@openvtc/trust-tasks 0.14.1 → 0.15.0

package/src/provision/integration/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/provision/integration/0.2/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * What the holder is asking the maintainer to do. Tagged on `type`; see `TemplateBootstrapAsk` and `AdminRotationAsk`.
  */
@@ -29,6 +32,9 @@ export interface ProvisionIntegrationPayload {
    * When `true`, the maintainer provisions the target context inline if it does not already exist. Requires super-admin role on the maintainer; context-admin callers MUST receive `provision/integration:forbidden` against a missing context. Idempotent when the context already exists.
    */
   createContext?: boolean;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
 /**
@@ -167,12 +173,6 @@ export interface DataIntegrityProof {
   proofValue: string;
   [k: string]: unknown | undefined;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Carried in a Trust Task document whose type is https://trusttasks.org/spec/provision/integration/0.1#response. The sealed `bundle` is the secret-bearing artefact; `summary` is non-secret audit metadata.
  */
@@ -186,7 +186,7 @@ export interface ProvisionIntegrationResponsePayload {
    */
   digest: string;
   summary: ProvisionSummary;
-  ext?: Ext1;
+  ext?: Ext;
 }
 /**
  * Non-secret audit metadata. MUST NOT include any private key material; the bundle is the only secret-bearing field.
@@ -241,12 +241,9 @@ export interface ProvisionSummary {
    */
   contextCreated?: boolean;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/provision/integration/0.2" as const;

package/src/provision/integration/0.3/payload.ts

@@ -3,14 +3,13 @@
  * Source: specs/provision/integration/0.3/payload.schema.json
  */
 
+import type { DigestMultibase, Ext } from "../../../_shared/components.js";
+
+
 /**
  * What the holder is asking the maintainer to do. Tagged on `type`; see `TemplateBootstrapAsk` and `AdminRotationAsk`.
  */
 export type BootstrapAsk = TemplateBootstrapAsk | AdminRotationAsk;
-/**
- * Digest over the armored ciphertext, for holders that pin the bundle out-of-band. Taken over the armored bytes exactly as carried in `bundle`, not over a canonicalization: the armor is the artifact, and re-armoring the same ciphertext does not have to reproduce the same bytes.
- */
-export type DigestMultibase = string;
 
 /**
  * Relayer presents a VP-signed bootstrap request from an integration holder; the maintainer mints the integration's DIDs and admin credential from a registered DID template and ships the material back HPKE-sealed to the holder's ephemeral did:key. Two ask variants are supported: TemplateBootstrap (mint integration DID + optional admin DID) and AdminRotation (mint only the long-term admin DID).
@@ -33,6 +32,9 @@ export interface ProvisionIntegrationPayload {
    * When `true`, the maintainer provisions the target context inline if it does not already exist. Requires super-admin role on the maintainer; context-admin callers MUST receive `provision/integration:forbidden` against a missing context. Idempotent when the context already exists.
    */
   createContext?: boolean;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
 /**
@@ -171,12 +173,6 @@ export interface DataIntegrityProof {
   proofValue: string;
   [k: string]: unknown | undefined;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Carried in a Trust Task document whose type is https://trusttasks.org/spec/provision/integration/0.1#response. The sealed `bundle` is the secret-bearing artefact; `summary` is non-secret audit metadata.
  */
@@ -185,9 +181,12 @@ export interface ProvisionIntegrationResponsePayload {
    * OpenPGP-style ASCII-armored ciphertext of `SealedPayloadV1`. HPKE base mode, X25519-HKDF-SHA256 KEM, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`. Recipient is the X25519 derivation of `request.holder`'s Ed25519 pubkey.
    */
   bundle: string;
+  /**
+   * Digest over the armored ciphertext, for holders that pin the bundle out-of-band. Taken over the armored bytes exactly as carried in `bundle`, not over a canonicalization: the armor is the artifact, and re-armoring the same ciphertext does not have to reproduce the same bytes.
+   */
   digestMultibase?: DigestMultibase;
   summary: ProvisionSummary;
-  ext?: Ext1;
+  ext?: Ext;
 }
 /**
  * Non-secret audit metadata. MUST NOT include any private key material; the bundle is the only secret-bearing field.
@@ -242,12 +241,9 @@ export interface ProvisionSummary {
    */
   contextCreated?: boolean;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DigestMultibase, Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/provision/integration/0.3" as const;

package/src/push/provision/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/push/provision/0.1/payload.schema.json
  */
 
