@openvtc/trust-tasks 0.20.7 → 0.21.0

package/dist/vta/webvh/dids/keys/list/1.0/payload.js

@@ -0,0 +1,942 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/webvh/dids/keys/list/1.0/payload.schema.json
+ */
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/keys/list/1.0";
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vta/webvh/dids/keys/list/1.0#response";
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://trusttasks.org/spec/vta/webvh/dids/keys/list/1.0",
+    "title": "VTA WebVH DIDs Keys List — payload",
+    "description": "List a did:webvh's keys by role, with their state, and optionally the DID's rotation history and any changes awaiting approval.",
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+        "did"
+    ],
+    "properties": {
+        "did": {
+            "type": "string",
+            "minLength": 1,
+            "description": "The DID whose key roles are listed."
+        },
+        "roles": {
+            "type": "array",
+            "items": {
+                "$ref": "#/$defs/KeyRole"
+            },
+            "uniqueItems": true,
+            "minItems": 1,
+            "description": "Return only these roles. Absent returns every role. Present-but-empty is refused by the schema rather than read as 'every role' — emptiness is never a wildcard."
+        },
+        "includeEnded": {
+            "type": "boolean",
+            "description": "Include `retired` and `revoked` keys. Absent reads as false. `revoked` keys still published in `verificationMethod` are always included, because the document shows them to anyone who resolves it."
+        },
+        "includeHistory": {
+            "type": "boolean",
+            "description": "Include the DID's rotation history. Absent reads as false."
+        },
+        "ext": {
+            "$ref": "#/$defs/Ext"
+        }
+    },
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTA WebVH DIDs Keys List — response payload",
+            "description": "Success response to vta/webvh/dids/keys/list. Type https://trusttasks.org/spec/vta/webvh/dids/keys/list/1.0#response.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "did",
+                "versionId",
+                "projection",
+                "roles"
+            ],
+            "properties": {
+                "did": {
+                    "type": "string"
+                },
+                "versionId": {
+                    "type": "string",
+                    "description": "The log entry the answer describes. Pass it as `expectedVersionId` to a change made on the strength of this answer."
+                },
+                "projection": {
+                    "$ref": "#/$defs/KeyRoleProjection"
+                },
+                "roles": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/RoleSummary"
+                    },
+                    "description": "One entry per role asked for, including roles with no keys — an empty role is an answer, and omitting it would read as 'not asked'."
+                },
+                "rotations": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/RotationRecord"
+                    },
+                    "description": "Present exactly when `includeHistory` was true. Newest first. In the custody projection this includes changes in `pendingApproval`; in the public projection it includes only changes that published an entry."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "RotationRecord": {
+            "title": "RotationRecord",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "rotationId",
+                "role",
+                "kind",
+                "state"
+            ],
+            "description": "One change to a role's key set, from preview to completion. The rotation history of a DID is the list of these; the log is the authority for what was published, and this record adds what the log cannot say — which change was which, and (custody projection only) who asked, who approved, and why.",
+            "properties": {
+                "rotationId": {
+                    "type": "string",
+                    "minLength": 1
+                },
+                "role": {
+                    "$ref": "#/$defs/KeyRole"
+                },
+                "kind": {
+                    "$ref": "#/$defs/RotationKind"
+                },
+                "state": {
+                    "$ref": "#/$defs/RotationState"
+                },
+                "predecessors": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Verification-method identifiers (or, for `update`, public keys) leaving the role."
+                },
+                "successors": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Verification-method identifiers (or, for `update`, public keys) entering the role."
+                },
+                "startedInVersionId": {
+                    "type": "string"
+                },
+                "endedInVersionId": {
+                    "type": "string"
+                },
+                "startedAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "overlapUntil": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "Custody projection only. End of the overlap window."
+                },
+                "autoRetire": {
+                    "type": "boolean",
+                    "description": "Custody projection only. Whether the VTA retires the predecessor itself at `overlapUntil`."
+                },
+                "endedAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "initiatedBy": {
+                    "type": "string",
+                    "description": "Custody projection only. VID of the administrator whose signed request started the change."
+                },
+                "approvals": {
+                    "$ref": "#/$defs/KeyRoleApprovalState",
+                    "description": "Custody projection only."
+                },
+                "reason": {
+                    "type": "string",
+                    "maxLength": 1024,
+                    "description": "Custody projection only. The operator's stated reason. Never published."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                },
+                "activatesAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the successor becomes `active` and the predecessor `retiring`; never before `cacheHorizonAt`."
