@openvtc/trust-tasks 0.28.1 → 0.28.3

package/dist/vta/dids/keys/list/1.0/payload.d.ts

@@ -0,0 +1,1855 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/dids/keys/list/1.0/payload.schema.json
+ */
+import type { ApprovalEvidenceKind, DidMethodName, DidVerificationRelationship, Ext, IdentityKeyCustody, IdentityKeyRole, IdentityRoleKey, KeyChangeApprovalState, KeyChangeKind, KeyChangeRecord, KeyChangeState, KeyLifecycleState, KeyListProjection, KeyOrigin, KeyRoleSummary, KeyType, ProtectionClass, RecordedApproval, UpdateKeyClass } from "../../../../../_shared/components.js";
+/**
+ * List the key roles of a key-role identity a VTA holds keys for: each role's keys and their states, the update authority and recovery commitment, and optionally the rotation history, in the public or custody projection (CONVENTIONS.md §11).
+ */
+export interface VTADIDsKeysListPayload {
+    /**
+     * The key-role identity, by DID (for a `did:scid` identity, the DID without `src`).
+     */
+    did: string;
+    /**
+     * Return only these roles. Absent returns every role. Present-but-empty is refused by the schema rather than read as 'every role'.
+     *
+     * @minItems 1
+     */
+    roles?: [IdentityKeyRole, ...IdentityKeyRole[]];
+    /**
+     * Include `retired` and `revoked` keys. Absent reads as false. A `revoked` key the document still lists is always included.
+     */
+    includeEnded?: boolean;
+    /**
+     * Include the rotation history. Absent reads as false.
+     */
+    includeHistory?: boolean;
+    ext?: Ext;
+}
+export interface VTADIDsKeysListResponsePayload {
+    did: string;
+    method: DidMethodName;
+    /**
+     * The version the answer describes. Pass it as `expectedVersionId` to a change made on its strength.
+     */
+    versionId: string;
+    projection: KeyListProjection;
+    /**
+     * One entry per role asked for, including roles with no keys.
+     */
+    roles: KeyRoleSummary[];
+    /**
+     * Present exactly when `includeHistory` was true. Newest first.
+     */
+    rotations?: KeyChangeRecord[];
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ApprovalEvidenceKind, DidMethodName, DidVerificationRelationship, Ext, IdentityKeyCustody, IdentityKeyRole, IdentityRoleKey, KeyChangeApprovalState, KeyChangeKind, KeyChangeRecord, KeyChangeState, KeyLifecycleState, KeyListProjection, KeyOrigin, KeyRoleSummary, KeyType, ProtectionClass, RecordedApproval, UpdateKeyClass };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vta/dids/keys/list/1.0";
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export declare const EXTENDS: string | null;
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export declare const DEPRECATION: string | null;
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTADIDsKeysListPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vta/dids/keys/list/1.0#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTADIDsKeysListResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/vta/dids/keys/list/1.0";
+    readonly title: "VTA DIDs — Keys List — payload";
+    readonly description: "List the key roles of a key-role identity a VTA holds keys for: each role's keys and their states, the update authority and recovery commitment, and optionally the rotation history, in the public or custody projection (CONVENTIONS.md §11).";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["did"];
+    readonly properties: {
+        readonly did: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "The key-role identity, by DID (for a `did:scid` identity, the DID without `src`).";
+        };
+        readonly roles: {
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly $ref: "#/$defs/IdentityKeyRole";
+            };
+            readonly description: "Return only these roles. Absent returns every role. Present-but-empty is refused by the schema rather than read as 'every role'.";
+        };
+        readonly includeEnded: {
+            readonly type: "boolean";
+            readonly description: "Include `retired` and `revoked` keys. Absent reads as false. A `revoked` key the document still lists is always included.";
+        };
+        readonly includeHistory: {
+            readonly type: "boolean";
+            readonly description: "Include the rotation history. Absent reads as false.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTA DIDs — Keys List — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["did", "method", "versionId", "projection", "roles"];
+            readonly properties: {
+                readonly did: {
+                    readonly type: "string";
+                };
+                readonly method: {
+                    readonly $ref: "#/$defs/DidMethodName";
+                };
+                readonly versionId: {
+                    readonly type: "string";
+                    readonly description: "The version the answer describes. Pass it as `expectedVersionId` to a change made on its strength.";
+                };
+                readonly projection: {
+                    readonly $ref: "#/$defs/KeyListProjection";
+                };
+                readonly roles: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/KeyRoleSummary";
+                    };
+                    readonly description: "One entry per role asked for, including roles with no keys.";
+                };
+                readonly rotations: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/KeyChangeRecord";
+                    };
+                    readonly description: "Present exactly when `includeHistory` was true. Newest first.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly KeyChangeRecord: {
+            readonly title: "KeyChangeRecord";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["rotationId", "role", "kind", "state"];
+            readonly description: "One change to a role's key set, from preview to completion. The identifier's history is the authority for what was published; this record adds which change was which and, in the custody projection, who asked, who approved, and why.";
+            readonly properties: {
+                readonly rotationId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/IdentityKeyRole";
+                };
+                readonly kind: {
+                    readonly $ref: "#/$defs/KeyChangeKind";
+                };
+                readonly state: {
+                    readonly $ref: "#/$defs/KeyChangeState";
+                };
+                readonly predecessors: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Verification-method identifiers (for `update`, public keys or commitments) leaving the role.";
+                };
+                readonly successors: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Verification-method identifiers (for `update`, public keys or commitments) entering the role.";
+                };
+                readonly startedInVersionId: {
+                    readonly type: "string";
+                };
+                readonly endedInVersionId: {
+                    readonly type: "string";
+                };
+                readonly startedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly cacheHorizonAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Planned rotations: the publishing change's cache horizon (CONVENTIONS.md §10.1). The switch and any retirement happen no earlier.";
+                };
+                readonly activatesAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the successor becomes `active` and the predecessor `retiring`; never before `cacheHorizonAt`.";
+                };
+                readonly overlapUntil: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Custody projection only. End of the overlap.";
+                };
+                readonly autoRetire: {
+                    readonly type: "boolean";
+                    readonly description: "Custody projection only. Whether the VTA retires the predecessor itself at `overlapUntil`.";
+                };
+                readonly endedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly initiatedBy: {
+                    readonly type: "string";
+                    readonly description: "Custody projection only. VID of the administrator whose signed request started the change.";
+                };
+                readonly approvals: {
+                    readonly $ref: "#/$defs/KeyChangeApprovalState";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "Custody projection only. The operator's stated reason. Never published.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly KeyChangeApprovalState: {
+            readonly title: "KeyChangeApprovalState";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["required", "received", "expiresAt"];
+            readonly description: "Approval progress of a change the VTA's policy gates on approvals (CONVENTIONS.md §6).";
+            readonly properties: {
+                readonly required: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Distinct approvals the VTA's policy requires.";
+                };
+                readonly received: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Distinct approvals recorded so far, the initiator's own included.";
+                };
+                readonly approvals: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/RecordedApproval";
+                    };
+                    readonly description: "The approvals recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                };
+            };
+        };
+        readonly RecordedApproval: {
+            readonly title: "RecordedApproval";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["approver", "evidence"];
+            readonly properties: {
+                readonly approver: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the approver.";
+                };
+                readonly evidence: {
+                    readonly $ref: "#/$defs/ApprovalEvidenceKind";
+                };
+                readonly recordedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly ApprovalEvidenceKind: {
+            readonly title: "ApprovalEvidenceKind";
+            readonly type: "string";
+            readonly enum: readonly ["didSigned", "webauthn", "approverSigned"];
+            readonly description: "The evidence an approval was recorded on, as `auth/step-up/approve-response` names it. Only the approver's own evidence is ever recorded: a proof by a key the VTA records as acting for an approver — a console signing key or any other delegation — is never an approval (CONVENTIONS.md §6.3).";
+        };
+        readonly KeyChangeState: {
+            readonly title: "KeyChangeState";
+            readonly type: "string";
+            readonly enum: readonly ["pendingApproval", "awaitingRecoveryProof", "staged", "overlapping", "completed", "aborted", "expired"];
+            readonly description: "`pendingApproval` — awaiting the approvals the VTA's policy requires; nothing is published. `awaitingRecoveryProof` — approved, and waiting for the recovery custodian's proof over the change; nothing is published. `staged` — successor published, not yet used. `overlapping` — successor active, predecessor `retiring`. `completed` — every predecessor retired, or the change is published and any overlap it began has ended. `aborted` — the successor was retired instead of the predecessor, or a revocation superseded the change. `expired` — the approvals or the recovery proof did not arrive before the preview expired; nothing was published.";
+        };
+        readonly KeyChangeKind: {
+            readonly title: "KeyChangeKind";
+            readonly type: "string";
+            readonly enum: readonly ["planned", "compromise", "addition", "recovery"];
+            readonly description: "`planned` — a successor was staged, activated, and the predecessor retired on the operator's schedule. `compromise` — a key was revoked and, where the role would otherwise be empty, replaced in the same change. `addition` — a key joined a role without anything leaving it. `recovery` — the identifier's update authority moved to the committed recovery key, because the VTA's own update keys were lost or may be in someone else's hands.";
+        };
+        readonly IdentityKeyRole: {
+            readonly title: "IdentityKeyRole";
+            readonly type: "string";