+import type { Ext, WakeTriggerPolicy } from "../../../_shared/components.js";
+
+
 /**
  * The controller VTA sets a wake handle's trigger allowlist on the push gateway — the DIDs permitted to wake the device. The gateway accepts it only from the handle's recorded controller VTA and enforces it on every push/wake. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
@@ -11,39 +14,24 @@ export interface PushProvisionPayload {
    * The opaque gateway-issued handle (from push/register) whose allowlist is being set.
    */
   handle: string;
-  policy: WakeTriggerPolicy;
-  ext?: Ext;
-}
-/**
- * The trigger allowlist the VTA computed by its own policy — the DIDs permitted to wake this handle (typically the device's mediator and/or the VTA itself). Empty disables waking.
- */
-export interface WakeTriggerPolicy {
   /**
-   * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
+   * The trigger allowlist the VTA computed by its own policy — the DIDs permitted to wake this handle (typically the device's mediator and/or the VTA itself). Empty disables waking.
    */
-  allowedTriggers: string[];
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
+  policy: WakeTriggerPolicy;
+  ext?: Ext;
 }
 export interface PushProvisionResponsePayload {
   handle: string;
-  policy: WakeTriggerPolicy1;
-  ext?: Ext;
-}
-/**
- * The effective allowlist the gateway recorded.
- */
-export interface WakeTriggerPolicy1 {
   /**
-   * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
+   * The effective allowlist the gateway recorded.
    */
-  allowedTriggers: string[];
+  policy: WakeTriggerPolicy;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, WakeTriggerPolicy };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/push/provision/0.1" as const;
 

package/src/push/provision/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/push/provision/0.2/payload.schema.json
  */
 
+import type { Ext, WakeTriggerPolicy } from "../../../_shared/components.js";
+
+
 /**
  * The controller VTA sets a wake handle's trigger allowlist on the push gateway — the DIDs permitted to wake the device. The gateway accepts it only from the handle's recorded controller VTA and enforces it on every push/wake. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
@@ -11,39 +14,24 @@ export interface PushProvisionPayload {
    * The opaque gateway-issued handle (from push/register) whose allowlist is being set.
    */
   handle: string;
-  policy: WakeTriggerPolicy;
-  ext?: Ext;
-}
-/**
- * The trigger allowlist the VTA computed by its own policy — the DIDs permitted to wake this handle (typically the device's mediator and/or the VTA itself). Empty disables waking.
- */
-export interface WakeTriggerPolicy {
   /**
-   * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
+   * The trigger allowlist the VTA computed by its own policy — the DIDs permitted to wake this handle (typically the device's mediator and/or the VTA itself). Empty disables waking.
    */
-  allowedTriggers: string[];
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
+  policy: WakeTriggerPolicy;
+  ext?: Ext;
 }
 export interface PushProvisionResponsePayload {
   handle: string;
-  policy: WakeTriggerPolicy1;
-  ext?: Ext;
-}
-/**
- * The effective allowlist the gateway recorded.
- */
-export interface WakeTriggerPolicy1 {
   /**
-   * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
+   * The effective allowlist the gateway recorded.
    */
-  allowedTriggers: string[];
+  policy: WakeTriggerPolicy;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, WakeTriggerPolicy };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/push/provision/0.2" as const;
 

package/src/push/register/0.1/payload.ts

@@ -3,15 +3,16 @@
  * Source: specs/push/register/0.1/payload.schema.json
  */
 
-/**
- * The platform push channel (token). Held by the gateway only — never disclosed to any other party.
- */
-export type PushRegistration = Apns | Fcm | WebPush;
+import type { Apns, Ext, Fcm, PushRegistration, WakeHandle, WebPush } from "../../../_shared/components.js";
+
 
