@openvtc/trust-tasks 0.14.1 → 0.15.0

package/src/vault/upsert/0.3/payload.ts

@@ -3,58 +3,8 @@
  * Source: specs/vault/upsert/0.3/payload.schema.json
  */
 
-/**
- * A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.
- */
-export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
-/**
- * Discriminator for the secret type stored in the entry. Definitions:
- * - `password` — username + password (+ optional TOTP seed).
- * - `passkey` — WebAuthn discoverable credential (private key + rpId + userHandle).
- * - `oauthTokens` — OAuth 2.0 refresh + access token bundle for a specific provider.
- * - `didSelfIssued` — Self-Issued OpenID Provider v2 (SIOP) credential: the entry points at a DID + signing key already managed by the VTA.
- * - `didcommPeer` — DIDComm peer identity used to authenticate against a DIDComm-speaking relying party.
- * - `bearerToken` — opaque bearer token carried in a maintainer-named header (covers API tokens, long-lived JWTs, personal-access tokens).
- * - `sshKey` — SSH private key + comment.
- * - `custom` — arbitrary structured fields; release-time consumer responsible for interpretation.
- */
-export type SecretKind =
-  | "password"
-  | "passkey"
-  | "oauthTokens"
-  | "didSelfIssued"
-  | "didcommPeer"
-  | "bearerToken"
-  | "sshKey"
-  | "custom";
-/**
- * Pluggable cipher envelope (discriminated by `envelope`) whose cleartext is a JCS-canonical JSON conforming to `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. The supported envelope kinds are listed in the SealedEnvelope shared schema; M2A consumers reject any kind they don't implement with `vault/upsert:envelopeUnsupported`. REQUIRED on create unless `secretKind` is `didSelfIssued` or `didcommPeer` (those carry only references to maintainer-internal key ids and have no extra secret bytes). On update, omit if the secret material is unchanged; populate if the secret is being rotated.
- */
-export type SealedEnvelope = DidcommAuthcryptEnvelope | HpkeArmoredEnvelope | TspMessageEnvelope;
-/**
- * Discriminator for the secret type stored in the entry. Definitions:
- * - `password` — username + password (+ optional TOTP seed).
- * - `passkey` — WebAuthn discoverable credential (private key + rpId + userHandle).
- * - `oauthTokens` — OAuth 2.0 refresh + access token bundle for a specific provider.
- * - `didSelfIssued` — Self-Issued OpenID Provider v2 (SIOP) credential: the entry points at a DID + signing key already managed by the VTA.
- * - `didcommPeer` — DIDComm peer identity used to authenticate against a DIDComm-speaking relying party.
- * - `bearerToken` — opaque bearer token carried in a maintainer-named header (covers API tokens, long-lived JWTs, personal-access tokens).
- * - `sshKey` — SSH private key + comment.
- * - `custom` — arbitrary structured fields; release-time consumer responsible for interpretation.
- */
-export type SecretKind1 =
-  | "password"
-  | "passkey"
-  | "oauthTokens"
-  | "didSelfIssued"
-  | "didcommPeer"
-  | "bearerToken"
-  | "sshKey"
-  | "custom";
-/**
- * Digest over the encrypted blob bytes (post-encryption), so the consumer can verify integrity after fetch. Taken over the bytes as stored, not over a canonicalization: the blob is an opaque artifact, not a JSON document.
- */
-export type DigestMultibase = string;
+import type { AndroidApp_VaultV0_2 as AndroidApp, AttachmentRef_VaultV0_3 as AttachmentRef, Did_VaultV0_2 as Did, DidcommAuthcryptEnvelope_VaultV0_2 as DidcommAuthcryptEnvelope, DigestMultibase, Ext, HpkeArmoredEnvelope_VaultV0_2 as HpkeArmoredEnvelope, IosApp_VaultV0_2 as IosApp, SealedEnvelope_VaultV0_2 as SealedEnvelope, SecretKind_VaultV0_2 as SecretKind, SiteTarget_VaultV0_2 as SiteTarget, TspMessageEnvelope_VaultV0_2 as TspMessageEnvelope, VaultEntry_VaultV0_3 as VaultEntry, WebOrigin_VaultV0_2 as WebOrigin } from "../../../_shared/components.js";
+
 