+            readonly enum: readonly ["attestation", "operational", "messaging", "update", "authenticator"];
+            readonly description: "The named key role a key occupies in an identity (CONVENTIONS.md §2; VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the identity's attestation artefacts (credentials, endorsements, status lists) through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys the identity's own process uses in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP signatures, invitations, notices, audit checkpoints). Derived. `messaging` — the only keys in `keyAgreement`; sign nothing. X25519, derived or generated in its own right and never converted from a signing key. `update` — the identifier's change authority as its DID method states it (a did:webvh log's `updateKeys` and `nextKeyHashes`, a KERI key event log's current and next keys); never a role-bound verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup, and always accompanied by a committed recovery key held outside the VTA's protection boundary. `authenticator` — a key held on a person's own authenticator (a WebAuthn passkey), listed in `authentication` of that person's identity only; used only to verify the person's WebAuthn assertions (sign-in and step-up evidence) and never to accept a Data Integrity proof. The VTA never holds its private half, so it is enrolled by the passkey ceremony and never generated, added or rotated by these tasks. Never permitted on the durable identity of a VTA, a VTC or a VTN. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075). The set is an extensible registry: a consumer that meets a role it does not implement MUST rely on the key for nothing, and MUST NOT map it onto a role it does know (VTI-KEY-074).";
+        };
+        readonly KeyRoleSummary: {
+            readonly title: "KeyRoleSummary";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["role", "relationships", "keys"];
+            readonly properties: {
+                readonly role: {
+                    readonly $ref: "#/$defs/IdentityKeyRole";
+                };
+                readonly relationships: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidVerificationRelationship";
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "The relationship this role owns. Empty for `update`.";
+                };
+                readonly keys: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/IdentityRoleKey";
+                    };
+                    readonly description: "The role's keys, in the order the document publishes them. Terminal-state keys are included only when the request asked for them, except a `revoked` key the document still lists, which is always included.";
+                };
+                readonly recoveryCommitted: {
+                    readonly type: "boolean";
+                    readonly description: "`update` only: whether the identifier's latest version commits to a recovery key in a boundary other than the VTA's (CONVENTIONS.md §5.3). `false` is a defect the VTA reports rather than hides.";
+                };
+                readonly threshold: {
+                    readonly type: "string";
+                    readonly description: "`update` only, where the method has one: the signing threshold over the current update keys, in the method's own notation (a KERI `kt`).";
+                };
+            };
+        };
+        readonly IdentityRoleKey: {
+            readonly title: "IdentityRoleKey";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["role", "keyType", "state"];
+            readonly description: "One key in one role. A key is in exactly one role for its whole life; a change of role is a retirement from one and an addition to another, with fresh material under a fresh identifier.";
+            readonly properties: {
+                readonly verificationMethod: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The full verification-method identifier (`did#fragment`) the document publishes the key under and lists in `keyRoles`. Absent for `update` keys, which are never role-bound verification methods (VTI-KEY-093). A VTA minting a method SHOULD derive its fragment from the key (VTI-KEY-150).";
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/IdentityKeyRole";
+                };
+                readonly updateKeyClass: {
+                    readonly $ref: "#/$defs/UpdateKeyClass";
+                };
+                readonly relationships: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidVerificationRelationship";
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "The relationships the key is (or, while `pending`, will be) listed in: always exactly its role's one relationship. Empty for `update`, `retired` and `revoked` keys.";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly publicKeyMultibase: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The public half, multibase-encoded, exactly as published. Absent for a `committed` update key, whose public half the identifier has not yet revealed.";
+                };
+                readonly commitment: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "For a `committed` update key: the commitment the identifier publishes (a did:webvh `nextKeyHashes` entry, a KERI next-key digest), in the method's own encoding.";
+                };
+                readonly state: {
+                    readonly $ref: "#/$defs/KeyLifecycleState";
+                };
+                readonly publishedInVersionId: {
+                    readonly type: "string";
+                    readonly description: "The method's version identifier of the change that first published the key or its commitment (method-profiles/: a did:webvh `versionId`, a KERI event's sequence number and digest). Absent while `pending`.";
+                };
+                readonly removedInVersionId: {
+                    readonly type: "string";
+                    readonly description: "Version identifier of the change that retired or revoked the key.";
+                };
+                readonly activatesAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "For a `staged` key: when the VTA will begin using it — no earlier than the publishing change's cache horizon.";
+                };
+                readonly retireAfter: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "For a `retiring` key: the end of its overlap. Custody projection only.";
+                };
+                readonly compromisedSince: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "For a `revoked` key: the compromise time (VTI-KEY-121), published as the verification method's `revoked` value. Where it cannot be established, the time the key was first published.";
+                };
+                readonly rotationId: {
+                    readonly type: "string";
+                    readonly description: "The rotation this key was introduced or retired by.";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "Operator-facing label. Custody projection only.";
+                };
+                readonly custody: {
+                    readonly $ref: "#/$defs/IdentityKeyCustody";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly IdentityKeyCustody: {
+            readonly title: "IdentityKeyCustody";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["exportable", "neverExportable", "inBackups", "protection"];
+            readonly description: "How a key is held. Present only in the custody projection. Carries no key material, and a conforming VTA MUST NOT place any in `ext`.";
+            readonly properties: {
+                readonly keyId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The custodian record identifier (`keys/*`'s `keyId`) behind this key. Absent for a key this VTA does not hold (`protection: externalCustodian`).";
+                };
+                readonly origin: {
+                    readonly $ref: "#/$defs/KeyOrigin";
+                };
+                readonly exportable: {
+                    readonly type: "boolean";
+                    readonly description: "Whether the custodian would release the private half. Always `false` for `attestation` and `update` keys. Stated explicitly, never absent.";
+                };
+                readonly neverExportable: {
+                    readonly type: "boolean";
+                    readonly description: "True when no authority can make the key exportable. `true` implies `exportable: false`.";
+                };
+                readonly inBackups: {
+                    readonly type: "boolean";
+                    readonly description: "Whether the key, or material it can be re-derived or decrypted from, is in the VTA's backups or any state transfer. Always `false` for `attestation` and `update` keys (VTI-KEY-112).";
+                };
+                readonly protection: {
+                    readonly $ref: "#/$defs/ProtectionClass";
+                };
+                readonly boundary: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "Opaque, VTA-assigned label of the protection boundary holding the key (CONVENTIONS.md §5.2). Two keys with the same label are lost or compromised together. A recovery update key MUST carry a label different from every routine update key's. Custody projection only; never published.";
+                };
+                readonly destroyed: {
+                    readonly type: "boolean";
+                    readonly description: "True once the private half has been destroyed — a retired `attestation` or `messaging` key. The record survives so the key's past signatures stay attributable.";
+                };
+            };
+        };
+        readonly ProtectionClass: {
+            readonly title: "ProtectionClass";
+            readonly type: "string";
+            readonly enum: readonly ["software", "encryptedAtRest", "enclave", "hardwareModule", "externalCustodian"];
+            readonly description: "How a private half is protected (CONVENTIONS.md §5.2). `software` — stored by the VTA without encryption independent of the host (a plain VTA). `encryptedAtRest` — wrapped under a key the VTA holds outside its store (a hardened VTA). `enclave` — held only inside an attested trusted execution environment, wrapped under a key released only to its measurement (a TEE VTA). `hardwareModule` — held by a hardware security module or cloud key service that performs the operation without releasing the key. `externalCustodian` — not held by this VTA at all: a recovery update key, or an `authenticator` key on a person's device.";
+        };
+        readonly KeyOrigin: {
+            readonly title: "KeyOrigin";
+            readonly type: "string";
+            readonly enum: readonly ["derived", "imported", "internal"];
+            readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.";
+            readonly default: "derived";
+        };
+        readonly KeyLifecycleState: {
+            readonly title: "KeyLifecycleState";
+            readonly type: "string";
+            readonly enum: readonly ["pending", "staged", "active", "retiring", "retired", "revoked", "committed"];
+            readonly description: "Where a key is in its role's lifecycle (CONVENTIONS.md §8, §10). `pending` — planned by a preview or a change awaiting approval; not published; custody projection only. `staged` — published and bound to its role but not yet used, until the publishing change's cache horizon. `active` — the key the VTA uses for new signatures (for `messaging`, advertises for new sessions; for `update`, the current authority). `retiring` — still published but never used to sign again; a retiring `messaging` key still decrypts until retirement. `retired` — removed by planned rotation; what it signed while published stays valid, judged against the identifier version current at issuance. `revoked` — withdrawn for compromise, recorded with `compromisedSince`; what it signed from then on establishes nothing. `committed` — an `update` key the identifier commits to as a successor but has not revealed (a did:webvh `nextKeyHashes` entry, a KERI next-key digest). `retired` and `revoked` are terminal.";
+        };
+        readonly DidVerificationRelationship: {
+            readonly title: "DidVerificationRelationship";
+            readonly type: "string";
+            readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+            readonly description: "A DID Core verification relationship.";
