@openvtc/trust-tasks 0.14.1 → 0.15.0

package/src/consent/list/1.0/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/consent/list/1.0/payload.schema.json
  */
 
+import type { ConsentGrant, ConsentSubject, Effect_ConsentV0_1 as Effect, Ext, Kind, Scope_ConsentV0_1 as Scope } from "../../../_shared/components.js";
+
+
 /**
  * A bridge fetches the consent grants it should enforce.
  */
@@ -15,6 +18,9 @@ export interface ConsentListPayload {
    * Optional. Restrict to this platform tag.
    */
   platform?: string;
+  /**
+   * Optional. A full subject, to point-check a single conversation.
+   */
   subject?: ConsentSubject;
   /**
    * Optional opaque cursor; return only grants changed after it.
@@ -22,33 +28,6 @@ export interface ConsentListPayload {
   since?: string;
   ext?: Ext;
 }
-/**
- * Optional. A full subject, to point-check a single conversation.
- */
-export interface ConsentSubject {
-  /**
-   * Messaging-platform tag, e.g. "signal", "whatsapp", "slack".
-   */
-  platform: string;
-  /**
-   * The bridge's OPAQUE conversation handle (e.g. "sig-1a2b3c4d"). NEVER the raw platform address — the VTA never learns the phone number / chat id.
-   */
-  conversationRef: string;
-  /**
-   * The interaction kind: a 1:1 direct message, a multi-party group, or a broadcast channel.
-   */
-  kind: "dm" | "group" | "channel";
-  /**
-   * VID (DID) of the AI agent the conversation would reach.
-   */
-  agent: string;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The grants the requesting bridge is authorized to enforce.
  */
@@ -63,57 +42,9 @@ export interface ConsentListResponsePayload {
   cursor?: string;
   ext?: Ext;
 }
-/**
- * A recorded consent decision over a ConsentSubject.
- */
-export interface ConsentGrant {
-  subject: ConsentSubject1;
-  /**
-   * Whether the subject is permitted. The ABSENCE of any grant is treated as `deny` (default-deny).
-   */
-  effect: "allow" | "deny";
-  /**
-   * Granted scope. REQUIRED when `effect` is `allow`; absent for `deny`.
-   */
-  scope?: "receive" | "converse";
-  /**
-   * VID of the approver who made the decision.
-   */
-  grantedBy: string;
-  /**
-   * RFC 3339 time the decision was recorded.
-   */
-  grantedAt: string;
-  /**
-   * Optional. After this time the grant lapses and the subject must be re-consented.
-   */
-  expiresAt?: string;
-  /**
-   * How the decision was authorized — e.g. "did-signed" (approver's DID signed the consent/decision) or "bridge-attested" (an enrolled bridge relayed the operator's out-of-band choice).
-   */
-  evidence?: string;
-}
-/**
- * The platform-agnostic identifier of WHAT is being consented to: one conversation, for one agent.
- */
-export interface ConsentSubject1 {
-  /**
-   * Messaging-platform tag, e.g. "signal", "whatsapp", "slack".
-   */
-  platform: string;
-  /**
-   * The bridge's OPAQUE conversation handle (e.g. "sig-1a2b3c4d"). NEVER the raw platform address — the VTA never learns the phone number / chat id.
-   */
-  conversationRef: string;
-  /**
-   * The interaction kind: a 1:1 direct message, a multi-party group, or a broadcast channel.
-   */
-  kind: "dm" | "group" | "channel";
-  /**
-   * VID (DID) of the AI agent the conversation would reach.
-   */
-  agent: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ConsentGrant, ConsentSubject, Effect, Ext, Kind, Scope };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/consent/list/1.0" as const;

package/src/consent/request/1.0/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/consent/request/1.0/payload.schema.json
  */
 
-/**
- * Optional multibase-encoded multihash over the rfc 8785 (jcs) canonicalization of the held first message, binding the request to concrete content.
- */
-export type DigestMultibase = string;
+import type { ConsentSubject, DigestMultibase, Ext, Kind, Scope_ConsentV0_1 as Scope } from "../../../_shared/components.js";
+
 