 /**
  * Create a new vault entry or update an existing one. The secret material — if present — rides inside a pluggable cipher envelope (see `vault/_shared/0.1/sealed-envelope`), so the Trust Task carries ciphertext and an authenticator, not plaintext. Updates may be partial: any populated metadata field replaces the current value; omitted fields are left untouched; explicit null clears the field (per `clearFields`). Optimistic-concurrency check via `expectedVersion`.
@@ -84,6 +34,9 @@ export interface VaultUpsertPayload {
   selectors?: string[];
   customFieldNames?: string[];
   expiresAt?: string;
+  /**
+   * Pluggable cipher envelope (discriminated by `envelope`) whose cleartext is a JCS-canonical JSON conforming to `vault/_shared/0.1/vault-secret#/$defs/VaultSecret`. The supported envelope kinds are listed in the SealedEnvelope shared schema; M2A consumers reject any kind they don't implement with `vault/upsert:envelopeUnsupported`. REQUIRED on create unless `secretKind` is `didSelfIssued` or `didcommPeer` (those carry only references to maintainer-internal key ids and have no extra secret bytes). On update, omit if the secret material is unchanged; populate if the secret is being rotated.
+   */
   sealedSecret?: SealedEnvelope;
   /**
    * List of metadata fields to explicitly clear on this upsert. Distinguishes "don't touch" (field omitted from payload) from "clear" (field listed here).
@@ -91,92 +44,6 @@ export interface VaultUpsertPayload {
   clearFields?: ("notes" | "favicon" | "expiresAt" | "tags" | "selectors" | "customFieldNames")[];
   ext?: Ext;
 }
-export interface WebOrigin {
-  kind: "webOrigin";
-  /**
-   * Web origin per RFC 6454 (scheme + host + optional port), e.g. "https://github.com". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.
-   */
-  origin: string;
-}
-export interface Did {
-  kind: "did";
-  /**
-   * DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.
-   */
-  did: string;
-}
-export interface IosApp {
-  kind: "iosApp";
-  /**
-   * iOS bundle identifier in reverse-DNS form (e.g. "com.github.stwalkerster.codehub"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).
-   */
-  bundleId: string;
-  /**
-   * Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.
-   */
-  teamId?: string;
-}
-export interface AndroidApp {
-  kind: "androidApp";
-  /**
-   * Android package name in reverse-DNS form (e.g. "com.github.android").
-   */
-  packageName: string;
-  /**
-   * SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).
-   *
-   * @minItems 1
-   */
-  sha256CertFingerprints: [string, ...string[]];
-}
-/**
- * DIDComm v2 authcrypt JWE (ECDH-1PU + A256CBC-HS512, X25519/P-256 key agreement). Sender authentication is the JWE's `skid` — the producer's DID#keyAgreement. The maintainer's keyAgreement key is the recipient. Cleartext is JCS-canonical JSON of the variant's payload type.
- *
- * M2A is the only implementation today; this is also the canonical default for new code.
- */
-export interface DidcommAuthcryptEnvelope {
-  envelope: "didcommAuthcrypt";
-  /**
-   * Compact DIDComm v2 JWE (base64url-encoded, dot-separated). Unpacks via the framework's standard DIDComm machinery; cleartext is the payload-specific JSON.
-   */
-  jwe: string;
-}
-/**
- * OpenPGP-style ASCII-armored HPKE bundle — the existing OpenVTC sealed-transfer wire form (X25519-HKDF-SHA256 KEM + ChaCha20-Poly1305 AEAD, framed in armor with Bundle-Id / Digest-Algo headers and a CRC24 checksum). Producer assertion (`didSigned` / `attested` / `pinnedOnly`) is the integrity / authenticity anchor.
- *
- * No open-source implementation reads this yet outside vta-sdk's `sealed_transfer` crate; new code SHOULD prefer the DIDComm variant. Defined here for parity with the existing offline-bundle / cross-VTA workflows that the design plan reserves for M5+.
- */
-export interface HpkeArmoredEnvelope {
-  envelope: "hpkeArmored";
-  /**
-   * ASCII-armored bundle text. Multi-line base64 with framing headers + CRC24.
-   */
-  armored: string;
-  /**
-   * did:key identifier of the X25519 public key the envelope was sealed to. The recipient uses this to select the matching private key.
-   */
-  recipientKeyId: string;
-  /**
-   * Producer-assertion mode per the sealed-transfer framework. `didSigned` = Ed25519 signature by issuer; `attested` = TEE attestation quote (e.g. Nitro); `pinnedOnly` = OOB SHA-256 digest only (dev/test, NOT for production).
-   */
-  producerAssertion?: "didSigned" | "attested" | "pinnedOnly";
-}
-/**
- * Trust Spanning Protocol message (https://trustoverip.github.io/tswg-tsp-specification/). Reserved variant; no OpenVTC component reads or emits this today. Listed in the union so implementations can declare intent to use TSP in discovery and so consumers reject `tspMessage` envelopes explicitly (`envelopeUnsupported`) until they're wired up — rather than silently failing in DIDComm parsing.
- */
-export interface TspMessageEnvelope {
-  envelope: "tspMessage";
-  /**
-   * Base64url-encoded TSP message bytes. Format reference: https://trustoverip.github.io/tswg-tsp-specification/#message-format
-   */
-  message: string;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface VaultUpsertResponsePayload {
   entry: VaultEntry;
   /**
@@ -185,111 +52,9 @@ export interface VaultUpsertResponsePayload {
   created?: boolean;
   ext?: Ext;
 }
-export interface VaultEntry {
-  /**
-   * Opaque vault-maintainer-assigned identifier for the entry. ULID/UUID/base32 are common; the wire spec only requires non-empty string equality.
-   */
-  id: string;
-  /**
-   * Identifier of the trust context (persona) the entry belongs to. Opaque string interpreted by the vault maintainer; corresponds to a single ContextRecord on the VTA side.
