@openvtc/trust-tasks 0.14.2 → 0.15.0

package/src/auth/challenge/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/challenge/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Request a one-time challenge nonce that the subject will sign to prove control of their VID.
  */
@@ -15,14 +18,11 @@ export interface AuthChallenge {
    * Producer-declared intent (e.g. "login", "step-up", "sign-out"). Consumers MAY surface this in audit logs or use it to scope the issued nonce. Free-form; ecosystems define the vocabulary.
    */
   purpose?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Issued by the auth service in reply to a challenge request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/challenge/0.1#response.
  */
@@ -39,15 +39,15 @@ export interface AuthChallengeResponsePayload {
    * ISO-8601 timestamp after which the challenge MUST NOT be accepted. Issuers SHOULD pick a window between 30 seconds and 5 minutes.
    */
   expiresAt: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/challenge/0.1" as const;
 

package/src/auth/passkey/enroll/finish/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/enroll/finish/0.1/payload.schema.json
  */
 
+import type { AuthenticatorAttestationResponseRegistration, Ext } from "../../../../../_shared/components.js";
+
+
 /**
  * Submit the WebAuthn attestation that completes a passkey-enrollment ceremony. On success the auth service binds the credential to the subject's VID.
  */
@@ -11,34 +14,19 @@ export interface AuthPasskeyEnrollFinish {
    * The enrollmentId issued by the matching `auth/passkey/enroll/start` response. Echoed verbatim.
    */
   enrollmentId: string;
+  /**
+   * AuthenticatorAttestationResponse as returned by `navigator.credentials.create`. Binary fields base64url-encoded.
+   */
   credential: AuthenticatorAttestationResponseRegistration;
   /**
    * Final operator-facing label for the credential. Overrides any label passed at start.
    */
   deviceLabel?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * AuthenticatorAttestationResponse as returned by `navigator.credentials.create`. Binary fields base64url-encoded.
- */
-export interface AuthenticatorAttestationResponseRegistration {
-  id: string;
-  rawId: string;
-  type: "public-key";
-  response: {
-    clientDataJSON: string;
-    attestationObject: string;
-    transports?: string[];
-  };
-  authenticatorAttachment?: "platform" | "cross-platform";
-  clientExtensionResults?: {};
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Acknowledgement of the registered credential. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/finish/0.1#response.
  */
@@ -56,15 +44,15 @@ export interface AuthPasskeyEnrollFinishResponsePayload {
    */
   deviceLabel?: string;
   registeredAt: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAttestationResponseRegistration, Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/finish/0.1" as const;
 

package/src/auth/passkey/enroll/finish/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/enroll/finish/0.2/payload.schema.json
  */
 
+import type { AuthenticatorAssertionResponseLogin, AuthenticatorAttestationResponseRegistration, Ext } from "../../../../../_shared/components.js";
+
+
 /**
  * Submit the WebAuthn attestation that completes a passkey-enrollment ceremony. On success the auth service binds the credential to the subject's VID.
  */
@@ -11,51 +14,23 @@ export interface AuthPasskeyEnrollFinish {
    * The enrollmentId issued by the matching `auth/passkey/enroll/start` response. Echoed verbatim.
    */
   enrollmentId: string;
+  /**
+   * AuthenticatorAttestationResponse as returned by `navigator.credentials.create`. Binary fields base64url-encoded.
+   */
   credential: AuthenticatorAttestationResponseRegistration;
+  /**
+   * New in 0.2. AuthenticatorAssertionResponse over the uvOptions returned by start, proving a human with an already-enrolled authenticator authorized adding this one. REQUIRED whenever start returned uvOptions; omitted otherwise. A consumer that issued uvOptions MUST reject a finish that lacks this member — the re-authentication requirement is the consumer's, so treating a missing assertion as consent would let a producer decline it unilaterally.
+   */
   uvCredential?: AuthenticatorAssertionResponseLogin;
   /**
    * Final operator-facing label for the credential. Overrides any label passed at start.
    */
   deviceLabel?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * AuthenticatorAttestationResponse as returned by `navigator.credentials.create`. Binary fields base64url-encoded.
- */
-export interface AuthenticatorAttestationResponseRegistration {
-  id: string;
-  rawId: string;
-  type: "public-key";
-  response: {
-    clientDataJSON: string;
-    attestationObject: string;
-    transports?: string[];
-  };
-  authenticatorAttachment?: "platform" | "cross-platform";
-  clientExtensionResults?: {};
-}
-/**
- * New in 0.2. AuthenticatorAssertionResponse over the uvOptions returned by start, proving a human with an already-enrolled authenticator authorized adding this one. REQUIRED whenever start returned uvOptions; omitted otherwise. A consumer that issued uvOptions MUST reject a finish that lacks this member — the re-authentication requirement is the consumer's, so treating a missing assertion as consent would let a producer decline it unilaterally.
- */
-export interface AuthenticatorAssertionResponseLogin {
-  id: string;
-  rawId: string;
-  type: "public-key";
-  response: {
-    clientDataJSON: string;
-    authenticatorData: string;
-    signature: string;
-    userHandle?: string | null;
-  };
-  authenticatorAttachment?: "platform" | "cross-platform";
-  clientExtensionResults?: {};
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Acknowledgement of the registered credential. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/finish/0.2#response.
  */
@@ -73,15 +48,15 @@ export interface AuthPasskeyEnrollFinishResponsePayload {
    */
   deviceLabel?: string;
   registeredAt: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAssertionResponseLogin, AuthenticatorAttestationResponseRegistration, Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/finish/0.2" as const;
 

