+                    readonly type: "string";
+                    readonly enum: readonly ["addKey", "retireKey", "revokeKey", "rotateUpdateKey", "setPreRotation"];
+                    readonly description: "`addKey` — a verification method is added, listed in its role's relationship and in `keyRoles`. `retireKey` — a verification method leaves its relationship, `keyRoles` and the document. `revokeKey` — a verification method leaves its relationship and `keyRoles`, and the compromise is recorded (CONVENTIONS.md §7). `rotateUpdateKey` — the log's update key moves to a committed successor. `setPreRotation` — the number of successors committed changes.";
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/KeyRole";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly publicKeyMultibase: {
+                    readonly type: "string";
+                };
+                readonly relationships: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidVerificationRelationship";
+                    };
+                    readonly uniqueItems: true;
+                };
+                readonly preRotationCount: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                };
+            };
+        };
+        readonly KeyRoleChangeOutcome: {
+            readonly title: "KeyRoleChangeOutcome";
+            readonly type: "string";
+            readonly enum: readonly ["preview", "applied", "pendingApproval"];
+            readonly description: "`preview` — nothing was written; the response carries the plan. `applied` — the entry was appended (and published, unless `serverless`). `pendingApproval` — the plan is recorded and awaits further approvals; nothing is published until they arrive (CONVENTIONS.md §3.3).";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0";
+        readonly title: "VTA WebVH DIDs Keys Add — payload";
+        readonly description: "Add a newly generated key to one role of a did:webvh, without removing any — a post-quantum key beside a classical one, or a second operational key.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["did", "role", "keyType"];
+        readonly properties: {
+            readonly did: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "The DID whose keys change.";
+            };
+            readonly role: {
+                readonly type: "string";
+                readonly enum: readonly ["attestation", "operational", "messaging"];
+                readonly description: "The role the key joins. `update` keys are not added; they move by rotation.";
+            };
+            readonly keyType: {
+                readonly $ref: "#/$defs/KeyType";
+                readonly description: "Algorithm of the key to generate. Must suit the role (CONVENTIONS.md §1 item 6).";
+            };
+            readonly label: {
+                readonly type: "string";
+                readonly maxLength: 256;
+                readonly description: "Operator-facing label for the key. Never published.";
+            };
+            readonly expectedVersionId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Optimistic-concurrency precondition: the versionId the caller based this change on (for example `keys/list`'s `versionId`). The VTA MUST refuse the change with `vta/webvh/dids:versionConflict` if the DID's latest entry no longer matches.";
+            };
+            readonly dryRun: {
+                readonly type: "boolean";
+                readonly description: "Compute and return the preview without writing anything but the plan (CONVENTIONS.md §3.1). Absent reads as false.";
+            };
+            readonly previewId: {
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly description: "Apply exactly the plan a previous dry run of this same request returned. The VTA MUST apply that plan or nothing, and MUST refuse with `vta/webvh/dids:previewStale` if it has expired, the log has moved past its base, or this request differs from the one previewed. An approval (step-up or quorum) is bound to this identifier.";
+            };
+            readonly reason: {
+                readonly type: "string";
+                readonly maxLength: 1024;
+                readonly description: "Why the change is being made, for the audit trail and for other approvers. Never published.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTA WebVH DIDs Keys Add — response payload";
+                readonly description: "Success response. Type https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0#response. A refusal is a `trust-task-error` document, never this.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["did", "outcome", "keys"];
+                readonly properties: {
+                    readonly did: {
+                        readonly type: "string";
+                    };
+                    readonly outcome: {
+                        readonly $ref: "#/$defs/KeyRoleChangeOutcome";
+                    };
+                    readonly preview: {
+                        readonly $ref: "#/$defs/DidDocumentPreview";
+                        readonly description: "Present when `outcome` is `preview` or `pendingApproval`: the plan, and what an approval is bound to.";
+                    };
+                    readonly newVersionId: {
+                        readonly type: "string";
+                        readonly description: "Present when `outcome` is `applied`: the versionId of the appended entry. Pass it as the next change's `expectedVersionId`.";
+                    };
+                    readonly keys: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/RoleKey";
+                        };
+                        readonly description: "Every key whose state this change sets or would set, after the change.";
+                    };
+                    readonly rotation: {
+                        readonly $ref: "#/$defs/RotationRecord";
+                    };
+                    readonly approvals: {
+                        readonly $ref: "#/$defs/KeyRoleApprovalState";
+                        readonly description: "Present when `outcome` is `pendingApproval`.";
+                    };
+                    readonly serverless: {
+                        readonly type: "boolean";
+                        readonly description: "True when no hosting server holds this DID. The caller must publish `newLogEntry` itself; until it does, resolvers still see the previous version.";
+                    };
+                    readonly newLogEntry: {
