@openvtc/trust-tasks 0.28.2 → 0.28.3

package/dist/vta/dids/update/1.0/payload.d.ts

@@ -0,0 +1,1422 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vta/dids/update/1.0/payload.schema.json
+ */
+import type { ApprovalEvidenceKind, DidMethodName, DidVerificationRelationship, Ext, IdentityChange, IdentityChangePreview, IdentityKeyRole, KeyChangeApprovalState, KeyChangeOutcome, KeyType, PreviewWarning, Publication, PublishedArtifact, RecordedApproval, RecoverySigningRequest } from "../../../../_shared/components.js";
+/**
+ * Ask a Verifiable Trust Agent to change a key-role identity's non-key members — services, `alsoKnownAs`, method parameters such as witnesses. Keys change only through the key-role tasks (vta/dids/_shared/0.1/CONVENTIONS.md).
+ */
+export interface VTADIDsUpdatePayload {
+    /**
+     * The key-role identity, by DID (for a `did:scid` identity, the DID without `src`).
+     */
+    did: string;
+    /**
+     * The new identifier document, for methods whose controller writes it. Omit to leave it unchanged. It MUST carry, unchanged, `verificationMethod`, every verification relationship and `keyRoles`: a change to any of them is refused with `vta/dids/update:keyMembersManaged`, because keys change only through the key-role tasks.
+     */
+    document?: {};
+    /**
+     * Validated against the method profile's `UpdateParameters` schema (method-profiles/<method>-parameters.schema.json); a member it does not define, or one fixed at creation, is refused with `vta/dids:methodParameterUnsupported`.
+     */
+    methodParameters?: {};
+    /**
+     * Operator-facing audit label.
+     */
+    label?: string;
+    /**
+     * Optimistic-concurrency precondition: the version identifier (method profile §3) the caller based this change on, for example `keys/list`'s `versionId`. The VTA MUST refuse with `vta/dids:versionConflict` if the identity has moved past it. Not optional for anything a person looked at.
+     */
+    expectedVersionId?: string;
+    /**
+     * Compute and return the preview without writing anything but the plan (CONVENTIONS.md §6.1). Absent reads as false.
+     */
+    dryRun?: boolean;
+    /**
+     * Apply exactly the plan a previous dry run of this same request returned, or nothing (CONVENTIONS.md §6.1); what every approval is bound to.
+     */
+    previewId?: string;
+    /**
+     * Why the change is being made, for the audit trail and for the other approvers. Never published.
+     */
+    reason?: string;
+    ext?: Ext;
+}
+export interface VTADIDsUpdateResponsePayload {
+    did: string;
+    outcome: KeyChangeOutcome;
+    /**
+     * Present when `outcome` is `preview`, `pendingApproval` or `awaitingRecoveryProof`: the plan, and what an approval is bound to.
+     */
+    preview?: IdentityChangePreview;
+    /**
+     * Present when `outcome` is `pendingApproval`.
+     */
+    approvals?: KeyChangeApprovalState;
+    /**
+     * Present when `outcome` is `applied`: the version identifier of the change. Pass it as the next change's `expectedVersionId`.
+     */
+    newVersionId?: string;
+    /**
+     * Present when `outcome` is `applied`.
+     */
+    publication?: Publication;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ApprovalEvidenceKind, DidMethodName, DidVerificationRelationship, Ext, IdentityChange, IdentityChangePreview, IdentityKeyRole, KeyChangeApprovalState, KeyChangeOutcome, KeyType, PreviewWarning, Publication, PublishedArtifact, RecordedApproval, RecoverySigningRequest };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vta/dids/update/1.0";
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export declare const EXTENDS: string | null;
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export declare const DEPRECATION: string | null;
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTADIDsUpdatePayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vta/dids/update/1.0#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTADIDsUpdateResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/vta/dids/update/1.0";
+    readonly title: "VTA DIDs — Update — payload";
+    readonly description: "Ask a Verifiable Trust Agent to change a key-role identity's non-key members — services, `alsoKnownAs`, method parameters such as witnesses. Keys change only through the key-role tasks (vta/dids/_shared/0.1/CONVENTIONS.md).";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["did"];
+    readonly properties: {
+        readonly did: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "The key-role identity, by DID (for a `did:scid` identity, the DID without `src`).";
+        };
+        readonly document: {
+            readonly type: "object";
+            readonly description: "The new identifier document, for methods whose controller writes it. Omit to leave it unchanged. It MUST carry, unchanged, `verificationMethod`, every verification relationship and `keyRoles`: a change to any of them is refused with `vta/dids/update:keyMembersManaged`, because keys change only through the key-role tasks.";
+        };
+        readonly methodParameters: {
+            readonly type: "object";
+            readonly description: "Validated against the method profile's `UpdateParameters` schema (method-profiles/<method>-parameters.schema.json); a member it does not define, or one fixed at creation, is refused with `vta/dids:methodParameterUnsupported`.";
+        };
+        readonly label: {
+            readonly type: "string";
+            readonly maxLength: 256;
+            readonly description: "Operator-facing audit label.";
+        };
+        readonly expectedVersionId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Optimistic-concurrency precondition: the version identifier (method profile §3) the caller based this change on, for example `keys/list`'s `versionId`. The VTA MUST refuse with `vta/dids:versionConflict` if the identity has moved past it. Not optional for anything a person looked at.";
+        };
+        readonly dryRun: {
+            readonly type: "boolean";
+            readonly description: "Compute and return the preview without writing anything but the plan (CONVENTIONS.md §6.1). Absent reads as false.";
+        };
+        readonly previewId: {
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly description: "Apply exactly the plan a previous dry run of this same request returned, or nothing (CONVENTIONS.md §6.1); what every approval is bound to.";
+        };
+        readonly reason: {
+            readonly type: "string";
+            readonly maxLength: 1024;
+            readonly description: "Why the change is being made, for the audit trail and for the other approvers. Never published.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTA DIDs — Update — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["did", "outcome"];
+            readonly properties: {
+                readonly did: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly outcome: {
+                    readonly $ref: "#/$defs/KeyChangeOutcome";
+                };
+                readonly preview: {
+                    readonly $ref: "#/$defs/IdentityChangePreview";
+                    readonly description: "Present when `outcome` is `preview`, `pendingApproval` or `awaitingRecoveryProof`: the plan, and what an approval is bound to.";
+                };
+                readonly approvals: {
+                    readonly $ref: "#/$defs/KeyChangeApprovalState";
+                    readonly description: "Present when `outcome` is `pendingApproval`.";
+                };
+                readonly newVersionId: {
+                    readonly type: "string";
+                    readonly description: "Present when `outcome` is `applied`: the version identifier of the change. Pass it as the next change's `expectedVersionId`.";
+                };
+                readonly publication: {
+                    readonly $ref: "#/$defs/Publication";
+                    readonly description: "Present when `outcome` is `applied`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Publication: {
+            readonly title: "Publication";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["selfPublish"];
+            readonly description: "How the change reaches resolvers.";
+            readonly properties: {
+                readonly selfPublish: {
+                    readonly type: "boolean";
+                    readonly description: "True when no hosting service holds the identifier for the VTA: the caller must publish `artifacts`, and until it does resolvers see the previous version.";
+                };
+                readonly artifacts: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/PublishedArtifact";
+                    };
+                    readonly description: "Present when `selfPublish` is true.";
+                };
+            };
+        };
+        readonly PublishedArtifact: {
+            readonly title: "PublishedArtifact";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["name", "mediaType", "content"];
+            readonly description: "A file the identifier's method publishes, as the method profile names it (`did.jsonl` for did:webvh, `did.json` and `keri.cesr` for did:webs).";
+            readonly properties: {
+                readonly name: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                };
+                readonly mediaType: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly content: {
+                    readonly type: "string";
+                    readonly description: "The artefact's content, or for an append-only artefact the appended part, as text.";