package/src/auth/passkey/enroll/invite/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/enroll/invite/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../../_shared/components.js";
+
+
 /**
  * An administrator issues a single-use invite link an unenrolled subject can redeem to bind their first passkey, without first holding an authenticated session.
  */
@@ -29,12 +32,6 @@ export interface AuthPasskeyEnrollInvite {
   ttl?: number;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The issued invite. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/invite/0.1#response.
  */
@@ -57,6 +54,9 @@ export interface AuthPasskeyEnrollInviteResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/invite/0.1" as const;
 

package/src/auth/passkey/enroll/start/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/enroll/start/0.1/payload.schema.json
  */
 
+import type { Ext, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor } from "../../../../../_shared/components.js";
+
+
 /**
  * Ask the auth service to begin a WebAuthn registration ceremony. The response carries PublicKeyCredentialCreationOptions; the producer hands them to `navigator.credentials.create({ publicKey: ... })`.
  */
@@ -11,14 +14,11 @@ export interface AuthPasskeyEnrollStart {
    * Operator-facing label for the credential (e.g. "Alice's MacBook"). Surfaced in the credential list for later management.
    */
   deviceLabel?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Server-issued WebAuthn creation options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/start/0.1#response.
  */
@@ -27,81 +27,19 @@ export interface AuthPasskeyEnrollStartResponsePayload {
    * Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim.
    */
   enrollmentId: string;
-  options: PublicKeyCredentialCreationOptions;
-  ext?: Ext1;
-}
-/**
- * PublicKeyCredentialCreationOptions for navigator.credentials.create.
- */
-export interface PublicKeyCredentialCreationOptions {
   /**
-   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
-   *
-   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
-   *
-   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   * PublicKeyCredentialCreationOptions for navigator.credentials.create.
    */
-  extensions?: {};
-  /**
-   * base64url-encoded one-time nonce.
-   */
-  challenge: string;
-  rp: {
-    id: string;
-    name: string;
-  };
-  user: {
-    /**
-     * base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.
-     */
-    id: string;
-    name: string;
-    displayName: string;
-  };
-  /**
-   * @minItems 1
-   */
-  pubKeyCredParams: [
-    {
-      type: "public-key";
-      /**
-       * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
-       */
-      alg: number;
-    },
-    ...{
-      type: "public-key";
-      /**
-       * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
-       */
-      alg: number;
-    }[]
-  ];
-  timeout?: number;
-  excludeCredentials?: PublicKeyCredentialDescriptor[];
-  authenticatorSelection?: {
-    authenticatorAttachment?: "platform" | "cross-platform";
-    requireResidentKey?: boolean;
-    residentKey?: "discouraged" | "preferred" | "required";
-    userVerification?: "discouraged" | "preferred" | "required";
-  };
-  attestation?: "none" | "indirect" | "direct" | "enterprise";
-}
-export interface PublicKeyCredentialDescriptor {
-  type: "public-key";
+  options: PublicKeyCredentialCreationOptions;
   /**
-   * base64url-encoded credential id.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  id: string;
-  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/start/0.1" as const;
 

package/src/auth/passkey/enroll/start/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/enroll/start/0.2/payload.schema.json
  */
 