-   */
-  contextId: string;
-  /**
-   * One or more binding targets — web origins, mobile app identifiers, and/or DIDs — that this credential applies to. A request from any matching target uses this entry. A typical entry for a service that exists as both a website and mobile apps will list a web origin, an iOS bundle id, and an Android package id; passkeys for that service typically list only the origin (because iOS Associated Domains and Android Asset Links bind apps to the domain at the OS level).
-   *
-   * @minItems 1
-   */
-  targets: [SiteTarget, ...SiteTarget[]];
-  /**
-   * Human-readable display name (e.g. "Work GitHub", "Personal bank — checking"). Maintainers MAY enforce a maximum length; the wire spec does not.
-   */
-  label: string;
-  secretKind: SecretKind1;
-  /**
-   * User-defined tags for organisation and filtering (e.g. ["family", "finance"]). Maintainers MAY enforce a maximum count; the wire spec does not.
-   */
-  tags?: string[];
-  /**
-   * Non-sensitive notes the user attached to the entry. Visible in metadata view (suitable for support contact, account number, expiry policy memos). SENSITIVE notes belong in the secret payload as a `secureNotes` field — those are only released by vault/release/0.1.
-   */
-  notes?: string;
-  /**
-   * Optional URI of an icon to display in the consumer UI. Maintainers MAY fetch and cache; consumers SHOULD treat as untrusted content and fetch via a sandboxed pipeline.
-   */
-  favicon?: string;
-  /**
-   * Opaque maintainer-defined selector strings fed to the policy engine when this entry is requested (e.g. "recent_uv_required", "network_class=corp", "step_up_push"). Consumers MUST treat selectors as opaque; they exist for policy authoring on the maintainer side.
-   */
-  selectors?: string[];
-  /**
-   * Names of additional fields the user has attached (e.g. ["security-question-1", "account-number"]). The VALUES live in the secret payload and are only delivered by vault/release/0.1. Exposing names in metadata lets the consumer render the right form layout before requesting release.
-   */
-  customFieldNames?: string[];
-  /**
-   * References to encrypted blobs associated with the entry (recovery codes, PEM files, screenshots of authenticator setup). The blobs themselves are fetched via a separate mechanism the maintainer documents; metadata view exposes only the descriptor.
-   */
-  attachments?: AttachmentRef[];
-  /**
-   * Optional time after which the credential is no longer expected to be valid (e.g. an OAuth refresh token's known expiry, a time-limited API token, an enterprise password rotation policy). Maintainers MAY surface this in the consumer UI as a warning.
-   */
-  expiresAt?: string;
-  /**
-   * Set by the maintainer (via HIBP integration or equivalent) when the password material associated with this entry is known to appear in a public breach. Consumers SHOULD surface this prominently. Cleared when the user rotates the password and the new password is not in any known breach.
-   */
-  breachedAt?: string;
-  /**
-   * Set whenever the password component of the secret payload is rotated. Maintainers MUST update this on every secret-material change for entries of kind `password` (or any kind that carries a password component). Used by consumers to surface rotation-overdue warnings.
-   */
-  passwordChangedAt?: string;
-  createdAt: string;
-  /**
-   * VID of the consumer that originally created the entry.
-   */
-  createdBy?: string;
-  updatedAt: string;
-  /**
-   * VID of the consumer that last modified the entry.
-   */
-  updatedBy?: string;
-  /**
-   * Most recent time the entry was used (either released or proxy-login performed). Maintainers MAY return this with reduced precision (e.g. hour-floored) when releasing to a less-trusted consumer.
-   */
-  lastUsedAt?: string;
-  /**
-   * Monotonic version counter incremented on every mutation. Used by consumers for optimistic-concurrency checks on vault/upsert and as the seq baseline for vault/sync.
-   */
-  version: number;
-  /**
-   * Optional cached DID the entry will act AS for DID-shaped flows — mirrors the `did` field of the entry's secret payload when `secretKind` carries one (`didSelfIssued`, `didcommPeer`). Absent for kinds that have no DID concept (`password`, `passkey`, `oauthTokens`, `bearerToken`, `sshKey`, `custom`). MAINTAINER-DERIVED, NOT CONSUMER-SUPPLIED: the maintainer MUST recompute this from the canonical secret at every upsert / secret rotation; a producer-supplied value on `vault/upsert/0.1` MUST be ignored (no error, but no honour). Read-only on the wire, present in metadata views so consumers can drive RP-side flows (e.g. fetch `/auth/challenge` keyed on the principal DID before requesting a proxy-login) without releasing the secret.
-   */
-  principalDid?: string;
-  ext?: Ext1;
-}
-export interface AttachmentRef {
-  /**
-   * Opaque maintainer-assigned id for this attachment; used to fetch the blob via a separate mechanism.
-   */
-  id: string;
-  /**
-   * User-supplied filename (e.g. "recovery-codes.txt").
-   */
-  name: string;
-  /**
-   * Size of the encrypted blob in bytes. Maintainers MAY enforce a maximum per attachment and per entry.
-   */
-  sizeBytes: number;
-  digestMultibase: DigestMultibase;
-  /**
-   * Optional MIME type hint for the consumer UI (e.g. "text/plain", "application/x-pem-file").
-   */
-  contentType?: string;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AndroidApp, AttachmentRef, Did, DidcommAuthcryptEnvelope, DigestMultibase, Ext, HpkeArmoredEnvelope, IosApp, SealedEnvelope, SecretKind, SiteTarget, TspMessageEnvelope, VaultEntry, WebOrigin };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/upsert/0.3" as const;