+                };
+            };
+        };
+        readonly KeyChangeApprovalState: {
+            readonly title: "KeyChangeApprovalState";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["required", "received", "expiresAt"];
+            readonly description: "Approval progress of a change the VTA's policy gates on approvals (CONVENTIONS.md §6).";
+            readonly properties: {
+                readonly required: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Distinct approvals the VTA's policy requires.";
+                };
+                readonly received: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Distinct approvals recorded so far, the initiator's own included.";
+                };
+                readonly approvals: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/RecordedApproval";
+                    };
+                    readonly description: "The approvals recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                };
+            };
+        };
+        readonly RecordedApproval: {
+            readonly title: "RecordedApproval";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["approver", "evidence"];
+            readonly properties: {
+                readonly approver: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the approver.";
+                };
+                readonly evidence: {
+                    readonly $ref: "#/$defs/ApprovalEvidenceKind";
+                };
+                readonly recordedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly ApprovalEvidenceKind: {
+            readonly title: "ApprovalEvidenceKind";
+            readonly type: "string";
+            readonly enum: readonly ["didSigned", "webauthn", "approverSigned"];
+            readonly description: "The evidence an approval was recorded on, as `auth/step-up/approve-response` names it. Only the approver's own evidence is ever recorded: a proof by a key the VTA records as acting for an approver — a console signing key or any other delegation — is never an approval (CONVENTIONS.md §6.3).";
+        };
+        readonly IdentityChangePreview: {
+            readonly title: "IdentityChangePreview";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["previewId", "method", "expiresAt", "changes", "document", "updateKeyRotates"];
+            readonly description: "What a change would publish, computed by the VTA by running the handler it would run to apply it (CONVENTIONS.md §6.1). This is what a consent surface renders and what an approval is bound to.";
+            readonly properties: {
+                readonly previewId: {
+                    readonly type: "string";
+                    readonly minLength: 16;
+                    readonly description: "Opaque, unguessable identifier of this exact plan. Carried back by the apply request; every approval and any recovery proof is bound to it.";
+                };
+                readonly method: {
+                    readonly $ref: "#/$defs/DidMethodName";
+                };
+                readonly baseVersionId: {
+                    readonly type: "string";
+                    readonly description: "The version identifier the plan was computed against. Absent only for a creation. The plan is void once the identifier moves past it.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly changes: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/IdentityChange";
+                    };
+                    readonly description: "Every change the plan would make, including the ones the caller did not ask for — in particular any movement of the update authority the method requires.";
+                };
+                readonly document: {
+                    readonly type: "object";
+                    readonly description: "The complete identifier document the change would publish, `keyRoles` included. Public data by construction.";
+                };
+                readonly warnings: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/PreviewWarning";
+                    };
+                    readonly uniqueItems: true;
+                };
+                readonly updateKeyRotates: {
+                    readonly type: "boolean";
+                    readonly description: "True when applying the plan also moves the identifier's update authority to a committed successor — every change under did:webvh pre-rotation, never a KERI interaction event. Stated as its own member because it is the consequence a reviewer most often misses.";
+                };
+                readonly recoverySigning: {
+                    readonly $ref: "#/$defs/RecoverySigningRequest";
+                };
+            };
+        };
+        readonly RecoverySigningRequest: {
+            readonly title: "RecoverySigningRequest";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["commitment", "keyType", "unsignedChange", "proofOptions"];
+            readonly description: "What a recovery custodian must sign for a change that only the recovery key may authorize (CONVENTIONS.md §5.4, §9.4). The custodian MUST check `unsignedChange` itself — render it to its human, confirm that it reveals the recovery key it holds and commits to a fresh recovery key it also holds — and MUST NOT sign on the strength of this request's description alone.";
+            readonly properties: {
+                readonly commitment: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The recovery commitment the identifier publishes; the custodian's key MUST be the one it commits to.";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly unsignedChange: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The change exactly as it will be published, without the recovery proof, as JSON text in the method's own form (a did:webvh log entry, a KERI rotation event).";
+                };
+                readonly proofOptions: {
+                    readonly type: "object";
+                    readonly description: "The proof the method requires over `unsignedChange`, without its signature value, as the method profile defines it (for did:webvh, a Data Integrity proof configuration with `proofPurpose: assertionMethod` and the recovery key's `did:key` as `verificationMethod`).";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly KeyType: {
+            readonly title: "KeyType";
+            readonly type: "string";
+            readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+            readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+        };
+        readonly PreviewWarning: {
+            readonly title: "PreviewWarning";
+            readonly type: "string";
+            readonly enum: readonly ["singleKeyRole", "algorithmNotInAcceptedSet", "roleWillHaveNoClassicalKey", "attestationReissuanceRequired", "selfPublish", "noWitnesses", "protectionBelowPolicy", "recoveryKeyRevealed"];
+            readonly description: "Conditions a human should be shown before approving. `singleKeyRole` — the role will hold one active key. `algorithmNotInAcceptedSet` — a verifier population the VTA knows of does not accept the new key's algorithm. `roleWillHaveNoClassicalKey` — every remaining key is post-quantum. `attestationReissuanceRequired` — revoking this attestation key obliges re-issuance and re-signed status lists (VTI-KEY-133). `selfPublish` — the VTA will not publish the change; the operator must. `noWitnesses` — the identifier has no witnesses, so a party holding the VTA's routine update key can drop the recovery commitment unobserved (CONVENTIONS.md §5.3). `protectionBelowPolicy` — a key will be held at a `ProtectionClass` below what the VTA's policy recommends for its role (a plain VTA holding an attestation key). `recoveryKeyRevealed` — this change uses the recovery key, which must be replaced by a fresh recovery commitment in the same change.";
+        };
+        readonly IdentityChange: {
+            readonly title: "IdentityChange";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["op", "role"];
+            readonly properties: {
+                readonly op: {
+                    readonly type: "string";
+                    readonly enum: readonly ["addKey", "retireKey", "revokeKey", "rotateUpdateKey", "commitUpdateKey", "replaceRecoveryCommitment", "useRecoveryKey"];
+                    readonly description: "`addKey` — a verification method joins its role's relationship and `keyRoles`. `retireKey` — a verification method leaves its relationship, `keyRoles` and the document. `revokeKey` — a verification method leaves its relationship and `keyRoles`, and stays in `verificationMethod` with `revoked` set to the compromise time (CONVENTIONS.md §9.1). `rotateUpdateKey` — the identifier's update authority moves to a committed routine successor. `commitUpdateKey` — a new routine successor is committed. `replaceRecoveryCommitment` — the recovery commitment changes. `useRecoveryKey` — the change is authorized by the recovery key, which the identifier then reveals.";
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/IdentityKeyRole";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly publicKeyMultibase: {
+                    readonly type: "string";
+                };
+                readonly commitment: {
+                    readonly type: "string";
+                };
+                readonly relationships: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidVerificationRelationship";
+                    };
+                    readonly uniqueItems: true;
+                };
+            };
+        };
+        readonly DidVerificationRelationship: {