+                        readonly type: "string";
+                        readonly description: "The appended entry as JSON text. Present when `serverless` is true.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly KeyRoleApprovalState: {
+                readonly title: "KeyRoleApprovalState";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["required", "received", "expiresAt"];
+                readonly description: "Approval progress of a change the VTA's policy gates on more than one approval (CONVENTIONS.md §3.3).";
+                readonly properties: {
+                    readonly required: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Distinct approvals the VTA's policy requires.";
+                    };
+                    readonly received: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Distinct approvals recorded so far, including the initiator's own.";
+                    };
+                    readonly approvers: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "VIDs whose approvals were recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                    };
+                };
+            };
+            readonly RotationRecord: {
+                readonly title: "RotationRecord";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["rotationId", "role", "kind", "state"];
+                readonly description: "One change to a role's key set, from preview to completion. The rotation history of a DID is the list of these; the log is the authority for what was published, and this record adds what the log cannot say — which change was which, and (custody projection only) who asked, who approved, and why.";
+                readonly properties: {
+                    readonly rotationId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/KeyRole";
+                    };
+                    readonly kind: {
+                        readonly $ref: "#/$defs/RotationKind";
+                    };
+                    readonly state: {
+                        readonly $ref: "#/$defs/RotationState";
+                    };
+                    readonly predecessors: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Verification-method identifiers (or, for `update`, public keys) leaving the role.";
+                    };
+                    readonly successors: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Verification-method identifiers (or, for `update`, public keys) entering the role.";
+                    };
+                    readonly startedInVersionId: {
+                        readonly type: "string";
+                    };
+                    readonly endedInVersionId: {
+                        readonly type: "string";
+                    };
+                    readonly startedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly overlapUntil: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Custody projection only. End of the overlap window.";
+                    };
+                    readonly autoRetire: {
+                        readonly type: "boolean";
+                        readonly description: "Custody projection only. Whether the VTA retires the predecessor itself at `overlapUntil`.";
+                    };
+                    readonly endedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly initiatedBy: {
+                        readonly type: "string";
+                        readonly description: "Custody projection only. VID of the administrator whose signed request started the change.";
+                    };
+                    readonly approvals: {
+                        readonly $ref: "#/$defs/KeyRoleApprovalState";
+                        readonly description: "Custody projection only.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "Custody projection only. The operator's stated reason. Never published.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                    readonly activatesAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the successor becomes `active` and the predecessor `retiring`; never before `cacheHorizonAt`.";
+                    };
+                    readonly cacheHorizonAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Planned rotations: the publishing entry's cache horizon — publication plus the longer of the document's TTL and the verifier cache cap (CONVENTIONS.md §11.1). The switch, and any retirement of the predecessor, happen no earlier. Public: it follows from the log and the published cap.";
+                    };
+                };
+            };
+            readonly RotationState: {
+                readonly title: "RotationState";
+                readonly type: "string";
+                readonly enum: readonly ["pendingApproval", "staged", "overlapping", "completed", "aborted", "expired"];
+                readonly description: "`pendingApproval` — awaiting the approvals the VTA's policy requires; nothing is published. `staged` — successor published, not yet used; predecessor still active. `overlapping` — successor active, predecessor `retiring`. `completed` — every predecessor retired (or, for `compromise` and `addition`, the entry is published and any overlap it began has ended). `aborted` — the successor was retired instead of the predecessor, which stayed or returned to `active`. `expired` — approvals were not gathered before the preview expired; nothing was published.";
+            };
+            readonly RotationKind: {
+                readonly title: "RotationKind";
+                readonly type: "string";
+                readonly enum: readonly ["planned", "compromise", "addition"];
+                readonly description: "`planned` — a successor was staged, activated, and the predecessor retired on the operator's schedule. `compromise` — a key was revoked and, where the role would otherwise be empty, replaced in the same log entry. `addition` — a key was added to a role without anything leaving it (for example a post-quantum key alongside a classical one).";
+            };
+            readonly KeyRole: {
+                readonly title: "KeyRole";
+                readonly type: "string";
+                readonly enum: readonly ["attestation", "operational", "messaging", "update"];