 /**
  * A bridge asks the VTA whether an inbound conversation may reach an AI agent, prompting operator consent on first contact.
@@ -16,7 +14,7 @@ export interface ConsentRequestPayload {
   /**
    * The access the bridge seeks for the agent on this conversation.
    */
-  scope: "receive" | "converse";
+  scope: Scope;
   /**
    * base64url-encoded nonce (≥128 bits entropy) echoed by the matching consent/decision, so the bridge can correlate the decision to this request.
    */
@@ -25,6 +23,9 @@ export interface ConsentRequestPayload {
    * Optional operator-facing label (e.g. "Signal group 'Family'"). MUST NOT contain a raw platform address.
    */
   displayHint?: string;
+  /**
+   * Optional multibase-encoded multihash over the rfc 8785 (jcs) canonicalization of the held first message, binding the request to concrete content.
+   */
   firstMessageDigest?: DigestMultibase;
   /**
    * Optional VTA context path the bridge runs under, to scope approver resolution.
@@ -32,33 +33,6 @@ export interface ConsentRequestPayload {
   contextHint?: string;
   ext?: Ext;
 }
-/**
- * The platform-agnostic identifier of WHAT is being consented to: one conversation, for one agent.
- */
-export interface ConsentSubject {
-  /**
-   * Messaging-platform tag, e.g. "signal", "whatsapp", "slack".
-   */
-  platform: string;
-  /**
-   * The bridge's OPAQUE conversation handle (e.g. "sig-1a2b3c4d"). NEVER the raw platform address — the VTA never learns the phone number / chat id.
-   */
-  conversationRef: string;
-  /**
-   * The interaction kind: a 1:1 direct message, a multi-party group, or a broadcast channel.
-   */
-  kind: "dm" | "group" | "channel";
-  /**
-   * VID (DID) of the AI agent the conversation would reach.
-   */
-  agent: string;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Synchronous ack from the VTA: a prompt was routed (accepted) or the request was refused. The actual decision arrives out-of-band as a consent/decision.
  */
@@ -78,6 +52,9 @@ export interface ConsentRequestResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ConsentSubject, DigestMultibase, Ext, Kind, Scope };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/consent/request/1.0" as const;
 

package/src/consent/revoke/1.0/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/consent/revoke/1.0/payload.schema.json
  */
 
+import type { ConsentSubject, Ext, Kind } from "../../../_shared/components.js";
+
+
 /**
  * An operator revokes a standing consent grant.
  */
@@ -14,33 +17,6 @@ export interface ConsentRevokePayload {
   reason?: string;
   ext?: Ext;
 }
-/**
- * The platform-agnostic identifier of WHAT is being consented to: one conversation, for one agent.
- */
-export interface ConsentSubject {
-  /**
-   * Messaging-platform tag, e.g. "signal", "whatsapp", "slack".
-   */
-  platform: string;
-  /**
-   * The bridge's OPAQUE conversation handle (e.g. "sig-1a2b3c4d"). NEVER the raw platform address — the VTA never learns the phone number / chat id.
-   */
-  conversationRef: string;
-  /**
-   * The interaction kind: a 1:1 direct message, a multi-party group, or a broadcast channel.
-   */
-  kind: "dm" | "group" | "channel";
-  /**
-   * VID (DID) of the AI agent the conversation would reach.
-   */
-  agent: string;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface ConsentRevokeResponsePayload {
   /**
    * `revoked` = the grant was deleted. `notFound` = no grant existed for the subject.
@@ -49,6 +25,9 @@ export interface ConsentRevokeResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ConsentSubject, Ext, Kind };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/consent/revoke/1.0" as const;
 

package/src/credential-exchange/_shared/0.1/deferred-presentation.ts

@@ -9,3 +9,9 @@
 export interface CredentialExchangeSharedDeferredPresentationDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { DeferredPresentation, RequestedCredential } from "../../../_shared/components.js";

package/src/credential-exchange/issue/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/issue/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Issuer to holder: the issued credential. Exactly one of `credential_response` (cleartext, known holder over an authenticated channel) or `sealed` (an armored sealed-transfer bundle, for a secret-bearing credential or an unknown holder).
  */
@@ -20,12 +23,8 @@ export type CredentialExchangeIssuePayload = {
   [k: string]: unknown | undefined;
 };
 
