@openvtc/trust-tasks 0.20.8 → 0.21.0

package/dist/vta/webvh/dids/update/2.0/payload.d.ts

@@ -0,0 +1,1062 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/webvh/dids/update/2.0/payload.schema.json
+ */
+import type { DidDocumentChange, DidDocumentPreview, DidVerificationRelationship, Ext, KeyRole, KeyRoleApprovalState, KeyRoleChangeOutcome, KeyType } from "../../../../../_shared/components.js";
+/**
+ * Ask a Verifiable Trust Agent to publish a new entry in a did:webvh log it holds the update key for, changing anything but the DID's keys. Keys change only through the key-role tasks (vta/_shared/0.3/CONVENTIONS.md).
+ */
+export interface WebVHDIDUpdatePayload {
+    /**
+     * The did:webvh being updated. The agent MUST verify it speaks for this subject.
+     */
+    did: string;
+    /**
+     * The new DID document. Omit to leave it unchanged. It MUST carry, unchanged, the current `verificationMethod`, `authentication`, `assertionMethod`, `keyAgreement`, `capabilityInvocation`, `capabilityDelegation` and `keyRoles` members: a change to any of them is refused with `vta/webvh/dids/update:keyMembersManaged`, because keys change only through the key-role tasks. Appending the entry still rotates the DID's update key under pre-rotation, which a consent surface MUST render from the executor's preview, never from this document.
+     */
+    document?: {};
+    /**
+     * Number of pre-rotation commitments to publish. Omit to keep the current count. `0` is refused for a durable node identity (`vta/webvh/dids:preRotationRequired`).
+     */
+    preRotationCount?: number;
+    /**
+     * New witness configuration. Omit to keep the current one.
+     */
+    witnesses?: {
+        [k: string]: unknown | undefined;
+    };
+    /**
+     * New watcher URLs. Omit to keep the current set; an empty array removes them.
+     */
+    watchers?: string[];
+    /**
+     * New TTL in seconds. Omit to keep the current value.
+     */
+    ttl?: number;
+    /**
+     * Operator-facing audit label.
+     */
+    label?: string;
+    /**
+     * Optimistic-concurrency precondition: the versionId the caller based this edit on. The agent MUST refuse the update if the DID's latest entry no longer matches. Without it a `get -> edit -> save` cycle silently overwrites a concurrent edit with a chain that is structurally valid, verifies perfectly, and is based on a stale read. Where a human approves the update the window is minutes wide, so this is a routine race rather than an exotic one. OPTIONAL because a scripted caller with no concurrent writers has nothing to protect against; not optional for anything a person looked at.
+     */
+    expectedVersionId?: string;
+    /**
+     * Compute and return the preview without writing anything but the plan (CONVENTIONS.md §3.1). Absent reads as false.
+     */
+    dryRun?: boolean;
+    /**
+     * Apply exactly the plan a previous dry run of this same request returned; what an approval is bound to (CONVENTIONS.md §3.1–§3.2).
+     */
+    previewId?: string;
+    ext?: Ext;
+}
+/**
+ * The outcome. `preview` and `pendingApproval` carry the plan; `applied` carries the published entry.
+ */
+export interface WebVHDIDUpdateResponsePayload {
+    did: string;
+    outcome: KeyRoleChangeOutcome;
+    preview?: DidDocumentPreview;
+    approvals?: KeyRoleApprovalState;
+    /**
+     * versionId of the entry just appended. A caller intending a further edit SHOULD pass this back as the next request's `expectedVersionId`.
+     */
+    newVersionId?: string;
+    newScid?: string;
+    /**
+     * The appended log entry, as JSON text.
+     */
+    newLogEntry?: string;
+    /**
+     * Update keys authorized AFTER this entry. Where `document` was supplied these are new keys — the previous ones no longer authorize anything.
+     */
+    updateKeysCount?: number;
+    /**
+     * Pre-rotation commitments published by this entry.
+     */
+    preRotationKeyCount?: number;
+    /**
+     * True when the agent holds the log itself and no hosting server was published to — the operator must fetch and redeploy `did.jsonl`.