+                readonly description: "The named key role a key occupies in the DID (VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the DID's attestation artefacts (membership and role credentials, endorsements, status lists, every other credential the node issues), through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP message signatures, invitations, notices, audit checkpoints) with proof purpose `authentication`. `messaging` — the only keys in `keyAgreement`; sign nothing. `update` — the keys that authorize appending to the DID's log (a did:webvh `updateKeys` entry) and the pre-rotation commitments that authorize the next ones; never a verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075); both are reserved for a future role. The mapping is normative and is set out in CONVENTIONS.md §1. The set is an extensible registry and growing it is a MINOR change: a consumer that receives a role it does not implement MUST refuse the document rather than map the key onto a role it does know.";
+            };
+            readonly RoleKey: {
+                readonly title: "RoleKey";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["role", "keyType", "publicKeyMultibase", "state"];
+                readonly description: "One key in one role. A key is in exactly one role for its whole life; a change of role is a retirement from one and an addition to another, under a new verification-method identifier.";
+                readonly properties: {
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The full verification-method identifier (`did#fragment`) the document publishes the key under, and lists in `keyRoles`. Absent only for `update` keys, which are published as log parameters and never as verification methods (VTI-KEY-093). A VTA minting a new method SHOULD derive its fragment from the key (VTI-KEY-150).";
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/KeyRole";
+                    };
+                    readonly relationships: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidVerificationRelationship";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "The relationships the key is (or, while `pending`, will be) listed in. Always exactly its role's single relationship (CONVENTIONS.md §1) — carried so a caller can check it against the document rather than trusting it. Empty for `update`, `retired` and `revoked` keys.";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly publicKeyMultibase: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The public half, multibase-encoded, exactly as published.";
+                    };
+                    readonly state: {
+                        readonly $ref: "#/$defs/RoleKeyState";
+                    };
+                    readonly publishedInVersionId: {
+                        readonly type: "string";
+                        readonly description: "versionId of the log entry that first published the key. Absent while `pending`.";
+                    };
+                    readonly removedInVersionId: {
+                        readonly type: "string";
+                        readonly description: "versionId of the log entry that retired or revoked the key.";
+                    };
+                    readonly retireAfter: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "For a `retiring` key: the end of its overlap window. Custody projection only.";
+                    };
+                    readonly compromisedSince: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "For a `revoked` key: the compromise time (VTI-KEY-121) — the earliest instant from which the key is treated as compromised. Where the operator cannot establish it, the time the key was first published. Published, because it is what a verifier needs.";
+                    };
+                    readonly rotationId: {
+                        readonly type: "string";
+                        readonly description: "The rotation this key was introduced or retired by, when it was.";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "Operator-facing label. Custody projection only.";
+                    };
+                    readonly custody: {
+                        readonly $ref: "#/$defs/RoleKeyCustody";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                    readonly activatesAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "For a `staged` key: when the VTA will begin using it — no earlier than the publishing entry's cache horizon (CONVENTIONS.md §11.1).";
+                    };
+                };
+            };
+            readonly RoleKeyCustody: {
+                readonly title: "RoleKeyCustody";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["keyId", "exportable", "neverExportable", "inBackups"];
+                readonly description: "How the VTA holds a key. Present only in the custody projection. Carries no key material, and a conforming VTA MUST NOT place any in `ext`.";
+                readonly properties: {
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The custodian record identifier (`keys/*`'s `keyId`) behind this key.";
+                    };
+                    readonly origin: {
+                        readonly $ref: "#/$defs/KeyOrigin";
+                    };
+                    readonly exportable: {
+                        readonly type: "boolean";
+                        readonly description: "Whether the custodian would release the private half through `keys/export-secret`. Always `false` for `attestation` and `update` keys (CONVENTIONS.md §4). Stated explicitly — never absent — because this is the member an operator reads to confirm a role key cannot leave the VTA, and `keys/*`'s absent-means-exportable reading is the wrong default to leave them to infer.";
+                    };
+                    readonly neverExportable: {
+                        readonly type: "boolean";
+                        readonly description: "True when no authority can make the key exportable — the role forbids it, or the material exists only inside a module that cannot release it. `true` implies `exportable: false`.";
+                    };
+                    readonly hardwareBacked: {
+                        readonly type: "boolean";
+                        readonly description: "True when the private half is held by a hardware or enclave module that performs the operation without releasing it. Absent means the VTA does not say, not that it is false.";
+                    };
+                    readonly inBackups: {
+                        readonly type: "boolean";
+                        readonly description: "Whether the key, or material it can be re-derived from, is included in the VTA's backups or any state transfer. Always `false` for `attestation` and `update` keys (VTI-KEY-112): they are generated, not derived, so there is no seed that recovers them, and their loss is recovered by rotation, never by restore.";