+            readonly title: "DidVerificationRelationship";
+            readonly type: "string";
+            readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+            readonly description: "A DID Core verification relationship.";
+        };
+        readonly IdentityKeyRole: {
+            readonly title: "IdentityKeyRole";
+            readonly type: "string";
+            readonly enum: readonly ["attestation", "operational", "messaging", "update", "authenticator"];
+            readonly description: "The named key role a key occupies in an identity (CONVENTIONS.md §2; VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the identity's attestation artefacts (credentials, endorsements, status lists) through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys the identity's own process uses in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP signatures, invitations, notices, audit checkpoints). Derived. `messaging` — the only keys in `keyAgreement`; sign nothing. X25519, derived or generated in its own right and never converted from a signing key. `update` — the identifier's change authority as its DID method states it (a did:webvh log's `updateKeys` and `nextKeyHashes`, a KERI key event log's current and next keys); never a role-bound verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup, and always accompanied by a committed recovery key held outside the VTA's protection boundary. `authenticator` — a key held on a person's own authenticator (a WebAuthn passkey), listed in `authentication` of that person's identity only; used only to verify the person's WebAuthn assertions (sign-in and step-up evidence) and never to accept a Data Integrity proof. The VTA never holds its private half, so it is enrolled by the passkey ceremony and never generated, added or rotated by these tasks. Never permitted on the durable identity of a VTA, a VTC or a VTN. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075). The set is an extensible registry: a consumer that meets a role it does not implement MUST rely on the key for nothing, and MUST NOT map it onto a role it does know (VTI-KEY-074).";
+        };
+        readonly DidMethodName: {
+            readonly title: "DidMethodName";
+            readonly type: "string";
+            readonly pattern: "^[a-z0-9]+(:[a-z0-9]+)*$";
+            readonly description: "The DID method an identity uses, as the method profile that governs it is named: `webvh` for a did:webvh identity, `scid:vh` for the did:scid:vh:1 form of one, `webs` for did:webs. Deliberately a pattern and not an enumeration: a method is added by publishing its profile under method-profiles/, never by changing this schema. A VTA MUST refuse a method it holds no profile for, or whose profile declares it ineligible, with `vta/dids:methodNotEligible`.";
+        };
+        readonly KeyChangeOutcome: {
+            readonly title: "KeyChangeOutcome";
+            readonly type: "string";
+            readonly enum: readonly ["preview", "applied", "pendingApproval", "awaitingRecoveryProof"];
+            readonly description: "`preview` — nothing was written; the response carries the plan. `applied` — the change was made (and published, unless `publication.selfPublish`). `pendingApproval` — the plan is recorded and awaits further approvals. `awaitingRecoveryProof` — the plan is approved and waits for the recovery custodian's proof (`preview.recoverySigning`); nothing is published until it arrives.";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTA DIDs — Update — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["did", "outcome"];
+            readonly properties: {
+                readonly did: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly outcome: {
+                    readonly $ref: "#/$defs/KeyChangeOutcome";
+                };
+                readonly preview: {
+                    readonly $ref: "#/$defs/IdentityChangePreview";
+                    readonly description: "Present when `outcome` is `preview`, `pendingApproval` or `awaitingRecoveryProof`: the plan, and what an approval is bound to.";
+                };
+                readonly approvals: {
+                    readonly $ref: "#/$defs/KeyChangeApprovalState";
+                    readonly description: "Present when `outcome` is `pendingApproval`.";
+                };
+                readonly newVersionId: {
+                    readonly type: "string";
+                    readonly description: "Present when `outcome` is `applied`: the version identifier of the change. Pass it as the next change's `expectedVersionId`.";
+                };
+                readonly publication: {
+                    readonly $ref: "#/$defs/Publication";
+                    readonly description: "Present when `outcome` is `applied`.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly Publication: {
+            readonly title: "Publication";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["selfPublish"];
+            readonly description: "How the change reaches resolvers.";
+            readonly properties: {
+                readonly selfPublish: {
+                    readonly type: "boolean";
+                    readonly description: "True when no hosting service holds the identifier for the VTA: the caller must publish `artifacts`, and until it does resolvers see the previous version.";
+                };
+                readonly artifacts: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/PublishedArtifact";
+                    };
+                    readonly description: "Present when `selfPublish` is true.";
+                };
+            };
+        };
+        readonly PublishedArtifact: {
+            readonly title: "PublishedArtifact";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["name", "mediaType", "content"];
+            readonly description: "A file the identifier's method publishes, as the method profile names it (`did.jsonl` for did:webvh, `did.json` and `keri.cesr` for did:webs).";
+            readonly properties: {
+                readonly name: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                };
+                readonly mediaType: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly content: {
+                    readonly type: "string";
+                    readonly description: "The artefact's content, or for an append-only artefact the appended part, as text.";
+                };
+            };
+        };
+        readonly KeyChangeApprovalState: {
+            readonly title: "KeyChangeApprovalState";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["required", "received", "expiresAt"];
+            readonly description: "Approval progress of a change the VTA's policy gates on approvals (CONVENTIONS.md §6).";
+            readonly properties: {
+                readonly required: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly description: "Distinct approvals the VTA's policy requires.";
+                };
+                readonly received: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Distinct approvals recorded so far, the initiator's own included.";
+                };
+                readonly approvals: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/RecordedApproval";
+                    };
+                    readonly description: "The approvals recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                };
+            };
+        };
+        readonly RecordedApproval: {
+            readonly title: "RecordedApproval";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["approver", "evidence"];
+            readonly properties: {
+                readonly approver: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "VID of the approver.";
+                };
+                readonly evidence: {
+                    readonly $ref: "#/$defs/ApprovalEvidenceKind";
+                };
+                readonly recordedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly ApprovalEvidenceKind: {
+            readonly title: "ApprovalEvidenceKind";
+            readonly type: "string";
+            readonly enum: readonly ["didSigned", "webauthn", "approverSigned"];
+            readonly description: "The evidence an approval was recorded on, as `auth/step-up/approve-response` names it. Only the approver's own evidence is ever recorded: a proof by a key the VTA records as acting for an approver — a console signing key or any other delegation — is never an approval (CONVENTIONS.md §6.3).";
+        };
+        readonly IdentityChangePreview: {
+            readonly title: "IdentityChangePreview";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["previewId", "method", "expiresAt", "changes", "document", "updateKeyRotates"];
+            readonly description: "What a change would publish, computed by the VTA by running the handler it would run to apply it (CONVENTIONS.md §6.1). This is what a consent surface renders and what an approval is bound to.";
+            readonly properties: {
+                readonly previewId: {
+                    readonly type: "string";
+                    readonly minLength: 16;
+                    readonly description: "Opaque, unguessable identifier of this exact plan. Carried back by the apply request; every approval and any recovery proof is bound to it.";
+                };
+                readonly method: {
+                    readonly $ref: "#/$defs/DidMethodName";
+                };
+                readonly baseVersionId: {
+                    readonly type: "string";