+     */
+    serverless?: boolean;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DidDocumentChange, DidDocumentPreview, DidVerificationRelationship, Ext, KeyRole, KeyRoleApprovalState, KeyRoleChangeOutcome, KeyType };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vta/webvh/dids/update/2.0";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = WebVHDIDUpdatePayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vta/webvh/dids/update/2.0#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = WebVHDIDUpdateResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/vta/webvh/dids/update/2.0";
+    readonly title: "WebVH DID Update — payload";
+    readonly description: "Ask a Verifiable Trust Agent to publish a new entry in a did:webvh log it holds the update key for, changing anything but the DID's keys. Keys change only through the key-role tasks (vta/_shared/0.3/CONVENTIONS.md).";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["did"];
+    readonly properties: {
+        readonly did: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "The did:webvh being updated. The agent MUST verify it speaks for this subject.";
+        };
+        readonly document: {
+            readonly type: "object";
+            readonly description: "The new DID document. Omit to leave it unchanged. It MUST carry, unchanged, the current `verificationMethod`, `authentication`, `assertionMethod`, `keyAgreement`, `capabilityInvocation`, `capabilityDelegation` and `keyRoles` members: a change to any of them is refused with `vta/webvh/dids/update:keyMembersManaged`, because keys change only through the key-role tasks. Appending the entry still rotates the DID's update key under pre-rotation, which a consent surface MUST render from the executor's preview, never from this document.";
+        };
+        readonly preRotationCount: {
+            readonly type: "integer";
+            readonly minimum: 0;
+            readonly description: "Number of pre-rotation commitments to publish. Omit to keep the current count. `0` is refused for a durable node identity (`vta/webvh/dids:preRotationRequired`).";
+        };
+        readonly witnesses: {
+            readonly description: "New witness configuration. Omit to keep the current one.";
+        };
+        readonly watchers: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "string";
+            };
+            readonly description: "New watcher URLs. Omit to keep the current set; an empty array removes them.";
+        };
+        readonly ttl: {
+            readonly type: "integer";
+            readonly minimum: 0;
+            readonly description: "New TTL in seconds. Omit to keep the current value.";
+        };
+        readonly label: {
+            readonly type: "string";
+            readonly maxLength: 256;
+            readonly description: "Operator-facing audit label.";
+        };
+        readonly expectedVersionId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Optimistic-concurrency precondition: the versionId the caller based this edit on. The agent MUST refuse the update if the DID's latest entry no longer matches. Without it a `get -> edit -> save` cycle silently overwrites a concurrent edit with a chain that is structurally valid, verifies perfectly, and is based on a stale read. Where a human approves the update the window is minutes wide, so this is a routine race rather than an exotic one. OPTIONAL because a scripted caller with no concurrent writers has nothing to protect against; not optional for anything a person looked at.";
+        };
+        readonly dryRun: {
+            readonly type: "boolean";
+            readonly description: "Compute and return the preview without writing anything but the plan (CONVENTIONS.md §3.1). Absent reads as false.";
+        };
+        readonly previewId: {
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly description: "Apply exactly the plan a previous dry run of this same request returned; what an approval is bound to (CONVENTIONS.md §3.1–§3.2).";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "WebVH DID Update — response payload";
+            readonly description: "The outcome. `preview` and `pendingApproval` carry the plan; `applied` carries the published entry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["did", "outcome"];
+            readonly properties: {
+                readonly did: {
+                    readonly type: "string";
+                };
+                readonly outcome: {
+                    readonly $ref: "#/$defs/KeyRoleChangeOutcome";
+                };
+                readonly preview: {
+                    readonly $ref: "#/$defs/DidDocumentPreview";
+                };
+                readonly approvals: {
+                    readonly $ref: "#/$defs/KeyRoleApprovalState";
+                };
+                readonly newVersionId: {
+                    readonly type: "string";
+                    readonly description: "versionId of the entry just appended. A caller intending a further edit SHOULD pass this back as the next request's `expectedVersionId`.";
+                };
+                readonly newScid: {
+                    readonly type: "string";
+                };
+                readonly newLogEntry: {
+                    readonly type: "string";
+                    readonly description: "The appended log entry, as JSON text.";
+                };
+                readonly updateKeysCount: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Update keys authorized AFTER this entry. Where `document` was supplied these are new keys — the previous ones no longer authorize anything.";
+                };
+                readonly preRotationKeyCount: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Pre-rotation commitments published by this entry.";
+                };
+                readonly serverless: {
+                    readonly type: "boolean";
+                    readonly description: "True when the agent holds the log itself and no hosting server was published to — the operator must fetch and redeploy `did.jsonl`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly KeyRoleApprovalState: {
+            readonly title: "KeyRoleApprovalState";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["required", "received", "expiresAt"];
+            readonly description: "Approval progress of a change the VTA's policy gates on more than one approval (CONVENTIONS.md §3.3).";
+            readonly properties: {
+                readonly required: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Distinct approvals the VTA's policy requires.";
+                };
+                readonly received: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Distinct approvals recorded so far, including the initiator's own.";
+                };
+                readonly approvers: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "VIDs whose approvals were recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                };