+                    };
+                    readonly destroyed: {
+                        readonly type: "boolean";
+                        readonly description: "True once the private half has been destroyed — a retired `attestation` key (VTI-KEY-125). The record survives so the key's past signatures stay attributable.";
+                    };
+                };
+            };
+            readonly KeyOrigin: {
+                readonly title: "KeyOrigin";
+                readonly type: "string";
+                readonly enum: readonly ["derived", "imported", "internal"];
+                readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.";
+                readonly default: "derived";
+            };
+            readonly RoleKeyState: {
+                readonly title: "RoleKeyState";
+                readonly type: "string";
+                readonly enum: readonly ["pending", "staged", "active", "retiring", "retired", "revoked"];
+                readonly description: "Where a key is in its role's lifecycle. `pending` — planned by a preview or a change awaiting approval; not published; custody projection only. `staged` — published and bound to its role, but not yet used: a planned rotation publishes the successor and waits until the entry's cache horizon — publication plus the longer of the document's TTL and the verifier cache cap (CONVENTIONS.md §11.1) — before the VTA first uses it, so that no verifier holding a cached document sees a signature by a key it has never seen (VTI-KEY-122). Becomes `active` at the rotation's `activatesAt`. `active` — the key the VTA uses for new signatures (or, for `messaging`, advertises for new sessions). `retiring` — still published so that what it signed and sessions keyed to it keep working, but never used again: from the successor's first use the VTA MUST NOT sign with it, while a retiring `messaging` key stays usable for decryption, and senders may still encrypt to it, until it is retired (CONVENTIONS.md §11.3). `retired` — removed by planned rotation; what it signed while published remains valid, judged against the DID version current at issuance (CONVENTIONS.md §7). A retired `attestation` or `messaging` key is destroyed at retirement. `revoked` — removed from every relationship and from `keyRoles` in one entry, without overlap, because it is or may be compromised; what it signed from `compromisedSince` onward establishes nothing. `retired` and `revoked` are terminal.";
+            };
+            readonly DidVerificationRelationship: {
+                readonly title: "DidVerificationRelationship";
+                readonly type: "string";
+                readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+                readonly description: "A DID Core verification relationship.";
+            };
+            readonly KeyType: {
+                readonly title: "KeyType";
+                readonly type: "string";
+                readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+                readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+            };
+            readonly DidDocumentPreview: {
+                readonly title: "DidDocumentPreview";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["previewId", "baseVersionId", "expiresAt", "changes", "document", "updateKeyRotates"];
+                readonly description: "What a change would publish, computed by the VTA by running the handler it would run to apply it, and nothing else (CONVENTIONS.md §3.1). This is what a consent surface renders and what an approval is bound to.";
+                readonly properties: {
+                    readonly previewId: {
+                        readonly type: "string";
+                        readonly minLength: 16;
+                        readonly description: "Opaque, unguessable identifier for this exact plan. Carried back by the apply request, and the thing every approval is bound to.";
+                    };
+                    readonly baseVersionId: {
+                        readonly type: "string";
+                        readonly description: "versionId of the log entry the plan was computed against. The plan is void once the log moves past it.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly changes: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidDocumentChange";
+                        };
+                        readonly description: "Every change the entry would make, including the ones the caller did not ask for — in particular `rotateUpdateKey`, which accompanies every entry appended under pre-rotation.";
+                    };
+                    readonly document: {
+                        readonly type: "object";
+                        readonly description: "The complete DID document the entry would publish. Public data by construction; no key material beyond public halves.";
+                    };
+                    readonly warnings: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly enum: readonly ["preRotationDisabled", "singleKeyRole", "algorithmNotInAcceptedSet", "roleWillHaveNoClassicalKey", "attestationReissuanceRequired", "serverless"];
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "Conditions a human should be shown before approving. `preRotationDisabled` — the entry leaves no committed successor, so a later update-key compromise can only end in deactivation. `singleKeyRole` — the role will hold one active key, so its next compromise empties it until replaced. `algorithmNotInAcceptedSet` — a verifier population the VTA knows of does not accept the new key's algorithm. `roleWillHaveNoClassicalKey` — every remaining key is post-quantum, which verifiers without post-quantum support cannot check. `attestationReissuanceRequired` — revoking this `attestation` key obliges the node to re-issue every attestation artefact still in force and re-sign every status list (VTI-KEY-133). `serverless` — the VTA will not publish the entry; the operator must.";
+                    };
+                    readonly updateKeyRotates: {
+                        readonly type: "boolean";
+                        readonly description: "True when appending this entry also moves the DID's update key to a committed successor. Stated as its own member, not left to be found in `changes`, because it is the consequence a reviewer most often misses.";