 /**
  * A device registers its platform push token (APNs / FCM / Web Push) with a push gateway and names the controller VTA permitted to provision its trigger allowlist. The gateway returns an opaque WakeHandle; the raw token is held by the gateway only. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
 export interface PushRegisterPayload {
+  /**
+   * The platform push channel (token). Held by the gateway only — never disclosed to any other party.
+   */
   registration: PushRegistration;
   /**
    * The DID of the VTA permitted to provision this handle's trigger allowlist (push/provision). The device conveys the resulting handle to this VTA via device/set-wake.
@@ -19,71 +20,16 @@ export interface PushRegisterPayload {
   controllerVtaDid: string;
   ext?: Ext;
 }
-export interface Apns {
-  platform: "apns";
-  /**
-   * APNs device token (hex string issued by Apple Push Notification service).
-   */
-  token: string;
-  /**
-   * APNs topic — typically the app bundle identifier the gateway pushes to.
-   */
-  topic: string;
-  /**
-   * Which APNs environment issued the token. Maintainers route to the matching APNs endpoint.
-   */
-  environment?: "sandbox" | "production";
-}
-export interface Fcm {
-  platform: "fcm";
-  /**
-   * Firebase Cloud Messaging registration token. The gateway sends a data message (not a notification message) so the app controls wake and display.
-   */
-  token: string;
-}
-export interface WebPush {
-  platform: "webpush";
-  /**
-   * RFC 8030 Web Push subscription endpoint.
-   */
-  endpoint: string;
+export interface PushRegisterResponsePayload {
   /**
-   * Web Push (RFC 8291) encryption keys. Note: per the push binding the payload remains contentless regardless of this encryption.
+   * The opaque gateway-issued handle (gateway address + handle). Conveyed onward; reveals no token.
    */
-  keys: {
-    /**
-     * base64url-encoded P-256 ECDH public key.
-     */
-    p256dh: string;
-    /**
-     * base64url-encoded auth secret.
-     */
-    auth: string;
-  };
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-export interface PushRegisterResponsePayload {
   wakeHandle: WakeHandle;
   ext?: Ext;
 }
-/**
- * The opaque gateway-issued handle (gateway address + handle). Conveyed onward; reveals no token.
- */
-export interface WakeHandle {
-  /**
-   * The push gateway that issued this handle and acts on it — a DID (DIDComm-reachable gateway) or an https URL (REST gateway). A trigger sends its contentless wake request here.
-   */
-  gateway: string;
-  /**
-   * Opaque gateway-issued identifier for the device's push channel. Reveals no platform token. Rotates whenever the device re-registers a new platform token with the gateway; the device then re-conveys the fresh handle via device/set-wake.
-   */
-  handle: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Apns, Ext, Fcm, PushRegistration, WakeHandle, WebPush };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/push/register/0.1" as const;

package/src/push/register/0.2/payload.ts

@@ -3,15 +3,16 @@
  * Source: specs/push/register/0.2/payload.schema.json
  */
 
-/**
- * The platform push channel (token). Held by the gateway only — never disclosed to any other party.
- */
-export type PushRegistration = Apns | Fcm | WebPush;
+import type { Apns, Ext, Fcm, PushRegistration, WakeHandle, WebPush } from "../../../_shared/components.js";
+
 
 /**
  * A device registers its platform push token (APNs / FCM / Web Push) with a push gateway and names the controller VTA permitted to provision its trigger allowlist. The gateway returns an opaque WakeHandle; the raw token is held by the gateway only. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
 export interface PushRegisterPayload {
+  /**
+   * The platform push channel (token). Held by the gateway only — never disclosed to any other party.
+   */
   registration: PushRegistration;
   /**
    * The DID of the VTA permitted to provision this handle's trigger allowlist (push/provision). The device conveys the resulting handle to this VTA via device/set-wake.
@@ -19,71 +20,16 @@ export interface PushRegisterPayload {
   controllerVtaDid: string;
   ext?: Ext;
 }
-export interface Apns {
-  platform: "apns";
-  /**
-   * APNs device token (hex string issued by Apple Push Notification service).
-   */
-  token: string;
-  /**
-   * APNs topic — typically the app bundle identifier the gateway pushes to.
-   */
-  topic: string;
-  /**
-   * Which APNs environment issued the token. Maintainers route to the matching APNs endpoint.
-   */
-  environment?: "sandbox" | "production";
-}
-export interface Fcm {
-  platform: "fcm";
-  /**
-   * Firebase Cloud Messaging registration token. The gateway sends a data message (not a notification message) so the app controls wake and display.
-   */
-  token: string;
-}
-export interface WebPush {
-  platform: "webpush";
-  /**
-   * RFC 8030 Web Push subscription endpoint.
-   */
-  endpoint: string;
+export interface PushRegisterResponsePayload {
   /**
-   * Web Push (RFC 8291) encryption keys. Note: per the push binding the payload remains contentless regardless of this encryption.
+   * The opaque gateway-issued handle (gateway address + handle). Conveyed onward; reveals no token.
    */
-  keys: {
-    /**
-     * base64url-encoded P-256 ECDH public key.
-     */
-    p256dh: string;
-    /**
-     * base64url-encoded auth secret.
-     */
-    auth: string;
-  };
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
-export interface PushRegisterResponsePayload {
   wakeHandle: WakeHandle;
   ext?: Ext;
 }
-/**
- * The opaque gateway-issued handle (gateway address + handle). Conveyed onward; reveals no token.
- */
-export interface WakeHandle {
-  /**
-   * The push gateway that issued this handle and acts on it — a DID (DIDComm-reachable gateway) or an https URL (REST gateway). A trigger sends its contentless wake request here.
-   */
-  gateway: string;
-  /**
-   * Opaque gateway-issued identifier for the device's push channel. Reveals no platform token. Rotates whenever the device re-registers a new platform token with the gateway; the device then re-conveys the fresh handle via device/set-wake.
-   */
-  handle: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Apns, Ext, Fcm, PushRegistration, WakeHandle, WebPush };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/push/register/0.2" as const;