+            };
+        };
+        readonly DidDocumentPreview: {
+            readonly title: "DidDocumentPreview";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["previewId", "baseVersionId", "expiresAt", "changes", "document", "updateKeyRotates"];
+            readonly description: "What a change would publish, computed by the VTA by running the handler it would run to apply it, and nothing else (CONVENTIONS.md §3.1). This is what a consent surface renders and what an approval is bound to.";
+            readonly properties: {
+                readonly previewId: {
+                    readonly type: "string";
+                    readonly minLength: 16;
+                    readonly description: "Opaque, unguessable identifier for this exact plan. Carried back by the apply request, and the thing every approval is bound to.";
+                };
+                readonly baseVersionId: {
+                    readonly type: "string";
+                    readonly description: "versionId of the log entry the plan was computed against. The plan is void once the log moves past it.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly changes: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidDocumentChange";
+                    };
+                    readonly description: "Every change the entry would make, including the ones the caller did not ask for — in particular `rotateUpdateKey`, which accompanies every entry appended under pre-rotation.";
+                };
+                readonly document: {
+                    readonly type: "object";
+                    readonly description: "The complete DID document the entry would publish. Public data by construction; no key material beyond public halves.";
+                };
+                readonly warnings: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                        readonly enum: readonly ["preRotationDisabled", "singleKeyRole", "algorithmNotInAcceptedSet", "roleWillHaveNoClassicalKey", "attestationReissuanceRequired", "serverless"];
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "Conditions a human should be shown before approving. `preRotationDisabled` — the entry leaves no committed successor, so a later update-key compromise can only end in deactivation. `singleKeyRole` — the role will hold one active key, so its next compromise empties it until replaced. `algorithmNotInAcceptedSet` — a verifier population the VTA knows of does not accept the new key's algorithm. `roleWillHaveNoClassicalKey` — every remaining key is post-quantum, which verifiers without post-quantum support cannot check. `attestationReissuanceRequired` — revoking this `attestation` key obliges the node to re-issue every attestation artefact still in force and re-sign every status list (VTI-KEY-133). `serverless` — the VTA will not publish the entry; the operator must.";
+                };
+                readonly updateKeyRotates: {
+                    readonly type: "boolean";
+                    readonly description: "True when appending this entry also moves the DID's update key to a committed successor. Stated as its own member, not left to be found in `changes`, because it is the consequence a reviewer most often misses.";
+                };
+            };
+        };
+        readonly DidDocumentChange: {
+            readonly title: "DidDocumentChange";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["op", "role"];
+            readonly properties: {
+                readonly op: {
+                    readonly type: "string";
+                    readonly enum: readonly ["addKey", "retireKey", "revokeKey", "rotateUpdateKey", "setPreRotation"];
+                    readonly description: "`addKey` — a verification method is added, listed in its role's relationship and in `keyRoles`. `retireKey` — a verification method leaves its relationship, `keyRoles` and the document. `revokeKey` — a verification method leaves its relationship and `keyRoles`, and the compromise is recorded (CONVENTIONS.md §7). `rotateUpdateKey` — the log's update key moves to a committed successor. `setPreRotation` — the number of successors committed changes.";
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/KeyRole";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly publicKeyMultibase: {
+                    readonly type: "string";
+                };
+                readonly relationships: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidVerificationRelationship";
+                    };
+                    readonly uniqueItems: true;
+                };
+                readonly preRotationCount: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                };
+            };
+        };
+        readonly DidVerificationRelationship: {
+            readonly title: "DidVerificationRelationship";
+            readonly type: "string";
+            readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+            readonly description: "A DID Core verification relationship.";
+        };
+        readonly KeyRole: {
+            readonly title: "KeyRole";
+            readonly type: "string";
+            readonly enum: readonly ["attestation", "operational", "messaging", "update"];
+            readonly description: "The named key role a key occupies in the DID (VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the DID's attestation artefacts (membership and role credentials, endorsements, status lists, every other credential the node issues), through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP message signatures, invitations, notices, audit checkpoints) with proof purpose `authentication`. `messaging` — the only keys in `keyAgreement`; sign nothing. `update` — the keys that authorize appending to the DID's log (a did:webvh `updateKeys` entry) and the pre-rotation commitments that authorize the next ones; never a verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075); both are reserved for a future role. The mapping is normative and is set out in CONVENTIONS.md §1. The set is an extensible registry and growing it is a MINOR change: a consumer that receives a role it does not implement MUST refuse the document rather than map the key onto a role it does know.";
+        };
+        readonly KeyType: {
+            readonly title: "KeyType";
+            readonly type: "string";
+            readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+            readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+        };
+        readonly KeyRoleChangeOutcome: {
+            readonly title: "KeyRoleChangeOutcome";
+            readonly type: "string";
+            readonly enum: readonly ["preview", "applied", "pendingApproval"];