+        };
+        readonly UpdateKeyClass: {
+            readonly title: "UpdateKeyClass";
+            readonly type: "string";
+            readonly enum: readonly ["routine", "recovery"];
+            readonly description: "For an `update` key only (CONVENTIONS.md §5.3). `routine` — generated and held by the VTA, which authorizes the identity's ordinary changes with it. `recovery` — held by a recovery custodian in a protection boundary other than the VTA's; the VTA holds only its commitment, carries that commitment forward in every change it makes, and can use the key only by asking the custodian for a proof (`RecoverySigningRequest`).";
+        };
+        readonly KeyType: {
+            readonly title: "KeyType";
+            readonly type: "string";
+            readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+            readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+        };
+        readonly KeyListProjection: {
+            readonly title: "KeyListProjection";
+            readonly type: "string";
+            readonly enum: readonly ["public", "custody"];
+            readonly description: "Which view of the identity's key roles the caller was given (CONVENTIONS.md §11). `public` — only what the published identifier document and history already reveal. `custody` — additionally the VTA's custody state: pending keys, the custodian record and protection boundary behind each key, overlap deadlines, who initiated and approved each change, and why.";
+        };
+        readonly DidMethodName: {
+            readonly title: "DidMethodName";
+            readonly type: "string";
+            readonly pattern: "^[a-z0-9]+(:[a-z0-9]+)*$";
+            readonly description: "The DID method an identity uses, as the method profile that governs it is named: `webvh` for a did:webvh identity, `scid:vh` for the did:scid:vh:1 form of one, `webs` for did:webs. Deliberately a pattern and not an enumeration: a method is added by publishing its profile under method-profiles/, never by changing this schema. A VTA MUST refuse a method it holds no profile for, or whose profile declares it ineligible, with `vta/dids:methodNotEligible`.";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTA DIDs — Keys List — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["did", "method", "versionId", "projection", "roles"];
+            readonly properties: {
+                readonly did: {
+                    readonly type: "string";
+                };
+                readonly method: {
+                    readonly $ref: "#/$defs/DidMethodName";
+                };
+                readonly versionId: {
+                    readonly type: "string";
+                    readonly description: "The version the answer describes. Pass it as `expectedVersionId` to a change made on its strength.";
+                };
+                readonly projection: {
+                    readonly $ref: "#/$defs/KeyListProjection";
+                };
+                readonly roles: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/KeyRoleSummary";
+                    };
+                    readonly description: "One entry per role asked for, including roles with no keys.";
+                };
+                readonly rotations: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/KeyChangeRecord";
+                    };
+                    readonly description: "Present exactly when `includeHistory` was true. Newest first.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly KeyChangeRecord: {
+            readonly title: "KeyChangeRecord";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["rotationId", "role", "kind", "state"];
+            readonly description: "One change to a role's key set, from preview to completion. The identifier's history is the authority for what was published; this record adds which change was which and, in the custody projection, who asked, who approved, and why.";
+            readonly properties: {
+                readonly rotationId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/IdentityKeyRole";
+                };
+                readonly kind: {
+                    readonly $ref: "#/$defs/KeyChangeKind";
+                };
+                readonly state: {
+                    readonly $ref: "#/$defs/KeyChangeState";
+                };
+                readonly predecessors: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Verification-method identifiers (for `update`, public keys or commitments) leaving the role.";
+                };
+                readonly successors: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Verification-method identifiers (for `update`, public keys or commitments) entering the role.";
+                };
+                readonly startedInVersionId: {
+                    readonly type: "string";
+                };
+                readonly endedInVersionId: {
+                    readonly type: "string";
+                };
+                readonly startedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly cacheHorizonAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Planned rotations: the publishing change's cache horizon (CONVENTIONS.md §10.1). The switch and any retirement happen no earlier.";
+                };
+                readonly activatesAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the successor becomes `active` and the predecessor `retiring`; never before `cacheHorizonAt`.";
+                };
+                readonly overlapUntil: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "Custody projection only. End of the overlap.";
+                };
+                readonly autoRetire: {
+                    readonly type: "boolean";
+                    readonly description: "Custody projection only. Whether the VTA retires the predecessor itself at `overlapUntil`.";
+                };
+                readonly endedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly initiatedBy: {
+                    readonly type: "string";
+                    readonly description: "Custody projection only. VID of the administrator whose signed request started the change.";
+                };
+                readonly approvals: {
+                    readonly $ref: "#/$defs/KeyChangeApprovalState";
+                };
+                readonly reason: {
+                    readonly type: "string";
+                    readonly maxLength: 1024;
+                    readonly description: "Custody projection only. The operator's stated reason. Never published.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly KeyChangeApprovalState: {
+            readonly title: "KeyChangeApprovalState";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["required", "received", "expiresAt"];
+            readonly description: "Approval progress of a change the VTA's policy gates on approvals (CONVENTIONS.md §6).";
+            readonly properties: {
+                readonly required: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Distinct approvals the VTA's policy requires.";
+                };
+                readonly received: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Distinct approvals recorded so far, the initiator's own included.";
+                };
+                readonly approvals: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/RecordedApproval";
+                    };
+                    readonly description: "The approvals recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                };
+            };
+        };
+        readonly RecordedApproval: {
+            readonly title: "RecordedApproval";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["approver", "evidence"];
+            readonly properties: {
+                readonly approver: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the approver.";
+                };
+                readonly evidence: {
+                    readonly $ref: "#/$defs/ApprovalEvidenceKind";
+                };
+                readonly recordedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly ApprovalEvidenceKind: {
+            readonly title: "ApprovalEvidenceKind";
+            readonly type: "string";
+            readonly enum: readonly ["didSigned", "webauthn", "approverSigned"];
+            readonly description: "The evidence an approval was recorded on, as `auth/step-up/approve-response` names it. Only the approver's own evidence is ever recorded: a proof by a key the VTA records as acting for an approver — a console signing key or any other delegation — is never an approval (CONVENTIONS.md §6.3).";
+        };
+        readonly KeyChangeState: {
+            readonly title: "KeyChangeState";
+            readonly type: "string";
+            readonly enum: readonly ["pendingApproval", "awaitingRecoveryProof", "staged", "overlapping", "completed", "aborted", "expired"];
+            readonly description: "`pendingApproval` — awaiting the approvals the VTA's policy requires; nothing is published. `awaitingRecoveryProof` — approved, and waiting for the recovery custodian's proof over the change; nothing is published. `staged` — successor published, not yet used. `overlapping` — successor active, predecessor `retiring`. `completed` — every predecessor retired, or the change is published and any overlap it began has ended. `aborted` — the successor was retired instead of the predecessor, or a revocation superseded the change. `expired` — the approvals or the recovery proof did not arrive before the preview expired; nothing was published.";
+        };
+        readonly KeyChangeKind: {
+            readonly title: "KeyChangeKind";
+            readonly type: "string";
+            readonly enum: readonly ["planned", "compromise", "addition", "recovery"];
+            readonly description: "`planned` — a successor was staged, activated, and the predecessor retired on the operator's schedule. `compromise` — a key was revoked and, where the role would otherwise be empty, replaced in the same change. `addition` — a key joined a role without anything leaving it. `recovery` — the identifier's update authority moved to the committed recovery key, because the VTA's own update keys were lost or may be in someone else's hands.";
+        };
+        readonly IdentityKeyRole: {
+            readonly title: "IdentityKeyRole";
+            readonly type: "string";
+            readonly enum: readonly ["attestation", "operational", "messaging", "update", "authenticator"];
+            readonly description: "The named key role a key occupies in an identity (CONVENTIONS.md §2; VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the identity's attestation artefacts (credentials, endorsements, status lists) through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys the identity's own process uses in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP signatures, invitations, notices, audit checkpoints). Derived. `messaging` — the only keys in `keyAgreement`; sign nothing. X25519, derived or generated in its own right and never converted from a signing key. `update` — the identifier's change authority as its DID method states it (a did:webvh log's `updateKeys` and `nextKeyHashes`, a KERI key event log's current and next keys); never a role-bound verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup, and always accompanied by a committed recovery key held outside the VTA's protection boundary. `authenticator` — a key held on a person's own authenticator (a WebAuthn passkey), listed in `authentication` of that person's identity only; used only to verify the person's WebAuthn assertions (sign-in and step-up evidence) and never to accept a Data Integrity proof. The VTA never holds its private half, so it is enrolled by the passkey ceremony and never generated, added or rotated by these tasks. Never permitted on the durable identity of a VTA, a VTC or a VTN. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075). The set is an extensible registry: a consumer that meets a role it does not implement MUST rely on the key for nothing, and MUST NOT map it onto a role it does know (VTI-KEY-074).";
+        };
+        readonly KeyRoleSummary: {
+            readonly title: "KeyRoleSummary";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["role", "relationships", "keys"];