+                    readonly description: "The version identifier the plan was computed against. Absent only for a creation. The plan is void once the identifier moves past it.";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly changes: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/IdentityChange";
+                    };
+                    readonly description: "Every change the plan would make, including the ones the caller did not ask for — in particular any movement of the update authority the method requires.";
+                };
+                readonly document: {
+                    readonly type: "object";
+                    readonly description: "The complete identifier document the change would publish, `keyRoles` included. Public data by construction.";
+                };
+                readonly warnings: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/PreviewWarning";
+                    };
+                    readonly uniqueItems: true;
+                };
+                readonly updateKeyRotates: {
+                    readonly type: "boolean";
+                    readonly description: "True when applying the plan also moves the identifier's update authority to a committed successor — every change under did:webvh pre-rotation, never a KERI interaction event. Stated as its own member because it is the consequence a reviewer most often misses.";
+                };
+                readonly recoverySigning: {
+                    readonly $ref: "#/$defs/RecoverySigningRequest";
+                };
+            };
+        };
+        readonly RecoverySigningRequest: {
+            readonly title: "RecoverySigningRequest";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["commitment", "keyType", "unsignedChange", "proofOptions"];
+            readonly description: "What a recovery custodian must sign for a change that only the recovery key may authorize (CONVENTIONS.md §5.4, §9.4). The custodian MUST check `unsignedChange` itself — render it to its human, confirm that it reveals the recovery key it holds and commits to a fresh recovery key it also holds — and MUST NOT sign on the strength of this request's description alone.";
+            readonly properties: {
+                readonly commitment: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The recovery commitment the identifier publishes; the custodian's key MUST be the one it commits to.";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly unsignedChange: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The change exactly as it will be published, without the recovery proof, as JSON text in the method's own form (a did:webvh log entry, a KERI rotation event).";
+                };
+                readonly proofOptions: {
+                    readonly type: "object";
+                    readonly description: "The proof the method requires over `unsignedChange`, without its signature value, as the method profile defines it (for did:webvh, a Data Integrity proof configuration with `proofPurpose: assertionMethod` and the recovery key's `did:key` as `verificationMethod`).";
+                };
+                readonly expiresAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly KeyType: {
+            readonly title: "KeyType";
+            readonly type: "string";
+            readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+            readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+        };
+        readonly PreviewWarning: {
+            readonly title: "PreviewWarning";
+            readonly type: "string";
+            readonly enum: readonly ["singleKeyRole", "algorithmNotInAcceptedSet", "roleWillHaveNoClassicalKey", "attestationReissuanceRequired", "selfPublish", "noWitnesses", "protectionBelowPolicy", "recoveryKeyRevealed"];
+            readonly description: "Conditions a human should be shown before approving. `singleKeyRole` — the role will hold one active key. `algorithmNotInAcceptedSet` — a verifier population the VTA knows of does not accept the new key's algorithm. `roleWillHaveNoClassicalKey` — every remaining key is post-quantum. `attestationReissuanceRequired` — revoking this attestation key obliges re-issuance and re-signed status lists (VTI-KEY-133). `selfPublish` — the VTA will not publish the change; the operator must. `noWitnesses` — the identifier has no witnesses, so a party holding the VTA's routine update key can drop the recovery commitment unobserved (CONVENTIONS.md §5.3). `protectionBelowPolicy` — a key will be held at a `ProtectionClass` below what the VTA's policy recommends for its role (a plain VTA holding an attestation key). `recoveryKeyRevealed` — this change uses the recovery key, which must be replaced by a fresh recovery commitment in the same change.";
+        };
+        readonly IdentityChange: {
+            readonly title: "IdentityChange";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["op", "role"];
+            readonly properties: {
+                readonly op: {
+                    readonly type: "string";
+                    readonly enum: readonly ["addKey", "retireKey", "revokeKey", "rotateUpdateKey", "commitUpdateKey", "replaceRecoveryCommitment", "useRecoveryKey"];
+                    readonly description: "`addKey` — a verification method joins its role's relationship and `keyRoles`. `retireKey` — a verification method leaves its relationship, `keyRoles` and the document. `revokeKey` — a verification method leaves its relationship and `keyRoles`, and stays in `verificationMethod` with `revoked` set to the compromise time (CONVENTIONS.md §9.1). `rotateUpdateKey` — the identifier's update authority moves to a committed routine successor. `commitUpdateKey` — a new routine successor is committed. `replaceRecoveryCommitment` — the recovery commitment changes. `useRecoveryKey` — the change is authorized by the recovery key, which the identifier then reveals.";
+                };
+                readonly role: {
+                    readonly $ref: "#/$defs/IdentityKeyRole";
+                };
+                readonly verificationMethod: {
+                    readonly type: "string";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly publicKeyMultibase: {
+                    readonly type: "string";
+                };
+                readonly commitment: {
+                    readonly type: "string";
+                };
+                readonly relationships: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/DidVerificationRelationship";
+                    };
+                    readonly uniqueItems: true;
+                };
+            };
+        };
+        readonly DidVerificationRelationship: {
+            readonly title: "DidVerificationRelationship";
+            readonly type: "string";
+            readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+            readonly description: "A DID Core verification relationship.";
+        };
+        readonly IdentityKeyRole: {
+            readonly title: "IdentityKeyRole";
+            readonly type: "string";
+            readonly enum: readonly ["attestation", "operational", "messaging", "update", "authenticator"];
+            readonly description: "The named key role a key occupies in an identity (CONVENTIONS.md §2; VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the identity's attestation artefacts (credentials, endorsements, status lists) through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys the identity's own process uses in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP signatures, invitations, notices, audit checkpoints). Derived. `messaging` — the only keys in `keyAgreement`; sign nothing. X25519, derived or generated in its own right and never converted from a signing key. `update` — the identifier's change authority as its DID method states it (a did:webvh log's `updateKeys` and `nextKeyHashes`, a KERI key event log's current and next keys); never a role-bound verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup, and always accompanied by a committed recovery key held outside the VTA's protection boundary. `authenticator` — a key held on a person's own authenticator (a WebAuthn passkey), listed in `authentication` of that person's identity only; used only to verify the person's WebAuthn assertions (sign-in and step-up evidence) and never to accept a Data Integrity proof. The VTA never holds its private half, so it is enrolled by the passkey ceremony and never generated, added or rotated by these tasks. Never permitted on the durable identity of a VTA, a VTC or a VTN. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075). The set is an extensible registry: a consumer that meets a role it does not implement MUST rely on the key for nothing, and MUST NOT map it onto a role it does know (VTI-KEY-074).";
+        };
+        readonly DidMethodName: {
+            readonly title: "DidMethodName";
+            readonly type: "string";
+            readonly pattern: "^[a-z0-9]+(:[a-z0-9]+)*$";
+            readonly description: "The DID method an identity uses, as the method profile that governs it is named: `webvh` for a did:webvh identity, `scid:vh` for the did:scid:vh:1 form of one, `webs` for did:webs. Deliberately a pattern and not an enumeration: a method is added by publishing its profile under method-profiles/, never by changing this schema. A VTA MUST refuse a method it holds no profile for, or whose profile declares it ineligible, with `vta/dids:methodNotEligible`.";
+        };
+        readonly KeyChangeOutcome: {
+            readonly title: "KeyChangeOutcome";
+            readonly type: "string";
+            readonly enum: readonly ["preview", "applied", "pendingApproval", "awaitingRecoveryProof"];