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/issue/0.1" as const;

package/src/credential-exchange/offer/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/offer/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Issuer to holder: an OID4VCI Credential Offer. Opens the issuance thread; the holder replies with credential-exchange/request.
  */
@@ -13,12 +16,9 @@ export interface CredentialExchangeOfferPayload {
   credential_offer: {};
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/offer/0.1" as const;

package/src/credential-exchange/pending/approve/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/pending/approve/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * Approve a deferred presentation request. The holder mints the presentation against the verifier's original query and nonce and returns it; the deferral is then terminal.
  */
@@ -13,12 +16,6 @@ export interface CredentialExchangePendingApprovePayload {
   id: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface CredentialExchangePendingApproveResponsePayload {
   /**
    * The freshly-minted OID4VP `vp_token`, identical in shape to credential-exchange/present. It is returned rather than only delivered so the approving operator holds exactly what the verifier will receive. Bound to the ORIGINAL query's nonce and audience — which is why an expired deferral cannot be approved.
@@ -27,6 +24,9 @@ export interface CredentialExchangePendingApproveResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/pending/approve/0.1" as const;
 

package/src/credential-exchange/pending/deny/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/pending/deny/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * Refuse a deferred presentation request. Nothing is presented and the deferral becomes terminal.
  */
@@ -13,12 +16,6 @@ export interface CredentialExchangePendingDenyPayload {
   id: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface CredentialExchangePendingDenyResponsePayload {
   /**
    * The deferral that was refused.
@@ -31,6 +28,9 @@ export interface CredentialExchangePendingDenyResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/pending/deny/0.1" as const;
 

package/src/credential-exchange/pending/list/0.1/payload.ts

@@ -3,18 +3,15 @@
  * Source: specs/credential-exchange/pending/list/0.1/payload.schema.json
  */
 
+import type { DeferredPresentation, Ext, RequestedCredential } from "../../../../_shared/components.js";
+
+
 /**
  * List the presentation requests this holder deferred for consent and that can still be acted on. Takes no parameters: the caller's authenticated identity is the scope, and a holder agent answers only for its own wallet.
  */
 export interface CredentialExchangePendingListPayload {
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface CredentialExchangePendingListResponsePayload {
   /**
    * The actionable deferrals. A consumer MUST omit records that are already terminal or past their `expiresAt` — they cannot be approved, so listing them would offer the approver a decision that is guaranteed to fail. An empty array means nothing is awaiting a decision.
@@ -22,54 +19,9 @@ export interface CredentialExchangePendingListResponsePayload {
   pending: DeferredPresentation[];
   ext?: Ext;
 }
-/**
- * One presentation request awaiting the holder's decision, as the approver sees it.
- *
- * This is deliberately **not** the stored record. A consumer also retains the original DCQL query so an approval can re-present byte-faithfully against the verifier's original nonce; that is machinery, not a decision input, and is not exposed here. What is exposed is exactly what an approver needs to answer "should I disclose this": who is asking, why, and precisely which claims of which held credentials would leave the wallet.
- */
-export interface DeferredPresentation {
-  /**
-   * Approval handle for this deferral — the value `pending/approve` and `pending/deny` act on.
-   */
-  id: string;
-  /**
-   * The verifier that asked. An approved presentation binds to this audience, so approving is a decision about *this* party and not a standing permission.
-   */
-  verifierDid: string;
-  /**
-   * Every held credential the query would disclose, resolved against what the holder actually holds. This is the authorization surface: the approver is consenting to these claims leaving the wallet, not to the query in the abstract.
-   */
-  requested: RequestedCredential[];
-  /**
-   * The verifier's stated reason, carried through from the query. Purpose binding: an approver decides against a stated why, never a bare request.
-   */
-  purpose: string;
-  /**
-   * When the deferral was recorded.
-   */
-  createdAt: string;
-  /**
-   * After this the deferral is stale and approval MUST refuse — the verifier's nonce is no longer fresh, so any presentation minted against it would fail the verifier's own replay check.
-   */
-  expiresAt: string;
-}
-/**
- * One held credential a deferred query asked for, and the claims of it that would be disclosed.
- */
-export interface RequestedCredential {
-  /**
-   * The DCQL `credential_query_id` this held credential satisfied.
-   */
-  credentialQueryId: string;
-  /**
-   * The held credential that would satisfy it.
-   */
-  credentialId: string;
-  /**
-   * The claims the query asks to disclose from this credential. An empty array means the query matched the credential without naming claims — a consumer SHOULD treat that as a request for the whole credential and present it to the approver as such.
-   */
-  claims: string[];
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DeferredPresentation, Ext, RequestedCredential };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/pending/list/0.1" as const;