+            readonly properties: {
+                readonly role: {
+                    readonly $ref: "#/$defs/IdentityKeyRole";
+                };
+                readonly relationships: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidVerificationRelationship";
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "The relationship this role owns. Empty for `update`.";
+                };
+                readonly keys: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/IdentityRoleKey";
+                    };
+                    readonly description: "The role's keys, in the order the document publishes them. Terminal-state keys are included only when the request asked for them, except a `revoked` key the document still lists, which is always included.";
+                };
+                readonly recoveryCommitted: {
+                    readonly type: "boolean";
+                    readonly description: "`update` only: whether the identifier's latest version commits to a recovery key in a boundary other than the VTA's (CONVENTIONS.md §5.3). `false` is a defect the VTA reports rather than hides.";
+                };
+                readonly threshold: {
+                    readonly type: "string";
+                    readonly description: "`update` only, where the method has one: the signing threshold over the current update keys, in the method's own notation (a KERI `kt`).";
+                };
+            };
+        };
+        readonly IdentityRoleKey: {
+            readonly title: "IdentityRoleKey";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["role", "keyType", "state"];
+            readonly description: "One key in one role. A key is in exactly one role for its whole life; a change of role is a retirement from one and an addition to another, with fresh material under a fresh identifier.";
+            readonly properties: {
+                readonly verificationMethod: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The full verification-method identifier (`did#fragment`) the document publishes the key under and lists in `keyRoles`. Absent for `update` keys, which are never role-bound verification methods (VTI-KEY-093). A VTA minting a method SHOULD derive its fragment from the key (VTI-KEY-150).";
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/IdentityKeyRole";
+                };
+                readonly updateKeyClass: {
+                    readonly $ref: "#/$defs/UpdateKeyClass";
+                };
+                readonly relationships: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidVerificationRelationship";
+                    };
+                    readonly uniqueItems: true;
+                    readonly description: "The relationships the key is (or, while `pending`, will be) listed in: always exactly its role's one relationship. Empty for `update`, `retired` and `revoked` keys.";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly publicKeyMultibase: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The public half, multibase-encoded, exactly as published. Absent for a `committed` update key, whose public half the identifier has not yet revealed.";
+                };
+                readonly commitment: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "For a `committed` update key: the commitment the identifier publishes (a did:webvh `nextKeyHashes` entry, a KERI next-key digest), in the method's own encoding.";
+                };
+                readonly state: {
+                    readonly $ref: "#/$defs/KeyLifecycleState";
+                };
+                readonly publishedInVersionId: {
+                    readonly type: "string";
+                    readonly description: "The method's version identifier of the change that first published the key or its commitment (method-profiles/: a did:webvh `versionId`, a KERI event's sequence number and digest). Absent while `pending`.";
+                };
+                readonly removedInVersionId: {
+                    readonly type: "string";
+                    readonly description: "Version identifier of the change that retired or revoked the key.";
+                };
+                readonly activatesAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "For a `staged` key: when the VTA will begin using it — no earlier than the publishing change's cache horizon.";
+                };
+                readonly retireAfter: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "For a `retiring` key: the end of its overlap. Custody projection only.";
+                };
+                readonly compromisedSince: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "For a `revoked` key: the compromise time (VTI-KEY-121), published as the verification method's `revoked` value. Where it cannot be established, the time the key was first published.";
+                };
+                readonly rotationId: {
+                    readonly type: "string";
+                    readonly description: "The rotation this key was introduced or retired by.";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly maxLength: 256;
+                    readonly description: "Operator-facing label. Custody projection only.";
+                };
+                readonly custody: {
+                    readonly $ref: "#/$defs/IdentityKeyCustody";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly IdentityKeyCustody: {
+            readonly title: "IdentityKeyCustody";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["exportable", "neverExportable", "inBackups", "protection"];
+            readonly description: "How a key is held. Present only in the custody projection. Carries no key material, and a conforming VTA MUST NOT place any in `ext`.";
+            readonly properties: {
+                readonly keyId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The custodian record identifier (`keys/*`'s `keyId`) behind this key. Absent for a key this VTA does not hold (`protection: externalCustodian`).";
+                };
+                readonly origin: {
+                    readonly $ref: "#/$defs/KeyOrigin";
+                };
+                readonly exportable: {
+                    readonly type: "boolean";
+                    readonly description: "Whether the custodian would release the private half. Always `false` for `attestation` and `update` keys. Stated explicitly, never absent.";
+                };
+                readonly neverExportable: {
+                    readonly type: "boolean";
+                    readonly description: "True when no authority can make the key exportable. `true` implies `exportable: false`.";
+                };
+                readonly inBackups: {
+                    readonly type: "boolean";
+                    readonly description: "Whether the key, or material it can be re-derived or decrypted from, is in the VTA's backups or any state transfer. Always `false` for `attestation` and `update` keys (VTI-KEY-112).";
+                };
+                readonly protection: {
+                    readonly $ref: "#/$defs/ProtectionClass";
+                };
+                readonly boundary: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "Opaque, VTA-assigned label of the protection boundary holding the key (CONVENTIONS.md §5.2). Two keys with the same label are lost or compromised together. A recovery update key MUST carry a label different from every routine update key's. Custody projection only; never published.";
+                };
+                readonly destroyed: {
+                    readonly type: "boolean";
+                    readonly description: "True once the private half has been destroyed — a retired `attestation` or `messaging` key. The record survives so the key's past signatures stay attributable.";
+                };
+            };
+        };
+        readonly ProtectionClass: {
+            readonly title: "ProtectionClass";
+            readonly type: "string";
+            readonly enum: readonly ["software", "encryptedAtRest", "enclave", "hardwareModule", "externalCustodian"];
+            readonly description: "How a private half is protected (CONVENTIONS.md §5.2). `software` — stored by the VTA without encryption independent of the host (a plain VTA). `encryptedAtRest` — wrapped under a key the VTA holds outside its store (a hardened VTA). `enclave` — held only inside an attested trusted execution environment, wrapped under a key released only to its measurement (a TEE VTA). `hardwareModule` — held by a hardware security module or cloud key service that performs the operation without releasing the key. `externalCustodian` — not held by this VTA at all: a recovery update key, or an `authenticator` key on a person's device.";
+        };
+        readonly KeyOrigin: {
+            readonly title: "KeyOrigin";
+            readonly type: "string";
+            readonly enum: readonly ["derived", "imported", "internal"];
+            readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.";
+            readonly default: "derived";
+        };
+        readonly KeyLifecycleState: {
+            readonly title: "KeyLifecycleState";
+            readonly type: "string";
+            readonly enum: readonly ["pending", "staged", "active", "retiring", "retired", "revoked", "committed"];
+            readonly description: "Where a key is in its role's lifecycle (CONVENTIONS.md §8, §10). `pending` — planned by a preview or a change awaiting approval; not published; custody projection only. `staged` — published and bound to its role but not yet used, until the publishing change's cache horizon. `active` — the key the VTA uses for new signatures (for `messaging`, advertises for new sessions; for `update`, the current authority). `retiring` — still published but never used to sign again; a retiring `messaging` key still decrypts until retirement. `retired` — removed by planned rotation; what it signed while published stays valid, judged against the identifier version current at issuance. `revoked` — withdrawn for compromise, recorded with `compromisedSince`; what it signed from then on establishes nothing. `committed` — an `update` key the identifier commits to as a successor but has not revealed (a did:webvh `nextKeyHashes` entry, a KERI next-key digest). `retired` and `revoked` are terminal.";
+        };
+        readonly DidVerificationRelationship: {
+            readonly title: "DidVerificationRelationship";
+            readonly type: "string";
+            readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+            readonly description: "A DID Core verification relationship.";
+        };
+        readonly UpdateKeyClass: {
+            readonly title: "UpdateKeyClass";
+            readonly type: "string";
+            readonly enum: readonly ["routine", "recovery"];
+            readonly description: "For an `update` key only (CONVENTIONS.md §5.3). `routine` — generated and held by the VTA, which authorizes the identity's ordinary changes with it. `recovery` — held by a recovery custodian in a protection boundary other than the VTA's; the VTA holds only its commitment, carries that commitment forward in every change it makes, and can use the key only by asking the custodian for a proof (`RecoverySigningRequest`).";
+        };
+        readonly KeyType: {
+            readonly title: "KeyType";
+            readonly type: "string";
+            readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+            readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+        };
+        readonly KeyListProjection: {
+            readonly title: "KeyListProjection";
+            readonly type: "string";
+            readonly enum: readonly ["public", "custody"];
+            readonly description: "Which view of the identity's key roles the caller was given (CONVENTIONS.md §11). `public` — only what the published identifier document and history already reveal. `custody` — additionally the VTA's custody state: pending keys, the custodian record and protection boundary behind each key, overlap deadlines, who initiated and approved each change, and why.";
+        };
+        readonly DidMethodName: {
+            readonly title: "DidMethodName";
+            readonly type: "string";
+            readonly pattern: "^[a-z0-9]+(:[a-z0-9]+)*$";
