@openvtc/trust-tasks 0.14.2 → 0.15.0

package/src/keys/list/0.1/payload.ts

@@ -3,24 +3,13 @@
  * Source: specs/keys/list/0.1/payload.schema.json
  */
 
-/**
- * Return only keys in this lifecycle state. Omitted returns every state, including revoked keys.
- */
-export type KeyStatus = "active" | "revoked";
-/**
- * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).
- */
-export type KeyType = "ed25519" | "x25519" | "p256";
-/**
- * Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.
- */
-export type KeyStatus1 = "active" | "revoked";
-/**
- * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.
- */
-export type KeyOrigin = "derived" | "imported" | "internal";
+import type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType } from "../../../_shared/components.js";
+
 
 export interface KeysListPayload {
+  /**
+   * Return only keys in this lifecycle state. Omitted returns every state, including revoked keys.
+   */
   status?: KeyStatus;
   /**
    * Return only keys filed under this scope.
@@ -34,14 +23,11 @@ export interface KeysListPayload {
    * Maximum records to return. The custodian MAY return fewer and MAY impose its own ceiling; `total` says how many matched.
    */
   limit?: number;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/list request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/list/0.1#response.
  */
@@ -62,53 +48,12 @@ export interface KeysListResponsePayload {
    * The page size actually applied, which MAY be smaller than the one requested.
    */
   limit: number;
-  ext?: Ext1;
-}
-export interface KeyRecord {
-  /**
-   * Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.
-   */
-  keyId: string;
-  keyType: KeyType;
-  status: KeyStatus1;
-  /**
-   * The public half, multibase-encoded. The private half is never carried by any keys/* response.
-   */
-  publicKey: string;
-  /**
-   * Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.
-   */
-  derivationPath?: string;
-  /**
-   * Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.
-   */
-  seedId?: number;
-  origin?: KeyOrigin;
-  /**
-   * Optional human-readable label. Operator-facing only; carries no authorization meaning.
-   */
-  label?: string;
-  /**
-   * Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.
-   */
-  contextId?: string;
-  /**
-   * RFC 3339 timestamp at which the key was created or imported.
-   */
-  createdAt: string;
-  /**
-   * RFC 3339 timestamp of the last change to the record (rename, revocation).
-   */
-  updatedAt?: string;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/list/0.1" as const;
 

package/src/keys/rename/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/keys/rename/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Change a key's identifier. The key material is untouched — only the name it is addressed by changes.
  */
@@ -15,14 +18,11 @@ export interface KeysRenamePayload {
    * The identifier it should be addressed by afterwards. MUST NOT collide with an existing record.
    */
   newKeyId: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/rename request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/rename/0.1#response.
  */
@@ -35,15 +35,12 @@ export interface KeysRenameResponsePayload {
    * RFC 3339 timestamp of the rename.
    */
   updatedAt: string;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/rename/0.1" as const;
 

package/src/keys/revoke/0.1/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/keys/revoke/0.1/payload.schema.json
  */
 
-/**
- * The lifecycle state now in effect — `revoked` on success. Returned rather than assumed so a caller reading only the response can see the realized state.
- */
-export type KeyStatus = "active" | "revoked";
+import type { Ext, KeyStatus } from "../../../_shared/components.js";
+
 
 /**
  * Retire a key from further use. The record is retained so historic signatures stay attributable; this is not a delete.
@@ -20,14 +18,11 @@ export interface KeysRevokePayload {
    * Optional human-readable rationale, recorded with the revocation.
    */
   reason?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/revoke request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/revoke/0.1#response.
  */
@@ -36,20 +31,20 @@ export interface KeysRevokeResponsePayload {
    * The key that was retired.
    */
   keyId: string;
+  /**
+   * The lifecycle state now in effect — `revoked` on success. Returned rather than assumed so a caller reading only the response can see the realized state.
+   */
   status: KeyStatus;
   /**
    * RFC 3339 timestamp of the revocation. The boundary between signatures made while the key was valid and requests refused afterwards.
    */
   updatedAt: string;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, KeyStatus };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/revoke/0.1" as const;
 

package/src/keys/show/0.1/payload.ts

@@ -3,32 +3,19 @@
  * Source: specs/keys/show/0.1/payload.schema.json
  */
 
-/**
- * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).
- */
-export type KeyType = "ed25519" | "x25519" | "p256";
-/**
- * Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.
- */
-export type KeyStatus = "active" | "revoked";
-/**
- * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.
- */
-export type KeyOrigin = "derived" | "imported" | "internal";
+import type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType } from "../../../_shared/components.js";
+
 
