@openvtc/trust-tasks 0.8.2 → 0.9.0

package/dist/keys/import/0.1/payload.d.ts

@@ -115,16 +115,438 @@ export type Payload = KeysImportPayload;
 export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/keys/import/0.1#response";
 /** Stable alias for this specification's success-response payload shape. */
 export type Response = KeysImportResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/keys/import/0.1";
+    readonly title: "Keys Import — payload";
+    readonly description: "Hand an externally-created private key to a custodian. Exactly one carrier member MUST be present; the choice of carrier is a confidentiality decision, not a formatting one.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["keyType"];
+    readonly oneOf: readonly [{
+        readonly required: readonly ["privateKeySealed"];
+    }, {
+        readonly required: readonly ["privateKeyJwe"];
+    }, {
+        readonly required: readonly ["privateKeyMultibase"];
+    }];
+    readonly properties: {
+        readonly keyType: {
+            readonly $ref: "#/$defs/KeyType";
+            readonly description: "Algorithm of the key being imported. The custodian MUST verify the supplied material is of this type rather than trusting the claim.";
+        };
+        readonly privateKeySealed: {
+            readonly type: "string";
+            readonly description: "The private key inside an armored sealed-transfer bundle, encrypted to the custodian's own public key. The only carrier that keeps the key confidential from every intermediary, including a transport terminator, so it is the one to prefer.";
+        };
+        readonly privateKeyJwe: {
+            readonly type: "string";
+            readonly description: "The private key as a JWE compact serialization, encrypted to the custodian. Equivalent in intent to `privateKeySealed`; retained for producers that already speak JOSE.";
+        };
+        readonly privateKeyMultibase: {
+            readonly type: "string";
+            readonly description: "The raw private key, multibase-encoded and NOT encrypted to the custodian. Admissible **only** where the transport itself provides end-to-end confidentiality between producer and custodian. A custodian reachable over a transport that terminates anywhere in between (TLS at a load balancer, for instance) MUST refuse this member — see the specification's Security section.";
+        };
+        readonly label: {
+            readonly type: "string";
+            readonly description: "Optional human-readable label for the resulting record.";
+        };
+        readonly contextId: {
+            readonly type: "string";
+            readonly description: "Scope to file the imported key under. Absence is the most restrictive reading, not a wildcard — see KeyRecord.contextId.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Keys Import — response payload";
+            readonly description: "The success response to a keys/import request: the record the custodian now holds. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/import/0.1#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["key"];
+            readonly properties: {
+                readonly key: {
+                    readonly $ref: "#/$defs/KeyRecord";
+                    readonly description: "The realized record. `origin` is `imported` and `derivationPath` is absent — an imported key is not reproducible from any seed the custodian holds.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly KeyRecord: {
+            readonly title: "KeyRecord";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["keyId", "keyType", "status", "publicKey", "createdAt"];
+            readonly properties: {
+                readonly keyId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly status: {
+                    readonly $ref: "#/$defs/KeyStatus";
+                };
+                readonly publicKey: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The public half, multibase-encoded. The private half is never carried by any keys/* response.";
+                };
+                readonly derivationPath: {
+                    readonly type: "string";
+                    readonly description: "Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.";
+                };
+                readonly seedId: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.";
+                };
+                readonly origin: {
+                    readonly $ref: "#/$defs/KeyOrigin";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly description: "Optional human-readable label. Operator-facing only; carries no authorization meaning.";
+                };
+                readonly contextId: {
+                    readonly type: "string";
+                    readonly description: "Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "RFC 3339 timestamp at which the key was created or imported.";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "RFC 3339 timestamp of the last change to the record (rename, revocation).";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly KeyOrigin: {
+            readonly title: "KeyOrigin";
+            readonly type: "string";
+            readonly enum: readonly ["derived", "imported"];
+            readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.";
+            readonly default: "derived";
+        };
+        readonly KeyStatus: {
+            readonly title: "KeyStatus";
+            readonly type: "string";
+            readonly enum: readonly ["active", "revoked"];
+            readonly description: "Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.";
+        };
+        readonly KeyType: {
+            readonly title: "KeyType";
+            readonly type: "string";
+            readonly enum: readonly ["ed25519", "x25519", "p256"];
+            readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Keys Import — response payload";
+            readonly description: "The success response to a keys/import request: the record the custodian now holds. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/import/0.1#response.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["key"];
+            readonly properties: {
+                readonly key: {
+                    readonly $ref: "#/$defs/KeyRecord";
+                    readonly description: "The realized record. `origin` is `imported` and `derivationPath` is absent — an imported key is not reproducible from any seed the custodian holds.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly KeyRecord: {
+            readonly title: "KeyRecord";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["keyId", "keyType", "status", "publicKey", "createdAt"];
+            readonly properties: {
+                readonly keyId: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.";
+                };