+                },
+                "cacheHorizonAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "Planned rotations: the publishing entry's cache horizon — publication plus the longer of the document's TTL and the verifier cache cap (CONVENTIONS.md §11.1). The switch, and any retirement of the predecessor, happen no earlier. Public: it follows from the log and the published cap."
+                }
+            }
+        },
+        "KeyRoleApprovalState": {
+            "title": "KeyRoleApprovalState",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "required",
+                "received",
+                "expiresAt"
+            ],
+            "description": "Approval progress of a change the VTA's policy gates on more than one approval (CONVENTIONS.md §3.3).",
+            "properties": {
+                "required": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "description": "Distinct approvals the VTA's policy requires."
+                },
+                "received": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "Distinct approvals recorded so far, including the initiator's own."
+                },
+                "approvers": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "uniqueItems": true,
+                    "description": "VIDs whose approvals were recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change."
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the preview, and every approval bound to it, stops being usable."
+                }
+            }
+        },
+        "RotationState": {
+            "title": "RotationState",
+            "type": "string",
+            "enum": [
+                "pendingApproval",
+                "staged",
+                "overlapping",
+                "completed",
+                "aborted",
+                "expired"
+            ],
+            "description": "`pendingApproval` — awaiting the approvals the VTA's policy requires; nothing is published. `staged` — successor published, not yet used; predecessor still active. `overlapping` — successor active, predecessor `retiring`. `completed` — every predecessor retired (or, for `compromise` and `addition`, the entry is published and any overlap it began has ended). `aborted` — the successor was retired instead of the predecessor, which stayed or returned to `active`. `expired` — approvals were not gathered before the preview expired; nothing was published."
+        },
+        "RotationKind": {
+            "title": "RotationKind",
+            "type": "string",
+            "enum": [
+                "planned",
+                "compromise",
+                "addition"
+            ],
+            "description": "`planned` — a successor was staged, activated, and the predecessor retired on the operator's schedule. `compromise` — a key was revoked and, where the role would otherwise be empty, replaced in the same log entry. `addition` — a key was added to a role without anything leaving it (for example a post-quantum key alongside a classical one)."
+        },
+        "KeyRole": {
+            "title": "KeyRole",
+            "type": "string",
+            "enum": [
+                "attestation",
+                "operational",
+                "messaging",
+                "update"
+            ],
+            "description": "The named key role a key occupies in the DID (VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the DID's attestation artefacts (membership and role credentials, endorsements, status lists, every other credential the node issues), through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP message signatures, invitations, notices, audit checkpoints) with proof purpose `authentication`. `messaging` — the only keys in `keyAgreement`; sign nothing. `update` — the keys that authorize appending to the DID's log (a did:webvh `updateKeys` entry) and the pre-rotation commitments that authorize the next ones; never a verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075); both are reserved for a future role. The mapping is normative and is set out in CONVENTIONS.md §1. The set is an extensible registry and growing it is a MINOR change: a consumer that receives a role it does not implement MUST refuse the document rather than map the key onto a role it does know."
+        },
+        "RoleSummary": {
+            "title": "RoleSummary",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "role",
+                "relationships",
+                "keys"
+            ],
+            "properties": {
+                "role": {
+                    "$ref": "#/$defs/KeyRole"
+                },
+                "relationships": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/DidVerificationRelationship"
+                    },
+                    "uniqueItems": true,
+                    "description": "The relationship this role owns (CONVENTIONS.md §1). Empty for `update`."
+                },
+                "keys": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/RoleKey"
+                    },
+                    "description": "The role's keys, in the order the document publishes them. Terminal-state keys are included only when the request asked for them."
+                },
+                "preRotationCommitments": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "`update` only: successors the latest entry commits to. `0` means a compromise of the current update key cannot be recovered from by rotation, and the DID would have to be deactivated (VTI-KEY-124)."
+                }
+            }
+        },
+        "RoleKey": {
+            "title": "RoleKey",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "role",
+                "keyType",
+                "publicKeyMultibase",
+                "state"
+            ],
+            "description": "One key in one role. A key is in exactly one role for its whole life; a change of role is a retirement from one and an addition to another, under a new verification-method identifier.",
+            "properties": {
+                "verificationMethod": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The full verification-method identifier (`did#fragment`) the document publishes the key under, and lists in `keyRoles`. Absent only for `update` keys, which are published as log parameters and never as verification methods (VTI-KEY-093). A VTA minting a new method SHOULD derive its fragment from the key (VTI-KEY-150)."