+            readonly description: "`preview` — nothing was written; the response carries the plan. `applied` — the entry was appended (and published, unless `serverless`). `pendingApproval` — the plan is recorded and awaits further approvals; nothing is published until they arrive (CONVENTIONS.md §3.3).";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "WebVH DID Update — response payload";
+            readonly description: "The outcome. `preview` and `pendingApproval` carry the plan; `applied` carries the published entry.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["did", "outcome"];
+            readonly properties: {
+                readonly did: {
+                    readonly type: "string";
+                };
+                readonly outcome: {
+                    readonly $ref: "#/$defs/KeyRoleChangeOutcome";
+                };
+                readonly preview: {
+                    readonly $ref: "#/$defs/DidDocumentPreview";
+                };
+                readonly approvals: {
+                    readonly $ref: "#/$defs/KeyRoleApprovalState";
+                };
+                readonly newVersionId: {
+                    readonly type: "string";
+                    readonly description: "versionId of the entry just appended. A caller intending a further edit SHOULD pass this back as the next request's `expectedVersionId`.";
+                };
+                readonly newScid: {
+                    readonly type: "string";
+                };
+                readonly newLogEntry: {
+                    readonly type: "string";
+                    readonly description: "The appended log entry, as JSON text.";
+                };
+                readonly updateKeysCount: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Update keys authorized AFTER this entry. Where `document` was supplied these are new keys — the previous ones no longer authorize anything.";
+                };
+                readonly preRotationKeyCount: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Pre-rotation commitments published by this entry.";
+                };
+                readonly serverless: {
+                    readonly type: "boolean";
+                    readonly description: "True when the agent holds the log itself and no hosting server was published to — the operator must fetch and redeploy `did.jsonl`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly KeyRoleApprovalState: {
+            readonly title: "KeyRoleApprovalState";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["required", "received", "expiresAt"];
+            readonly description: "Approval progress of a change the VTA's policy gates on more than one approval (CONVENTIONS.md §3.3).";
+            readonly properties: {
+                readonly required: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Distinct approvals the VTA's policy requires.";
+                };
+                readonly received: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Distinct approvals recorded so far, including the initiator's own.";
+                };
+                readonly approvers: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "VIDs whose approvals were recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                };
+            };
+        };
+        readonly DidDocumentPreview: {
+            readonly title: "DidDocumentPreview";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["previewId", "baseVersionId", "expiresAt", "changes", "document", "updateKeyRotates"];
+            readonly description: "What a change would publish, computed by the VTA by running the handler it would run to apply it, and nothing else (CONVENTIONS.md §3.1). This is what a consent surface renders and what an approval is bound to.";
+            readonly properties: {
+                readonly previewId: {
+                    readonly type: "string";
+                    readonly minLength: 16;
+                    readonly description: "Opaque, unguessable identifier for this exact plan. Carried back by the apply request, and the thing every approval is bound to.";
+                };
+                readonly baseVersionId: {
+                    readonly type: "string";
+                    readonly description: "versionId of the log entry the plan was computed against. The plan is void once the log moves past it.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly changes: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidDocumentChange";
+                    };
+                    readonly description: "Every change the entry would make, including the ones the caller did not ask for — in particular `rotateUpdateKey`, which accompanies every entry appended under pre-rotation.";
+                };
+                readonly document: {
+                    readonly type: "object";
+                    readonly description: "The complete DID document the entry would publish. Public data by construction; no key material beyond public halves.";
+                };
+                readonly warnings: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                        readonly enum: readonly ["preRotationDisabled", "singleKeyRole", "algorithmNotInAcceptedSet", "roleWillHaveNoClassicalKey", "attestationReissuanceRequired", "serverless"];
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "Conditions a human should be shown before approving. `preRotationDisabled` — the entry leaves no committed successor, so a later update-key compromise can only end in deactivation. `singleKeyRole` — the role will hold one active key, so its next compromise empties it until replaced. `algorithmNotInAcceptedSet` — a verifier population the VTA knows of does not accept the new key's algorithm. `roleWillHaveNoClassicalKey` — every remaining key is post-quantum, which verifiers without post-quantum support cannot check. `attestationReissuanceRequired` — revoking this `attestation` key obliges the node to re-issue every attestation artefact still in force and re-sign every status list (VTI-KEY-133). `serverless` — the VTA will not publish the entry; the operator must.";
+                };
+                readonly updateKeyRotates: {
+                    readonly type: "boolean";
+                    readonly description: "True when appending this entry also moves the DID's update key to a committed successor. Stated as its own member, not left to be found in `changes`, because it is the consequence a reviewer most often misses.";
+                };
+            };
+        };
+        readonly DidDocumentChange: {
+            readonly title: "DidDocumentChange";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["op", "role"];
+            readonly properties: {
+                readonly op: {
+                    readonly type: "string";
+                    readonly enum: readonly ["addKey", "retireKey", "revokeKey", "rotateUpdateKey", "setPreRotation"];