+                readonly keyType: {
+                    readonly $ref: "#/$defs/KeyType";
+                };
+                readonly status: {
+                    readonly $ref: "#/$defs/KeyStatus";
+                };
+                readonly publicKey: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The public half, multibase-encoded. The private half is never carried by any keys/* response.";
+                };
+                readonly derivationPath: {
+                    readonly type: "string";
+                    readonly description: "Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.";
+                };
+                readonly seedId: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.";
+                };
+                readonly origin: {
+                    readonly $ref: "#/$defs/KeyOrigin";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly description: "Optional human-readable label. Operator-facing only; carries no authorization meaning.";
+                };
+                readonly contextId: {
+                    readonly type: "string";
+                    readonly description: "Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "RFC 3339 timestamp at which the key was created or imported.";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                    readonly description: "RFC 3339 timestamp of the last change to the record (rename, revocation).";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly KeyOrigin: {
+            readonly title: "KeyOrigin";
+            readonly type: "string";
+            readonly enum: readonly ["derived", "imported"];
+            readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.";
+            readonly default: "derived";
+        };
+        readonly KeyStatus: {
+            readonly title: "KeyStatus";
+            readonly type: "string";
+            readonly enum: readonly ["active", "revoked"];
+            readonly description: "Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.";
+        };
+        readonly KeyType: {
+            readonly title: "KeyType";
+            readonly type: "string";
+            readonly enum: readonly ["ed25519", "x25519", "p256"];
+            readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).";
+        };
+    };
+};
 /**
  * SPEC.md §7.2 policy for the request variant, from this specification's
  * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
- * per-specification and cannot be derived from the document alone.
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
  */
 export declare const SPEC: {
     readonly typeUri: "https://trusttasks.org/spec/keys/import/0.1";
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/keys/import/0.1";
+        readonly title: "Keys Import — payload";
+        readonly description: "Hand an externally-created private key to a custodian. Exactly one carrier member MUST be present; the choice of carrier is a confidentiality decision, not a formatting one.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["keyType"];
+        readonly oneOf: readonly [{
+            readonly required: readonly ["privateKeySealed"];
+        }, {
+            readonly required: readonly ["privateKeyJwe"];
+        }, {
+            readonly required: readonly ["privateKeyMultibase"];
+        }];
+        readonly properties: {
+            readonly keyType: {
+                readonly $ref: "#/$defs/KeyType";
+                readonly description: "Algorithm of the key being imported. The custodian MUST verify the supplied material is of this type rather than trusting the claim.";
+            };
+            readonly privateKeySealed: {
+                readonly type: "string";
+                readonly description: "The private key inside an armored sealed-transfer bundle, encrypted to the custodian's own public key. The only carrier that keeps the key confidential from every intermediary, including a transport terminator, so it is the one to prefer.";
+            };
+            readonly privateKeyJwe: {
+                readonly type: "string";
+                readonly description: "The private key as a JWE compact serialization, encrypted to the custodian. Equivalent in intent to `privateKeySealed`; retained for producers that already speak JOSE.";
+            };
+            readonly privateKeyMultibase: {
+                readonly type: "string";
+                readonly description: "The raw private key, multibase-encoded and NOT encrypted to the custodian. Admissible **only** where the transport itself provides end-to-end confidentiality between producer and custodian. A custodian reachable over a transport that terminates anywhere in between (TLS at a load balancer, for instance) MUST refuse this member — see the specification's Security section.";
+            };
+            readonly label: {
+                readonly type: "string";
+                readonly description: "Optional human-readable label for the resulting record.";
+            };
+            readonly contextId: {
+                readonly type: "string";
+                readonly description: "Scope to file the imported key under. Absence is the most restrictive reading, not a wildcard — see KeyRecord.contextId.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Keys Import — response payload";
+                readonly description: "The success response to a keys/import request: the record the custodian now holds. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/import/0.1#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["key"];
+                readonly properties: {
+                    readonly key: {
+                        readonly $ref: "#/$defs/KeyRecord";
+                        readonly description: "The realized record. `origin` is `imported` and `derivationPath` is absent — an imported key is not reproducible from any seed the custodian holds.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly KeyRecord: {
+                readonly title: "KeyRecord";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["keyId", "keyType", "status", "publicKey", "createdAt"];
+                readonly properties: {
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly status: {
+                        readonly $ref: "#/$defs/KeyStatus";
+                    };
+                    readonly publicKey: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The public half, multibase-encoded. The private half is never carried by any keys/* response.";
+                    };
+                    readonly derivationPath: {
+                        readonly type: "string";
+                        readonly description: "Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.";
+                    };
+                    readonly seedId: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.";
