@openvtc/trust-tasks 0.14.2 → 0.15.0

package/src/device/heartbeat/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/device/heartbeat/0.2/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Periodic check-in from a Companion or Service. Refreshes `lastSeenAt`, carries optional state digests, and gives the maintainer a chance to deliver queued operations (notably queued wipes for targets that were offline at issuance).
  */
@@ -17,12 +20,6 @@ export interface DeviceHeartbeatPayload {
   vaultSeq?: number;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DeviceHeartbeatResponsePayload {
   /**
    * Authoritative timestamp — consumers MAY use to detect clock drift.
@@ -51,6 +48,9 @@ export interface QueuedOperation {
   };
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/heartbeat/0.2" as const;
 

package/src/device/list/0.1/payload.ts

@@ -3,32 +3,8 @@
  * Source: specs/device/list/0.1/payload.schema.json
  */
 
-/**
- * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each.
- */
-export type Capability =
-  | "vault-read"
-  | "vault-write"
-  | "proxy-login"
-  | "fill-release"
-  | "policy-admin"
-  | "device-admin"
-  | "sign"
-  | "key-mint";
-/**
- * Discriminator: is this consumer a user-driven Companion or a headless Service?
- */
-export type ConsumerKind = Companion | Service;
-/**
- * Producer-supplied attestation at registration time, verifiable by the maintainer against the platform's attestation infrastructure. Tagged union over the discriminator `kind`.
- */
-export type DeviceAttestation =
-  | WebAuthnAttestation
-  | AppleAppAttest
-  | PlayIntegrity
-  | Tpm
-  | NitroEnclave
-  | NoAttestation;
+import type { AppleAppAttest_DeviceV0_1 as AppleAppAttest, Capability_DeviceV0_1 as Capability, Companion_DeviceV0_1 as Companion, ConsumerKind_DeviceV0_1 as ConsumerKind, DeviceAttestation_DeviceV0_1 as DeviceAttestation, DeviceBinding_DeviceV0_1 as DeviceBinding, Ext, KeyCustody, NitroEnclave_DeviceV0_1 as NitroEnclave, NoAttestation_DeviceV0_1 as NoAttestation, PlayIntegrity_DeviceV0_1 as PlayIntegrity, Service_DeviceV0_1 as Service, Tpm_DeviceV0_1 as Tpm, WebAuthnAttestation_DeviceV0_1 as WebAuthnAttestation } from "../../../_shared/components.js";
+
 
 /**
  * List DeviceBindings known to the maintainer, optionally filtered by consumer kind, capability, status, and last-seen time.
@@ -48,120 +24,15 @@ export interface DeviceListPayload {
   cursor?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DeviceListResponsePayload {
   devices: DeviceBinding[];
   truncated: boolean;
   cursor?: string;
   ext?: Ext;
 }
-export interface DeviceBinding {
-  /**
-   * Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.
-   */
-  deviceId: string;
-  /**
-   * The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.
-   */
-  consumerDid: string;
-  consumerKind: ConsumerKind;
-  /**
-   * Human-readable name (e.g. "Glenn's MacBook — Chrome", "iPhone 17").
-   */
-  displayName: string;
-  /**
-   * Free-form platform descriptor (e.g. "macOS 16 / Chrome 142", "iOS 19.1", "Android 16", "Linux/x86_64"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.
-   */
-  platform?: string;
-  attestation?: DeviceAttestation;
-  /**
-   * Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.
-   */
-  pushCapable?: boolean;
-  keyCustody?: KeyCustody;
-  /**
-   * Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.
-   */
-  capabilities?: Capability[];
-  registeredAt: string;
-  /**
-   * Updated on every device/heartbeat and on any successful auth.
-   */
-  lastSeenAt?: string;
-  /**
-   * Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.
-   */
-  disabledAt?: string;
-  /**
-   * Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).
-   */
-  wipedAt?: string;
-  ext?: Ext;
-}
-export interface Companion {
-  kind: "companion";
-  formFactor: "browser" | "mobile" | "desktop";
-}
-export interface Service {
-  kind: "service";
-  serviceKind: "mediator" | "ai-agent" | "daemon";
-}
-export interface WebAuthnAttestation {
-  kind: "webauthn";
-  /**
-   * WebAuthn Authenticator AAGUID (UUID).
-   */
-  aaguid: string;
-  /**
-   * Base64url-encoded WebAuthn attestation statement, when supplied by the platform.
-   */
-  attestationStatement?: string;
-}
-export interface AppleAppAttest {
-  kind: "apple-app-attest";
-  keyId: string;
-  attestation: string;
-}
-export interface PlayIntegrity {
-  kind: "play-integrity";
-  token: string;
-}
-export interface Tpm {
-  kind: "tpm";
-  quote: string;
-}
-export interface NitroEnclave {
-  kind: "nitro-enclave";
-  quote: string;
-}
-/**
- * No device-level attestation is available. Maintainers MAY still register the device but SHOULD apply stricter policy (shorter session TTL, more frequent step-up).
- */
-export interface NoAttestation {
-  kind: "none";
-}
-/**
- * How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.
- */
-export interface KeyCustody {
-  /**
-   * `hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.
-   */
-  tier: "hardware" | "software";
-  /**
-   * JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).
-   */
-  signingAlg?: string;
-  /**
-   * Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).
-   */
-  keyAgreementCurve?: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AppleAppAttest, Capability, Companion, ConsumerKind, DeviceAttestation, DeviceBinding, Ext, KeyCustody, NitroEnclave, NoAttestation, PlayIntegrity, Service, Tpm, WebAuthnAttestation };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/list/0.1" as const;