+                    readonly description: "`addKey` — a verification method is added, listed in its role's relationship and in `keyRoles`. `retireKey` — a verification method leaves its relationship, `keyRoles` and the document. `revokeKey` — a verification method leaves its relationship and `keyRoles`, and the compromise is recorded (CONVENTIONS.md §7). `rotateUpdateKey` — the log's update key moves to a committed successor. `setPreRotation` — the number of successors committed changes.";
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/KeyRole";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly publicKeyMultibase: {
+                    readonly type: "string";
+                };
+                readonly relationships: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidVerificationRelationship";
+                    };
+                    readonly uniqueItems: true;
+                };
+                readonly preRotationCount: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                };
+            };
+        };
+        readonly DidVerificationRelationship: {
+            readonly title: "DidVerificationRelationship";
+            readonly type: "string";
+            readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+            readonly description: "A DID Core verification relationship.";
+        };
+        readonly KeyRole: {
+            readonly title: "KeyRole";
+            readonly type: "string";
+            readonly enum: readonly ["attestation", "operational", "messaging", "update"];
+            readonly description: "The named key role a key occupies in the DID (VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the DID's attestation artefacts (membership and role credentials, endorsements, status lists, every other credential the node issues), through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP message signatures, invitations, notices, audit checkpoints) with proof purpose `authentication`. `messaging` — the only keys in `keyAgreement`; sign nothing. `update` — the keys that authorize appending to the DID's log (a did:webvh `updateKeys` entry) and the pre-rotation commitments that authorize the next ones; never a verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075); both are reserved for a future role. The mapping is normative and is set out in CONVENTIONS.md §1. The set is an extensible registry and growing it is a MINOR change: a consumer that receives a role it does not implement MUST refuse the document rather than map the key onto a role it does know.";
+        };
+        readonly KeyType: {
+            readonly title: "KeyType";
+            readonly type: "string";
+            readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+            readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+        };
+        readonly KeyRoleChangeOutcome: {
+            readonly title: "KeyRoleChangeOutcome";
+            readonly type: "string";
+            readonly enum: readonly ["preview", "applied", "pendingApproval"];
+            readonly description: "`preview` — nothing was written; the response carries the plan. `applied` — the entry was appended (and published, unless `serverless`). `pendingApproval` — the plan is recorded and awaits further approvals; nothing is published until they arrive (CONVENTIONS.md §3.3).";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/webvh/dids/update/2.0";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/vta/webvh/dids/update/2.0";
+        readonly title: "WebVH DID Update — payload";
+        readonly description: "Ask a Verifiable Trust Agent to publish a new entry in a did:webvh log it holds the update key for, changing anything but the DID's keys. Keys change only through the key-role tasks (vta/_shared/0.3/CONVENTIONS.md).";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["did"];
+        readonly properties: {
+            readonly did: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "The did:webvh being updated. The agent MUST verify it speaks for this subject.";
+            };
+            readonly document: {
+                readonly type: "object";
+                readonly description: "The new DID document. Omit to leave it unchanged. It MUST carry, unchanged, the current `verificationMethod`, `authentication`, `assertionMethod`, `keyAgreement`, `capabilityInvocation`, `capabilityDelegation` and `keyRoles` members: a change to any of them is refused with `vta/webvh/dids/update:keyMembersManaged`, because keys change only through the key-role tasks. Appending the entry still rotates the DID's update key under pre-rotation, which a consent surface MUST render from the executor's preview, never from this document.";
+            };
+            readonly preRotationCount: {
+                readonly type: "integer";
+                readonly minimum: 0;
+                readonly description: "Number of pre-rotation commitments to publish. Omit to keep the current count. `0` is refused for a durable node identity (`vta/webvh/dids:preRotationRequired`).";
+            };
+            readonly witnesses: {
+                readonly description: "New witness configuration. Omit to keep the current one.";
+            };
+            readonly watchers: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+                readonly description: "New watcher URLs. Omit to keep the current set; an empty array removes them.";
+            };
+            readonly ttl: {
+                readonly type: "integer";
+                readonly minimum: 0;
+                readonly description: "New TTL in seconds. Omit to keep the current value.";
+            };
+            readonly label: {
+                readonly type: "string";
+                readonly maxLength: 256;
+                readonly description: "Operator-facing audit label.";
+            };
+            readonly expectedVersionId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Optimistic-concurrency precondition: the versionId the caller based this edit on. The agent MUST refuse the update if the DID's latest entry no longer matches. Without it a `get -> edit -> save` cycle silently overwrites a concurrent edit with a chain that is structurally valid, verifies perfectly, and is based on a stale read. Where a human approves the update the window is minutes wide, so this is a routine race rather than an exotic one. OPTIONAL because a scripted caller with no concurrent writers has nothing to protect against; not optional for anything a person looked at.";
+            };
+            readonly dryRun: {
+                readonly type: "boolean";
+                readonly description: "Compute and return the preview without writing anything but the plan (CONVENTIONS.md §3.1). Absent reads as false.";
+            };
+            readonly previewId: {
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly description: "Apply exactly the plan a previous dry run of this same request returned; what an approval is bound to (CONVENTIONS.md §3.1–§3.2).";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "WebVH DID Update — response payload";