package/src/vault/usage/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vault/usage/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Consumer queries the maintainer's audit log of recent vault uses (proxy-logins, releases). Drives UIs like "recent activity" and "which AI agent has been using my GitHub credential". Read-only.
  */
@@ -26,12 +29,6 @@ export interface VaultUsagePayload {
   cursor?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface VaultUsageResponsePayload {
   uses: UsageRecord[];
   truncated: boolean;
@@ -71,6 +68,9 @@ export interface UsageRecord {
   errorCode?: string;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/usage/0.1" as const;
 

package/src/vault/usage/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vault/usage/0.2/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Consumer queries the maintainer's audit log of recent vault uses (proxy-logins, releases). Drives UIs like "recent activity" and "which AI agent has been using my GitHub credential". Read-only.
  */
@@ -26,12 +29,6 @@ export interface VaultUsagePayload {
   cursor?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface VaultUsageResponsePayload {
   uses: UsageRecord[];
   truncated: boolean;
@@ -71,6 +68,9 @@ export interface UsageRecord {
   errorCode?: string;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vault/usage/0.2" as const;
 

package/src/vrc/relationships/issue/0.1/payload.ts

@@ -3,14 +3,8 @@
  * Source: specs/vrc/relationships/issue/0.1/payload.schema.json
  */
 