+                    };
+                };
+            };
+            readonly DidDocumentChange: {
+                readonly title: "DidDocumentChange";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["op", "role"];
+                readonly properties: {
+                    readonly op: {
+                        readonly type: "string";
+                        readonly enum: readonly ["addKey", "retireKey", "revokeKey", "rotateUpdateKey", "setPreRotation"];
+                        readonly description: "`addKey` — a verification method is added, listed in its role's relationship and in `keyRoles`. `retireKey` — a verification method leaves its relationship, `keyRoles` and the document. `revokeKey` — a verification method leaves its relationship and `keyRoles`, and the compromise is recorded (CONVENTIONS.md §7). `rotateUpdateKey` — the log's update key moves to a committed successor. `setPreRotation` — the number of successors committed changes.";
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/KeyRole";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly publicKeyMultibase: {
+                        readonly type: "string";
+                    };
+                    readonly relationships: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidVerificationRelationship";
+                        };
+                        readonly uniqueItems: true;
+                    };
+                    readonly preRotationCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                    };
+                };
+            };
+            readonly KeyRoleChangeOutcome: {
+                readonly title: "KeyRoleChangeOutcome";
+                readonly type: "string";
+                readonly enum: readonly ["preview", "applied", "pendingApproval"];
+                readonly description: "`preview` — nothing was written; the response carries the plan. `applied` — the entry was appended (and published, unless `serverless`). `pendingApproval` — the plan is recorded and awaits further approvals; nothing is published until they arrive (CONVENTIONS.md §3.3).";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTA WebVH DIDs Keys Add — response payload";
+                readonly description: "Success response. Type https://trusttasks.org/spec/vta/webvh/dids/keys/add/1.0#response. A refusal is a `trust-task-error` document, never this.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["did", "outcome", "keys"];
+                readonly properties: {
+                    readonly did: {
+                        readonly type: "string";
+                    };
+                    readonly outcome: {
+                        readonly $ref: "#/$defs/KeyRoleChangeOutcome";
+                    };
+                    readonly preview: {
+                        readonly $ref: "#/$defs/DidDocumentPreview";
+                        readonly description: "Present when `outcome` is `preview` or `pendingApproval`: the plan, and what an approval is bound to.";
+                    };
+                    readonly newVersionId: {
+                        readonly type: "string";
+                        readonly description: "Present when `outcome` is `applied`: the versionId of the appended entry. Pass it as the next change's `expectedVersionId`.";
+                    };
+                    readonly keys: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/RoleKey";
+                        };
+                        readonly description: "Every key whose state this change sets or would set, after the change.";
+                    };
+                    readonly rotation: {
+                        readonly $ref: "#/$defs/RotationRecord";
+                    };
+                    readonly approvals: {
+                        readonly $ref: "#/$defs/KeyRoleApprovalState";
+                        readonly description: "Present when `outcome` is `pendingApproval`.";
+                    };
+                    readonly serverless: {
+                        readonly type: "boolean";
+                        readonly description: "True when no hosting server holds this DID. The caller must publish `newLogEntry` itself; until it does, resolvers still see the previous version.";
+                    };
+                    readonly newLogEntry: {
+                        readonly type: "string";
+                        readonly description: "The appended entry as JSON text. Present when `serverless` is true.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly KeyRoleApprovalState: {
+                readonly title: "KeyRoleApprovalState";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["required", "received", "expiresAt"];
+                readonly description: "Approval progress of a change the VTA's policy gates on more than one approval (CONVENTIONS.md §3.3).";
+                readonly properties: {
+                    readonly required: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Distinct approvals the VTA's policy requires.";
+                    };
+                    readonly received: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Distinct approvals recorded so far, including the initiator's own.";
+                    };
+                    readonly approvers: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "VIDs whose approvals were recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                    };
+                };
+            };
+            readonly RotationRecord: {
+                readonly title: "RotationRecord";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["rotationId", "role", "kind", "state"];
+                readonly description: "One change to a role's key set, from preview to completion. The rotation history of a DID is the list of these; the log is the authority for what was published, and this record adds what the log cannot say — which change was which, and (custody projection only) who asked, who approved, and why.";
+                readonly properties: {
+                    readonly rotationId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/KeyRole";
+                    };
+                    readonly kind: {
+                        readonly $ref: "#/$defs/RotationKind";
+                    };
+                    readonly state: {
+                        readonly $ref: "#/$defs/RotationState";
+                    };
