@openvtc/trust-tasks 0.14.1 → 0.15.0

package/src/device/register/0.2/payload.ts

@@ -3,32 +3,8 @@
  * Source: specs/device/register/0.2/payload.schema.json
  */
 
-/**
- * Discriminator: is this consumer a user-driven Companion or a headless Service?
- */
-export type ConsumerKind = Companion | Service;
-/**
- * Producer-supplied attestation at registration time, verifiable by the maintainer against the platform's attestation infrastructure. Tagged union over the discriminator `kind`.
- */
-export type DeviceAttestation =
-  | WebAuthnAttestation
-  | AppleAppAttest
-  | PlayIntegrity
-  | Tpm
-  | NitroEnclave
-  | NoAttestation;
-/**
- * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each.
- */
-export type Capability =
-  | "vaultRead"
-  | "vaultWrite"
-  | "proxyLogin"
-  | "fillRelease"
-  | "policyAdmin"
-  | "deviceAdmin"
-  | "sign"
-  | "keyMint";
+import type { AppleAppAttest_DeviceV0_2 as AppleAppAttest, Capability_DeviceV0_2 as Capability, Companion_DeviceV0_2 as Companion, ConsumerKind_DeviceV0_2 as ConsumerKind, DeviceAttestation_DeviceV0_2 as DeviceAttestation, DeviceBinding_DeviceV0_2 as DeviceBinding, Ext, KeyCustody, NitroEnclave_DeviceV0_2 as NitroEnclave, NoAttestation_DeviceV0_2 as NoAttestation, PlayIntegrity_DeviceV0_2 as PlayIntegrity, Service_DeviceV0_2 as Service, Tpm_DeviceV0_2 as Tpm, WebAuthnAttestation_DeviceV0_2 as WebAuthnAttestation } from "../../../_shared/components.js";
+
 