+                },
+                "role": {
+                    "$ref": "#/$defs/KeyRole"
+                },
+                "relationships": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/DidVerificationRelationship"
+                    },
+                    "uniqueItems": true,
+                    "description": "The relationships the key is (or, while `pending`, will be) listed in. Always exactly its role's single relationship (CONVENTIONS.md §1) — carried so a caller can check it against the document rather than trusting it. Empty for `update`, `retired` and `revoked` keys."
+                },
+                "keyType": {
+                    "$ref": "#/$defs/KeyType"
+                },
+                "publicKeyMultibase": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The public half, multibase-encoded, exactly as published."
+                },
+                "state": {
+                    "$ref": "#/$defs/RoleKeyState"
+                },
+                "publishedInVersionId": {
+                    "type": "string",
+                    "description": "versionId of the log entry that first published the key. Absent while `pending`."
+                },
+                "removedInVersionId": {
+                    "type": "string",
+                    "description": "versionId of the log entry that retired or revoked the key."
+                },
+                "retireAfter": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "For a `retiring` key: the end of its overlap window. Custody projection only."
+                },
+                "compromisedSince": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "For a `revoked` key: the compromise time (VTI-KEY-121) — the earliest instant from which the key is treated as compromised. Where the operator cannot establish it, the time the key was first published. Published, because it is what a verifier needs."
+                },
+                "rotationId": {
+                    "type": "string",
+                    "description": "The rotation this key was introduced or retired by, when it was."
+                },
+                "label": {
+                    "type": "string",
+                    "maxLength": 256,
+                    "description": "Operator-facing label. Custody projection only."
+                },
+                "custody": {
+                    "$ref": "#/$defs/RoleKeyCustody"
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                },
+                "activatesAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "For a `staged` key: when the VTA will begin using it — no earlier than the publishing entry's cache horizon (CONVENTIONS.md §11.1)."
+                }
+            }
+        },
+        "RoleKeyCustody": {
+            "title": "RoleKeyCustody",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "keyId",
+                "exportable",
+                "neverExportable",
+                "inBackups"
+            ],
+            "description": "How the VTA holds a key. Present only in the custody projection. Carries no key material, and a conforming VTA MUST NOT place any in `ext`.",
+            "properties": {
+                "keyId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The custodian record identifier (`keys/*`'s `keyId`) behind this key."
+                },
+                "origin": {
+                    "$ref": "#/$defs/KeyOrigin"
+                },
+                "exportable": {
+                    "type": "boolean",
+                    "description": "Whether the custodian would release the private half through `keys/export-secret`. Always `false` for `attestation` and `update` keys (CONVENTIONS.md §4). Stated explicitly — never absent — because this is the member an operator reads to confirm a role key cannot leave the VTA, and `keys/*`'s absent-means-exportable reading is the wrong default to leave them to infer."
+                },
+                "neverExportable": {
+                    "type": "boolean",
+                    "description": "True when no authority can make the key exportable — the role forbids it, or the material exists only inside a module that cannot release it. `true` implies `exportable: false`."
+                },
+                "hardwareBacked": {
+                    "type": "boolean",
+                    "description": "True when the private half is held by a hardware or enclave module that performs the operation without releasing it. Absent means the VTA does not say, not that it is false."
+                },
+                "inBackups": {
+                    "type": "boolean",
+                    "description": "Whether the key, or material it can be re-derived from, is included in the VTA's backups or any state transfer. Always `false` for `attestation` and `update` keys (VTI-KEY-112): they are generated, not derived, so there is no seed that recovers them, and their loss is recovered by rotation, never by restore."
+                },
+                "destroyed": {
+                    "type": "boolean",
+                    "description": "True once the private half has been destroyed — a retired `attestation` key (VTI-KEY-125). The record survives so the key's past signatures stay attributable."
