@openvtc/trust-tasks 0.14.2 → 0.15.0

package/src/auth/refresh/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/refresh/0.1/payload.schema.json
  */
 
+import type { Ext, Session, TokenBundle } from "../../../_shared/components.js";
+
+
 /**
  * Exchange a refresh token for a new access token (and optionally a new refresh token).
  */
@@ -15,103 +18,32 @@ export interface AuthRefresh {
    * Optional capability tags requested on the new access token. MAY be narrower than the original session's scope; consumers MUST NOT widen scope on refresh.
    */
   scope?: string[];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Issued by the auth service when the presented refresh token is valid. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/refresh/0.1#response.
  */
 export interface AuthRefreshResponsePayload {
-  session?: Session;
-  tokens: TokenBundle;
-  ext?: Ext3;
-}
-/**
- * Optional session snapshot. Consumers SHOULD include it so the producer can refresh client-side state (acr changes after step-up, scope changes after policy edits) without a separate whoami call.
- */
-export interface Session {
   /**
-   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
+   * Optional session snapshot. Consumers SHOULD include it so the producer can refresh client-side state (acr changes after step-up, scope changes after policy edits) without a separate whoami call.
    */
-  id: string;
-  /**
-   * The authenticated party's VID (typically a DID URL).
-   */
-  subject: string;
-  /**
-   * ISO-8601 timestamp when the session was created.
-   */
-  issuedAt: string;
-  /**
-   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
-   */
-  expiresAt: string;
-  /**
-   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
-   *
-   * @minItems 1
-   */
-  amr?: [string, ...string[]];
-  /**
-   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
-   */
-  acr?: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
-/**
- * New access token. If the consumer's policy rotates refresh tokens on each use, a new refreshToken is included; otherwise the producer continues using the previously-issued one.
- */
-export interface TokenBundle {
-  /**
-   * Bearer-style access token. Consumers presenting this token to downstream services prove the holder of the original session. Format is consumer-defined — JWT is common, but opaque strings are also valid.
-   */
-  accessToken: string;
-  /**
-   * Long-lived token redeemable via auth/refresh for a new access token. MAY be absent when the issuer does not support refresh.
-   */
-  refreshToken?: string;
-  /**
-   * Token presentation scheme. Almost always "Bearer"; reserved for future schemes.
-   */
-  tokenType: string;
-  /**
-   * Seconds from issuance until the access token expires.
-   */
-  expiresIn: number;
+  session?: Session;
   /**
-   * Seconds from issuance until the refresh token expires, when one was issued.
+   * New access token. If the consumer's policy rotates refresh tokens on each use, a new refreshToken is included; otherwise the producer continues using the previously-issued one.
    */
-  refreshExpiresIn?: number;
+  tokens: TokenBundle;
   /**
-   * Capability tags effective on this token. Format is consumer-defined; the framework imposes no syntax.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  scope?: string[];
-  ext?: Ext2;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext2 {
-  [k: string]: unknown | undefined;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext3 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Session, TokenBundle };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/refresh/0.1" as const;
 

package/src/auth/revoke-session/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/revoke-session/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Invalidate one or all sessions for the producer. The auth service drops the named session(s); any future use of their access or refresh tokens MUST fail.
  */
@@ -19,17 +22,14 @@ export type AuthRevokeSession = {
    * Optional human-readable rationale (e.g. "logout", "device-lost", "key-rotation"). Surfaced in audit logs; the framework imposes no vocabulary.
    */
   reason?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 } & {
   [k: string]: unknown | undefined;
 };
 
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Acknowledgement carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/revoke-session/0.1#response.
  */
@@ -38,15 +38,15 @@ export interface AuthRevokeSessionResponsePayload {
    * Number of sessions invalidated by this call. Zero is a valid outcome (e.g. the named sessionId was already revoked).
    */
   revokedCount: number;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/revoke-session/0.1" as const;
 

package/src/auth/sessions/list/0.1/payload.ts

@@ -3,18 +3,15 @@
  * Source: specs/auth/sessions/list/0.1/payload.schema.json
  */
 
+import type { Ext, Session } from "../../../../_shared/components.js";
+
+
 /**
  * Enumerate every active session the auth service holds for the producer's subject. Companion to auth/whoami (single-session introspection) for users managing multi-device sign-ins.
  */
 export interface AuthSessionsList {
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/sessions/list/0.1#response.
  */
@@ -25,44 +22,9 @@ export interface AuthSessionsListResponsePayload {
   sessions: Session[];
   ext?: Ext;
 }
-/**
- * A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).
- */
-export interface Session {
-  /**
-   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
-   */
-  id: string;
-  /**
-   * The authenticated party's VID (typically a DID URL).
-   */
-  subject: string;
-  /**
-   * ISO-8601 timestamp when the session was created.
-   */
-  issuedAt: string;
-  /**
-   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
-   */
-  expiresAt: string;
-  /**
-   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
-   *
-   * @minItems 1
-   */
-  amr?: [string, ...string[]];
-  /**
-   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
-   */
-  acr?: string;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Session };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/sessions/list/0.1" as const;

package/src/auth/step-up/approve-request/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/step-up/approve-request/0.1/payload.schema.json
  */
 
