@openvtc/trust-tasks 0.14.2 → 0.15.0

package/src/governance/_shared/0.1/governance.ts

@@ -9,3 +9,9 @@
 export interface GovernanceSharedDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { CapabilityManifest } from "../../../_shared/components.js";

package/src/governance/capability/disable/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/governance/capability/disable/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * A community operator disables a previously enabled capability. Disable is not delete: the capability's registry records are retained for audit, but its handlers stop executing, it disappears from discovery, and its lifecycle hooks stop firing.
  */
@@ -17,12 +20,6 @@ export interface GovernanceCapabilityDisablePayload {
   reason?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface GovernanceCapabilityDisableResponsePayload {
   capability: string;
   /**
@@ -36,6 +33,9 @@ export interface GovernanceCapabilityDisableResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/governance/capability/disable/0.1" as const;
 

package/src/governance/capability/enable/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/governance/capability/enable/0.1/payload.schema.json
  */
 
+import type { CapabilityManifest, Ext } from "../../../../_shared/components.js";
+
+
 /**
  * A community operator enables a pluggable capability for a community. Activation registers the capability's Trust Task handlers, advertises it in discovery, and starts its lifecycle hooks; a community with no enable record carries none of the capability's records, surfaces, or attack surface.
  */
@@ -23,91 +26,12 @@ export interface GovernanceCapabilityEnablePayload {
    * DID of the companion service that serves this capability, for capabilities not built into the host. When present, the host records a namespace delegation to this DID and `manifest` is REQUIRED (the host cannot know a companion's manifest a priori).
    */
   delegate?: string;
-  manifest?: CapabilityManifest;
-  ext?: Ext;
-}
-/**
- * The capability's manifest. OPTIONAL for built-in capabilities (the host knows it); REQUIRED when `delegate` is present.
- */
-export interface CapabilityManifest {
-  /**
-   * The capability's namespace slug, e.g. `git-trust`.
-   */
-  capability: string;
-  /**
-   * Manifest/capability version, `MAJOR.MINOR`.
-   */
-  version: string;
-  /**
-   * Human-readable capability name for management surfaces.
-   */
-  title?: string;
-  /**
-   * One-paragraph description for management surfaces.
-   */
-  description?: string;
   /**
-   * Trust Task spec slugs (or `<family>/*` globs) this capability serves when enabled.
-   *
-   * @minItems 1
+   * The capability's manifest. OPTIONAL for built-in capabilities (the host knows it); REQUIRED when `delegate` is present.
    */
-  specs: [string, ...string[]];
-  /**
-   * The trust-registry tuple vocabulary this capability may read and write. A conforming host MUST reject writes by this capability whose `action` is not listed.
-   */
-  vocabulary?: {
-    /**
-     * TRQP `action` values this capability owns, e.g. `git.commit.sign`.
-     *
-     * @minItems 1
-     */
-    actions: [string, ...string[]];
-    /**
-     * Human-readable pattern of the `resource` values used, e.g. `<org>[/<repo>]`.
-     */
-    resourcePattern?: string;
-  };
-  /**
-   * Map of capability operation (e.g. `grant`, `view`) to the community roles allowed to perform it.
-   */
-  roles?: {
-    [k: string]: string[] | undefined;
-  };
-  /**
-   * Membership lifecycle events the capability consumes, e.g. `member.enrolled`, `member.revoked`, `role.changed`.
-   */
-  lifecycleHooks?: string[];
-  /**
-   * Map of capability operation to the consent class its execution requires under the host's delegated-execution policy.
-   */
-  consentClass?: {
-    [k: string]: ("normal" | "elevated" | "destructive") | undefined;
-  };
-  /**
-   * Out-of-stack components that consume this capability's trust decisions.
-   */
-  externalAdapters?: {
-    /**
-     * Adapter type, e.g. `github-action`, `webhook`.
-     */
-    kind: string;
-    /**
-     * Where the adapter lives, e.g. a repository path or URL.
-     */
-    ref: string;
-  }[];
-  /**
-   * Spec slug of the JSON schema the per-community `config` document must validate against.
-   */
-  configSchema?: string;
+  manifest?: CapabilityManifest;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface GovernanceCapabilityEnableResponsePayload {
   capability: string;
   version?: string;
@@ -126,6 +50,9 @@ export interface GovernanceCapabilityEnableResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { CapabilityManifest, Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/governance/capability/enable/0.1" as const;
 

package/src/governance/capability/list/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/governance/capability/list/0.1/payload.schema.json
  */
 