+            readonly description: "The DID method an identity uses, as the method profile that governs it is named: `webvh` for a did:webvh identity, `scid:vh` for the did:scid:vh:1 form of one, `webs` for did:webs. Deliberately a pattern and not an enumeration: a method is added by publishing its profile under method-profiles/, never by changing this schema. A VTA MUST refuse a method it holds no profile for, or whose profile declares it ineligible, with `vta/dids:methodNotEligible`.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/dids/keys/list/1.0";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/vta/dids/keys/list/1.0";
+        readonly title: "VTA DIDs — Keys List — payload";
+        readonly description: "List the key roles of a key-role identity a VTA holds keys for: each role's keys and their states, the update authority and recovery commitment, and optionally the rotation history, in the public or custody projection (CONVENTIONS.md §11).";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["did"];
+        readonly properties: {
+            readonly did: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "The key-role identity, by DID (for a `did:scid` identity, the DID without `src`).";
+            };
+            readonly roles: {
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly uniqueItems: true;
+                readonly items: {
+                    readonly $ref: "#/$defs/IdentityKeyRole";
+                };
+                readonly description: "Return only these roles. Absent returns every role. Present-but-empty is refused by the schema rather than read as 'every role'.";
+            };
+            readonly includeEnded: {
+                readonly type: "boolean";
+                readonly description: "Include `retired` and `revoked` keys. Absent reads as false. A `revoked` key the document still lists is always included.";
+            };
+            readonly includeHistory: {
+                readonly type: "boolean";
+                readonly description: "Include the rotation history. Absent reads as false.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTA DIDs — Keys List — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["did", "method", "versionId", "projection", "roles"];
+                readonly properties: {
+                    readonly did: {
+                        readonly type: "string";
+                    };
+                    readonly method: {
+                        readonly $ref: "#/$defs/DidMethodName";
+                    };
+                    readonly versionId: {
+                        readonly type: "string";
+                        readonly description: "The version the answer describes. Pass it as `expectedVersionId` to a change made on its strength.";
+                    };
+                    readonly projection: {
+                        readonly $ref: "#/$defs/KeyListProjection";
+                    };
+                    readonly roles: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/KeyRoleSummary";
+                        };
+                        readonly description: "One entry per role asked for, including roles with no keys.";
+                    };
+                    readonly rotations: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/KeyChangeRecord";
+                        };
+                        readonly description: "Present exactly when `includeHistory` was true. Newest first.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly KeyChangeRecord: {
+                readonly title: "KeyChangeRecord";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["rotationId", "role", "kind", "state"];
+                readonly description: "One change to a role's key set, from preview to completion. The identifier's history is the authority for what was published; this record adds which change was which and, in the custody projection, who asked, who approved, and why.";
+                readonly properties: {
+                    readonly rotationId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/IdentityKeyRole";
+                    };
+                    readonly kind: {
+                        readonly $ref: "#/$defs/KeyChangeKind";
+                    };
+                    readonly state: {
+                        readonly $ref: "#/$defs/KeyChangeState";
+                    };
+                    readonly predecessors: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Verification-method identifiers (for `update`, public keys or commitments) leaving the role.";
+                    };
+                    readonly successors: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Verification-method identifiers (for `update`, public keys or commitments) entering the role.";
+                    };
+                    readonly startedInVersionId: {
+                        readonly type: "string";
+                    };
+                    readonly endedInVersionId: {
+                        readonly type: "string";
+                    };
+                    readonly startedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly cacheHorizonAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Planned rotations: the publishing change's cache horizon (CONVENTIONS.md §10.1). The switch and any retirement happen no earlier.";
+                    };
+                    readonly activatesAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the successor becomes `active` and the predecessor `retiring`; never before `cacheHorizonAt`.";
+                    };
+                    readonly overlapUntil: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Custody projection only. End of the overlap.";
+                    };
+                    readonly autoRetire: {
+                        readonly type: "boolean";
+                        readonly description: "Custody projection only. Whether the VTA retires the predecessor itself at `overlapUntil`.";
+                    };
+                    readonly endedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly initiatedBy: {
+                        readonly type: "string";
+                        readonly description: "Custody projection only. VID of the administrator whose signed request started the change.";
+                    };
+                    readonly approvals: {
+                        readonly $ref: "#/$defs/KeyChangeApprovalState";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "Custody projection only. The operator's stated reason. Never published.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly KeyChangeApprovalState: {
+                readonly title: "KeyChangeApprovalState";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["required", "received", "expiresAt"];
+                readonly description: "Approval progress of a change the VTA's policy gates on approvals (CONVENTIONS.md §6).";
+                readonly properties: {
+                    readonly required: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Distinct approvals the VTA's policy requires.";
+                    };
+                    readonly received: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Distinct approvals recorded so far, the initiator's own included.";
+                    };
+                    readonly approvals: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/RecordedApproval";
+                        };
+                        readonly description: "The approvals recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                    };
+                };
+            };
+            readonly RecordedApproval: {
+                readonly title: "RecordedApproval";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["approver", "evidence"];
+                readonly properties: {
+                    readonly approver: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the approver.";
+                    };
+                    readonly evidence: {
+                        readonly $ref: "#/$defs/ApprovalEvidenceKind";
+                    };
+                    readonly recordedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly ApprovalEvidenceKind: {
+                readonly title: "ApprovalEvidenceKind";
+                readonly type: "string";
+                readonly enum: readonly ["didSigned", "webauthn", "approverSigned"];
+                readonly description: "The evidence an approval was recorded on, as `auth/step-up/approve-response` names it. Only the approver's own evidence is ever recorded: a proof by a key the VTA records as acting for an approver — a console signing key or any other delegation — is never an approval (CONVENTIONS.md §6.3).";
+            };
+            readonly KeyChangeState: {
+                readonly title: "KeyChangeState";
+                readonly type: "string";
+                readonly enum: readonly ["pendingApproval", "awaitingRecoveryProof", "staged", "overlapping", "completed", "aborted", "expired"];
+                readonly description: "`pendingApproval` — awaiting the approvals the VTA's policy requires; nothing is published. `awaitingRecoveryProof` — approved, and waiting for the recovery custodian's proof over the change; nothing is published. `staged` — successor published, not yet used. `overlapping` — successor active, predecessor `retiring`. `completed` — every predecessor retired, or the change is published and any overlap it began has ended. `aborted` — the successor was retired instead of the predecessor, or a revocation superseded the change. `expired` — the approvals or the recovery proof did not arrive before the preview expired; nothing was published.";
+            };
+            readonly KeyChangeKind: {
+                readonly title: "KeyChangeKind";
+                readonly type: "string";
+                readonly enum: readonly ["planned", "compromise", "addition", "recovery"];
+                readonly description: "`planned` — a successor was staged, activated, and the predecessor retired on the operator's schedule. `compromise` — a key was revoked and, where the role would otherwise be empty, replaced in the same change. `addition` — a key joined a role without anything leaving it. `recovery` — the identifier's update authority moved to the committed recovery key, because the VTA's own update keys were lost or may be in someone else's hands.";
+            };
+            readonly IdentityKeyRole: {
+                readonly title: "IdentityKeyRole";
+                readonly type: "string";
+                readonly enum: readonly ["attestation", "operational", "messaging", "update", "authenticator"];
+                readonly description: "The named key role a key occupies in an identity (CONVENTIONS.md §2; VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the identity's attestation artefacts (credentials, endorsements, status lists) through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys the identity's own process uses in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP signatures, invitations, notices, audit checkpoints). Derived. `messaging` — the only keys in `keyAgreement`; sign nothing. X25519, derived or generated in its own right and never converted from a signing key. `update` — the identifier's change authority as its DID method states it (a did:webvh log's `updateKeys` and `nextKeyHashes`, a KERI key event log's current and next keys); never a role-bound verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup, and always accompanied by a committed recovery key held outside the VTA's protection boundary. `authenticator` — a key held on a person's own authenticator (a WebAuthn passkey), listed in `authentication` of that person's identity only; used only to verify the person's WebAuthn assertions (sign-in and step-up evidence) and never to accept a Data Integrity proof. The VTA never holds its private half, so it is enrolled by the passkey ceremony and never generated, added or rotated by these tasks. Never permitted on the durable identity of a VTA, a VTC or a VTN. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075). The set is an extensible registry: a consumer that meets a role it does not implement MUST rely on the key for nothing, and MUST NOT map it onto a role it does know (VTI-KEY-074).";
+            };
+            readonly KeyRoleSummary: {
+                readonly title: "KeyRoleSummary";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["role", "relationships", "keys"];