+import type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions } from "../../../../_shared/components.js";
+
+
 /**
  * A relying party asks an approver (typically a wallet or a VTA) to ratify an AAL elevation for a subject's session.
  */
@@ -33,6 +36,9 @@ export interface AuthStepUpApproveRequest {
    * @minItems 1
    */
   acceptableEvidence?: ["did-signed" | "webauthn", ...("did-signed" | "webauthn")[]];
+  /**
+   * Optional WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. When present, its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side. `rpId`/`allowCredentials` identify which credential the approver should assert with.
+   */
   webauthn?: PublicKeyCredentialRequestOptions;
   /**
    * Seconds within which the relying party expects the approve-response. Approvers SHOULD treat as advisory — the relying party's own expiry policy is authoritative.
@@ -40,41 +46,6 @@ export interface AuthStepUpApproveRequest {
   ttl?: number;
   ext?: Ext;
 }
-/**
- * Optional WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. When present, its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side. `rpId`/`allowCredentials` identify which credential the approver should assert with.
- */
-export interface PublicKeyCredentialRequestOptions {
-  /**
-   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
-   *
-   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
-   *
-   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
-   */
-  extensions?: {};
-  /**
-   * base64url-encoded one-time nonce.
-   */
-  challenge: string;
-  timeout?: number;
-  rpId?: string;
-  allowCredentials?: PublicKeyCredentialDescriptor[];
-  userVerification?: "discouraged" | "preferred" | "required";
-}
-export interface PublicKeyCredentialDescriptor {
-  type: "public-key";
-  /**
-   * base64url-encoded credential id.
-   */
-  id: string;
-  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.1#response.
  */
@@ -90,6 +61,9 @@ export interface AuthStepUpApproveRequestResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-request/0.1" as const;
 

package/src/auth/step-up/approve-request/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/step-up/approve-request/0.2/payload.schema.json
  */
 
+import type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions } from "../../../../_shared/components.js";
+
+
 /**
  * A relying party asks an approver (typically a wallet or a VTA) to ratify an AAL elevation for a subject's session.
  */
@@ -33,6 +36,9 @@ export interface AuthStepUpApproveRequest {
    * @minItems 1
    */
   acceptableEvidence?: ["didSigned" | "webauthn", ...("didSigned" | "webauthn")[]];
+  /**
+   * Optional WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. When present, its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side. `rpId`/`allowCredentials` identify which credential the approver should assert with.
+   */
   webauthn?: PublicKeyCredentialRequestOptions;
   /**
    * Seconds within which the relying party expects the approve-response. Approvers SHOULD treat as advisory — the relying party's own expiry policy is authoritative.
@@ -40,41 +46,6 @@ export interface AuthStepUpApproveRequest {
   ttl?: number;
   ext?: Ext;
 }
-/**
- * Optional WebAuthn `PublicKeyCredentialRequestOptions` the approver passes to the platform passkey API when producing `webauthn` evidence. When present, its `challenge` MUST equal `payload.challenge` so the resulting assertion binds the same nonce the relying party bound server-side. `rpId`/`allowCredentials` identify which credential the approver should assert with.
- */
-export interface PublicKeyCredentialRequestOptions {
-  /**
-   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
-   *
-   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
-   *
-   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
-   */
-  extensions?: {};
-  /**
-   * base64url-encoded one-time nonce.
-   */
-  challenge: string;
-  timeout?: number;
-  rpId?: string;
-  allowCredentials?: PublicKeyCredentialDescriptor[];
-  userVerification?: "discouraged" | "preferred" | "required";
-}
-export interface PublicKeyCredentialDescriptor {
-  type: "public-key";
-  /**
-   * base64url-encoded credential id.
-   */
-  id: string;
-  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.1#response.
  */
@@ -90,6 +61,9 @@ export interface AuthStepUpApproveRequestResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-request/0.2" as const;
 

package/src/auth/step-up/approve-response/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/step-up/approve-response/0.1/payload.schema.json
  */
 