+            readonly description: "`preview` — nothing was written; the response carries the plan. `applied` — the change was made (and published, unless `publication.selfPublish`). `pendingApproval` — the plan is recorded and awaits further approvals. `awaitingRecoveryProof` — the plan is approved and waits for the recovery custodian's proof (`preview.recoverySigning`); nothing is published until it arrives.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/dids/update/1.0";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/vta/dids/update/1.0";
+        readonly title: "VTA DIDs — Update — payload";
+        readonly description: "Ask a Verifiable Trust Agent to change a key-role identity's non-key members — services, `alsoKnownAs`, method parameters such as witnesses. Keys change only through the key-role tasks (vta/dids/_shared/0.1/CONVENTIONS.md).";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["did"];
+        readonly properties: {
+            readonly did: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "The key-role identity, by DID (for a `did:scid` identity, the DID without `src`).";
+            };
+            readonly document: {
+                readonly type: "object";
+                readonly description: "The new identifier document, for methods whose controller writes it. Omit to leave it unchanged. It MUST carry, unchanged, `verificationMethod`, every verification relationship and `keyRoles`: a change to any of them is refused with `vta/dids/update:keyMembersManaged`, because keys change only through the key-role tasks.";
+            };
+            readonly methodParameters: {
+                readonly type: "object";
+                readonly description: "Validated against the method profile's `UpdateParameters` schema (method-profiles/<method>-parameters.schema.json); a member it does not define, or one fixed at creation, is refused with `vta/dids:methodParameterUnsupported`.";
+            };
+            readonly label: {
+                readonly type: "string";
+                readonly maxLength: 256;
+                readonly description: "Operator-facing audit label.";
+            };
+            readonly expectedVersionId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Optimistic-concurrency precondition: the version identifier (method profile §3) the caller based this change on, for example `keys/list`'s `versionId`. The VTA MUST refuse with `vta/dids:versionConflict` if the identity has moved past it. Not optional for anything a person looked at.";
+            };
+            readonly dryRun: {
+                readonly type: "boolean";
+                readonly description: "Compute and return the preview without writing anything but the plan (CONVENTIONS.md §6.1). Absent reads as false.";
+            };
+            readonly previewId: {
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly description: "Apply exactly the plan a previous dry run of this same request returned, or nothing (CONVENTIONS.md §6.1); what every approval is bound to.";
+            };
+            readonly reason: {
+                readonly type: "string";
+                readonly maxLength: 1024;
+                readonly description: "Why the change is being made, for the audit trail and for the other approvers. Never published.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTA DIDs — Update — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["did", "outcome"];
+                readonly properties: {
+                    readonly did: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly outcome: {
+                        readonly $ref: "#/$defs/KeyChangeOutcome";
+                    };
+                    readonly preview: {
+                        readonly $ref: "#/$defs/IdentityChangePreview";
+                        readonly description: "Present when `outcome` is `preview`, `pendingApproval` or `awaitingRecoveryProof`: the plan, and what an approval is bound to.";
+                    };
+                    readonly approvals: {
+                        readonly $ref: "#/$defs/KeyChangeApprovalState";
+                        readonly description: "Present when `outcome` is `pendingApproval`.";
+                    };
+                    readonly newVersionId: {
+                        readonly type: "string";
+                        readonly description: "Present when `outcome` is `applied`: the version identifier of the change. Pass it as the next change's `expectedVersionId`.";
+                    };
+                    readonly publication: {
+                        readonly $ref: "#/$defs/Publication";
+                        readonly description: "Present when `outcome` is `applied`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Publication: {
+                readonly title: "Publication";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["selfPublish"];
+                readonly description: "How the change reaches resolvers.";
+                readonly properties: {
+                    readonly selfPublish: {
+                        readonly type: "boolean";
+                        readonly description: "True when no hosting service holds the identifier for the VTA: the caller must publish `artifacts`, and until it does resolvers see the previous version.";
+                    };
+                    readonly artifacts: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/PublishedArtifact";
+                        };
+                        readonly description: "Present when `selfPublish` is true.";
+                    };
+                };
+            };
+            readonly PublishedArtifact: {
+                readonly title: "PublishedArtifact";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["name", "mediaType", "content"];
+                readonly description: "A file the identifier's method publishes, as the method profile names it (`did.jsonl` for did:webvh, `did.json` and `keri.cesr` for did:webs).";
+                readonly properties: {
+                    readonly name: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                    };
+                    readonly mediaType: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly content: {
+                        readonly type: "string";
+                        readonly description: "The artefact's content, or for an append-only artefact the appended part, as text.";
+                    };
+                };
+            };
+            readonly KeyChangeApprovalState: {
+                readonly title: "KeyChangeApprovalState";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["required", "received", "expiresAt"];
+                readonly description: "Approval progress of a change the VTA's policy gates on approvals (CONVENTIONS.md §6).";
+                readonly properties: {
+                    readonly required: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Distinct approvals the VTA's policy requires.";
+                    };
+                    readonly received: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Distinct approvals recorded so far, the initiator's own included.";
+                    };
+                    readonly approvals: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/RecordedApproval";
+                        };
+                        readonly description: "The approvals recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                    };
+                };
+            };
+            readonly RecordedApproval: {
+                readonly title: "RecordedApproval";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["approver", "evidence"];
+                readonly properties: {
+                    readonly approver: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the approver.";
+                    };
+                    readonly evidence: {
+                        readonly $ref: "#/$defs/ApprovalEvidenceKind";
+                    };
+                    readonly recordedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly ApprovalEvidenceKind: {
+                readonly title: "ApprovalEvidenceKind";
+                readonly type: "string";
+                readonly enum: readonly ["didSigned", "webauthn", "approverSigned"];
+                readonly description: "The evidence an approval was recorded on, as `auth/step-up/approve-response` names it. Only the approver's own evidence is ever recorded: a proof by a key the VTA records as acting for an approver — a console signing key or any other delegation — is never an approval (CONVENTIONS.md §6.3).";
+            };
+            readonly IdentityChangePreview: {
+                readonly title: "IdentityChangePreview";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["previewId", "method", "expiresAt", "changes", "document", "updateKeyRotates"];
+                readonly description: "What a change would publish, computed by the VTA by running the handler it would run to apply it (CONVENTIONS.md §6.1). This is what a consent surface renders and what an approval is bound to.";
+                readonly properties: {
+                    readonly previewId: {
+                        readonly type: "string";
+                        readonly minLength: 16;
+                        readonly description: "Opaque, unguessable identifier of this exact plan. Carried back by the apply request; every approval and any recovery proof is bound to it.";
+                    };
+                    readonly method: {
+                        readonly $ref: "#/$defs/DidMethodName";