 /**
  * Public discovery surface that wraps the maintainer's existing two-phase enrolment (provision-integration → acl/swap-key). A new Companion or Service hands the maintainer its long-term VTA-derived key, its consumer kind, display name, and an optional device attestation; the maintainer creates the DeviceBinding and returns it. Phase 1 (provision-integration) is assumed to have already happened — this task is the post-bootstrap claim step.
@@ -38,6 +14,9 @@ export interface DeviceRegisterPayload {
   displayName: string;
   platform?: string;
   attestation?: DeviceAttestation;
+  /**
+   * OPTIONAL. How the device custodies its private keys (tier + algorithms). RECOMMENDED for mobile Companions. Maintainer policy input — see docs/design-notes/mobile-key-custody-profile.md.
+   */
   keyCustody?: KeyCustody;
   /**
    * X25519 public key (did:key form) the maintainer will use to HPKE-seal sensitive payloads to this device (sealed secrets, session blobs, sync events). REQUIRED — every Companion/Service needs a recipient key.
@@ -45,135 +24,13 @@ export interface DeviceRegisterPayload {
   hpkePublicKey?: string;
   ext?: Ext;
 }
-export interface Companion {
-  kind: "companion";
-  formFactor: "browser" | "mobile" | "desktop";
-}
-export interface Service {
-  kind: "service";
-  serviceKind: "mediator" | "aiAgent" | "daemon";
-}
-export interface WebAuthnAttestation {
-  kind: "webauthn";
-  /**
-   * WebAuthn Authenticator AAGUID (UUID).
-   */
-  aaguid: string;
-  /**
-   * Base64url-encoded WebAuthn attestation statement, when supplied by the platform.
-   */
-  attestationStatement?: string;
-}
-export interface AppleAppAttest {
-  kind: "appleAppAttest";
-  keyId: string;
-  attestation: string;
-}
-export interface PlayIntegrity {
-  kind: "playIntegrity";
-  token: string;
-}
-export interface Tpm {
-  kind: "tpm";
-  quote: string;
-}
-export interface NitroEnclave {
-  kind: "nitroEnclave";
-  quote: string;
-}
-/**
- * No device-level attestation is available. Maintainers MAY still register the device but SHOULD apply stricter policy (shorter session TTL, more frequent step-up).
- */
-export interface NoAttestation {
-  kind: "none";
-}
-/**
- * OPTIONAL. How the device custodies its private keys (tier + algorithms). RECOMMENDED for mobile Companions. Maintainer policy input — see docs/design-notes/mobile-key-custody-profile.md.
- */
-export interface KeyCustody {
-  /**
-   * `hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.
-   */
-  tier: "hardware" | "software";
-  /**
-   * JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).
-   */
-  signingAlg?: string;
-  /**
-   * Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).
-   */
-  keyAgreementCurve?: string;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DeviceRegisterResponsePayload {
   binding: DeviceBinding;
   ext?: Ext;
 }
-export interface DeviceBinding {
-  /**
-   * Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.
-   */
-  deviceId: string;
-  /**
-   * The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.
-   */
-  consumerDid: string;
-  consumerKind: ConsumerKind;
-  /**
-   * Human-readable name (e.g. "Glenn's MacBook — Chrome", "iPhone 17").
-   */
-  displayName: string;
-  /**
-   * Free-form platform descriptor (e.g. "macOS 16 / Chrome 142", "iOS 19.1", "Android 16", "Linux/x86_64"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.
-   */
-  platform?: string;
-  attestation?: DeviceAttestation;
-  /**
-   * Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.
-   */
-  pushCapable?: boolean;
-  keyCustody?: KeyCustody1;
-  /**
-   * Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.
-   */
-  capabilities?: Capability[];
-  registeredAt: string;
-  /**
-   * Updated on every device/heartbeat and on any successful auth.
-   */
-  lastSeenAt?: string;
-  /**
-   * Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.
-   */
-  disabledAt?: string;
-  /**
-   * Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).
-   */
-  wipedAt?: string;
-  ext?: Ext;
-}
-/**
- * How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.
- */
-export interface KeyCustody1 {
-  /**
-   * `hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.
-   */
-  tier: "hardware" | "software";
-  /**
-   * JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).
-   */
-  signingAlg?: string;
-  /**
-   * Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).
-   */
-  keyAgreementCurve?: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AppleAppAttest, Capability, Companion, ConsumerKind, DeviceAttestation, DeviceBinding, Ext, KeyCustody, NitroEnclave, NoAttestation, PlayIntegrity, Service, Tpm, WebAuthnAttestation };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/register/0.2" as const;

package/src/device/set-wake/0.1/payload.ts

@@ -3,10 +3,16 @@
  * Source: specs/device/set-wake/0.1/payload.schema.json
  */
 
+import type { Ext, WakeHandle, WakeTriggerPolicy } from "../../../_shared/components.js";
+
+
 /**
  * A device conveys to its VTA the opaque WakeHandle it obtained from a push gateway, so the VTA can own the trigger allowlist and provision the gateway. Carries no platform push token — only the handle. Present `wakeHandle` sets/replaces the wake channel; absent clears it (device becomes non-wakeable). Idempotent; re-issued on token rotation. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
 export interface DeviceSetWakePayload {
+  /**
+   * OPTIONAL. The opaque gateway-issued handle for this device's push channel. Omit to clear the wake channel (the VTA empties the gateway allowlist; the device becomes non-wakeable).
+   */
   wakeHandle?: WakeHandle;
   /**
    * OPTIONAL, advisory. The abstract platform behind the handle, for device/list visibility only. The VTA never sees the token; this is a non-authoritative hint.
@@ -18,26 +24,10 @@ export interface DeviceSetWakePayload {
   suggestedTriggers?: string[];
   ext?: Ext;
 }
-/**
- * OPTIONAL. The opaque gateway-issued handle for this device's push channel. Omit to clear the wake channel (the VTA empties the gateway allowlist; the device becomes non-wakeable).
- */
-export interface WakeHandle {
-  /**
-   * The push gateway that issued this handle and acts on it — a DID (DIDComm-reachable gateway) or an https URL (REST gateway). A trigger sends its contentless wake request here.
-   */
-  gateway: string;
+export interface DeviceSetWakeResponsePayload {
   /**
-   * Opaque gateway-issued identifier for the device's push channel. Reveals no platform token. Rotates whenever the device re-registers a new platform token with the gateway; the device then re-conveys the fresh handle via device/set-wake.
+   * The effective allowlist the VTA computed and provisioned to the gateway. Absent when the wake channel was cleared.
    */
-  handle: string;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-export interface DeviceSetWakeResponsePayload {
   triggerPolicy?: WakeTriggerPolicy;
   /**
    * Whether the device now has a usable wake channel (true after a successful set, false after a clear).
@@ -45,15 +35,9 @@ export interface DeviceSetWakeResponsePayload {
   pushCapable: boolean;
   ext?: Ext;
 }
-/**
- * The effective allowlist the VTA computed and provisioned to the gateway. Absent when the wake channel was cleared.
- */
-export interface WakeTriggerPolicy {
-  /**
-   * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
-   */
-  allowedTriggers: string[];
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, WakeHandle, WakeTriggerPolicy };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/set-wake/0.1" as const;