package/src/device/list/0.2/payload.ts

@@ -3,32 +3,8 @@
  * Source: specs/device/list/0.2/payload.schema.json
  */
 
-/**
- * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each.
- */
-export type Capability =
-  | "vaultRead"
-  | "vaultWrite"
-  | "proxyLogin"
-  | "fillRelease"
-  | "policyAdmin"
-  | "deviceAdmin"
-  | "sign"
-  | "keyMint";
-/**
- * Discriminator: is this consumer a user-driven Companion or a headless Service?
- */
-export type ConsumerKind = Companion | Service;
-/**
- * Producer-supplied attestation at registration time, verifiable by the maintainer against the platform's attestation infrastructure. Tagged union over the discriminator `kind`.
- */
-export type DeviceAttestation =
-  | WebAuthnAttestation
-  | AppleAppAttest
-  | PlayIntegrity
-  | Tpm
-  | NitroEnclave
-  | NoAttestation;
+import type { AppleAppAttest_DeviceV0_2 as AppleAppAttest, Capability_DeviceV0_2 as Capability, Companion_DeviceV0_2 as Companion, ConsumerKind_DeviceV0_2 as ConsumerKind, DeviceAttestation_DeviceV0_2 as DeviceAttestation, DeviceBinding_DeviceV0_2 as DeviceBinding, Ext, KeyCustody, NitroEnclave_DeviceV0_2 as NitroEnclave, NoAttestation_DeviceV0_2 as NoAttestation, PlayIntegrity_DeviceV0_2 as PlayIntegrity, Service_DeviceV0_2 as Service, Tpm_DeviceV0_2 as Tpm, WebAuthnAttestation_DeviceV0_2 as WebAuthnAttestation } from "../../../_shared/components.js";
+
 