package/src/credential-exchange/present/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/present/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Holder to verifier: an OID4VP vp_token carrying the selectively-disclosed, holder-bound presentation. Replies on the query thread.
  */
@@ -13,12 +16,9 @@ export interface CredentialExchangePresentPayload {
   vp_token: string | {};
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/present/0.1" as const;

package/src/credential-exchange/query/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/query/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Verifier to holder: an OID4VP DCQL query, a freshness nonce, and a mandatory stated purpose. The holder answers with credential-exchange/present, or defers for consent.
  */
@@ -21,12 +24,9 @@ export interface CredentialExchangeQueryPayload {
   purpose: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/query/0.1" as const;

package/src/credential-exchange/request/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/request/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Holder to issuer: an OID4VCI Credential Request carrying the holder's key-binding proof. Replies on the offer thread.
  */
@@ -13,12 +16,9 @@ export interface CredentialExchangeRequestPayload {
   credential_request: {};
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/request/0.1" as const;

package/src/credentials/_shared/0.1/credentials.ts

@@ -13,3 +13,9 @@
 export interface CredentialsSharedIssuanceAndRevocationDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { CredentialId, CredentialReference, RevocationReceipt } from "../../../_shared/components.js";

package/src/credentials/_shared/0.2/credentials.ts

@@ -13,3 +13,9 @@
 export interface CredentialsSharedIssuanceAndRevocationDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { CredentialId, IssuedCredentialBase } from "../../../_shared/components.js";

package/src/device/_shared/0.1/device-binding.ts

@@ -9,3 +9,9 @@
 export interface DeviceBindingSharedDefinitionForTheDeviceSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { Capability_DeviceV0_1 as Capability, ConsumerKind_DeviceV0_1 as ConsumerKind, DeviceAttestation_DeviceV0_1 as DeviceAttestation, DeviceBinding_DeviceV0_1 as DeviceBinding, KeyCustody, PushRegistration, WakeHandle, WakeTriggerPolicy } from "../../../_shared/components.js";

package/src/device/_shared/0.2/device-binding.ts

@@ -9,3 +9,9 @@
 export interface DeviceBindingSharedDefinitionForTheDeviceSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { Capability_DeviceV0_2 as Capability, ConsumerKind_DeviceV0_2 as ConsumerKind, DeviceAttestation_DeviceV0_2 as DeviceAttestation, DeviceBinding_DeviceV0_2 as DeviceBinding, KeyCustody, PushRegistration, WakeHandle, WakeTriggerPolicy } from "../../../_shared/components.js";

package/src/device/disable/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/device/disable/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Disable a Companion or Service. The maintainer revokes the device's ACL entry, refuses subsequent authentication, and emits sync events so other devices learn of the disable. Distinct from device/wipe: disable is a passive denial; wipe additionally instructs the target to destroy its local cache.
  */
@@ -11,18 +14,15 @@ export interface DeviceDisablePayload {
   reason?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DeviceDisableResponsePayload {
   deviceId: string;
   disabledAt: string;
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/disable/0.1" as const;
 

package/src/device/heartbeat/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/device/heartbeat/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Periodic check-in from a Companion or Service. Refreshes `lastSeenAt`, carries optional state digests, and gives the maintainer a chance to deliver queued operations (notably queued wipes for targets that were offline at issuance).
  */
@@ -17,12 +20,6 @@ export interface DeviceHeartbeatPayload {
   vaultSeq?: number;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DeviceHeartbeatResponsePayload {
   /**
    * Authoritative timestamp — consumers MAY use to detect clock drift.
@@ -51,6 +48,9 @@ export interface QueuedOperation {
   };
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/heartbeat/0.1" as const;