+                }
+            }
+        },
+        "KeyOrigin": {
+            "title": "KeyOrigin",
+            "type": "string",
+            "enum": [
+                "derived",
+                "imported",
+                "internal"
+            ],
+            "description": "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.",
+            "default": "derived"
+        },
+        "RoleKeyState": {
+            "title": "RoleKeyState",
+            "type": "string",
+            "enum": [
+                "pending",
+                "staged",
+                "active",
+                "retiring",
+                "retired",
+                "revoked"
+            ],
+            "description": "Where a key is in its role's lifecycle. `pending` — planned by a preview or a change awaiting approval; not published; custody projection only. `staged` — published and bound to its role, but not yet used: a planned rotation publishes the successor and waits until the entry's cache horizon — publication plus the longer of the document's TTL and the verifier cache cap (CONVENTIONS.md §11.1) — before the VTA first uses it, so that no verifier holding a cached document sees a signature by a key it has never seen (VTI-KEY-122). Becomes `active` at the rotation's `activatesAt`. `active` — the key the VTA uses for new signatures (or, for `messaging`, advertises for new sessions). `retiring` — still published so that what it signed and sessions keyed to it keep working, but never used again: from the successor's first use the VTA MUST NOT sign with it, while a retiring `messaging` key stays usable for decryption, and senders may still encrypt to it, until it is retired (CONVENTIONS.md §11.3). `retired` — removed by planned rotation; what it signed while published remains valid, judged against the DID version current at issuance (CONVENTIONS.md §7). A retired `attestation` or `messaging` key is destroyed at retirement. `revoked` — removed from every relationship and from `keyRoles` in one entry, without overlap, because it is or may be compromised; what it signed from `compromisedSince` onward establishes nothing. `retired` and `revoked` are terminal."
+        },
+        "DidVerificationRelationship": {
+            "title": "DidVerificationRelationship",
+            "type": "string",
+            "enum": [
+                "authentication",
+                "assertionMethod",
+                "keyAgreement",
+                "capabilityInvocation",
+                "capabilityDelegation"
+            ],
+            "description": "A DID Core verification relationship."
+        },
+        "KeyType": {
+            "title": "KeyType",
+            "type": "string",
+            "enum": [
+                "ed25519",
+                "x25519",
+                "p256",
+                "mldsa44",
+                "mldsa65"
+            ],
+            "description": "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support."
+        },
+        "KeyRoleProjection": {
+            "title": "KeyRoleProjection",
+            "type": "string",
+            "enum": [
+                "public",
+                "custody"
+            ],
+            "description": "Which view of the DID's key roles the caller was given (CONVENTIONS.md §5). `public` — only what the published document and log already reveal to anyone who resolves the DID. `custody` — additionally the VTA's own custody state: pending keys, the custodian record behind each key, overlap deadlines, who initiated and approved each change, and why. The response always states which it is, so a caller never mistakes an absent member for a statement that the thing does not exist."
+        }
+    }
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$ref": "#/$defs/Response",
+    "$defs": {
+        "Response": {
+            "$anchor": "response",
+            "title": "VTA WebVH DIDs Keys List — response payload",
+            "description": "Success response to vta/webvh/dids/keys/list. Type https://trusttasks.org/spec/vta/webvh/dids/keys/list/1.0#response.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "did",
+                "versionId",
+                "projection",
+                "roles"
+            ],
+            "properties": {
+                "did": {
+                    "type": "string"
+                },
+                "versionId": {
+                    "type": "string",
+                    "description": "The log entry the answer describes. Pass it as `expectedVersionId` to a change made on the strength of this answer."
+                },
+                "projection": {
+                    "$ref": "#/$defs/KeyRoleProjection"
+                },
+                "roles": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/RoleSummary"
+                    },
+                    "description": "One entry per role asked for, including roles with no keys — an empty role is an answer, and omitting it would read as 'not asked'."
+                },
+                "rotations": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/RotationRecord"
+                    },
+                    "description": "Present exactly when `includeHistory` was true. Newest first. In the custody projection this includes changes in `pendingApproval`; in the public projection it includes only changes that published an entry."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                }
+            }
+        },
+        "Ext": {
+            "title": "Ext",
+            "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+            "type": "object",
+            "minProperties": 1,
+            "additionalProperties": true,
+            "propertyNames": {
+                "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+            }
+        },
+        "RotationRecord": {
+            "title": "RotationRecord",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "rotationId",
+                "role",
+                "kind",
+                "state"
+            ],
+            "description": "One change to a role's key set, from preview to completion. The rotation history of a DID is the list of these; the log is the authority for what was published, and this record adds what the log cannot say — which change was which, and (custody projection only) who asked, who approved, and why.",
+            "properties": {
+                "rotationId": {
+                    "type": "string",
+                    "minLength": 1
+                },
+                "role": {
+                    "$ref": "#/$defs/KeyRole"
+                },
+                "kind": {
+                    "$ref": "#/$defs/RotationKind"
+                },
+                "state": {
+                    "$ref": "#/$defs/RotationState"
+                },
+                "predecessors": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Verification-method identifiers (or, for `update`, public keys) leaving the role."