package/src/device/set-wake/0.2/payload.ts

@@ -3,10 +3,16 @@
  * Source: specs/device/set-wake/0.2/payload.schema.json
  */
 
+import type { Ext, WakeHandle, WakeTriggerPolicy } from "../../../_shared/components.js";
+
+
 /**
  * A device conveys to its VTA the opaque WakeHandle it obtained from a push gateway, so the VTA can own the trigger allowlist and provision the gateway. Carries no platform push token — only the handle. Present `wakeHandle` sets/replaces the wake channel; absent clears it (device becomes non-wakeable). Idempotent; re-issued on token rotation. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
 export interface DeviceSetWakePayload {
+  /**
+   * OPTIONAL. The opaque gateway-issued handle for this device's push channel. Omit to clear the wake channel (the VTA empties the gateway allowlist; the device becomes non-wakeable).
+   */
   wakeHandle?: WakeHandle;
   /**
    * OPTIONAL, advisory. The abstract platform behind the handle, for device/list visibility only. The VTA never sees the token; this is a non-authoritative hint.
@@ -18,26 +24,10 @@ export interface DeviceSetWakePayload {
   suggestedTriggers?: string[];
   ext?: Ext;
 }
-/**
- * OPTIONAL. The opaque gateway-issued handle for this device's push channel. Omit to clear the wake channel (the VTA empties the gateway allowlist; the device becomes non-wakeable).
- */
-export interface WakeHandle {
-  /**
-   * The push gateway that issued this handle and acts on it — a DID (DIDComm-reachable gateway) or an https URL (REST gateway). A trigger sends its contentless wake request here.
-   */
-  gateway: string;
+export interface DeviceSetWakeResponsePayload {
   /**
-   * Opaque gateway-issued identifier for the device's push channel. Reveals no platform token. Rotates whenever the device re-registers a new platform token with the gateway; the device then re-conveys the fresh handle via device/set-wake.
+   * The effective allowlist the VTA computed and provisioned to the gateway. Absent when the wake channel was cleared.
    */
-  handle: string;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-export interface DeviceSetWakeResponsePayload {
   triggerPolicy?: WakeTriggerPolicy;
   /**
    * Whether the device now has a usable wake channel (true after a successful set, false after a clear).
@@ -45,15 +35,9 @@ export interface DeviceSetWakeResponsePayload {
   pushCapable: boolean;
   ext?: Ext;
 }
-/**
- * The effective allowlist the VTA computed and provisioned to the gateway. Absent when the wake channel was cleared.
- */
-export interface WakeTriggerPolicy {
-  /**
-   * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
-   */
-  allowedTriggers: string[];
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, WakeHandle, WakeTriggerPolicy };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/set-wake/0.2" as const;

package/src/device/wipe/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/device/wipe/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * The maintainer issues a wipe to a Companion or Service. The target is expected to destroy its local cache and (depending on scope) its device-local key material. The action is best-effort — a compromised device may silently drop the wipe — so the maintainer additionally revokes ACL access and rotates the device's cache-key derivation root, so that defence in depth means a non-compliant device is still neutralised.
  */
@@ -25,12 +28,6 @@ export interface DeviceWipePayload {
   issuedAt?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Acknowledgement from the target device. Sent only when the target executes the wipe; absent if the target was offline or compromised. The maintainer treats the absence of a response as 'not confirmed' but considers the device neutralised because of the server-side defence-in-depth.
  */
@@ -53,6 +50,9 @@ export interface DeviceWipeResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/wipe/0.1" as const;
 