+                    readonly predecessors: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Verification-method identifiers (or, for `update`, public keys) leaving the role.";
+                    };
+                    readonly successors: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Verification-method identifiers (or, for `update`, public keys) entering the role.";
+                    };
+                    readonly startedInVersionId: {
+                        readonly type: "string";
+                    };
+                    readonly endedInVersionId: {
+                        readonly type: "string";
+                    };
+                    readonly startedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly overlapUntil: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Custody projection only. End of the overlap window.";
+                    };
+                    readonly autoRetire: {
+                        readonly type: "boolean";
+                        readonly description: "Custody projection only. Whether the VTA retires the predecessor itself at `overlapUntil`.";
+                    };
+                    readonly endedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly initiatedBy: {
+                        readonly type: "string";
+                        readonly description: "Custody projection only. VID of the administrator whose signed request started the change.";
+                    };
+                    readonly approvals: {
+                        readonly $ref: "#/$defs/KeyRoleApprovalState";
+                        readonly description: "Custody projection only.";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "Custody projection only. The operator's stated reason. Never published.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                    readonly activatesAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the successor becomes `active` and the predecessor `retiring`; never before `cacheHorizonAt`.";
+                    };
+                    readonly cacheHorizonAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Planned rotations: the publishing entry's cache horizon — publication plus the longer of the document's TTL and the verifier cache cap (CONVENTIONS.md §11.1). The switch, and any retirement of the predecessor, happen no earlier. Public: it follows from the log and the published cap.";
+                    };
+                };
+            };
+            readonly RotationState: {
+                readonly title: "RotationState";
+                readonly type: "string";
+                readonly enum: readonly ["pendingApproval", "staged", "overlapping", "completed", "aborted", "expired"];
+                readonly description: "`pendingApproval` — awaiting the approvals the VTA's policy requires; nothing is published. `staged` — successor published, not yet used; predecessor still active. `overlapping` — successor active, predecessor `retiring`. `completed` — every predecessor retired (or, for `compromise` and `addition`, the entry is published and any overlap it began has ended). `aborted` — the successor was retired instead of the predecessor, which stayed or returned to `active`. `expired` — approvals were not gathered before the preview expired; nothing was published.";
+            };
+            readonly RotationKind: {
+                readonly title: "RotationKind";
+                readonly type: "string";
+                readonly enum: readonly ["planned", "compromise", "addition"];
+                readonly description: "`planned` — a successor was staged, activated, and the predecessor retired on the operator's schedule. `compromise` — a key was revoked and, where the role would otherwise be empty, replaced in the same log entry. `addition` — a key was added to a role without anything leaving it (for example a post-quantum key alongside a classical one).";
+            };
+            readonly KeyRole: {
+                readonly title: "KeyRole";
+                readonly type: "string";
+                readonly enum: readonly ["attestation", "operational", "messaging", "update"];
+                readonly description: "The named key role a key occupies in the DID (VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the DID's attestation artefacts (membership and role credentials, endorsements, status lists, every other credential the node issues), through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP message signatures, invitations, notices, audit checkpoints) with proof purpose `authentication`. `messaging` — the only keys in `keyAgreement`; sign nothing. `update` — the keys that authorize appending to the DID's log (a did:webvh `updateKeys` entry) and the pre-rotation commitments that authorize the next ones; never a verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075); both are reserved for a future role. The mapping is normative and is set out in CONVENTIONS.md §1. The set is an extensible registry and growing it is a MINOR change: a consumer that receives a role it does not implement MUST refuse the document rather than map the key onto a role it does know.";
+            };
+            readonly RoleKey: {
+                readonly title: "RoleKey";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["role", "keyType", "publicKeyMultibase", "state"];
+                readonly description: "One key in one role. A key is in exactly one role for its whole life; a change of role is a retirement from one and an addition to another, under a new verification-method identifier.";
+                readonly properties: {
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The full verification-method identifier (`did#fragment`) the document publishes the key under, and lists in `keyRoles`. Absent only for `update` keys, which are published as log parameters and never as verification methods (VTI-KEY-093). A VTA minting a new method SHOULD derive its fragment from the key (VTI-KEY-150).";
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/KeyRole";
+                    };
+                    readonly relationships: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidVerificationRelationship";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "The relationships the key is (or, while `pending`, will be) listed in. Always exactly its role's single relationship (CONVENTIONS.md §1) — carried so a caller can check it against the document rather than trusting it. Empty for `update`, `retired` and `revoked` keys.";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly publicKeyMultibase: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The public half, multibase-encoded, exactly as published.";