+                readonly description: "The outcome. `preview` and `pendingApproval` carry the plan; `applied` carries the published entry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["did", "outcome"];
+                readonly properties: {
+                    readonly did: {
+                        readonly type: "string";
+                    };
+                    readonly outcome: {
+                        readonly $ref: "#/$defs/KeyRoleChangeOutcome";
+                    };
+                    readonly preview: {
+                        readonly $ref: "#/$defs/DidDocumentPreview";
+                    };
+                    readonly approvals: {
+                        readonly $ref: "#/$defs/KeyRoleApprovalState";
+                    };
+                    readonly newVersionId: {
+                        readonly type: "string";
+                        readonly description: "versionId of the entry just appended. A caller intending a further edit SHOULD pass this back as the next request's `expectedVersionId`.";
+                    };
+                    readonly newScid: {
+                        readonly type: "string";
+                    };
+                    readonly newLogEntry: {
+                        readonly type: "string";
+                        readonly description: "The appended log entry, as JSON text.";
+                    };
+                    readonly updateKeysCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Update keys authorized AFTER this entry. Where `document` was supplied these are new keys — the previous ones no longer authorize anything.";
+                    };
+                    readonly preRotationKeyCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Pre-rotation commitments published by this entry.";
+                    };
+                    readonly serverless: {
+                        readonly type: "boolean";
+                        readonly description: "True when the agent holds the log itself and no hosting server was published to — the operator must fetch and redeploy `did.jsonl`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly KeyRoleApprovalState: {
+                readonly title: "KeyRoleApprovalState";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["required", "received", "expiresAt"];
+                readonly description: "Approval progress of a change the VTA's policy gates on more than one approval (CONVENTIONS.md §3.3).";
+                readonly properties: {
+                    readonly required: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Distinct approvals the VTA's policy requires.";
+                    };
+                    readonly received: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Distinct approvals recorded so far, including the initiator's own.";
+                    };
+                    readonly approvers: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "VIDs whose approvals were recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                    };
+                };
+            };
+            readonly DidDocumentPreview: {
+                readonly title: "DidDocumentPreview";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["previewId", "baseVersionId", "expiresAt", "changes", "document", "updateKeyRotates"];
+                readonly description: "What a change would publish, computed by the VTA by running the handler it would run to apply it, and nothing else (CONVENTIONS.md §3.1). This is what a consent surface renders and what an approval is bound to.";
+                readonly properties: {
+                    readonly previewId: {
+                        readonly type: "string";
+                        readonly minLength: 16;
+                        readonly description: "Opaque, unguessable identifier for this exact plan. Carried back by the apply request, and the thing every approval is bound to.";
+                    };
+                    readonly baseVersionId: {
+                        readonly type: "string";
+                        readonly description: "versionId of the log entry the plan was computed against. The plan is void once the log moves past it.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly changes: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidDocumentChange";
+                        };
+                        readonly description: "Every change the entry would make, including the ones the caller did not ask for — in particular `rotateUpdateKey`, which accompanies every entry appended under pre-rotation.";
+                    };
+                    readonly document: {
+                        readonly type: "object";
+                        readonly description: "The complete DID document the entry would publish. Public data by construction; no key material beyond public halves.";
+                    };
+                    readonly warnings: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly enum: readonly ["preRotationDisabled", "singleKeyRole", "algorithmNotInAcceptedSet", "roleWillHaveNoClassicalKey", "attestationReissuanceRequired", "serverless"];
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "Conditions a human should be shown before approving. `preRotationDisabled` — the entry leaves no committed successor, so a later update-key compromise can only end in deactivation. `singleKeyRole` — the role will hold one active key, so its next compromise empties it until replaced. `algorithmNotInAcceptedSet` — a verifier population the VTA knows of does not accept the new key's algorithm. `roleWillHaveNoClassicalKey` — every remaining key is post-quantum, which verifiers without post-quantum support cannot check. `attestationReissuanceRequired` — revoking this `attestation` key obliges the node to re-issue every attestation artefact still in force and re-sign every status list (VTI-KEY-133). `serverless` — the VTA will not publish the entry; the operator must.";
+                    };
+                    readonly updateKeyRotates: {
+                        readonly type: "boolean";
+                        readonly description: "True when appending this entry also moves the DID's update key to a committed successor. Stated as its own member, not left to be found in `changes`, because it is the consequence a reviewer most often misses.";
+                    };
+                };
+            };
+            readonly DidDocumentChange: {
+                readonly title: "DidDocumentChange";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["op", "role"];
+                readonly properties: {
+                    readonly op: {
+                        readonly type: "string";
+                        readonly enum: readonly ["addKey", "retireKey", "revokeKey", "rotateUpdateKey", "setPreRotation"];