 export interface KeysShowPayload {
   /**
    * Identifier of the key to read.
    */
   keyId: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/show request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/show/0.1#response.
  */
@@ -37,53 +24,12 @@ export interface KeysShowResponsePayload {
    * The record the custodian holds, or null where it holds none for this identifier. 'No such key' is a successful answer, not an error.
    */
   key: KeyRecord | null;
-  ext?: Ext1;
-}
-export interface KeyRecord {
-  /**
-   * Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.
-   */
-  keyId: string;
-  keyType: KeyType;
-  status: KeyStatus;
-  /**
-   * The public half, multibase-encoded. The private half is never carried by any keys/* response.
-   */
-  publicKey: string;
-  /**
-   * Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.
-   */
-  derivationPath?: string;
-  /**
-   * Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.
-   */
-  seedId?: number;
-  origin?: KeyOrigin;
-  /**
-   * Optional human-readable label. Operator-facing only; carries no authorization meaning.
-   */
-  label?: string;
-  /**
-   * Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.
-   */
-  contextId?: string;
-  /**
-   * RFC 3339 timestamp at which the key was created or imported.
-   */
-  createdAt: string;
-  /**
-   * RFC 3339 timestamp of the last change to the record (rename, revocation).
-   */
-  updatedAt?: string;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/show/0.1" as const;
 

package/src/keys/sign/0.1/payload.ts

@@ -3,14 +3,8 @@
  * Source: specs/keys/sign/0.1/payload.schema.json
  */
 
-/**
- * Signature algorithm to use. MUST be compatible with the named key's `keyType`.
- */
-export type SignAlgorithm = "EdDSA" | "ES256";
-/**
- * `EdDSA` pairs with an `ed25519` key; `ES256` pairs with a `p256` key. An `x25519` key performs key agreement and can sign nothing, so no algorithm here is valid for one. The enumeration is closed: an unrecognised algorithm is refused rather than silently substituted with a supported one.
- */
-export type SignAlgorithm1 = "EdDSA" | "ES256";
+import type { Ext, SignAlgorithm } from "../../../_shared/components.js";
+
 
 export interface KeysSignPayload {
   /**
@@ -21,15 +15,15 @@ export interface KeysSignPayload {
    * The exact bytes to sign, base64url-encoded without padding. The maintainer signs these bytes verbatim: it does not parse, canonicalize, or wrap them.
    */
   payload: string;
+  /**
+   * Signature algorithm to use. MUST be compatible with the named key's `keyType`.
+   */
   algorithm: SignAlgorithm;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/sign request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign/0.1#response.
  */
@@ -42,16 +36,13 @@ export interface KeysSignResponsePayload {
    * Signature bytes, base64url-encoded without padding.
    */
   signature: string;
-  algorithm: SignAlgorithm1;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  algorithm: SignAlgorithm;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, SignAlgorithm };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/sign/0.1" as const;
 

package/src/messaging/_shared/0.1/messaging.ts

@@ -9,3 +9,9 @@
 export interface MessagingAdministrationSharedDefinitionsForTheMessagingSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { Account, AccountType, AdminAccount, AuditAction, AuditEntry, MediatorAcl, QueueLimits, Vid } from "../../../_shared/components.js";

package/src/messaging/access-list/add/0.1/payload.ts

@@ -3,57 +3,50 @@
  * Source: specs/messaging/access-list/add/0.1/payload.schema.json
  */
 
-/**
- * The target account's DID whose access list is being modified.
- */
-export type Vid = string;
-/**
- * A Verifiable Identifier (SPEC §4.8). For a mediator-served account this is the account's controlling DID, carried verbatim and compared by exact string equality. For privacy — and because some mediators key accounts by a one-way hash and never hold the full DID — a stable hash of the DID (e.g. its SHA-256 digest) is an equally valid value here: producer and consumer simply agree on the same opaque identifier and compare by exact string equality. The field carries whichever form the issuing mediator uses.
- */
-export type Vid1 = string;
-/**
- * A Verifiable Identifier (SPEC §4.8). For a mediator-served account this is the account's controlling DID, carried verbatim and compared by exact string equality. For privacy — and because some mediators key accounts by a one-way hash and never hold the full DID — a stable hash of the DID (e.g. its SHA-256 digest) is an equally valid value here: producer and consumer simply agree on the same opaque identifier and compare by exact string equality. The field carries whichever form the issuing mediator uses.
- */
-export type Vid2 = string;
+import type { Ext, Vid } from "../../../../_shared/components.js";
+
 