+                readonly properties: {
+                    readonly role: {
+                        readonly $ref: "#/$defs/IdentityKeyRole";
+                    };
+                    readonly relationships: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidVerificationRelationship";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "The relationship this role owns. Empty for `update`.";
+                    };
+                    readonly keys: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/IdentityRoleKey";
+                        };
+                        readonly description: "The role's keys, in the order the document publishes them. Terminal-state keys are included only when the request asked for them, except a `revoked` key the document still lists, which is always included.";
+                    };
+                    readonly recoveryCommitted: {
+                        readonly type: "boolean";
+                        readonly description: "`update` only: whether the identifier's latest version commits to a recovery key in a boundary other than the VTA's (CONVENTIONS.md §5.3). `false` is a defect the VTA reports rather than hides.";
+                    };
+                    readonly threshold: {
+                        readonly type: "string";
+                        readonly description: "`update` only, where the method has one: the signing threshold over the current update keys, in the method's own notation (a KERI `kt`).";
+                    };
+                };
+            };
+            readonly IdentityRoleKey: {
+                readonly title: "IdentityRoleKey";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["role", "keyType", "state"];
+                readonly description: "One key in one role. A key is in exactly one role for its whole life; a change of role is a retirement from one and an addition to another, with fresh material under a fresh identifier.";
+                readonly properties: {
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The full verification-method identifier (`did#fragment`) the document publishes the key under and lists in `keyRoles`. Absent for `update` keys, which are never role-bound verification methods (VTI-KEY-093). A VTA minting a method SHOULD derive its fragment from the key (VTI-KEY-150).";
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/IdentityKeyRole";
+                    };
+                    readonly updateKeyClass: {
+                        readonly $ref: "#/$defs/UpdateKeyClass";
+                    };
+                    readonly relationships: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidVerificationRelationship";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "The relationships the key is (or, while `pending`, will be) listed in: always exactly its role's one relationship. Empty for `update`, `retired` and `revoked` keys.";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly publicKeyMultibase: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The public half, multibase-encoded, exactly as published. Absent for a `committed` update key, whose public half the identifier has not yet revealed.";
+                    };
+                    readonly commitment: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "For a `committed` update key: the commitment the identifier publishes (a did:webvh `nextKeyHashes` entry, a KERI next-key digest), in the method's own encoding.";
+                    };
+                    readonly state: {
+                        readonly $ref: "#/$defs/KeyLifecycleState";
+                    };
+                    readonly publishedInVersionId: {
+                        readonly type: "string";
+                        readonly description: "The method's version identifier of the change that first published the key or its commitment (method-profiles/: a did:webvh `versionId`, a KERI event's sequence number and digest). Absent while `pending`.";
+                    };
+                    readonly removedInVersionId: {
+                        readonly type: "string";
+                        readonly description: "Version identifier of the change that retired or revoked the key.";
+                    };
+                    readonly activatesAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "For a `staged` key: when the VTA will begin using it — no earlier than the publishing change's cache horizon.";
+                    };
+                    readonly retireAfter: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "For a `retiring` key: the end of its overlap. Custody projection only.";
+                    };
+                    readonly compromisedSince: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "For a `revoked` key: the compromise time (VTI-KEY-121), published as the verification method's `revoked` value. Where it cannot be established, the time the key was first published.";
+                    };
+                    readonly rotationId: {
+                        readonly type: "string";
+                        readonly description: "The rotation this key was introduced or retired by.";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "Operator-facing label. Custody projection only.";
+                    };
+                    readonly custody: {
+                        readonly $ref: "#/$defs/IdentityKeyCustody";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly IdentityKeyCustody: {
+                readonly title: "IdentityKeyCustody";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["exportable", "neverExportable", "inBackups", "protection"];
+                readonly description: "How a key is held. Present only in the custody projection. Carries no key material, and a conforming VTA MUST NOT place any in `ext`.";
+                readonly properties: {
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The custodian record identifier (`keys/*`'s `keyId`) behind this key. Absent for a key this VTA does not hold (`protection: externalCustodian`).";
+                    };
+                    readonly origin: {
+                        readonly $ref: "#/$defs/KeyOrigin";
+                    };
+                    readonly exportable: {
+                        readonly type: "boolean";
+                        readonly description: "Whether the custodian would release the private half. Always `false` for `attestation` and `update` keys. Stated explicitly, never absent.";
+                    };
+                    readonly neverExportable: {
+                        readonly type: "boolean";
+                        readonly description: "True when no authority can make the key exportable. `true` implies `exportable: false`.";
+                    };
+                    readonly inBackups: {
+                        readonly type: "boolean";
+                        readonly description: "Whether the key, or material it can be re-derived or decrypted from, is in the VTA's backups or any state transfer. Always `false` for `attestation` and `update` keys (VTI-KEY-112).";
+                    };
+                    readonly protection: {
+                        readonly $ref: "#/$defs/ProtectionClass";
+                    };
+                    readonly boundary: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "Opaque, VTA-assigned label of the protection boundary holding the key (CONVENTIONS.md §5.2). Two keys with the same label are lost or compromised together. A recovery update key MUST carry a label different from every routine update key's. Custody projection only; never published.";
+                    };
+                    readonly destroyed: {
+                        readonly type: "boolean";
+                        readonly description: "True once the private half has been destroyed — a retired `attestation` or `messaging` key. The record survives so the key's past signatures stay attributable.";
+                    };
+                };
+            };
+            readonly ProtectionClass: {
+                readonly title: "ProtectionClass";
+                readonly type: "string";
+                readonly enum: readonly ["software", "encryptedAtRest", "enclave", "hardwareModule", "externalCustodian"];
+                readonly description: "How a private half is protected (CONVENTIONS.md §5.2). `software` — stored by the VTA without encryption independent of the host (a plain VTA). `encryptedAtRest` — wrapped under a key the VTA holds outside its store (a hardened VTA). `enclave` — held only inside an attested trusted execution environment, wrapped under a key released only to its measurement (a TEE VTA). `hardwareModule` — held by a hardware security module or cloud key service that performs the operation without releasing the key. `externalCustodian` — not held by this VTA at all: a recovery update key, or an `authenticator` key on a person's device.";
+            };
+            readonly KeyOrigin: {
+                readonly title: "KeyOrigin";
+                readonly type: "string";
+                readonly enum: readonly ["derived", "imported", "internal"];
+                readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.";
+                readonly default: "derived";
+            };
+            readonly KeyLifecycleState: {
+                readonly title: "KeyLifecycleState";
+                readonly type: "string";
+                readonly enum: readonly ["pending", "staged", "active", "retiring", "retired", "revoked", "committed"];
+                readonly description: "Where a key is in its role's lifecycle (CONVENTIONS.md §8, §10). `pending` — planned by a preview or a change awaiting approval; not published; custody projection only. `staged` — published and bound to its role but not yet used, until the publishing change's cache horizon. `active` — the key the VTA uses for new signatures (for `messaging`, advertises for new sessions; for `update`, the current authority). `retiring` — still published but never used to sign again; a retiring `messaging` key still decrypts until retirement. `retired` — removed by planned rotation; what it signed while published stays valid, judged against the identifier version current at issuance. `revoked` — withdrawn for compromise, recorded with `compromisedSince`; what it signed from then on establishes nothing. `committed` — an `update` key the identifier commits to as a successor but has not revealed (a did:webvh `nextKeyHashes` entry, a KERI next-key digest). `retired` and `revoked` are terminal.";
+            };
+            readonly DidVerificationRelationship: {
+                readonly title: "DidVerificationRelationship";
+                readonly type: "string";
+                readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+                readonly description: "A DID Core verification relationship.";
+            };
+            readonly UpdateKeyClass: {
+                readonly title: "UpdateKeyClass";
+                readonly type: "string";
+                readonly enum: readonly ["routine", "recovery"];
+                readonly description: "For an `update` key only (CONVENTIONS.md §5.3). `routine` — generated and held by the VTA, which authorizes the identity's ordinary changes with it. `recovery` — held by a recovery custodian in a protection boundary other than the VTA's; the VTA holds only its commitment, carries that commitment forward in every change it makes, and can use the key only by asking the custodian for a proof (`RecoverySigningRequest`).";
+            };
+            readonly KeyType: {
+                readonly title: "KeyType";
+                readonly type: "string";
+                readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+                readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+            };
+            readonly KeyListProjection: {
+                readonly title: "KeyListProjection";
+                readonly type: "string";
+                readonly enum: readonly ["public", "custody"];
+                readonly description: "Which view of the identity's key roles the caller was given (CONVENTIONS.md §11). `public` — only what the published identifier document and history already reveal. `custody` — additionally the VTA's custody state: pending keys, the custodian record and protection boundary behind each key, overlap deadlines, who initiated and approved each change, and why.";