+                    };
+                    readonly state: {
+                        readonly $ref: "#/$defs/RoleKeyState";
+                    };
+                    readonly publishedInVersionId: {
+                        readonly type: "string";
+                        readonly description: "versionId of the log entry that first published the key. Absent while `pending`.";
+                    };
+                    readonly removedInVersionId: {
+                        readonly type: "string";
+                        readonly description: "versionId of the log entry that retired or revoked the key.";
+                    };
+                    readonly retireAfter: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "For a `retiring` key: the end of its overlap window. Custody projection only.";
+                    };
+                    readonly compromisedSince: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "For a `revoked` key: the compromise time (VTI-KEY-121) — the earliest instant from which the key is treated as compromised. Where the operator cannot establish it, the time the key was first published. Published, because it is what a verifier needs.";
+                    };
+                    readonly rotationId: {
+                        readonly type: "string";
+                        readonly description: "The rotation this key was introduced or retired by, when it was.";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "Operator-facing label. Custody projection only.";
+                    };
+                    readonly custody: {
+                        readonly $ref: "#/$defs/RoleKeyCustody";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                    readonly activatesAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "For a `staged` key: when the VTA will begin using it — no earlier than the publishing entry's cache horizon (CONVENTIONS.md §11.1).";
+                    };
+                };
+            };
+            readonly RoleKeyCustody: {
+                readonly title: "RoleKeyCustody";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["keyId", "exportable", "neverExportable", "inBackups"];
+                readonly description: "How the VTA holds a key. Present only in the custody projection. Carries no key material, and a conforming VTA MUST NOT place any in `ext`.";
+                readonly properties: {
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The custodian record identifier (`keys/*`'s `keyId`) behind this key.";
+                    };
+                    readonly origin: {
+                        readonly $ref: "#/$defs/KeyOrigin";
+                    };
+                    readonly exportable: {
+                        readonly type: "boolean";
+                        readonly description: "Whether the custodian would release the private half through `keys/export-secret`. Always `false` for `attestation` and `update` keys (CONVENTIONS.md §4). Stated explicitly — never absent — because this is the member an operator reads to confirm a role key cannot leave the VTA, and `keys/*`'s absent-means-exportable reading is the wrong default to leave them to infer.";
+                    };
+                    readonly neverExportable: {
+                        readonly type: "boolean";
+                        readonly description: "True when no authority can make the key exportable — the role forbids it, or the material exists only inside a module that cannot release it. `true` implies `exportable: false`.";
+                    };
+                    readonly hardwareBacked: {
+                        readonly type: "boolean";
+                        readonly description: "True when the private half is held by a hardware or enclave module that performs the operation without releasing it. Absent means the VTA does not say, not that it is false.";
+                    };
+                    readonly inBackups: {
+                        readonly type: "boolean";
+                        readonly description: "Whether the key, or material it can be re-derived from, is included in the VTA's backups or any state transfer. Always `false` for `attestation` and `update` keys (VTI-KEY-112): they are generated, not derived, so there is no seed that recovers them, and their loss is recovered by rotation, never by restore.";
+                    };
+                    readonly destroyed: {
+                        readonly type: "boolean";
+                        readonly description: "True once the private half has been destroyed — a retired `attestation` key (VTI-KEY-125). The record survives so the key's past signatures stay attributable.";
+                    };
+                };
+            };
+            readonly KeyOrigin: {
+                readonly title: "KeyOrigin";
+                readonly type: "string";
+                readonly enum: readonly ["derived", "imported", "internal"];
+                readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.";
+                readonly default: "derived";
+            };
+            readonly RoleKeyState: {
+                readonly title: "RoleKeyState";
+                readonly type: "string";
+                readonly enum: readonly ["pending", "staged", "active", "retiring", "retired", "revoked"];
+                readonly description: "Where a key is in its role's lifecycle. `pending` — planned by a preview or a change awaiting approval; not published; custody projection only. `staged` — published and bound to its role, but not yet used: a planned rotation publishes the successor and waits until the entry's cache horizon — publication plus the longer of the document's TTL and the verifier cache cap (CONVENTIONS.md §11.1) — before the VTA first uses it, so that no verifier holding a cached document sees a signature by a key it has never seen (VTI-KEY-122). Becomes `active` at the rotation's `activatesAt`. `active` — the key the VTA uses for new signatures (or, for `messaging`, advertises for new sessions). `retiring` — still published so that what it signed and sessions keyed to it keep working, but never used again: from the successor's first use the VTA MUST NOT sign with it, while a retiring `messaging` key stays usable for decryption, and senders may still encrypt to it, until it is retired (CONVENTIONS.md §11.3). `retired` — removed by planned rotation; what it signed while published remains valid, judged against the DID version current at issuance (CONVENTIONS.md §7). A retired `attestation` or `messaging` key is destroyed at retirement. `revoked` — removed from every relationship and from `keyRoles` in one entry, without overlap, because it is or may be compromised; what it signed from `compromisedSince` onward establishes nothing. `retired` and `revoked` are terminal.";