+                    };
+                    readonly baseVersionId: {
+                        readonly type: "string";
+                        readonly description: "The version identifier the plan was computed against. Absent only for a creation. The plan is void once the identifier moves past it.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly changes: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/IdentityChange";
+                        };
+                        readonly description: "Every change the plan would make, including the ones the caller did not ask for — in particular any movement of the update authority the method requires.";
+                    };
+                    readonly document: {
+                        readonly type: "object";
+                        readonly description: "The complete identifier document the change would publish, `keyRoles` included. Public data by construction.";
+                    };
+                    readonly warnings: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/PreviewWarning";
+                        };
+                        readonly uniqueItems: true;
+                    };
+                    readonly updateKeyRotates: {
+                        readonly type: "boolean";
+                        readonly description: "True when applying the plan also moves the identifier's update authority to a committed successor — every change under did:webvh pre-rotation, never a KERI interaction event. Stated as its own member because it is the consequence a reviewer most often misses.";
+                    };
+                    readonly recoverySigning: {
+                        readonly $ref: "#/$defs/RecoverySigningRequest";
+                    };
+                };
+            };
+            readonly RecoverySigningRequest: {
+                readonly title: "RecoverySigningRequest";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["commitment", "keyType", "unsignedChange", "proofOptions"];
+                readonly description: "What a recovery custodian must sign for a change that only the recovery key may authorize (CONVENTIONS.md §5.4, §9.4). The custodian MUST check `unsignedChange` itself — render it to its human, confirm that it reveals the recovery key it holds and commits to a fresh recovery key it also holds — and MUST NOT sign on the strength of this request's description alone.";
+                readonly properties: {
+                    readonly commitment: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The recovery commitment the identifier publishes; the custodian's key MUST be the one it commits to.";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly unsignedChange: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The change exactly as it will be published, without the recovery proof, as JSON text in the method's own form (a did:webvh log entry, a KERI rotation event).";
+                    };
+                    readonly proofOptions: {
+                        readonly type: "object";
+                        readonly description: "The proof the method requires over `unsignedChange`, without its signature value, as the method profile defines it (for did:webvh, a Data Integrity proof configuration with `proofPurpose: assertionMethod` and the recovery key's `did:key` as `verificationMethod`).";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly KeyType: {
+                readonly title: "KeyType";
+                readonly type: "string";
+                readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+                readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+            };
+            readonly PreviewWarning: {
+                readonly title: "PreviewWarning";
+                readonly type: "string";
+                readonly enum: readonly ["singleKeyRole", "algorithmNotInAcceptedSet", "roleWillHaveNoClassicalKey", "attestationReissuanceRequired", "selfPublish", "noWitnesses", "protectionBelowPolicy", "recoveryKeyRevealed"];
+                readonly description: "Conditions a human should be shown before approving. `singleKeyRole` — the role will hold one active key. `algorithmNotInAcceptedSet` — a verifier population the VTA knows of does not accept the new key's algorithm. `roleWillHaveNoClassicalKey` — every remaining key is post-quantum. `attestationReissuanceRequired` — revoking this attestation key obliges re-issuance and re-signed status lists (VTI-KEY-133). `selfPublish` — the VTA will not publish the change; the operator must. `noWitnesses` — the identifier has no witnesses, so a party holding the VTA's routine update key can drop the recovery commitment unobserved (CONVENTIONS.md §5.3). `protectionBelowPolicy` — a key will be held at a `ProtectionClass` below what the VTA's policy recommends for its role (a plain VTA holding an attestation key). `recoveryKeyRevealed` — this change uses the recovery key, which must be replaced by a fresh recovery commitment in the same change.";
+            };
+            readonly IdentityChange: {
+                readonly title: "IdentityChange";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["op", "role"];
+                readonly properties: {
+                    readonly op: {
+                        readonly type: "string";
+                        readonly enum: readonly ["addKey", "retireKey", "revokeKey", "rotateUpdateKey", "commitUpdateKey", "replaceRecoveryCommitment", "useRecoveryKey"];
+                        readonly description: "`addKey` — a verification method joins its role's relationship and `keyRoles`. `retireKey` — a verification method leaves its relationship, `keyRoles` and the document. `revokeKey` — a verification method leaves its relationship and `keyRoles`, and stays in `verificationMethod` with `revoked` set to the compromise time (CONVENTIONS.md §9.1). `rotateUpdateKey` — the identifier's update authority moves to a committed routine successor. `commitUpdateKey` — a new routine successor is committed. `replaceRecoveryCommitment` — the recovery commitment changes. `useRecoveryKey` — the change is authorized by the recovery key, which the identifier then reveals.";
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/IdentityKeyRole";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly publicKeyMultibase: {
+                        readonly type: "string";
+                    };
+                    readonly commitment: {
+                        readonly type: "string";
+                    };
+                    readonly relationships: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidVerificationRelationship";
+                        };
+                        readonly uniqueItems: true;
+                    };
+                };
+            };
+            readonly DidVerificationRelationship: {
+                readonly title: "DidVerificationRelationship";
+                readonly type: "string";
+                readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+                readonly description: "A DID Core verification relationship.";
+            };
+            readonly IdentityKeyRole: {
+                readonly title: "IdentityKeyRole";
+                readonly type: "string";
+                readonly enum: readonly ["attestation", "operational", "messaging", "update", "authenticator"];
+                readonly description: "The named key role a key occupies in an identity (CONVENTIONS.md §2; VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the identity's attestation artefacts (credentials, endorsements, status lists) through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys the identity's own process uses in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP signatures, invitations, notices, audit checkpoints). Derived. `messaging` — the only keys in `keyAgreement`; sign nothing. X25519, derived or generated in its own right and never converted from a signing key. `update` — the identifier's change authority as its DID method states it (a did:webvh log's `updateKeys` and `nextKeyHashes`, a KERI key event log's current and next keys); never a role-bound verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup, and always accompanied by a committed recovery key held outside the VTA's protection boundary. `authenticator` — a key held on a person's own authenticator (a WebAuthn passkey), listed in `authentication` of that person's identity only; used only to verify the person's WebAuthn assertions (sign-in and step-up evidence) and never to accept a Data Integrity proof. The VTA never holds its private half, so it is enrolled by the passkey ceremony and never generated, added or rotated by these tasks. Never permitted on the durable identity of a VTA, a VTC or a VTN. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075). The set is an extensible registry: a consumer that meets a role it does not implement MUST rely on the key for nothing, and MUST NOT map it onto a role it does know (VTI-KEY-074).";
+            };
+            readonly DidMethodName: {
+                readonly title: "DidMethodName";
+                readonly type: "string";
+                readonly pattern: "^[a-z0-9]+(:[a-z0-9]+)*$";
+                readonly description: "The DID method an identity uses, as the method profile that governs it is named: `webvh` for a did:webvh identity, `scid:vh` for the did:scid:vh:1 form of one, `webs` for did:webs. Deliberately a pattern and not an enumeration: a method is added by publishing its profile under method-profiles/, never by changing this schema. A VTA MUST refuse a method it holds no profile for, or whose profile declares it ineligible, with `vta/dids:methodNotEligible`.";