 export interface MessagingAddToAccessListPayload {
+  /**
+   * The target account's DID whose access list is being modified.
+   */
   did: Vid;
   /**
    * The DIDs to add to the account's access list. Entries already present are ignored.
    *
    * @minItems 1
    */
-  entries: [Vid1, ...Vid1[]];
+  entries: [Vid, ...Vid[]];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a messaging/access-list/add request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/access-list/add/0.1#response.
  */
 export interface MessagingAddToAccessListResponsePayload {
-  did: Vid2;
+  /**
+   * The account whose access list was modified.
+   */
+  did: Vid;
   /**
    * The entries actually added (those not already present in the access list).
    */
-  added: Vid1[];
+  added: Vid[];
   /**
    * The resulting number of entries in the account's access list.
    */
   accessListCount: number;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Vid };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/messaging/access-list/add/0.1" as const;
 

package/src/messaging/access-list/clear/0.1/payload.ts

@@ -3,43 +3,40 @@
  * Source: specs/messaging/access-list/clear/0.1/payload.schema.json
  */
 
-/**
- * The target account's DID whose access list is being cleared.
- */
-export type Vid = string;
-/**
- * The account whose access list was cleared.
- */
-export type Vid1 = string;
+import type { Ext, Vid } from "../../../../_shared/components.js";
+
 
 export interface MessagingClearAccessListPayload {
+  /**
+   * The target account's DID whose access list is being cleared.
+   */
   did: Vid;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a messaging/access-list/clear request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/access-list/clear/0.1#response.
  */
 export interface MessagingClearAccessListResponsePayload {
-  did: Vid1;
+  /**
+   * The account whose access list was cleared.
+   */
+  did: Vid;
   /**
    * The resulting number of entries in the account's access list (0 after a clear).
    */
   accessListCount: number;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Vid };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/messaging/access-list/clear/0.1" as const;
 

package/src/messaging/access-list/get/0.1/payload.ts

@@ -3,57 +3,50 @@
  * Source: specs/messaging/access-list/get/0.1/payload.schema.json
  */
 
-/**
- * The target account's DID whose access list is being checked.
- */
-export type Vid = string;
-/**
- * A Verifiable Identifier (SPEC §4.8). For a mediator-served account this is the account's controlling DID, carried verbatim and compared by exact string equality. For privacy — and because some mediators key accounts by a one-way hash and never hold the full DID — a stable hash of the DID (e.g. its SHA-256 digest) is an equally valid value here: producer and consumer simply agree on the same opaque identifier and compare by exact string equality. The field carries whichever form the issuing mediator uses.
- */
-export type Vid1 = string;
-/**
- * A Verifiable Identifier (SPEC §4.8). For a mediator-served account this is the account's controlling DID, carried verbatim and compared by exact string equality. For privacy — and because some mediators key accounts by a one-way hash and never hold the full DID — a stable hash of the DID (e.g. its SHA-256 digest) is an equally valid value here: producer and consumer simply agree on the same opaque identifier and compare by exact string equality. The field carries whichever form the issuing mediator uses.
- */
-export type Vid2 = string;
+import type { Ext, Vid } from "../../../../_shared/components.js";
+
 
 export interface MessagingCheckAccessListMembershipPayload {
+  /**
+   * The target account's DID whose access list is being checked.
+   */
   did: Vid;
   /**
    * The DIDs to test for membership in the account's access list.
    *
    * @minItems 1
    */
-  entries: [Vid1, ...Vid1[]];
+  entries: [Vid, ...Vid[]];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a messaging/access-list/get request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/access-list/get/0.1#response.
  */
 export interface MessagingCheckAccessListMembershipResponsePayload {
-  did: Vid2;
+  /**
+   * The account whose access list was checked.
+   */
+  did: Vid;
   /**
    * The supplied entries that are present in the account's access list.
    */
-  present: Vid1[];
+  present: Vid[];
   /**
    * The supplied entries that are not present in the account's access list.
    */
-  absent: Vid1[];
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  absent: Vid[];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Vid };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/messaging/access-list/get/0.1" as const;