+import type { CapabilityManifest, Ext } from "../../../../_shared/components.js";
+
+
 /**
  * List a community's capabilities and their manifests — the query behind a capability management surface. Defaults to enabled capabilities only.
  */
@@ -13,12 +16,6 @@ export interface GovernanceCapabilityListPayload {
   status?: "enabled" | "available" | "all";
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface GovernanceCapabilityListResponsePayload {
   capabilities: {
     manifest: CapabilityManifest;
@@ -34,82 +31,9 @@ export interface GovernanceCapabilityListResponsePayload {
   }[];
   ext?: Ext;
 }
-/**
- * The self-description of a pluggable community capability: the Trust Task families it serves, the trust-registry vocabulary it reads and writes, the roles that may operate it, the membership lifecycle hooks it consumes, and the external adapters that act on its decisions. The manifest is what governance approves, what discovery advertises, and what a management UX renders.
- */
-export interface CapabilityManifest {
-  /**
-   * The capability's namespace slug, e.g. `git-trust`.
-   */
-  capability: string;
-  /**
-   * Manifest/capability version, `MAJOR.MINOR`.
-   */
-  version: string;
-  /**
-   * Human-readable capability name for management surfaces.
-   */
-  title?: string;
-  /**
-   * One-paragraph description for management surfaces.
-   */
-  description?: string;
-  /**
-   * Trust Task spec slugs (or `<family>/*` globs) this capability serves when enabled.
-   *
-   * @minItems 1
-   */
-  specs: [string, ...string[]];
-  /**
-   * The trust-registry tuple vocabulary this capability may read and write. A conforming host MUST reject writes by this capability whose `action` is not listed.
-   */
-  vocabulary?: {
-    /**
-     * TRQP `action` values this capability owns, e.g. `git.commit.sign`.
-     *
-     * @minItems 1
-     */
-    actions: [string, ...string[]];
-    /**
-     * Human-readable pattern of the `resource` values used, e.g. `<org>[/<repo>]`.
-     */
-    resourcePattern?: string;
-  };
-  /**
-   * Map of capability operation (e.g. `grant`, `view`) to the community roles allowed to perform it.
-   */
-  roles?: {
-    [k: string]: string[] | undefined;
-  };
-  /**
-   * Membership lifecycle events the capability consumes, e.g. `member.enrolled`, `member.revoked`, `role.changed`.
-   */
-  lifecycleHooks?: string[];
-  /**
-   * Map of capability operation to the consent class its execution requires under the host's delegated-execution policy.
-   */
-  consentClass?: {
-    [k: string]: ("normal" | "elevated" | "destructive") | undefined;
-  };
-  /**
-   * Out-of-stack components that consume this capability's trust decisions.
-   */
-  externalAdapters?: {
-    /**
-     * Adapter type, e.g. `github-action`, `webhook`.
-     */
-    kind: string;
-    /**
-     * Where the adapter lives, e.g. a repository path or URL.
-     */
-    ref: string;
-  }[];
-  /**
-   * Spec slug of the JSON schema the per-community `config` document must validate against.
-   */
-  configSchema?: string;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { CapabilityManifest, Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/governance/capability/list/0.1" as const;

package/src/index.ts

@@ -5,6 +5,11 @@
 // not one specification among many.
 export * from "./_runtime/index.js";
 
+// Every cross-file definition, declared once. Namespaced rather than flat:
+// 150-odd names in the root export would collide with the runtime's on the
+// first shared definition anyone calls `Transport` or `Session`.
+export * as SharedComponents from "./_shared/components.js";
+
 export * as FrameworkShared_v0_1 from "./_framework/0.1/framework.js";
 export * as FrameworkShared_v0_2 from "./_framework/0.2/framework.js";
 export * as FrameworkShared_v0_3 from "./_framework/0.3/framework.js";

package/src/keys/_shared/0.1/key-record.ts

@@ -9,3 +9,9 @@
 export interface KeyRecordSharedDefinitionForTheKeysSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { KeyOrigin, KeyRecord, KeyStatus, KeyType } from "../../../_shared/components.js";

package/src/keys/_shared/0.1/sign-algorithm.ts

@@ -9,3 +9,9 @@
 export interface SignAlgorithmSharedDefinitionForTheKeysSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { SignAlgorithm } from "../../../_shared/components.js";