 /**
  * List DeviceBindings known to the maintainer, optionally filtered by consumer kind, capability, status, and last-seen time.
@@ -48,120 +24,15 @@ export interface DeviceListPayload {
   cursor?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DeviceListResponsePayload {
   devices: DeviceBinding[];
   truncated: boolean;
   cursor?: string;
   ext?: Ext;
 }
-export interface DeviceBinding {
-  /**
-   * Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.
-   */
-  deviceId: string;
-  /**
-   * The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.
-   */
-  consumerDid: string;
-  consumerKind: ConsumerKind;
-  /**
-   * Human-readable name (e.g. "Glenn's MacBook — Chrome", "iPhone 17").
-   */
-  displayName: string;
-  /**
-   * Free-form platform descriptor (e.g. "macOS 16 / Chrome 142", "iOS 19.1", "Android 16", "Linux/x86_64"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.
-   */
-  platform?: string;
-  attestation?: DeviceAttestation;
-  /**
-   * Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.
-   */
-  pushCapable?: boolean;
-  keyCustody?: KeyCustody;
-  /**
-   * Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.
-   */
-  capabilities?: Capability[];
-  registeredAt: string;
-  /**
-   * Updated on every device/heartbeat and on any successful auth.
-   */
-  lastSeenAt?: string;
-  /**
-   * Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.
-   */
-  disabledAt?: string;
-  /**
-   * Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).
-   */
-  wipedAt?: string;
-  ext?: Ext;
-}
-export interface Companion {
-  kind: "companion";
-  formFactor: "browser" | "mobile" | "desktop";
-}
-export interface Service {
-  kind: "service";
-  serviceKind: "mediator" | "aiAgent" | "daemon";
-}
-export interface WebAuthnAttestation {
-  kind: "webauthn";
-  /**
-   * WebAuthn Authenticator AAGUID (UUID).
-   */
-  aaguid: string;
-  /**
-   * Base64url-encoded WebAuthn attestation statement, when supplied by the platform.
-   */
-  attestationStatement?: string;
-}
-export interface AppleAppAttest {
-  kind: "appleAppAttest";
-  keyId: string;
-  attestation: string;
-}
-export interface PlayIntegrity {
-  kind: "playIntegrity";
-  token: string;
-}
-export interface Tpm {
-  kind: "tpm";
-  quote: string;
-}
-export interface NitroEnclave {
-  kind: "nitroEnclave";
-  quote: string;
-}
-/**
- * No device-level attestation is available. Maintainers MAY still register the device but SHOULD apply stricter policy (shorter session TTL, more frequent step-up).
- */
-export interface NoAttestation {
-  kind: "none";
-}
-/**
- * How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.
- */
-export interface KeyCustody {
-  /**
-   * `hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.
-   */
-  tier: "hardware" | "software";
-  /**
-   * JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).
-   */
-  signingAlg?: string;
-  /**
-   * Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).
-   */
-  keyAgreementCurve?: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AppleAppAttest, Capability, Companion, ConsumerKind, DeviceAttestation, DeviceBinding, Ext, KeyCustody, NitroEnclave, NoAttestation, PlayIntegrity, Service, Tpm, WebAuthnAttestation };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/list/0.2" as const;

package/src/device/register/0.1/payload.ts

@@ -3,32 +3,8 @@
  * Source: specs/device/register/0.1/payload.schema.json
  */
 
-/**
- * Discriminator: is this consumer a user-driven Companion or a headless Service?
- */
-export type ConsumerKind = Companion | Service;
-/**
- * Producer-supplied attestation at registration time, verifiable by the maintainer against the platform's attestation infrastructure. Tagged union over the discriminator `kind`.
- */
-export type DeviceAttestation =
-  | WebAuthnAttestation
-  | AppleAppAttest
-  | PlayIntegrity
-  | Tpm
-  | NitroEnclave
-  | NoAttestation;
-/**
- * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each.
- */
-export type Capability =
-  | "vault-read"
-  | "vault-write"
-  | "proxy-login"
-  | "fill-release"
-  | "policy-admin"
-  | "device-admin"
-  | "sign"
-  | "key-mint";
+import type { AppleAppAttest_DeviceV0_1 as AppleAppAttest, Capability_DeviceV0_1 as Capability, Companion_DeviceV0_1 as Companion, ConsumerKind_DeviceV0_1 as ConsumerKind, DeviceAttestation_DeviceV0_1 as DeviceAttestation, DeviceBinding_DeviceV0_1 as DeviceBinding, Ext, KeyCustody, NitroEnclave_DeviceV0_1 as NitroEnclave, NoAttestation_DeviceV0_1 as NoAttestation, PlayIntegrity_DeviceV0_1 as PlayIntegrity, Service_DeviceV0_1 as Service, Tpm_DeviceV0_1 as Tpm, WebAuthnAttestation_DeviceV0_1 as WebAuthnAttestation } from "../../../_shared/components.js";
+
 