+            };
+            readonly KeyChangeOutcome: {
+                readonly title: "KeyChangeOutcome";
+                readonly type: "string";
+                readonly enum: readonly ["preview", "applied", "pendingApproval", "awaitingRecoveryProof"];
+                readonly description: "`preview` — nothing was written; the response carries the plan. `applied` — the change was made (and published, unless `publication.selfPublish`). `pendingApproval` — the plan is recorded and awaits further approvals. `awaitingRecoveryProof` — the plan is approved and waits for the recovery custodian's proof (`preview.recoverySigning`); nothing is published until it arrives.";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vta/dids/update/1.0#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTA DIDs — Update — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["did", "outcome"];
+                readonly properties: {
+                    readonly did: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly outcome: {
+                        readonly $ref: "#/$defs/KeyChangeOutcome";
+                    };
+                    readonly preview: {
+                        readonly $ref: "#/$defs/IdentityChangePreview";
+                        readonly description: "Present when `outcome` is `preview`, `pendingApproval` or `awaitingRecoveryProof`: the plan, and what an approval is bound to.";
+                    };
+                    readonly approvals: {
+                        readonly $ref: "#/$defs/KeyChangeApprovalState";
+                        readonly description: "Present when `outcome` is `pendingApproval`.";
+                    };
+                    readonly newVersionId: {
+                        readonly type: "string";
+                        readonly description: "Present when `outcome` is `applied`: the version identifier of the change. Pass it as the next change's `expectedVersionId`.";
+                    };
+                    readonly publication: {
+                        readonly $ref: "#/$defs/Publication";
+                        readonly description: "Present when `outcome` is `applied`.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly Publication: {
+                readonly title: "Publication";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["selfPublish"];
+                readonly description: "How the change reaches resolvers.";
+                readonly properties: {
+                    readonly selfPublish: {
+                        readonly type: "boolean";
+                        readonly description: "True when no hosting service holds the identifier for the VTA: the caller must publish `artifacts`, and until it does resolvers see the previous version.";
+                    };
+                    readonly artifacts: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/PublishedArtifact";
+                        };
+                        readonly description: "Present when `selfPublish` is true.";
+                    };
+                };
+            };
+            readonly PublishedArtifact: {
+                readonly title: "PublishedArtifact";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["name", "mediaType", "content"];
+                readonly description: "A file the identifier's method publishes, as the method profile names it (`did.jsonl` for did:webvh, `did.json` and `keri.cesr` for did:webs).";
+                readonly properties: {
+                    readonly name: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                    };
+                    readonly mediaType: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly content: {
+                        readonly type: "string";
+                        readonly description: "The artefact's content, or for an append-only artefact the appended part, as text.";
+                    };
+                };
+            };
+            readonly KeyChangeApprovalState: {
+                readonly title: "KeyChangeApprovalState";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["required", "received", "expiresAt"];
+                readonly description: "Approval progress of a change the VTA's policy gates on approvals (CONVENTIONS.md §6).";
+                readonly properties: {
+                    readonly required: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "Distinct approvals the VTA's policy requires.";
+                    };
+                    readonly received: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Distinct approvals recorded so far, the initiator's own included.";
+                    };
+                    readonly approvals: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/RecordedApproval";
+                        };
+                        readonly description: "The approvals recorded. Custody projection only; omitted from a response to anyone who is not themselves an eligible approver of this change.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "When the preview, and every approval bound to it, stops being usable.";
+                    };
+                };
+            };
+            readonly RecordedApproval: {
+                readonly title: "RecordedApproval";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["approver", "evidence"];
+                readonly properties: {
+                    readonly approver: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "VID of the approver.";
+                    };
+                    readonly evidence: {
+                        readonly $ref: "#/$defs/ApprovalEvidenceKind";
+                    };
+                    readonly recordedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly ApprovalEvidenceKind: {
+                readonly title: "ApprovalEvidenceKind";
+                readonly type: "string";
+                readonly enum: readonly ["didSigned", "webauthn", "approverSigned"];
+                readonly description: "The evidence an approval was recorded on, as `auth/step-up/approve-response` names it. Only the approver's own evidence is ever recorded: a proof by a key the VTA records as acting for an approver — a console signing key or any other delegation — is never an approval (CONVENTIONS.md §6.3).";
+            };
+            readonly IdentityChangePreview: {
+                readonly title: "IdentityChangePreview";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["previewId", "method", "expiresAt", "changes", "document", "updateKeyRotates"];
+                readonly description: "What a change would publish, computed by the VTA by running the handler it would run to apply it (CONVENTIONS.md §6.1). This is what a consent surface renders and what an approval is bound to.";
+                readonly properties: {
+                    readonly previewId: {
+                        readonly type: "string";
+                        readonly minLength: 16;
+                        readonly description: "Opaque, unguessable identifier of this exact plan. Carried back by the apply request; every approval and any recovery proof is bound to it.";
+                    };
+                    readonly method: {
+                        readonly $ref: "#/$defs/DidMethodName";
+                    };
+                    readonly baseVersionId: {
+                        readonly type: "string";
+                        readonly description: "The version identifier the plan was computed against. Absent only for a creation. The plan is void once the identifier moves past it.";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly changes: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/IdentityChange";
+                        };
+                        readonly description: "Every change the plan would make, including the ones the caller did not ask for — in particular any movement of the update authority the method requires.";
+                    };
+                    readonly document: {
+                        readonly type: "object";
+                        readonly description: "The complete identifier document the change would publish, `keyRoles` included. Public data by construction.";
+                    };
+                    readonly warnings: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/PreviewWarning";
+                        };
+                        readonly uniqueItems: true;
+                    };
+                    readonly updateKeyRotates: {
+                        readonly type: "boolean";
+                        readonly description: "True when applying the plan also moves the identifier's update authority to a committed successor — every change under did:webvh pre-rotation, never a KERI interaction event. Stated as its own member because it is the consequence a reviewer most often misses.";
+                    };
+                    readonly recoverySigning: {
+                        readonly $ref: "#/$defs/RecoverySigningRequest";
+                    };
+                };
+            };
+            readonly RecoverySigningRequest: {
+                readonly title: "RecoverySigningRequest";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["commitment", "keyType", "unsignedChange", "proofOptions"];
+                readonly description: "What a recovery custodian must sign for a change that only the recovery key may authorize (CONVENTIONS.md §5.4, §9.4). The custodian MUST check `unsignedChange` itself — render it to its human, confirm that it reveals the recovery key it holds and commits to a fresh recovery key it also holds — and MUST NOT sign on the strength of this request's description alone.";