+            };
+            readonly DidMethodName: {
+                readonly title: "DidMethodName";
+                readonly type: "string";
+                readonly pattern: "^[a-z0-9]+(:[a-z0-9]+)*$";
+                readonly description: "The DID method an identity uses, as the method profile that governs it is named: `webvh` for a did:webvh identity, `scid:vh` for the did:scid:vh:1 form of one, `webs` for did:webs. Deliberately a pattern and not an enumeration: a method is added by publishing its profile under method-profiles/, never by changing this schema. A VTA MUST refuse a method it holds no profile for, or whose profile declares it ineligible, with `vta/dids:methodNotEligible`.";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/dids/keys/list/1.0#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTA DIDs — Keys List — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["did", "method", "versionId", "projection", "roles"];
+                readonly properties: {
+                    readonly did: {
+                        readonly type: "string";
+                    };
+                    readonly method: {
+                        readonly $ref: "#/$defs/DidMethodName";
+                    };
+                    readonly versionId: {
+                        readonly type: "string";
+                        readonly description: "The version the answer describes. Pass it as `expectedVersionId` to a change made on its strength.";
+                    };
+                    readonly projection: {
+                        readonly $ref: "#/$defs/KeyListProjection";
+                    };
+                    readonly roles: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/KeyRoleSummary";
+                        };
+                        readonly description: "One entry per role asked for, including roles with no keys.";
+                    };
+                    readonly rotations: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/KeyChangeRecord";
+                        };
+                        readonly description: "Present exactly when `includeHistory` was true. Newest first.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly KeyChangeRecord: {
+                readonly title: "KeyChangeRecord";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["rotationId", "role", "kind", "state"];
+                readonly description: "One change to a role's key set, from preview to completion. The identifier's history is the authority for what was published; this record adds which change was which and, in the custody projection, who asked, who approved, and why.";
+                readonly properties: {
+                    readonly rotationId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/IdentityKeyRole";
+                    };
+                    readonly kind: {
+                        readonly $ref: "#/$defs/KeyChangeKind";
+                    };
+                    readonly state: {
+                        readonly $ref: "#/$defs/KeyChangeState";
+                    };
+                    readonly predecessors: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Verification-method identifiers (for `update`, public keys or commitments) leaving the role.";
+                    };
+                    readonly successors: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Verification-method identifiers (for `update`, public keys or commitments) entering the role.";
+                    };
+                    readonly startedInVersionId: {
+                        readonly type: "string";
+                    };
+                    readonly endedInVersionId: {
+                        readonly type: "string";
+                    };
+                    readonly startedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly cacheHorizonAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Planned rotations: the publishing change's cache horizon (CONVENTIONS.md §10.1). The switch and any retirement happen no earlier.";
+                    };
+                    readonly activatesAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the successor becomes `active` and the predecessor `retiring`; never before `cacheHorizonAt`.";
+                    };
+                    readonly overlapUntil: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "Custody projection only. End of the overlap.";
+                    };
+                    readonly autoRetire: {
+                        readonly type: "boolean";
+                        readonly description: "Custody projection only. Whether the VTA retires the predecessor itself at `overlapUntil`.";
+                    };
+                    readonly endedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly initiatedBy: {
+                        readonly type: "string";
+                        readonly description: "Custody projection only. VID of the administrator whose signed request started the change.";
+                    };
+                    readonly approvals: {
+                        readonly $ref: "#/$defs/KeyChangeApprovalState";
+                    };
+                    readonly reason: {
+                        readonly type: "string";
+                        readonly maxLength: 1024;
+                        readonly description: "Custody projection only. The operator's stated reason. Never published.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly KeyChangeApprovalState: {
+                readonly title: "KeyChangeApprovalState";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["required", "received", "expiresAt"];
+                readonly description: "Approval progress of a change the VTA's policy gates on approvals (CONVENTIONS.md §6).";
+                readonly properties: {
+                    readonly required: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Distinct approvals the VTA's policy requires.";
+                    };
+                    readonly received: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Distinct approvals recorded so far, the initiator's own included.";
+                    };
+                    readonly approvals: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/RecordedApproval";
+                        };
+                        readonly description: "The approvals recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                    };
+                };
+            };
+            readonly RecordedApproval: {
+                readonly title: "RecordedApproval";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["approver", "evidence"];
+                readonly properties: {
+                    readonly approver: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the approver.";
+                    };
+                    readonly evidence: {
+                        readonly $ref: "#/$defs/ApprovalEvidenceKind";
+                    };
+                    readonly recordedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly ApprovalEvidenceKind: {
+                readonly title: "ApprovalEvidenceKind";
+                readonly type: "string";
+                readonly enum: readonly ["didSigned", "webauthn", "approverSigned"];
+                readonly description: "The evidence an approval was recorded on, as `auth/step-up/approve-response` names it. Only the approver's own evidence is ever recorded: a proof by a key the VTA records as acting for an approver — a console signing key or any other delegation — is never an approval (CONVENTIONS.md §6.3).";
+            };
+            readonly KeyChangeState: {
+                readonly title: "KeyChangeState";
+                readonly type: "string";
+                readonly enum: readonly ["pendingApproval", "awaitingRecoveryProof", "staged", "overlapping", "completed", "aborted", "expired"];
+                readonly description: "`pendingApproval` — awaiting the approvals the VTA's policy requires; nothing is published. `awaitingRecoveryProof` — approved, and waiting for the recovery custodian's proof over the change; nothing is published. `staged` — successor published, not yet used. `overlapping` — successor active, predecessor `retiring`. `completed` — every predecessor retired, or the change is published and any overlap it began has ended. `aborted` — the successor was retired instead of the predecessor, or a revocation superseded the change. `expired` — the approvals or the recovery proof did not arrive before the preview expired; nothing was published.";
+            };
+            readonly KeyChangeKind: {
+                readonly title: "KeyChangeKind";
+                readonly type: "string";
+                readonly enum: readonly ["planned", "compromise", "addition", "recovery"];
+                readonly description: "`planned` — a successor was staged, activated, and the predecessor retired on the operator's schedule. `compromise` — a key was revoked and, where the role would otherwise be empty, replaced in the same change. `addition` — a key joined a role without anything leaving it. `recovery` — the identifier's update authority moved to the committed recovery key, because the VTA's own update keys were lost or may be in someone else's hands.";
+            };
+            readonly IdentityKeyRole: {
+                readonly title: "IdentityKeyRole";
+                readonly type: "string";
+                readonly enum: readonly ["attestation", "operational", "messaging", "update", "authenticator"];
+                readonly description: "The named key role a key occupies in an identity (CONVENTIONS.md §2; VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the identity's attestation artefacts (credentials, endorsements, status lists) through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys the identity's own process uses in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP signatures, invitations, notices, audit checkpoints). Derived. `messaging` — the only keys in `keyAgreement`; sign nothing. X25519, derived or generated in its own right and never converted from a signing key. `update` — the identifier's change authority as its DID method states it (a did:webvh log's `updateKeys` and `nextKeyHashes`, a KERI key event log's current and next keys); never a role-bound verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup, and always accompanied by a committed recovery key held outside the VTA's protection boundary. `authenticator` — a key held on a person's own authenticator (a WebAuthn passkey), listed in `authentication` of that person's identity only; used only to verify the person's WebAuthn assertions (sign-in and step-up evidence) and never to accept a Data Integrity proof. The VTA never holds its private half, so it is enrolled by the passkey ceremony and never generated, added or rotated by these tasks. Never permitted on the durable identity of a VTA, a VTC or a VTN. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075). The set is an extensible registry: a consumer that meets a role it does not implement MUST rely on the key for nothing, and MUST NOT map it onto a role it does know (VTI-KEY-074).";
+            };
+            readonly KeyRoleSummary: {
+                readonly title: "KeyRoleSummary";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["role", "relationships", "keys"];
+                readonly properties: {
+                    readonly role: {
+                        readonly $ref: "#/$defs/IdentityKeyRole";
+                    };
+                    readonly relationships: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidVerificationRelationship";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "The relationship this role owns. Empty for `update`.";
+                    };
+                    readonly keys: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/IdentityRoleKey";
+                        };
+                        readonly description: "The role's keys, in the order the document publishes them. Terminal-state keys are included only when the request asked for them, except a `revoked` key the document still lists, which is always included.";
+                    };
+                    readonly recoveryCommitted: {