package/src/keys/create/0.1/payload.ts

@@ -3,24 +3,13 @@
  * Source: specs/keys/create/0.1/payload.schema.json
  */
 
-/**
- * Algorithm to generate.
- */
-export type KeyType = "ed25519" | "x25519" | "p256";
-/**
- * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).
- */
-export type KeyType1 = "ed25519" | "x25519" | "p256";
-/**
- * Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.
- */
-export type KeyStatus = "active" | "revoked";
-/**
- * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.
- */
-export type KeyOrigin = "derived" | "imported" | "internal";
+import type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType } from "../../../_shared/components.js";
+
 
 export interface KeysCreatePayload {
+  /**
+   * Algorithm to generate.
+   */
   keyType: KeyType;
   /**
    * Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian. MUST NOT be combined with `internal: true`, which derives from no seed and records no path — a request carrying both is contradictory and the maintainer SHOULD reject it.
@@ -48,69 +37,25 @@ export interface KeysCreatePayload {
    * Scope to file the key under. Absence is the most restrictive reading, not a wildcard — see KeyRecord.contextId.
    */
   contextId?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/create request: the record the custodian now holds. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/create/0.1#response.
  */
 export interface KeysCreateResponsePayload {
-  key: KeyRecord;
-  ext?: Ext1;
-}
-/**
- * The realized record, carrying the public half. The private half is never returned.
- */
-export interface KeyRecord {
-  /**
-   * Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.
-   */
-  keyId: string;
-  keyType: KeyType1;
-  status: KeyStatus;
   /**
-   * The public half, multibase-encoded. The private half is never carried by any keys/* response.
+   * The realized record, carrying the public half. The private half is never returned.
    */
-  publicKey: string;
-  /**
-   * Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.
-   */
-  derivationPath?: string;
-  /**
-   * Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.
-   */
-  seedId?: number;
-  origin?: KeyOrigin;
-  /**
-   * Optional human-readable label. Operator-facing only; carries no authorization meaning.
-   */
-  label?: string;
-  /**
-   * Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.
-   */
-  contextId?: string;
-  /**
-   * RFC 3339 timestamp at which the key was created or imported.
-   */
-  createdAt: string;
-  /**
-   * RFC 3339 timestamp of the last change to the record (rename, revocation).
-   */
-  updatedAt?: string;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  key: KeyRecord;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/create/0.1" as const;
 

package/src/keys/derive-and-sign/0.1/payload.ts

@@ -3,23 +3,16 @@
  * Source: specs/keys/derive-and-sign/0.1/payload.schema.json
  */
 
-/**
- * Algorithm to derive. MUST be one that can sign.
- */
-export type KeyType = "ed25519" | "x25519" | "p256";
-/**
- * Signature algorithm. MUST be compatible with the derived key's type.
- */
-export type SignAlgorithm = "EdDSA" | "ES256";
-/**
- * `EdDSA` pairs with an `ed25519` key; `ES256` pairs with a `p256` key. An `x25519` key performs key agreement and can sign nothing, so no algorithm here is valid for one. The enumeration is closed: an unrecognised algorithm is refused rather than silently substituted with a supported one.
- */
-export type SignAlgorithm1 = "EdDSA" | "ES256";
+import type { Ext, KeyType, SignAlgorithm } from "../../../_shared/components.js";
+
 
 /**
  * Derive a key at a path and sign with it in one step, without adding a stored key record.
  */
 export interface KeysDeriveAndSignPayload {
+  /**
+   * Algorithm to derive. MUST be one that can sign.
+   */
   keyType: KeyType;
   /**
    * Hierarchical-deterministic path to derive at. The same path against the same seed always yields the same key, which is what makes this reproducible rather than ephemeral.
@@ -29,15 +22,15 @@ export interface KeysDeriveAndSignPayload {
    * The exact bytes to sign, base64url-encoded without padding. Signed verbatim — not parsed, canonicalized or wrapped.
    */
   payload: string;
+  /**
+   * Signature algorithm. MUST be compatible with the derived key's type.
+   */
   algorithm: SignAlgorithm;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/derive-and-sign request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/derive-and-sign/0.1#response.
  */
@@ -50,16 +43,13 @@ export interface KeysDeriveAndSignResponsePayload {
    * Signature bytes, base64url-encoded without padding.
    */
   signature: string;
-  algorithm: SignAlgorithm1;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  algorithm: SignAlgorithm;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, KeyType, SignAlgorithm };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/derive-and-sign/0.1" as const;
 

package/src/keys/derive-and-sign-document/0.1/payload.ts

@@ -3,15 +3,16 @@
  * Source: specs/keys/derive-and-sign-document/0.1/payload.schema.json
  */
 