+                    };
+                    readonly origin: {
+                        readonly $ref: "#/$defs/KeyOrigin";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly description: "Optional human-readable label. Operator-facing only; carries no authorization meaning.";
+                    };
+                    readonly contextId: {
+                        readonly type: "string";
+                        readonly description: "Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "RFC 3339 timestamp at which the key was created or imported.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "RFC 3339 timestamp of the last change to the record (rename, revocation).";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly KeyOrigin: {
+                readonly title: "KeyOrigin";
+                readonly type: "string";
+                readonly enum: readonly ["derived", "imported"];
+                readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.";
+                readonly default: "derived";
+            };
+            readonly KeyStatus: {
+                readonly title: "KeyStatus";
+                readonly type: "string";
+                readonly enum: readonly ["active", "revoked"];
+                readonly description: "Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.";
+            };
+            readonly KeyType: {
+                readonly title: "KeyType";
+                readonly type: "string";
+                readonly enum: readonly ["ed25519", "x25519", "p256"];
+                readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).";
+            };
+        };
+    };
 };
 /**
  * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
@@ -136,5 +558,114 @@ export declare const RESPONSE_SPEC: {
     readonly isBearer: false;
     readonly isProofRequired: true;
     readonly isRecipientRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Keys Import — response payload";
+                readonly description: "The success response to a keys/import request: the record the custodian now holds. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/import/0.1#response.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["key"];
+                readonly properties: {
+                    readonly key: {
+                        readonly $ref: "#/$defs/KeyRecord";
+                        readonly description: "The realized record. `origin` is `imported` and `derivationPath` is absent — an imported key is not reproducible from any seed the custodian holds.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly KeyRecord: {
+                readonly title: "KeyRecord";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["keyId", "keyType", "status", "publicKey", "createdAt"];
+                readonly properties: {
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.";
+                    };
+                    readonly keyType: {
+                        readonly $ref: "#/$defs/KeyType";
+                    };
+                    readonly status: {
+                        readonly $ref: "#/$defs/KeyStatus";
+                    };
+                    readonly publicKey: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The public half, multibase-encoded. The private half is never carried by any keys/* response.";
+                    };
+                    readonly derivationPath: {
+                        readonly type: "string";
+                        readonly description: "Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.";
+                    };
+                    readonly seedId: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.";
+                    };
+                    readonly origin: {
+                        readonly $ref: "#/$defs/KeyOrigin";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly description: "Optional human-readable label. Operator-facing only; carries no authorization meaning.";
+                    };
+                    readonly contextId: {
+                        readonly type: "string";
+                        readonly description: "Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "RFC 3339 timestamp at which the key was created or imported.";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                        readonly description: "RFC 3339 timestamp of the last change to the record (rename, revocation).";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly KeyOrigin: {
+                readonly title: "KeyOrigin";
+                readonly type: "string";
+                readonly enum: readonly ["derived", "imported"];
+                readonly description: "Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately.";
+                readonly default: "derived";
+            };
+            readonly KeyStatus: {
+                readonly title: "KeyStatus";
+                readonly type: "string";
+                readonly enum: readonly ["active", "revoked"];
+                readonly description: "Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.";
+            };
+            readonly KeyType: {
+                readonly title: "KeyType";
+                readonly type: "string";
+                readonly enum: readonly ["ed25519", "x25519", "p256"];
+                readonly description: "Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).";
+            };
+        };
+    };
 };
 //# sourceMappingURL=payload.d.ts.map

package/dist/keys/import/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/keys/import/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX,GAAG;IACF,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC,CAAC;AACF;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AACpD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AACrD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC7C;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,6CAAsD,CAAC;AAE/E,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAExC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,sDAA+D,CAAC;AAEjG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,IAAI;;;;;CAKP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/keys/import/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX,GAAG;IACF,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC,CAAC;AACF;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AACpD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AACrD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC7C;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,6CAAsD,CAAC;AAE/E,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAExC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,sDAA+D,CAAC;AAEjG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoLjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8H1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMhB,CAAC"}