+                },
+                "successors": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "description": "Verification-method identifiers (or, for `update`, public keys) entering the role."
+                },
+                "startedInVersionId": {
+                    "type": "string"
+                },
+                "endedInVersionId": {
+                    "type": "string"
+                },
+                "startedAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "overlapUntil": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "Custody projection only. End of the overlap window."
+                },
+                "autoRetire": {
+                    "type": "boolean",
+                    "description": "Custody projection only. Whether the VTA retires the predecessor itself at `overlapUntil`."
+                },
+                "endedAt": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "initiatedBy": {
+                    "type": "string",
+                    "description": "Custody projection only. VID of the administrator whose signed request started the change."
+                },
+                "approvals": {
+                    "$ref": "#/$defs/KeyRoleApprovalState",
+                    "description": "Custody projection only."
+                },
+                "reason": {
+                    "type": "string",
+                    "maxLength": 1024,
+                    "description": "Custody projection only. The operator's stated reason. Never published."
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                },
+                "activatesAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the successor becomes `active` and the predecessor `retiring`; never before `cacheHorizonAt`."
+                },
+                "cacheHorizonAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "Planned rotations: the publishing entry's cache horizon — publication plus the longer of the document's TTL and the verifier cache cap (CONVENTIONS.md §11.1). The switch, and any retirement of the predecessor, happen no earlier. Public: it follows from the log and the published cap."
+                }
+            }
+        },
+        "KeyRoleApprovalState": {
+            "title": "KeyRoleApprovalState",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "required",
+                "received",
+                "expiresAt"
+            ],
+            "description": "Approval progress of a change the VTA's policy gates on more than one approval (CONVENTIONS.md §3.3).",
+            "properties": {
+                "required": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "description": "Distinct approvals the VTA's policy requires."
+                },
+                "received": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "Distinct approvals recorded so far, including the initiator's own."
+                },
+                "approvers": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "uniqueItems": true,
+                    "description": "VIDs whose approvals were recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change."
+                },
+                "expiresAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "When the preview, and every approval bound to it, stops being usable."
+                }
+            }
+        },
+        "RotationState": {
+            "title": "RotationState",
+            "type": "string",
+            "enum": [
+                "pendingApproval",
+                "staged",
+                "overlapping",
+                "completed",
+                "aborted",
+                "expired"
+            ],
+            "description": "`pendingApproval` — awaiting the approvals the VTA's policy requires; nothing is published. `staged` — successor published, not yet used; predecessor still active. `overlapping` — successor active, predecessor `retiring`. `completed` — every predecessor retired (or, for `compromise` and `addition`, the entry is published and any overlap it began has ended). `aborted` — the successor was retired instead of the predecessor, which stayed or returned to `active`. `expired` — approvals were not gathered before the preview expired; nothing was published."
+        },
+        "RotationKind": {
+            "title": "RotationKind",
+            "type": "string",
+            "enum": [
+                "planned",
+                "compromise",
+                "addition"
+            ],
+            "description": "`planned` — a successor was staged, activated, and the predecessor retired on the operator's schedule. `compromise` — a key was revoked and, where the role would otherwise be empty, replaced in the same log entry. `addition` — a key was added to a role without anything leaving it (for example a post-quantum key alongside a classical one)."
+        },
+        "KeyRole": {
+            "title": "KeyRole",
+            "type": "string",
+            "enum": [
+                "attestation",
+                "operational",
+                "messaging",
+                "update"
+            ],
+            "description": "The named key role a key occupies in the DID (VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the DID's attestation artefacts (membership and role credentials, endorsements, status lists, every other credential the node issues), through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP message signatures, invitations, notices, audit checkpoints) with proof purpose `authentication`. `messaging` — the only keys in `keyAgreement`; sign nothing. `update` — the keys that authorize appending to the DID's log (a did:webvh `updateKeys` entry) and the pre-rotation commitments that authorize the next ones; never a verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075); both are reserved for a future role. The mapping is normative and is set out in CONVENTIONS.md §1. The set is an extensible registry and growing it is a MINOR change: a consumer that receives a role it does not implement MUST refuse the document rather than map the key onto a role it does know."