package/src/device/wipe/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/device/wipe/0.2/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * The maintainer issues a wipe to a Companion or Service. The target is expected to destroy its local cache and (depending on scope) its device-local key material. The action is best-effort — a compromised device may silently drop the wipe — so the maintainer additionally revokes ACL access and rotates the device's cache-key derivation root, so that defence in depth means a non-compliant device is still neutralised.
  */
@@ -25,12 +28,6 @@ export interface DeviceWipePayload {
   issuedAt?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Acknowledgement from the target device. Sent only when the target executes the wipe; absent if the target was offline or compromised. The maintainer treats the absence of a response as 'not confirmed' but considers the device neutralised because of the server-side defence-in-depth.
  */
@@ -53,6 +50,9 @@ export interface DeviceWipeResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/wipe/0.2" as const;
 

package/src/did-management/_shared/0.1/did-record.ts

@@ -9,3 +9,9 @@
 export interface DidRecordSharedDefinitionForTheDidManagementSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { DidRecord } from "../../../_shared/components.js";

package/src/did-management/_shared/0.1/domain-entry.ts

@@ -9,3 +9,9 @@
 export interface DomainEntrySharedDefinitionForTheDidManagementDomainSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { DomainEntry } from "../../../_shared/components.js";

package/src/did-management/_shared/0.1/service-instance.ts

@@ -6,3 +6,9 @@
 export interface ServiceInstanceSharedDefinitionForTheDidManagementRegistrySpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { ServiceInstance } from "../../../_shared/components.js";

package/src/did-management/agent-name/check/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/did-management/agent-name/check/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 export interface DIDManagementCheckAgentNamePayload {
   /**
    * The agent name's local part to probe, without the leading `@` (the `alice` in `/@alice`). A leading `@` submitted by a lenient client is stripped by the consumer before evaluation.
@@ -14,12 +17,6 @@ export interface DIDManagementCheckAgentNamePayload {
   domain?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DIDManagementCheckAgentNameResponsePayload {
   /**
    * The probed name's local part, echoed in canonical bare form (leading `@` stripped).
@@ -40,6 +37,9 @@ export interface DIDManagementCheckAgentNameResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/did-management/agent-name/check/0.1" as const;
 

package/src/did-management/agent-name/disable/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/did-management/agent-name/disable/0.1/payload.schema.json
  */
 
+import type { DidRecord, Ext } from "../../../../_shared/components.js";
+
+
 export interface DIDManagementDisableAgentNamePayload {
   /**
    * The hosted DID slot.
@@ -22,69 +25,13 @@ export interface DIDManagementDisableAgentNamePayload {
   domain?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DIDManagementDisableAgentNameResponsePayload {
   record: DidRecord;
   ext?: Ext;
 }
-export interface DidRecord {
-  /**
-   * Local path under which the DID is hosted (e.g. `alice`, `tenant/staff/alice`, `.well-known`). Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.
-   */
-  mnemonic: string;
-  /**
-   * VID of the party that currently owns the record. Authorization to mutate the record is anchored on this field.
-   */
-  owner: string;
-  /**
-   * RFC3339 timestamp of initial reservation.
-   */
-  createdAt: string;
-  /**
-   * RFC3339 timestamp of the most recent record mutation.
-   */
-  updatedAt: string;
-  /**
-   * Number of log entries the host currently holds for the DID. `0` indicates a reservation with no published log yet.
-   */
-  versionCount: number;
-  /**
-   * Fully-qualified DID identifier resolved from the most recent log entry (e.g. `did:webvh:<scid>:host:path`). Absent when `versionCount === 0`.
-   */
-  didId?: string;
-  /**
-   * Resolvable URL of the DID's log document (e.g. `https://did.example.com/alice/did.jsonl`). Stable across the record's lifetime: present from the initial reservation (`versionCount === 0`), it tells the owner where to publish the signed log and where resolvers fetch it. Distinct from `didId`, which only exists once a log entry has been published.
-   */
-  didUrl?: string;
-  /**
-   * DID method this record was registered under (e.g. `webvh`, `web`). When omitted, consumers MAY treat the record as legacy; SHOULD default to `webvh` only if their host predates the multi-method era.
-   */
-  method?: string;
-  /**
-   * Hosting domain (hostname) under which the DID resolves. Matches the host segment of the embedded DID identifier.
-   */
-  domain?: string;
-  /**
-   * When `true`, the DID is administratively disabled — the host serves a deactivation marker but retains content for recovery within the host's retention policy.
-   */
-  disabled?: boolean;
-  /**
-   * Lifetime resolve counter, when the host exposes per-DID statistics.
-   */
-  totalResolves?: number;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DidRecord, Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/did-management/agent-name/disable/0.1" as const;