-/**
- * Digest over the RFC 8785 canonicalization of the credential, so the delivery can be tied to later references to it without re-hashing. A producer SHOULD set it; the receipt's own digest is what makes the round trip checkable, so a producer that omits it can still verify the delivery against the credential it holds.
- */
-export type DigestMultibase = string;
-/**
- * Digest over the RFC 8785 canonicalization of the credential AS STORED, computed by the receiving party rather than copied from the request. Computing it is the point: a copied value attests nothing, while a recomputed one makes a mismatch between what was sent and what was stored detectable in-band, and identifies which delivery this receipt answers.
- */
-export type DigestMultibase1 = string;
+import type { DigestMultibase, Ext } from "../../../../_shared/components.js";
+
 
 /**
  * Delivers one party's signed Verifiable Relationship Credential to the other within an accepted relationship exchange. Performed once in each direction; the response is a delivery receipt naming what was stored, and does not echo the credential back.
@@ -20,25 +14,28 @@ export interface VRCRelationshipsIssuePayload {
    * A signed W3C Verifiable Relationship Credential (opaque here). Its issuer MUST be the issuing party's relationship DID and its credential subject MUST name the receiving party's relationship DID — the values the accepted proposal exchanged.
    */
   vrc: {};
+  /**
+   * Digest over the RFC 8785 canonicalization of the credential, so the delivery can be tied to later references to it without re-hashing. A producer SHOULD set it; the receipt's own digest is what makes the round trip checkable, so a producer that omits it can still verify the delivery against the credential it holds.
+   */
   vrcDigestMultibase?: DigestMultibase;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The delivery receipt: the receiving party accepted and stored the credential, and names which one. A refusal is a trust-task-error, never a receipt reporting failure.
  *
  * The receipt names the stored artifact rather than merely asserting that something arrived, following the delivery idiom of vtc/members/vmc and vtc/join-requests/accept. It has to: both directions of this exchange share one threadId, and a #response carries no inResponseTo, so the digest is what tells a party which of its two deliveries a receipt answers.
  */
 export interface VRCRelationshipsIssueResponsePayload {
-  vrcDigestMultibase: DigestMultibase1;
+  /**
+   * Digest over the RFC 8785 canonicalization of the credential AS STORED, computed by the receiving party rather than copied from the request. Computing it is the point: a copied value attests nothing, while a recomputed one makes a mismatch between what was sent and what was stored detectable in-band, and identifies which delivery this receipt answers.
+   */
+  vrcDigestMultibase: DigestMultibase;
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DigestMultibase, Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vrc/relationships/issue/0.1" as const;
 

package/src/vrc/relationships/propose/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vrc/relationships/propose/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * One person proposes a peer-to-peer relationship to another, naming the pairwise DID they will use for it. The counterparty accepts or declines; a decline is a trust-task-error carrying `vrc/relationships/propose:declined`.
  */
@@ -21,12 +24,6 @@ export interface VRCRelationshipsProposePayload {
   reason?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The counterparty's acceptance, and its answer on witnessing. A decline is a trust-task-error, never a response with accept: false.
  */
@@ -46,6 +43,9 @@ export interface VRCRelationshipsProposeResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vrc/relationships/propose/0.1" as const;
 

package/src/vta/_shared/0.1/app-state-record.ts

@@ -15,3 +15,9 @@
 export interface AppStateRecordSharedDefinitionForTheVtaAppStateSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { AppStateRecord, ExpectedVersion, Key, Namespace, Version, WriteResult } from "../../../_shared/components.js";

package/src/vta/_shared/0.1/context.ts

@@ -9,3 +9,9 @@
 export interface ContextRecordSharedDefinitionForTheVtaContextsSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { ContextPolicy, ContextRecord } from "../../../_shared/components.js";

package/src/vta/_shared/0.1/did-template.ts

@@ -9,3 +9,9 @@
 export interface DidTemplateDidTemplateRecordSharedDefinitionsForTheVtaDidTemplatesSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { DidTemplate, DidTemplateRecord, Scope_VtaV0_1 as Scope } from "../../../_shared/components.js";