+        },
+        "RoleSummary": {
+            "title": "RoleSummary",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "role",
+                "relationships",
+                "keys"
+            ],
+            "properties": {
+                "role": {
+                    "$ref": "#/$defs/KeyRole"
+                },
+                "relationships": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/DidVerificationRelationship"
+                    },
+                    "uniqueItems": true,
+                    "description": "The relationship this role owns (CONVENTIONS.md §1). Empty for `update`."
+                },
+                "keys": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/RoleKey"
+                    },
+                    "description": "The role's keys, in the order the document publishes them. Terminal-state keys are included only when the request asked for them."
+                },
+                "preRotationCommitments": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "`update` only: successors the latest entry commits to. `0` means a compromise of the current update key cannot be recovered from by rotation, and the DID would have to be deactivated (VTI-KEY-124)."
+                }
+            }
+        },
+        "RoleKey": {
+            "title": "RoleKey",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "role",
+                "keyType",
+                "publicKeyMultibase",
+                "state"
+            ],
+            "description": "One key in one role. A key is in exactly one role for its whole life; a change of role is a retirement from one and an addition to another, under a new verification-method identifier.",
+            "properties": {
+                "verificationMethod": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The full verification-method identifier (`did#fragment`) the document publishes the key under, and lists in `keyRoles`. Absent only for `update` keys, which are published as log parameters and never as verification methods (VTI-KEY-093). A VTA minting a new method SHOULD derive its fragment from the key (VTI-KEY-150)."
+                },
+                "role": {
+                    "$ref": "#/$defs/KeyRole"
+                },
+                "relationships": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/$defs/DidVerificationRelationship"
+                    },
+                    "uniqueItems": true,
+                    "description": "The relationships the key is (or, while `pending`, will be) listed in. Always exactly its role's single relationship (CONVENTIONS.md §1) — carried so a caller can check it against the document rather than trusting it. Empty for `update`, `retired` and `revoked` keys."
+                },
+                "keyType": {
+                    "$ref": "#/$defs/KeyType"
+                },
+                "publicKeyMultibase": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The public half, multibase-encoded, exactly as published."
+                },
+                "state": {
+                    "$ref": "#/$defs/RoleKeyState"
+                },
+                "publishedInVersionId": {
+                    "type": "string",
+                    "description": "versionId of the log entry that first published the key. Absent while `pending`."
+                },
+                "removedInVersionId": {
+                    "type": "string",
+                    "description": "versionId of the log entry that retired or revoked the key."
+                },
+                "retireAfter": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "For a `retiring` key: the end of its overlap window. Custody projection only."
+                },
+                "compromisedSince": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "For a `revoked` key: the compromise time (VTI-KEY-121) — the earliest instant from which the key is treated as compromised. Where the operator cannot establish it, the time the key was first published. Published, because it is what a verifier needs."
+                },
+                "rotationId": {
+                    "type": "string",
+                    "description": "The rotation this key was introduced or retired by, when it was."
+                },
+                "label": {
+                    "type": "string",
+                    "maxLength": 256,
+                    "description": "Operator-facing label. Custody projection only."
+                },
+                "custody": {
+                    "$ref": "#/$defs/RoleKeyCustody"
+                },
+                "ext": {
+                    "$ref": "#/$defs/Ext"
+                },
+                "activatesAt": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "For a `staged` key: when the VTA will begin using it — no earlier than the publishing entry's cache horizon (CONVENTIONS.md §11.1)."
+                }
+            }
+        },
+        "RoleKeyCustody": {
+            "title": "RoleKeyCustody",
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "keyId",
+                "exportable",
+                "neverExportable",
+                "inBackups"
+            ],
+            "description": "How the VTA holds a key. Present only in the custody projection. Carries no key material, and a conforming VTA MUST NOT place any in `ext`.",
+            "properties": {
+                "keyId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The custodian record identifier (`keys/*`'s `keyId`) behind this key."
+                },
+                "origin": {
+                    "$ref": "#/$defs/KeyOrigin"
+                },
+                "exportable": {
+                    "type": "boolean",
+                    "description": "Whether the custodian would release the private half through `keys/export-secret`. Always `false` for `attestation` and `update` keys (CONVENTIONS.md §4). Stated explicitly — never absent — because this is the member an operator reads to confirm a role key cannot leave the VTA, and `keys/*`'s absent-means-exportable reading is the wrong default to leave them to infer."