package/src/did-management/agent-name/enable/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/did-management/agent-name/enable/0.1/payload.schema.json
  */
 
+import type { DidRecord, Ext } from "../../../../_shared/components.js";
+
+
 export interface DIDManagementEnableAgentNamePayload {
   /**
    * The hosted DID slot.
@@ -22,69 +25,13 @@ export interface DIDManagementEnableAgentNamePayload {
   domain?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DIDManagementEnableAgentNameResponsePayload {
   record: DidRecord;
   ext?: Ext;
 }
-export interface DidRecord {
-  /**
-   * Local path under which the DID is hosted (e.g. `alice`, `tenant/staff/alice`, `.well-known`). Compared by exact string equality (SPEC.md §4.8); producers SHOULD emit canonical form.
-   */
-  mnemonic: string;
-  /**
-   * VID of the party that currently owns the record. Authorization to mutate the record is anchored on this field.
-   */
-  owner: string;
-  /**
-   * RFC3339 timestamp of initial reservation.
-   */
-  createdAt: string;
-  /**
-   * RFC3339 timestamp of the most recent record mutation.
-   */
-  updatedAt: string;
-  /**
-   * Number of log entries the host currently holds for the DID. `0` indicates a reservation with no published log yet.
-   */
-  versionCount: number;
-  /**
-   * Fully-qualified DID identifier resolved from the most recent log entry (e.g. `did:webvh:<scid>:host:path`). Absent when `versionCount === 0`.
-   */
-  didId?: string;
-  /**
-   * Resolvable URL of the DID's log document (e.g. `https://did.example.com/alice/did.jsonl`). Stable across the record's lifetime: present from the initial reservation (`versionCount === 0`), it tells the owner where to publish the signed log and where resolvers fetch it. Distinct from `didId`, which only exists once a log entry has been published.
-   */
-  didUrl?: string;
-  /**
-   * DID method this record was registered under (e.g. `webvh`, `web`). When omitted, consumers MAY treat the record as legacy; SHOULD default to `webvh` only if their host predates the multi-method era.
-   */
-  method?: string;
-  /**
-   * Hosting domain (hostname) under which the DID resolves. Matches the host segment of the embedded DID identifier.
-   */
-  domain?: string;
-  /**
-   * When `true`, the DID is administratively disabled — the host serves a deactivation marker but retains content for recovery within the host's retention policy.
-   */
-  disabled?: boolean;
-  /**
-   * Lifetime resolve counter, when the host exposes per-DID statistics.
-   */
-  totalResolves?: number;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DidRecord, Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/did-management/agent-name/enable/0.1" as const;

package/src/did-management/agent-name/list/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/did-management/agent-name/list/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 export interface DIDManagementListAgentNamesPayload {
   /**
    * The hosted DID slot whose agent-name registry is being read.
@@ -14,12 +17,6 @@ export interface DIDManagementListAgentNamesPayload {
   domain?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DIDManagementListAgentNamesResponsePayload {
   /**
    * The slot the listing is for, echoed.
@@ -50,6 +47,9 @@ export interface AgentNameEntry {
   createdAt: string;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/did-management/agent-name/list/0.1" as const;