package/src/vta/_shared/0.1/passkey-vm.ts

@@ -11,3 +11,9 @@
 export interface PasskeyVerificationMethodSharedDefinitionForTheVtaPasskeyVmsSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { PasskeyVerificationMethod } from "../../../_shared/components.js";

package/src/vta/_shared/0.1/service.ts

@@ -9,3 +9,9 @@
 export interface ServiceDefinitionsSharedAcrossTheVtaServicesSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { DrainEntry, RollbackResult, ServiceKind, ServiceMutationResult, ServiceState } from "../../../_shared/components.js";

package/src/vta/_shared/0.1/webvh-records.ts

@@ -9,3 +9,9 @@
 export interface WebVHRecordsSharedDefinitionsForTheVtaWebvhSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { AgentNameEntry, WebvhDidRecord, WebvhServerRecord } from "../../../_shared/components.js";

package/src/vta/app-state/delete/1.0/payload.ts

@@ -3,22 +3,8 @@
  * Source: specs/vta/app-state/delete/1.0/payload.schema.json
  */
 
-/**
- * Scopes one application's records within a context, so several tools can share a context without colliding — `openvtc`, `cnm`, an agent runtime. The maintainer MUST NOT interpret the value; it is an opaque partition name. Namespaces are first-come and unreserved, so an application SHOULD pick a stable, specific one: a future per-namespace ACL would grant on this exact string, which makes renaming a namespace a migration rather than an edit.
- */
-export type Namespace = string;
-/**
- * Application-chosen identifier for a record within a namespace. Opaque to the maintainer: it MUST NOT be parsed, normalized, or case-folded, and prefix matching in `list` is a byte-prefix comparison over the UTF-8 encoding. Applications SHOULD use `/`-delimited hierarchical keys (`community/acme`, `contact/z6Mk…`) so that `prefix` can address a record family, but the delimiter is a convention between an application and itself — the maintainer attaches no meaning to it.
- */
-export type Key = string;
-/**
- * Optional precondition, on the same terms as vta/app-state/put. A positive value requires the live record to be at exactly that version — so a delete cannot discard an edit the caller never saw. Zero is meaningless here (a create-only precondition on a delete can never be satisfiable and never useful) and MUST be refused.
- */
-export type ExpectedVersion = number;
-/**
- * The tombstone's version — the counter value this delete took, or the value the existing tombstone already held when `existed` is false. Absent only when the address held nothing and no tombstone was written.
- */
-export type Version = number;
+import type { ExpectedVersion, Ext, Key, Namespace, Version } from "../../../../_shared/components.js";
+
 
 /**
  * Delete one application-state record, leaving a versioned tombstone so that consumers syncing incrementally learn of the deletion rather than resurrecting the record on their next rebuild. The tombstone is reaped after the maintainer's retention window.
@@ -30,15 +16,15 @@ export interface VTAApplicationStateDeletePayload {
   contextId: string;
   namespace: Namespace;
   key: Key;
+  /**
+   * Optional precondition, on the same terms as vta/app-state/put. A positive value requires the live record to be at exactly that version — so a delete cannot discard an edit the caller never saw. Zero is meaningless here (a create-only precondition on a delete can never be satisfiable and never useful) and MUST be refused.
+   */
   expectedVersion?: ExpectedVersion;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Success response to vta/app-state/delete. Type https://trusttasks.org/spec/vta/app-state/delete/1.0#response. Deleting an address that holds nothing is a success, not an error — that is what makes the task converge under replay.
  */
@@ -53,20 +39,23 @@ export interface VTAApplicationStateDeleteResponsePayload {
    * True when a live record was removed by this request. False when the address already held a tombstone, or held nothing at all — both of which are successes, because the caller's intent is satisfied either way.
    */
   existed: boolean;
+  /**
+   * The tombstone's version — the counter value this delete took, or the value the existing tombstone already held when `existed` is false. Absent only when the address held nothing and no tombstone was written.
+   */
   version?: Version;
   /**
    * When the deletion was recorded. Absent on the same terms as `version`.
    */
   deletedAt?: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ExpectedVersion, Ext, Key, Namespace, Version };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/app-state/delete/1.0" as const;