+                },
+                "neverExportable": {
+                    "type": "boolean",
+                    "description": "True when no authority can make the key exportable — the role forbids it, or the material exists only inside a module that cannot release it. `true` implies `exportable: false`."
+                },
+                "hardwareBacked": {
+                    "type": "boolean",
+                    "description": "True when the private half is held by a hardware or enclave module that performs the operation without releasing it. Absent means the VTA does not say, not that it is false."
+                },
+                "inBackups": {
+                    "type": "boolean",
+                    "description": "Whether the key, or material it can be re-derived from, is included in the VTA's backups or any state transfer. Always `false` for `attestation` and `update` keys (VTI-KEY-112): they are generated, not derived, so there is no seed that recovers them, and their loss is recovered by rotation, never by restore."
+                },
+                "destroyed": {
+                    "type": "boolean",
+                    "description": "True once the private half has been destroyed — a retired `attestation` key (VTI-KEY-125). The record survives so the key's past signatures stay attributable."
+                }
+            }
+        },
+        "KeyOrigin": {
+            "title": "KeyOrigin",
+            "type": "string",
+            "enum": [
+                "derived",
+                "imported",
+                "internal"
+            ],
+            "description": "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.",
+            "default": "derived"
+        },
+        "RoleKeyState": {
+            "title": "RoleKeyState",
+            "type": "string",
+            "enum": [
+                "pending",
+                "staged",
+                "active",
+                "retiring",
+                "retired",
+                "revoked"
+            ],
+            "description": "Where a key is in its role's lifecycle. `pending` — planned by a preview or a change awaiting approval; not published; custody projection only. `staged` — published and bound to its role, but not yet used: a planned rotation publishes the successor and waits until the entry's cache horizon — publication plus the longer of the document's TTL and the verifier cache cap (CONVENTIONS.md §11.1) — before the VTA first uses it, so that no verifier holding a cached document sees a signature by a key it has never seen (VTI-KEY-122). Becomes `active` at the rotation's `activatesAt`. `active` — the key the VTA uses for new signatures (or, for `messaging`, advertises for new sessions). `retiring` — still published so that what it signed and sessions keyed to it keep working, but never used again: from the successor's first use the VTA MUST NOT sign with it, while a retiring `messaging` key stays usable for decryption, and senders may still encrypt to it, until it is retired (CONVENTIONS.md §11.3). `retired` — removed by planned rotation; what it signed while published remains valid, judged against the DID version current at issuance (CONVENTIONS.md §7). A retired `attestation` or `messaging` key is destroyed at retirement. `revoked` — removed from every relationship and from `keyRoles` in one entry, without overlap, because it is or may be compromised; what it signed from `compromisedSince` onward establishes nothing. `retired` and `revoked` are terminal."
+        },
+        "DidVerificationRelationship": {
+            "title": "DidVerificationRelationship",
+            "type": "string",
+            "enum": [
+                "authentication",
+                "assertionMethod",
+                "keyAgreement",
+                "capabilityInvocation",
+                "capabilityDelegation"
+            ],
+            "description": "A DID Core verification relationship."
+        },
+        "KeyType": {
+            "title": "KeyType",
+            "type": "string",
+            "enum": [
+                "ed25519",
+                "x25519",
+                "p256",
+                "mldsa44",
+                "mldsa65"
+            ],
+            "description": "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support."
+        },
+        "KeyRoleProjection": {
+            "title": "KeyRoleProjection",
+            "type": "string",
+            "enum": [
+                "public",
+                "custody"
+            ],
+            "description": "Which view of the DID's key roles the caller was given (CONVENTIONS.md §5). `public` — only what the published document and log already reveal to anyone who resolves the DID. `custody` — additionally the VTA's own custody state: pending keys, the custodian record behind each key, overlap deadlines, who initiated and approved each change, and why. The response always states which it is, so a caller never mistakes an absent member for a statement that the thing does not exist."
+        }
+    }
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+    typeUri: TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    isIssuedAtRequired: false,
+    payloadSchema: PAYLOAD_SCHEMA,
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+    typeUri: RESPONSE_TYPE_URI,
+    isBearer: false,
+    isProofRequired: false,
+    isRecipientRequired: true,
+    isIssuedAtRequired: false,
+    payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+};
+//# sourceMappingURL=payload.js.map