+            };
+            readonly DidVerificationRelationship: {
+                readonly title: "DidVerificationRelationship";
+                readonly type: "string";
+                readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+                readonly description: "A DID Core verification relationship.";
+            };
+            readonly KeyType: {
+                readonly title: "KeyType";
+                readonly type: "string";
+                readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+                readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+            };
+            readonly DidDocumentPreview: {
+                readonly title: "DidDocumentPreview";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["previewId", "baseVersionId", "expiresAt", "changes", "document", "updateKeyRotates"];
+                readonly description: "What a change would publish, computed by the VTA by running the handler it would run to apply it, and nothing else (CONVENTIONS.md §3.1). This is what a consent surface renders and what an approval is bound to.";
+                readonly properties: {
+                    readonly previewId: {
+                        readonly type: "string";
+                        readonly minLength: 16;
+                        readonly description: "Opaque, unguessable identifier for this exact plan. Carried back by the apply request, and the thing every approval is bound to.";
+                    };
+                    readonly baseVersionId: {
+                        readonly type: "string";
+                        readonly description: "versionId of the log entry the plan was computed against. The plan is void once the log moves past it.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly changes: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidDocumentChange";
+                        };
+                        readonly description: "Every change the entry would make, including the ones the caller did not ask for — in particular `rotateUpdateKey`, which accompanies every entry appended under pre-rotation.";
+                    };
+                    readonly document: {
+                        readonly type: "object";
+                        readonly description: "The complete DID document the entry would publish. Public data by construction; no key material beyond public halves.";
+                    };
+                    readonly warnings: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly enum: readonly ["preRotationDisabled", "singleKeyRole", "algorithmNotInAcceptedSet", "roleWillHaveNoClassicalKey", "attestationReissuanceRequired", "serverless"];
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "Conditions a human should be shown before approving. `preRotationDisabled` — the entry leaves no committed successor, so a later update-key compromise can only end in deactivation. `singleKeyRole` — the role will hold one active key, so its next compromise empties it until replaced. `algorithmNotInAcceptedSet` — a verifier population the VTA knows of does not accept the new key's algorithm. `roleWillHaveNoClassicalKey` — every remaining key is post-quantum, which verifiers without post-quantum support cannot check. `attestationReissuanceRequired` — revoking this `attestation` key obliges the node to re-issue every attestation artefact still in force and re-sign every status list (VTI-KEY-133). `serverless` — the VTA will not publish the entry; the operator must.";
+                    };
+                    readonly updateKeyRotates: {
+                        readonly type: "boolean";
+                        readonly description: "True when appending this entry also moves the DID's update key to a committed successor. Stated as its own member, not left to be found in `changes`, because it is the consequence a reviewer most often misses.";
+                    };
+                };
+            };
+            readonly DidDocumentChange: {
+                readonly title: "DidDocumentChange";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["op", "role"];
+                readonly properties: {
+                    readonly op: {
+                        readonly type: "string";
+                        readonly enum: readonly ["addKey", "retireKey", "revokeKey", "rotateUpdateKey", "setPreRotation"];
+                        readonly description: "`addKey` — a verification method is added, listed in its role's relationship and in `keyRoles`. `retireKey` — a verification method leaves its relationship, `keyRoles` and the document. `revokeKey` — a verification method leaves its relationship and `keyRoles`, and the compromise is recorded (CONVENTIONS.md §7). `rotateUpdateKey` — the log's update key moves to a committed successor. `setPreRotation` — the number of successors committed changes.";
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/KeyRole";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly publicKeyMultibase: {
+                        readonly type: "string";
+                    };
+                    readonly relationships: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidVerificationRelationship";
+                        };
+                        readonly uniqueItems: true;
+                    };
+                    readonly preRotationCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                    };
+                };
+            };
+            readonly KeyRoleChangeOutcome: {
+                readonly title: "KeyRoleChangeOutcome";
+                readonly type: "string";
+                readonly enum: readonly ["preview", "applied", "pendingApproval"];
+                readonly description: "`preview` — nothing was written; the response carries the plan. `applied` — the entry was appended (and published, unless `serverless`). `pendingApproval` — the plan is recorded and awaits further approvals; nothing is published until they arrive (CONVENTIONS.md §3.3).";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map