+import type { AuthenticatorAssertionResponseLogin, Ext, Session } from "../../../../_shared/components.js";
+
+
 /**
  * How the approver demonstrated the factor backing this elevation. A tagged union on `kind`. When `evidence` is absent the elevation is gated solely by the document's framework `proof` (equivalent to `kind: did-signed`). When `kind: webauthn` is supplied, the carried WebAuthn assertion over `challenge` is the gate and the framework `proof` MAY be omitted.
  */
@@ -47,35 +50,19 @@ export interface DidSigned {
 }
 export interface WebAuthn {
   kind: "webauthn";
+  /**
+   * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects "passkey".
+   */
   assertion: AuthenticatorAssertionResponseLogin;
 }
-/**
- * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects "passkey".
- */
-export interface AuthenticatorAssertionResponseLogin {
-  id: string;
-  rawId: string;
-  type: "public-key";
-  response: {
-    clientDataJSON: string;
-    authenticatorData: string;
-    signature: string;
-    userHandle?: string | null;
-  };
-  authenticatorAttachment?: "platform" | "cross-platform";
-  clientExtensionResults?: {};
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.1#response.
  */
 export interface AuthStepUpApproveResponseRelyingPartyAck {
   status: "elevated" | "rejected";
+  /**
+   * Present when status is `elevated`. The session's updated amr/acr after the approval was applied.
+   */
   session?: Session;
   /**
    * Present when status is `rejected` (e.g. "challenge expired", "session not found", "acr ceiling exceeded").
@@ -83,44 +70,9 @@ export interface AuthStepUpApproveResponseRelyingPartyAck {
   reason?: string;
   ext?: Ext;
 }
-/**
- * Present when status is `elevated`. The session's updated amr/acr after the approval was applied.
- */
-export interface Session {
-  /**
-   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
-   */
-  id: string;
-  /**
-   * The authenticated party's VID (typically a DID URL).
-   */
-  subject: string;
-  /**
-   * ISO-8601 timestamp when the session was created.
-   */
-  issuedAt: string;
-  /**
-   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
-   */
-  expiresAt: string;
-  /**
-   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
-   *
-   * @minItems 1
-   */
-  amr?: [string, ...string[]];
-  /**
-   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
-   */
-  acr?: string;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAssertionResponseLogin, Ext, Session };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-response/0.1" as const;

package/src/auth/step-up/approve-response/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/step-up/approve-response/0.2/payload.schema.json
  */
 
+import type { AuthenticatorAssertionResponseLogin, Ext, Session } from "../../../../_shared/components.js";
+
+
 /**
  * How the approver demonstrated the factor backing this elevation. A tagged union on `kind`. When `evidence` is absent the elevation is gated solely by the document's framework `proof` (equivalent to `kind: did-signed`). When `kind: webauthn` is supplied, the carried WebAuthn assertion over `challenge` is the gate and the framework `proof` MAY be omitted.
  */
@@ -47,35 +50,19 @@ export interface DidSigned {
 }
 export interface WebAuthn {
   kind: "webauthn";
+  /**
+   * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects "passkey".
+   */
   assertion: AuthenticatorAssertionResponseLogin;
 }
-/**
- * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects "passkey".
- */
-export interface AuthenticatorAssertionResponseLogin {
-  id: string;
-  rawId: string;
-  type: "public-key";
-  response: {
-    clientDataJSON: string;
-    authenticatorData: string;
-    signature: string;
-    userHandle?: string | null;
-  };
-  authenticatorAttachment?: "platform" | "cross-platform";
-  clientExtensionResults?: {};
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.1#response.
  */
 export interface AuthStepUpApproveResponseRelyingPartyAck {
   status: "elevated" | "rejected";
+  /**
+   * Present when status is `elevated`. The session's updated amr/acr after the approval was applied.
+   */
   session?: Session;
   /**
    * Present when status is `rejected` (e.g. "challenge expired", "session not found", "acr ceiling exceeded").
@@ -83,44 +70,9 @@ export interface AuthStepUpApproveResponseRelyingPartyAck {
   reason?: string;
   ext?: Ext;
 }
-/**
- * Present when status is `elevated`. The session's updated amr/acr after the approval was applied.
- */
-export interface Session {
-  /**
-   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
-   */
-  id: string;
-  /**
-   * The authenticated party's VID (typically a DID URL).
-   */
-  subject: string;
-  /**
-   * ISO-8601 timestamp when the session was created.
-   */
-  issuedAt: string;
-  /**
-   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
-   */
-  expiresAt: string;
-  /**
-   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
-   *
-   * @minItems 1
-   */
-  amr?: [string, ...string[]];
-  /**
-   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
-   */
-  acr?: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAssertionResponseLogin, Ext, Session };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-response/0.2" as const;

package/src/auth/step-up/policy/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/step-up/policy/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * The relying party's (ACL maintainer's) system-wide step-up policy: the per-operation-class floor that decides whether — and how — a step-up to a higher assurance level is required before a gated operation proceeds. Set by an administrator; resolved per request against per-entry overrides (see acl/_shared AclEntry.stepUp).
  */
@@ -15,6 +18,9 @@ export interface AuthStepUpPolicyPayload {
    * The system-wide minimum step-up requirement per operation-class — the maintainer-owned floor. Per-entry `stepUp` settings on an AclEntry MAY raise the requirement for a given subject but MUST NOT lower it (additive-only). The effective requirement for a request is the strictest of (matching floor, caller's per-entry setting).
    */
   floors: StepUpFloor[];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
 export interface StepUpFloor {
@@ -31,12 +37,6 @@ export interface StepUpFloor {
    */
   allowAal1IfNonEscalating?: boolean;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The policy the maintainer now holds after applying the request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/policy/0.1#response.
  */
@@ -49,15 +49,12 @@ export interface AuthStepUpPolicyResponsePayload {
    * The effective floors the maintainer now holds (canonicalized: deduplicated by `operation`, defaults materialized).
    */
   floors: StepUpFloor[];
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/policy/0.1" as const;