+import type { Ext, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions } from "../../../../../_shared/components.js";
+
+
 /**
  * Ask the auth service to begin a WebAuthn registration ceremony. The response carries PublicKeyCredentialCreationOptions; the producer hands them to `navigator.credentials.create({ publicKey: ... })`.
  */
@@ -11,14 +14,11 @@ export interface AuthPasskeyEnrollStart {
    * Operator-facing label for the credential (e.g. "Alice's MacBook"). Surfaced in the credential list for later management.
    */
   deviceLabel?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Server-issued WebAuthn creation options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/start/0.2#response.
  */
@@ -27,103 +27,23 @@ export interface AuthPasskeyEnrollStartResponsePayload {
    * Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim.
    */
   enrollmentId: string;
-  options: PublicKeyCredentialCreationOptions;
-  uvOptions?: PublicKeyCredentialRequestOptions;
-  ext?: Ext1;
-}
-/**
- * PublicKeyCredentialCreationOptions for navigator.credentials.create.
- */
-export interface PublicKeyCredentialCreationOptions {
-  /**
-   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
-   *
-   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
-   *
-   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
-   */
-  extensions?: {};
-  /**
-   * base64url-encoded one-time nonce.
-   */
-  challenge: string;
-  rp: {
-    id: string;
-    name: string;
-  };
-  user: {
-    /**
-     * base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.
-     */
-    id: string;
-    name: string;
-    displayName: string;
-  };
-  /**
-   * @minItems 1
-   */
-  pubKeyCredParams: [
-    {
-      type: "public-key";
-      /**
-       * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
-       */
-      alg: number;
-    },
-    ...{
-      type: "public-key";
-      /**
-       * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
-       */
-      alg: number;
-    }[]
-  ];
-  timeout?: number;
-  excludeCredentials?: PublicKeyCredentialDescriptor[];
-  authenticatorSelection?: {
-    authenticatorAttachment?: "platform" | "cross-platform";
-    requireResidentKey?: boolean;
-    residentKey?: "discouraged" | "preferred" | "required";
-    userVerification?: "discouraged" | "preferred" | "required";
-  };
-  attestation?: "none" | "indirect" | "direct" | "enterprise";
-}
-export interface PublicKeyCredentialDescriptor {
-  type: "public-key";
   /**
-   * base64url-encoded credential id.
+   * PublicKeyCredentialCreationOptions for navigator.credentials.create.
    */
-  id: string;
-  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
-}
-/**
- * New in 0.2. PublicKeyCredentialRequestOptions for a concurrent user-verification ceremony against the subject's EXISTING credentials. Present when the consumer requires re-authentication to add an authenticator — normally whenever the subject already has one. Absent for a first enrollment, when there is nothing to re-authenticate against. When present the producer MUST run both ceremonies and return both results to finish.
- */
-export interface PublicKeyCredentialRequestOptions {
+  options: PublicKeyCredentialCreationOptions;
   /**
-   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
-   *
-   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
-   *
-   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
+   * New in 0.2. PublicKeyCredentialRequestOptions for a concurrent user-verification ceremony against the subject's EXISTING credentials. Present when the consumer requires re-authentication to add an authenticator — normally whenever the subject already has one. Absent for a first enrollment, when there is nothing to re-authenticate against. When present the producer MUST run both ceremonies and return both results to finish.
    */
-  extensions?: {};
+  uvOptions?: PublicKeyCredentialRequestOptions;
   /**
-   * base64url-encoded one-time nonce.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  challenge: string;
-  timeout?: number;
-  rpId?: string;
-  allowCredentials?: PublicKeyCredentialDescriptor[];
-  userVerification?: "discouraged" | "preferred" | "required";
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialCreationOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/start/0.2" as const;
 

package/src/auth/passkey/list/0.1/payload.ts

@@ -3,18 +3,18 @@
  * Source: specs/auth/passkey/list/0.1/payload.schema.json
  */
 
+import type { Ext, RegisteredCredential } from "../../../../_shared/components.js";
+
+
 /**
  * Enumerate the passkeys the auth service holds for the producer's subject. The credential-management counterpart to auth/sessions/list: sessions answers "where am I signed in?", this answers "what can sign me in?". Its output is the input to auth/passkey/revoke/start.
  */
 export interface AuthPasskeyList {
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/list/0.1#response.
  */
@@ -23,40 +23,15 @@ export interface AuthPasskeyListResponsePayload {
    * Every passkey currently bound to the producer's subject. MAY be empty — a subject who authenticates by other means has no passkeys, which is not an error. Consumers SHOULD sort by registeredAt descending.
    */
   credentials: RegisteredCredential[];
-  ext?: Ext1;
-}
-/**
- * A passkey already bound to a subject, as listed by `auth/passkey/list` and targeted by `auth/passkey/revoke/*`. This is the auth service's own management view of a credential — not a WebAuthn dictionary — so its members are camelCase per SPEC.md §4.10. The exception is `transports`, whose values are the externally-owned WebAuthn transport tokens and are carried verbatim.
- */
-export interface RegisteredCredential {
-  /**
-   * Durable identifier for this credential, as issued by `auth/passkey/enroll/finish`: the base64url-encoded WebAuthn credential id. Opaque to the producer — it MUST be echoed verbatim when revoking and MUST NOT be parsed.
-   */
-  credentialId: string;
   /**
-   * Operator-facing label captured at enrollment (e.g. "Alice's MacBook Pro"). Absent when the subject enrolled without one. Consumers MUST NOT synthesize a label, because an invented one is indistinguishable from a chosen one to somebody deciding which credential to revoke.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  deviceLabel?: string;
-  /**
-   * WebAuthn transport hints reported by the authenticator at enrollment (`usb`, `nfc`, `ble`, `internal`, `hybrid`, …). Externally owned and carried verbatim. Deliberately not an enum — unlike `CredentialDescriptor.transports`, which the consumer itself emits, these values were reported by a third-party authenticator, the WebAuthn transport registry grows independently of this specification, and an unrecognized token here is a display concern rather than a validation failure.
-   */
-  transports?: string[];
-  /**
-   * When the credential was bound to the subject.
-   */
-  registeredAt: string;
-  /**
-   * When this credential last completed an assertion. Absent if it never has, or if the consumer does not track usage. Those two cases are deliberately NOT distinguished: a nullable variant cannot survive the round-trip through generated bindings, which map absent and null onto the same optional, so a distinction stated here would not be one any conforming implementation could rely on. Consumers that need to advertise "usage is not tracked" SHOULD say so under `ext`.
-   */
-  lastUsedAt?: string;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, RegisteredCredential };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/list/0.1" as const;