+                readonly properties: {
+                    readonly commitment: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The recovery commitment the identifier publishes; the custodian's key MUST be the one it commits to.";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly unsignedChange: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The change exactly as it will be published, without the recovery proof, as JSON text in the method's own form (a did:webvh log entry, a KERI rotation event).";
+                    };
+                    readonly proofOptions: {
+                        readonly type: "object";
+                        readonly description: "The proof the method requires over `unsignedChange`, without its signature value, as the method profile defines it (for did:webvh, a Data Integrity proof configuration with `proofPurpose: assertionMethod` and the recovery key's `did:key` as `verificationMethod`).";
+                    };
+                    readonly expiresAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly KeyType: {
+                readonly title: "KeyType";
+                readonly type: "string";
+                readonly enum: readonly ["ed25519", "x25519", "p256", "mldsa44", "mldsa65"];
+                readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256), and `mldsa44` and `mldsa65` sign with the post-quantum ML-DSA scheme of US NIST FIPS 204. The set is expected to grow as algorithms are standardised, and growing it is a MINOR change under SPEC.md §5.2: `keyType` selects no schema branch, so adding a value relaxes a constraint rather than narrowing one, and the generated libraries mark this enumeration non-exhaustive so that a consumer absorbs a new value rather than failing to compile. Two ML-DSA parameter sets are carried because two specifications require different ones — W3C Quantum-Resistant Cryptosuites defines Data Integrity suites only for ML-DSA-44, while Trust Spanning Protocol Rev 3 §8.1 mandates ML-DSA-65 — so the parameter set is chosen by whatever consumes the key and the two are not redundant. A consumer that does not implement a value it receives MUST refuse the document rather than substitute one it does support.";
+            };
+            readonly PreviewWarning: {
+                readonly title: "PreviewWarning";
+                readonly type: "string";
+                readonly enum: readonly ["singleKeyRole", "algorithmNotInAcceptedSet", "roleWillHaveNoClassicalKey", "attestationReissuanceRequired", "selfPublish", "noWitnesses", "protectionBelowPolicy", "recoveryKeyRevealed"];
+                readonly description: "Conditions a human should be shown before approving. `singleKeyRole` — the role will hold one active key. `algorithmNotInAcceptedSet` — a verifier population the VTA knows of does not accept the new key's algorithm. `roleWillHaveNoClassicalKey` — every remaining key is post-quantum. `attestationReissuanceRequired` — revoking this attestation key obliges re-issuance and re-signed status lists (VTI-KEY-133). `selfPublish` — the VTA will not publish the change; the operator must. `noWitnesses` — the identifier has no witnesses, so a party holding the VTA's routine update key can drop the recovery commitment unobserved (CONVENTIONS.md §5.3). `protectionBelowPolicy` — a key will be held at a `ProtectionClass` below what the VTA's policy recommends for its role (a plain VTA holding an attestation key). `recoveryKeyRevealed` — this change uses the recovery key, which must be replaced by a fresh recovery commitment in the same change.";
+            };
+            readonly IdentityChange: {
+                readonly title: "IdentityChange";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["op", "role"];
+                readonly properties: {
+                    readonly op: {
+                        readonly type: "string";
+                        readonly enum: readonly ["addKey", "retireKey", "revokeKey", "rotateUpdateKey", "commitUpdateKey", "replaceRecoveryCommitment", "useRecoveryKey"];
+                        readonly description: "`addKey` — a verification method joins its role's relationship and `keyRoles`. `retireKey` — a verification method leaves its relationship, `keyRoles` and the document. `revokeKey` — a verification method leaves its relationship and `keyRoles`, and stays in `verificationMethod` with `revoked` set to the compromise time (CONVENTIONS.md §9.1). `rotateUpdateKey` — the identifier's update authority moves to a committed routine successor. `commitUpdateKey` — a new routine successor is committed. `replaceRecoveryCommitment` — the recovery commitment changes. `useRecoveryKey` — the change is authorized by the recovery key, which the identifier then reveals.";
+                    };
+                    readonly role: {
+                        readonly $ref: "#/$defs/IdentityKeyRole";
+                    };
+                    readonly verificationMethod: {
+                        readonly type: "string";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly publicKeyMultibase: {
+                        readonly type: "string";
+                    };
+                    readonly commitment: {
+                        readonly type: "string";
+                    };
+                    readonly relationships: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly $ref: "#/$defs/DidVerificationRelationship";
+                        };
+                        readonly uniqueItems: true;
+                    };
+                };
+            };
+            readonly DidVerificationRelationship: {
+                readonly title: "DidVerificationRelationship";
+                readonly type: "string";
+                readonly enum: readonly ["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"];
+                readonly description: "A DID Core verification relationship.";
+            };
+            readonly IdentityKeyRole: {
+                readonly title: "IdentityKeyRole";
+                readonly type: "string";
+                readonly enum: readonly ["attestation", "operational", "messaging", "update", "authenticator"];
+                readonly description: "The named key role a key occupies in an identity (CONVENTIONS.md §2; VTI-KEY-070 onward). `attestation` — the only keys in `assertionMethod`; sign the identity's attestation artefacts (credentials, endorsements, status lists) through the VTA's signing service and nowhere else. Generated inside the VTA, never derived, never exportable, never in a backup. `operational` — the only keys the identity's own process uses in `authentication`; sign the node's own traffic (Trust Task requests and responses, DIDComm and TSP signatures, invitations, notices, audit checkpoints). Derived. `messaging` — the only keys in `keyAgreement`; sign nothing. X25519, derived or generated in its own right and never converted from a signing key. `update` — the identifier's change authority as its DID method states it (a did:webvh log's `updateKeys` and `nextKeyHashes`, a KERI key event log's current and next keys); never a role-bound verification method, never in `keyRoles`. Generated inside the VTA, never derived, never exportable, never in a backup, and always accompanied by a committed recovery key held outside the VTA's protection boundary. `authenticator` — a key held on a person's own authenticator (a WebAuthn passkey), listed in `authentication` of that person's identity only; used only to verify the person's WebAuthn assertions (sign-in and step-up evidence) and never to accept a Data Integrity proof. The VTA never holds its private half, so it is enrolled by the passkey ceremony and never generated, added or rotated by these tasks. Never permitted on the durable identity of a VTA, a VTC or a VTN. No role permits `capabilityInvocation` or `capabilityDelegation` (VTI-KEY-075). The set is an extensible registry: a consumer that meets a role it does not implement MUST rely on the key for nothing, and MUST NOT map it onto a role it does know (VTI-KEY-074).";
+            };
+            readonly DidMethodName: {
+                readonly title: "DidMethodName";
+                readonly type: "string";
+                readonly pattern: "^[a-z0-9]+(:[a-z0-9]+)*$";
+                readonly description: "The DID method an identity uses, as the method profile that governs it is named: `webvh` for a did:webvh identity, `scid:vh` for the did:scid:vh:1 form of one, `webs` for did:webs. Deliberately a pattern and not an enumeration: a method is added by publishing its profile under method-profiles/, never by changing this schema. A VTA MUST refuse a method it holds no profile for, or whose profile declares it ineligible, with `vta/dids:methodNotEligible`.";
+            };
+            readonly KeyChangeOutcome: {
+                readonly title: "KeyChangeOutcome";
+                readonly type: "string";
+                readonly enum: readonly ["preview", "applied", "pendingApproval", "awaitingRecoveryProof"];
+                readonly description: "`preview` — nothing was written; the response carries the plan. `applied` — the change was made (and published, unless `publication.selfPublish`). `pendingApproval` — the plan is recorded and awaits further approvals. `awaitingRecoveryProof` — the plan is approved and waits for the recovery custodian's proof (`preview.recoverySigning`); nothing is published until it arrives.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map