+                        readonly type: "boolean";
+                        readonly description: "`update` only: whether the identifier's latest version commits to a recovery key in a boundary other than the VTA's (CONVENTIONS.md §5.3). `false` is a defect the VTA reports rather than hides.";
+                    };
+                    readonly threshold: {
+                        readonly type: "string";
+                        readonly description: "`update` only, where the method has one: the signing threshold over the current update keys, in the method's own notation (a KERI `kt`).";
+                    };
+                };
+            };
+            readonly IdentityRoleKey: {
+                readonly title: "IdentityRoleKey";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["role", "keyType", "state"];
+                readonly description: "One key in one role. A key is in exactly one role for its whole life; a change of role is a retirement from one and an addition to another, with fresh material under a fresh identifier.";
+                readonly properties: {
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The full verification-method identifier (`did#fragment`) the document publishes the key under and lists in `keyRoles`. Absent for `update` keys, which are never role-bound verification methods (VTI-KEY-093). A VTA minting a method SHOULD derive its fragment from the key (VTI-KEY-150).";
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/IdentityKeyRole";
+                    };
+                    readonly updateKeyClass: {
+                        readonly $ref: "#/$defs/UpdateKeyClass";
+                    };
+                    readonly relationships: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidVerificationRelationship";
+                        };
+                        readonly uniqueItems: true;
+                        readonly description: "The relationships the key is (or, while `pending`, will be) listed in: always exactly its role's one relationship. Empty for `update`, `retired` and `revoked` keys.";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly publicKeyMultibase: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The public half, multibase-encoded, exactly as published. Absent for a `committed` update key, whose public half the identifier has not yet revealed.";
+                    };
+                    readonly commitment: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "For a `committed` update key: the commitment the identifier publishes (a did:webvh `nextKeyHashes` entry, a KERI next-key digest), in the method's own encoding.";
+                    };
+                    readonly state: {
+                        readonly $ref: "#/$defs/KeyLifecycleState";
+                    };
+                    readonly publishedInVersionId: {
+                        readonly type: "string";
+                        readonly description: "The method's version identifier of the change that first published the key or its commitment (method-profiles/: a did:webvh `versionId`, a KERI event's sequence number and digest). Absent while `pending`.";
+                    };
+                    readonly removedInVersionId: {
+                        readonly type: "string";
+                        readonly description: "Version identifier of the change that retired or revoked the key.";
+                    };
+                    readonly activatesAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "For a `staged` key: when the VTA will begin using it — no earlier than the publishing change's cache horizon.";
+                    };
+                    readonly retireAfter: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "For a `retiring` key: the end of its overlap. Custody projection only.";
+                    };
+                    readonly compromisedSince: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "For a `revoked` key: the compromise time (VTI-KEY-121), published as the verification method's `revoked` value. Where it cannot be established, the time the key was first published.";
+                    };
+                    readonly rotationId: {
+                        readonly type: "string";
+                        readonly description: "The rotation this key was introduced or retired by.";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly description: "Operator-facing label. Custody projection only.";
+                    };
+                    readonly custody: {
+                        readonly $ref: "#/$defs/IdentityKeyCustody";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly IdentityKeyCustody: {
+                readonly title: "IdentityKeyCustody";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["exportable", "neverExportable", "inBackups", "protection"];
+                readonly description: "How a key is held. Present only in the custody projection. Carries no key material, and a conforming VTA MUST NOT place any in `ext`.";
+                readonly properties: {
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The custodian record identifier (`keys/*`'s `keyId`) behind this key. Absent for a key this VTA does not hold (`protection: externalCustodian`).";
+                    };
+                    readonly origin: {
+                        readonly $ref: "#/$defs/KeyOrigin";
+                    };
+                    readonly exportable: {
+                        readonly type: "boolean";
+                        readonly description: "Whether the custodian would release the private half. Always `false` for `attestation` and `update` keys. Stated explicitly, never absent.";
+                    };
+                    readonly neverExportable: {
+                        readonly type: "boolean";
+                        readonly description: "True when no authority can make the key exportable. `true` implies `exportable: false`.";
+                    };
+                    readonly inBackups: {
+                        readonly type: "boolean";
+                        readonly description: "Whether the key, or material it can be re-derived or decrypted from, is in the VTA's backups or any state transfer. Always `false` for `attestation` and `update` keys (VTI-KEY-112).";
+                    };
+                    readonly protection: {
+                        readonly $ref: "#/$defs/ProtectionClass";
+                    };
+                    readonly boundary: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "Opaque, VTA-assigned label of the protection boundary holding the key (CONVENTIONS.md §5.2). Two keys with the same label are lost or compromised together. A recovery update key MUST carry a label different from every routine update key's. Custody projection only; never published.";
+                    };
+                    readonly destroyed: {
+                        readonly type: "boolean";
+                        readonly description: "True once the private half has been destroyed — a retired `attestation` or `messaging` key. The record survives so the key's past signatures stay attributable.";
+                    };
+                };
+            };
+            readonly ProtectionClass: {
+                readonly title: "ProtectionClass";
+                readonly type: "string";
+                readonly enum: readonly ["software", "encryptedAtRest", "enclave", "hardwareModule", "externalCustodian"];
+                readonly description: "How a private half is protected (CONVENTIONS.md §5.2). `software` — stored by the VTA without encryption independent of the host (a plain VTA). `encryptedAtRest` — wrapped under a key the VTA holds outside its store (a hardened VTA). `enclave` — held only inside an attested trusted execution environment, wrapped under a key released only to its measurement (a TEE VTA). `hardwareModule` — held by a hardware security module or cloud key service that performs the operation without releasing the key. `externalCustodian` — not held by this VTA at all: a recovery update key, or an `authenticator` key on a person's device.";
+            };
+            readonly KeyOrigin: {
+                readonly title: "KeyOrigin";
+                readonly type: "string";
+                readonly enum: readonly ["derived", "imported", "internal"];
+                readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.";
+                readonly default: "derived";
+            };
+            readonly KeyLifecycleState: {
+                readonly title: "KeyLifecycleState";
+                readonly type: "string";
+                readonly enum: readonly ["pending", "staged", "active", "retiring", "retired", "revoked", "committed"];
+                readonly description: "Where a key is in its role's lifecycle (CONVENTIONS.md §8, §10). `pending` — planned by a preview or a change awaiting approval; not published; custody projection only. `staged` — published and bound to its role but not yet used, until the publishing change's cache horizon. `active` — the key the VTA uses for new signatures (for `messaging`, advertises for new sessions; for `update`, the current authority). `retiring` — still published but never used to sign again; a retiring `messaging` key still decrypts until retirement. `retired` — removed by planned rotation; what it signed while published stays valid, judged against the identifier version current at issuance. `revoked` — withdrawn for compromise, recorded with `compromisedSince`; what it signed from then on establishes nothing. `committed` — an `update` key the identifier commits to as a successor but has not revealed (a did:webvh `nextKeyHashes` entry, a KERI next-key digest). `retired` and `revoked` are terminal.";
+            };
+            readonly DidVerificationRelationship: {
+                readonly title: "DidVerificationRelationship";
+                readonly type: "string";
+                readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+                readonly description: "A DID Core verification relationship.";
+            };
+            readonly UpdateKeyClass: {
+                readonly title: "UpdateKeyClass";
+                readonly type: "string";
+                readonly enum: readonly ["routine", "recovery"];
+                readonly description: "For an `update` key only (CONVENTIONS.md §5.3). `routine` — generated and held by the VTA, which authorizes the identity's ordinary changes with it. `recovery` — held by a recovery custodian in a protection boundary other than the VTA's; the VTA holds only its commitment, carries that commitment forward in every change it makes, and can use the key only by asking the custodian for a proof (`RecoverySigningRequest`).";
+            };
+            readonly KeyType: {
+                readonly title: "KeyType";
+                readonly type: "string";
+                readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+                readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+            };
+            readonly KeyListProjection: {
+                readonly title: "KeyListProjection";
+                readonly type: "string";
+                readonly enum: readonly ["public", "custody"];
+                readonly description: "Which view of the identity's key roles the caller was given (CONVENTIONS.md §11). `public` — only what the published identifier document and history already reveal. `custody` — additionally the VTA's custody state: pending keys, the custodian record and protection boundary behind each key, overlap deadlines, who initiated and approved each change, and why.";
+            };
+            readonly DidMethodName: {
+                readonly title: "DidMethodName";
+                readonly type: "string";
+                readonly pattern: "^[a-z0-9]+(:[a-z0-9]+)*$";
+                readonly description: "The DID method an identity uses, as the method profile that governs it is named: `webvh` for a did:webvh identity, `scid:vh` for the did:scid:vh:1 form of one, `webs` for did:webs. Deliberately a pattern and not an enumeration: a method is added by publishing its profile under method-profiles/, never by changing this schema. A VTA MUST refuse a method it holds no profile for, or whose profile declares it ineligible, with `vta/dids:methodNotEligible`.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map