package/src/push/wake/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/push/wake/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * A trigger (the device's mediator or its VTA) asks the push gateway to deliver a contentless wake to a handle. Carries ONLY the push binding's contentless hint fields — never Trust Task content. The gateway authorizes against the handle's allowlist, then fires the doorbell. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
@@ -29,12 +32,6 @@ export interface PushWakePayload {
   urgency?: "interactive" | "background";
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PushWakeResponsePayload {
   /**
    * Outcome of the wake: `delivered` (push service accepted) or `token-unregistered` (dead token; handle dropped — see push/wake:token_unregistered).
@@ -43,6 +40,9 @@ export interface PushWakeResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/push/wake/0.1" as const;
 

package/src/push/wake/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/push/wake/0.2/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * A trigger (the device's mediator or its VTA) asks the push gateway to deliver a contentless wake to a handle. Carries ONLY the push binding's contentless hint fields — never Trust Task content. The gateway authorizes against the handle's allowlist, then fires the doorbell. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
@@ -29,12 +32,6 @@ export interface PushWakePayload {
   urgency?: "interactive" | "background";
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PushWakeResponsePayload {
   /**
    * Outcome of the wake: `delivered` (push service accepted) or `tokenUnregistered` (dead token; handle dropped — see push/wake:token_unregistered).
@@ -43,6 +40,9 @@ export interface PushWakeResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/push/wake/0.2" as const;
 

package/src/registry/_shared/0.1/registry.ts

@@ -9,3 +9,9 @@
 export interface SharedDefinitionsForTheRegistrySpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { QueryContext, RecordType, TrustRecord } from "../../../_shared/components.js";

package/src/registry/authorization/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/registry/authorization/0.1/payload.schema.json
  */
 
+import type { Ext, QueryContext } from "../../../_shared/components.js";
+
+
 /**
  * TRQP v2.0 authorization query: ask a trust registry whether an entity is authorized by an authority for a given action+resource. Field names are verbatim from the TRQP authorization request/response schemas so the same payload serves the plain HTTP TRQP binding and the Trust Task binding.
  */
@@ -26,26 +29,6 @@ export interface RegistryAuthorizationPayload {
   context?: QueryContext;
   ext?: Ext;
 }
-/**
- * Optional TRQP query context. `time` requests evaluation as of a given instant; `locator` is an authority-defined hint for locating records.
- */
-export interface QueryContext {
-  /**
-   * Evaluate the query as of this RFC3339 (Z offset) instant. Blank/absent uses current server time.
-   */
-  time?: string;
-  /**
-   * Optional hint for systems that need extra information to locate the records in question (authorization queries).
-   */
-  locator?: string;
-  [k: string]: string | undefined;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryAuthorizationResponsePayload {
   entity_id: string;
   authority_id: string;
@@ -71,6 +54,9 @@ export interface RegistryAuthorizationResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, QueryContext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/authorization/0.1" as const;
 

package/src/registry/did/rotate/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/registry/did/rotate/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * An administrator asks a trust registry to rotate the keys of the registry's own agent-managed did:webvh in place, preserving the DID while refreshing its key material. Field names are snake_case, frozen from the pre-existing deployed wire form this specification documents (matching the registry/* family convention).
  */
@@ -17,12 +20,6 @@ export interface RegistryDIDRotatePayload {
   label?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryDIDRotateResponsePayload {
   /**
    * The DID whose keys were rotated.
@@ -39,6 +36,9 @@ export interface RegistryDIDRotateResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/did/rotate/0.1" as const;
 

package/src/registry/recognition/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/registry/recognition/0.1/payload.schema.json
  */
 
+import type { Ext, QueryContext } from "../../../_shared/components.js";
+
+
 /**
  * TRQP v2.0 recognition query: ask a trust registry whether an entity is recognised by an authority for a given action+resource. Field names are verbatim from the TRQP recognition request/response schemas so the same payload serves the plain HTTP TRQP binding and the Trust Task binding.
  */
@@ -26,26 +29,6 @@ export interface RegistryRecognitionPayload {
   context?: QueryContext;
   ext?: Ext;
 }
-/**
- * Optional TRQP query context. `time` requests evaluation as of a given instant; `locator` is an authority-defined hint for locating records.
- */
-export interface QueryContext {
-  /**
-   * Evaluate the query as of this RFC3339 (Z offset) instant. Blank/absent uses current server time.
-   */
-  time?: string;
-  /**
-   * Optional hint for systems that need extra information to locate the records in question (authorization queries).
-   */
-  locator?: string;
-  [k: string]: string | undefined;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface RegistryRecognitionResponsePayload {
   entity_id: string;
   authority_id: string;
@@ -71,6 +54,9 @@ export interface RegistryRecognitionResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, QueryContext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/registry/recognition/0.1" as const;