+                        readonly description: "`addKey` — a verification method is added, listed in its role's relationship and in `keyRoles`. `retireKey` — a verification method leaves its relationship, `keyRoles` and the document. `revokeKey` — a verification method leaves its relationship and `keyRoles`, and the compromise is recorded (CONVENTIONS.md §7). `rotateUpdateKey` — the log's update key moves to a committed successor. `setPreRotation` — the number of successors committed changes.";
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/KeyRole";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly publicKeyMultibase: {
+                        readonly type: "string";
+                    };
+                    readonly relationships: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidVerificationRelationship";
+                        };
+                        readonly uniqueItems: true;
+                    };
+                    readonly preRotationCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                    };
+                };
+            };
+            readonly DidVerificationRelationship: {
+                readonly title: "DidVerificationRelationship";
+                readonly type: "string";
+                readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+                readonly description: "A DID Core verification relationship.";
+            };
+            readonly KeyRole: {
+                readonly title: "KeyRole";
+                readonly type: "string";
+                readonly enum: readonly ["attestation", "operational", "messaging", "update"];
+                readonly description: "The named key role a key occupies in the DID (VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the DID's attestation artefacts (membership and role credentials, endorsements, status lists, every other credential the node issues), through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP message signatures, invitations, notices, audit checkpoints) with proof purpose `authentication`. `messaging` — the only keys in `keyAgreement`; sign nothing. `update` — the keys that authorize appending to the DID's log (a did:webvh `updateKeys` entry) and the pre-rotation commitments that authorize the next ones; never a verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075); both are reserved for a future role. The mapping is normative and is set out in CONVENTIONS.md §1. The set is an extensible registry and growing it is a MINOR change: a consumer that receives a role it does not implement MUST refuse the document rather than map the key onto a role it does know.";
+            };
+            readonly KeyType: {
+                readonly title: "KeyType";
+                readonly type: "string";
+                readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+                readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+            };
+            readonly KeyRoleChangeOutcome: {
+                readonly title: "KeyRoleChangeOutcome";
+                readonly type: "string";
+                readonly enum: readonly ["preview", "applied", "pendingApproval"];
+                readonly description: "`preview` — nothing was written; the response carries the plan. `applied` — the entry was appended (and published, unless `serverless`). `pendingApproval` — the plan is recorded and awaits further approvals; nothing is published until they arrive (CONVENTIONS.md §3.3).";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/webvh/dids/update/2.0#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "WebVH DID Update — response payload";
+                readonly description: "The outcome. `preview` and `pendingApproval` carry the plan; `applied` carries the published entry.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["did", "outcome"];
+                readonly properties: {
+                    readonly did: {
+                        readonly type: "string";
+                    };
+                    readonly outcome: {
+                        readonly $ref: "#/$defs/KeyRoleChangeOutcome";
+                    };
+                    readonly preview: {
+                        readonly $ref: "#/$defs/DidDocumentPreview";
+                    };
+                    readonly approvals: {
+                        readonly $ref: "#/$defs/KeyRoleApprovalState";
+                    };
+                    readonly newVersionId: {
+                        readonly type: "string";
+                        readonly description: "versionId of the entry just appended. A caller intending a further edit SHOULD pass this back as the next request's `expectedVersionId`.";
+                    };
+                    readonly newScid: {
+                        readonly type: "string";
+                    };
+                    readonly newLogEntry: {
+                        readonly type: "string";
+                        readonly description: "The appended log entry, as JSON text.";
+                    };
+                    readonly updateKeysCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Update keys authorized AFTER this entry. Where `document` was supplied these are new keys — the previous ones no longer authorize anything.";
+                    };
+                    readonly preRotationKeyCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Pre-rotation commitments published by this entry.";
+                    };
+                    readonly serverless: {
+                        readonly type: "boolean";
+                        readonly description: "True when the agent holds the log itself and no hosting server was published to — the operator must fetch and redeploy `did.jsonl`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly KeyRoleApprovalState: {
+                readonly title: "KeyRoleApprovalState";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["required", "received", "expiresAt"];
+                readonly description: "Approval progress of a change the VTA's policy gates on more than one approval (CONVENTIONS.md §3.3).";
+                readonly properties: {
+                    readonly required: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Distinct approvals the VTA's policy requires.";
+                    };
+                    readonly received: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Distinct approvals recorded so far, including the initiator's own.";
+                    };
+                    readonly approvers: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "VIDs whose approvals were recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                    };
+                };
+            };
+            readonly DidDocumentPreview: {
+                readonly title: "DidDocumentPreview";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["previewId", "baseVersionId", "expiresAt", "changes", "document", "updateKeyRotates"];