-/**
- * Algorithm to derive. MUST be one that can sign.
- */
-export type KeyType = "ed25519" | "x25519" | "p256";
+import type { Ext, KeyType } from "../../../_shared/components.js";
+
 
 /**
  * Derive a key at a path and return the supplied JSON document with a Data Integrity proof grafted on. Unlike keys/derive-and-sign, the custodian canonicalizes the document itself.
  */
 export interface KeysDeriveAndSignDocumentPayload {
+  /**
+   * Algorithm to derive. MUST be one that can sign.
+   */
   keyType: KeyType;
   /**
    * Hierarchical-deterministic path to derive at.
@@ -25,14 +26,11 @@ export interface KeysDeriveAndSignDocumentPayload {
    * Proof purpose to record in the generated proof. Absent means `assertionMethod`.
    */
   proofPurpose?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/derive-and-sign-document request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/derive-and-sign-document/0.1#response.
  */
@@ -45,15 +43,12 @@ export interface KeysDeriveAndSignDocumentResponsePayload {
    * The document with the Data Integrity `proof` grafted on.
    */
   document: {};
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, KeyType };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/derive-and-sign-document/0.1" as const;
 

package/src/keys/import/0.1/payload.ts

@@ -3,10 +3,16 @@
  * Source: specs/keys/import/0.1/payload.schema.json
  */
 
+import type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType } from "../../../_shared/components.js";
+
+
 /**
  * Hand an externally-created private key to a custodian. Exactly one carrier member MUST be present; the choice of carrier is a confidentiality decision, not a formatting one.
  */
 export type KeysImportPayload = {
+  /**
+   * Algorithm of the key being imported. The custodian MUST verify the supplied material is of this type rather than trusting the claim.
+   */
   keyType: KeyType;
   /**
    * The private key inside an armored sealed-transfer bundle, encrypted to the custodian's own public key. The only carrier that keeps the key confidential from every intermediary, including a transport terminator, so it is the one to prefer.
@@ -28,88 +34,28 @@ export type KeysImportPayload = {
    * Scope to file the imported key under. Absence is the most restrictive reading, not a wildcard — see KeyRecord.contextId.
    */
   contextId?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 } & {
   [k: string]: unknown | undefined;
 };
-/**
- * Algorithm of the key being imported. The custodian MUST verify the supplied material is of this type rather than trusting the claim.
- */
-export type KeyType = "ed25519" | "x25519" | "p256";
-/**
- * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).
- */
-export type KeyType1 = "ed25519" | "x25519" | "p256";
-/**
- * Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.
- */
-export type KeyStatus = "active" | "revoked";
-/**
- * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.
- */
-export type KeyOrigin = "derived" | "imported" | "internal";
 
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/import request: the record the custodian now holds. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/import/0.1#response.
  */
 export interface KeysImportResponsePayload {
-  key: KeyRecord;
-  ext?: Ext1;
-}
-/**
- * The realized record. `origin` is `imported` and `derivationPath` is absent — an imported key is not reproducible from any seed the custodian holds.
- */
-export interface KeyRecord {
   /**
-   * Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.
+   * The realized record. `origin` is `imported` and `derivationPath` is absent — an imported key is not reproducible from any seed the custodian holds.
    */
-  keyId: string;
-  keyType: KeyType1;
-  status: KeyStatus;
-  /**
-   * The public half, multibase-encoded. The private half is never carried by any keys/* response.
-   */
-  publicKey: string;
-  /**
-   * Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.
-   */
-  derivationPath?: string;
-  /**
-   * Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.
-   */
-  seedId?: number;
-  origin?: KeyOrigin;
-  /**
-   * Optional human-readable label. Operator-facing only; carries no authorization meaning.
-   */
-  label?: string;
-  /**
-   * Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.
-   */
-  contextId?: string;
-  /**
-   * RFC 3339 timestamp at which the key was created or imported.
-   */
-  createdAt: string;
-  /**
-   * RFC 3339 timestamp of the last change to the record (rename, revocation).
-   */
-  updatedAt?: string;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  key: KeyRecord;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/import/0.1" as const;