 /**
  * Public discovery surface that wraps the maintainer's existing two-phase enrolment (provision-integration → acl/swap-key). A new Companion or Service hands the maintainer its long-term VTA-derived key, its consumer kind, display name, and an optional device attestation; the maintainer creates the DeviceBinding and returns it. Phase 1 (provision-integration) is assumed to have already happened — this task is the post-bootstrap claim step.
@@ -38,6 +14,9 @@ export interface DeviceRegisterPayload {
   displayName: string;
   platform?: string;
   attestation?: DeviceAttestation;
+  /**
+   * OPTIONAL. How the device custodies its private keys (tier + algorithms). RECOMMENDED for mobile Companions. Maintainer policy input — see docs/design-notes/mobile-key-custody-profile.md.
+   */
   keyCustody?: KeyCustody;
   /**
    * X25519 public key (did:key form) the maintainer will use to HPKE-seal sensitive payloads to this device (sealed secrets, session blobs, sync events). REQUIRED — every Companion/Service needs a recipient key.
@@ -45,135 +24,13 @@ export interface DeviceRegisterPayload {
   hpkePublicKey?: string;
   ext?: Ext;
 }
-export interface Companion {
-  kind: "companion";
-  formFactor: "browser" | "mobile" | "desktop";
-}
-export interface Service {
-  kind: "service";
-  serviceKind: "mediator" | "ai-agent" | "daemon";
-}
-export interface WebAuthnAttestation {
-  kind: "webauthn";
-  /**
-   * WebAuthn Authenticator AAGUID (UUID).
-   */
-  aaguid: string;
-  /**
-   * Base64url-encoded WebAuthn attestation statement, when supplied by the platform.
-   */
-  attestationStatement?: string;
-}
-export interface AppleAppAttest {
-  kind: "apple-app-attest";
-  keyId: string;
-  attestation: string;
-}
-export interface PlayIntegrity {
-  kind: "play-integrity";
-  token: string;
-}
-export interface Tpm {
-  kind: "tpm";
-  quote: string;
-}
-export interface NitroEnclave {
-  kind: "nitro-enclave";
-  quote: string;
-}
-/**
- * No device-level attestation is available. Maintainers MAY still register the device but SHOULD apply stricter policy (shorter session TTL, more frequent step-up).
- */
-export interface NoAttestation {
-  kind: "none";
-}
-/**
- * OPTIONAL. How the device custodies its private keys (tier + algorithms). RECOMMENDED for mobile Companions. Maintainer policy input — see docs/design-notes/mobile-key-custody-profile.md.
- */
-export interface KeyCustody {
-  /**
-   * `hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.
-   */
-  tier: "hardware" | "software";
-  /**
-   * JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).
-   */
-  signingAlg?: string;
-  /**
-   * Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).
-   */
-  keyAgreementCurve?: string;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DeviceRegisterResponsePayload {
   binding: DeviceBinding;
   ext?: Ext;
 }
-export interface DeviceBinding {
-  /**
-   * Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.
-   */
-  deviceId: string;
-  /**
-   * The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.
-   */
-  consumerDid: string;
-  consumerKind: ConsumerKind;
-  /**
-   * Human-readable name (e.g. "Glenn's MacBook — Chrome", "iPhone 17").
-   */
-  displayName: string;
-  /**
-   * Free-form platform descriptor (e.g. "macOS 16 / Chrome 142", "iOS 19.1", "Android 16", "Linux/x86_64"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.
-   */
-  platform?: string;
-  attestation?: DeviceAttestation;
-  /**
-   * Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.
-   */
-  pushCapable?: boolean;
-  keyCustody?: KeyCustody1;
-  /**
-   * Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.
-   */
-  capabilities?: Capability[];
-  registeredAt: string;
-  /**
-   * Updated on every device/heartbeat and on any successful auth.
-   */
-  lastSeenAt?: string;
-  /**
-   * Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.
-   */
-  disabledAt?: string;
-  /**
-   * Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).
-   */
-  wipedAt?: string;
-  ext?: Ext;
-}
-/**
- * How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.
- */
-export interface KeyCustody1 {
-  /**
-   * `hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.
-   */
-  tier: "hardware" | "software";
-  /**
-   * JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).
-   */
-  signingAlg?: string;
-  /**
-   * Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).
-   */
-  keyAgreementCurve?: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AppleAppAttest, Capability, Companion, ConsumerKind, DeviceAttestation, DeviceBinding, Ext, KeyCustody, NitroEnclave, NoAttestation, PlayIntegrity, Service, Tpm, WebAuthnAttestation };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/register/0.1" as const;