+                readonly description: "What a change would publish, computed by the VTA by running the handler it would run to apply it, and nothing else (CONVENTIONS.md §3.1). This is what a consent surface renders and what an approval is bound to.";
+                readonly properties: {
+                    readonly previewId: {
+                        readonly type: "string";
+                        readonly minLength: 16;
+                        readonly description: "Opaque, unguessable identifier for this exact plan. Carried back by the apply request, and the thing every approval is bound to.";
+                    };
+                    readonly baseVersionId: {
+                        readonly type: "string";
+                        readonly description: "versionId of the log entry the plan was computed against. The plan is void once the log moves past it.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly changes: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidDocumentChange";
+                        };
+                        readonly description: "Every change the entry would make, including the ones the caller did not ask for — in particular `rotateUpdateKey`, which accompanies every entry appended under pre-rotation.";
+                    };
+                    readonly document: {
+                        readonly type: "object";
+                        readonly description: "The complete DID document the entry would publish. Public data by construction; no key material beyond public halves.";
+                    };
+                    readonly warnings: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                            readonly enum: readonly ["preRotationDisabled", "singleKeyRole", "algorithmNotInAcceptedSet", "roleWillHaveNoClassicalKey", "attestationReissuanceRequired", "serverless"];
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "Conditions a human should be shown before approving. `preRotationDisabled` — the entry leaves no committed successor, so a later update-key compromise can only end in deactivation. `singleKeyRole` — the role will hold one active key, so its next compromise empties it until replaced. `algorithmNotInAcceptedSet` — a verifier population the VTA knows of does not accept the new key's algorithm. `roleWillHaveNoClassicalKey` — every remaining key is post-quantum, which verifiers without post-quantum support cannot check. `attestationReissuanceRequired` — revoking this `attestation` key obliges the node to re-issue every attestation artefact still in force and re-sign every status list (VTI-KEY-133). `serverless` — the VTA will not publish the entry; the operator must.";
+                    };
+                    readonly updateKeyRotates: {
+                        readonly type: "boolean";
+                        readonly description: "True when appending this entry also moves the DID's update key to a committed successor. Stated as its own member, not left to be found in `changes`, because it is the consequence a reviewer most often misses.";
+                    };
+                };
+            };
+            readonly DidDocumentChange: {
+                readonly title: "DidDocumentChange";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["op", "role"];
+                readonly properties: {
+                    readonly op: {
+                        readonly type: "string";
+                        readonly enum: readonly ["addKey", "retireKey", "revokeKey", "rotateUpdateKey", "setPreRotation"];
+                        readonly description: "`addKey` — a verification method is added, listed in its role's relationship and in `keyRoles`. `retireKey` — a verification method leaves its relationship, `keyRoles` and the document. `revokeKey` — a verification method leaves its relationship and `keyRoles`, and the compromise is recorded (CONVENTIONS.md §7). `rotateUpdateKey` — the log's update key moves to a committed successor. `setPreRotation` — the number of successors committed changes.";
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/KeyRole";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly publicKeyMultibase: {
+                        readonly type: "string";
+                    };
+                    readonly relationships: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidVerificationRelationship";
+                        };
+                        readonly uniqueItems: true;
+                    };
+                    readonly preRotationCount: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                    };
+                };
+            };
+            readonly DidVerificationRelationship: {
+                readonly title: "DidVerificationRelationship";
+                readonly type: "string";
+                readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+                readonly description: "A DID Core verification relationship.";
+            };
+            readonly KeyRole: {
+                readonly title: "KeyRole";
+                readonly type: "string";
+                readonly enum: readonly ["attestation", "operational", "messaging", "update"];
+                readonly description: "The named key role a key occupies in the DID (VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the DID's attestation artefacts (membership and role credentials, endorsements, status lists, every other credential the node issues), through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP message signatures, invitations, notices, audit checkpoints) with proof purpose `authentication`. `messaging` — the only keys in `keyAgreement`; sign nothing. `update` — the keys that authorize appending to the DID's log (a did:webvh `updateKeys` entry) and the pre-rotation commitments that authorize the next ones; never a verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075); both are reserved for a future role. The mapping is normative and is set out in CONVENTIONS.md §1. The set is an extensible registry and growing it is a MINOR change: a consumer that receives a role it does not implement MUST refuse the document rather than map the key onto a role it does know.";
+            };
+            readonly KeyType: {
+                readonly title: "KeyType";
+                readonly type: "string";
+                readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+                readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+            };
+            readonly KeyRoleChangeOutcome: {
+                readonly title: "KeyRoleChangeOutcome";
+                readonly type: "string";
+                readonly enum: readonly ["preview", "applied", "pendingApproval"];
+                readonly description: "`preview` — nothing was written; the response carries the plan. `applied` — the entry was appended (and published, unless `serverless`). `pendingApproval` — the plan is recorded and awaits further approvals; nothing is published until they arrive (CONVENTIONS.md §3.3).";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map