@openvtc/trust-tasks 0.14.2 → 0.15.0

package/src/messaging/admin/audit-log/0.1/payload.ts

@@ -3,28 +3,8 @@
  * Source: specs/messaging/admin/audit-log/0.1/payload.schema.json
  */
 
-/**
- * The authenticated account that made the change (an admin, or the owner for a self-service change).
- */
-export type Vid = string;
-/**
- * The account whose record changed.
- */
-export type Vid1 = string;
-/**
- * The kind of privileged change recorded in the audit log.
- */
-export type AuditAction =
-  | "setAcl"
-  | "accessListAdd"
-  | "accessListRemove"
-  | "accessListClear"
-  | "accountAdd"
-  | "accountRemove"
-  | "accountChangeType"
-  | "accountChangeQueueLimits"
-  | "adminAdd"
-  | "adminStrip";
+import type { AuditAction, AuditEntry, Ext, Vid } from "../../../../_shared/components.js";
+
 
 export interface MessagingAuditLogPayload {
   /**
@@ -35,14 +15,11 @@ export interface MessagingAuditLogPayload {
    * Maximum number of audit entries to return in this page. The mediator chooses a default when omitted.
    */
   limit?: number;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a messaging/admin/audit-log request (newest-first). Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/admin/audit-log/0.1#response.
  */
@@ -55,31 +32,15 @@ export interface MessagingAuditLogResponsePayload {
    * Opaque continuation token. Present only when further entries remain beyond this page; omitted on the final page.
    */
   nextCursor?: string;
-  ext?: Ext1;
-}
-/**
- * One record in the mediator's privileged-change audit log: one change, by one actor, at one time.
- */
-export interface AuditEntry {
-  /**
-   * Unix epoch seconds at which the change was recorded.
-   */
-  timestamp: number;
-  actor: Vid;
-  target: Vid1;
-  action: AuditAction;
   /**
-   * Short human-readable summary of the change; not machine-parsed.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  detail?: string;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuditAction, AuditEntry, Ext, Vid };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/messaging/admin/audit-log/0.1" as const;
 

package/src/messaging/admin/config/0.1/payload.ts

@@ -3,15 +3,15 @@
  * Source: specs/messaging/admin/config/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 export interface MessagingGetConfigurationPayload {
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a messaging/admin/config request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/admin/config/0.1#response.
  */
@@ -26,15 +26,15 @@ export interface MessagingGetConfigurationResponsePayload {
   config: {
     [k: string]: unknown | undefined;
   };
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/messaging/admin/config/0.1" as const;
 

package/src/messaging/admin/list/0.1/payload.ts

@@ -3,14 +3,8 @@
  * Source: specs/messaging/admin/list/0.1/payload.schema.json
  */
 
-/**
- * The admin account's identifier — its DID or, for privacy, a stable hash of that DID (see `Vid`).
- */
-export type Vid = string;
-/**
- * The admin role; one of `admin` or `rootAdmin`.
- */
-export type AccountType = "standard" | "admin" | "rootAdmin" | "mediator";
+import type { AccountType, AdminAccount, Ext, Vid } from "../../../../_shared/components.js";
+
 
 export interface MessagingListAdminsPayload {
   /**
@@ -21,14 +15,11 @@ export interface MessagingListAdminsPayload {
    * Maximum number of admin accounts to return in this page. The mediator chooses a default when omitted.
    */
   limit?: number;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a messaging/admin/list request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/admin/list/0.1#response.
  */
@@ -41,22 +32,15 @@ export interface MessagingListAdminsResponsePayload {
    * Opaque continuation token. Present only when further admins remain beyond this page; omitted on the final page.
    */
   nextCursor?: string;
-  ext?: Ext1;
-}
-/**
- * A privileged account at the mediator (an `admin` or `rootAdmin`).
- */
-export interface AdminAccount {
-  did: Vid;
-  accountType: AccountType;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AccountType, AdminAccount, Ext, Vid };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/messaging/admin/list/0.1" as const;
 

package/src/messaging/admin/strip/0.1/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/messaging/admin/strip/0.1/payload.schema.json
  */
 
-/**
- * A Verifiable Identifier (SPEC §4.8). For a mediator-served account this is the account's controlling DID, carried verbatim and compared by exact string equality. For privacy — and because some mediators key accounts by a one-way hash and never hold the full DID — a stable hash of the DID (e.g. its SHA-256 digest) is an equally valid value here: producer and consumer simply agree on the same opaque identifier and compare by exact string equality. The field carries whichever form the issuing mediator uses.
- */
-export type Vid = string;
+import type { Ext, Vid } from "../../../../_shared/components.js";
+
 
 export interface MessagingStripAdminsPayload {
   /**
@@ -15,14 +13,11 @@ export interface MessagingStripAdminsPayload {
    * @minItems 1
    */
   dids: [Vid, ...Vid[]];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a messaging/admin/strip request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/admin/strip/0.1#response.
  */
@@ -31,15 +26,15 @@ export interface MessagingStripAdminsResponsePayload {
    * The accounts whose admin rights were removed.
    */
   stripped: Vid[];
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Vid };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/messaging/admin/strip/0.1" as const;
 

package/src/messaging/ping/0.1/payload.ts

@@ -3,19 +3,19 @@
  * Source: specs/messaging/ping/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 export interface MessagingPingPayload {
   /**
    * Optional opaque value the requester may supply to correlate the response to this probe. The mediator echoes it verbatim in the response.
    */
   nonce?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a messaging/ping request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/ping/0.1#response.
  */
@@ -36,15 +36,15 @@ export interface MessagingPingResponsePayload {
    * Echoed verbatim from the request when one was supplied.
    */
   nonce?: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/messaging/ping/0.1" as const;
 

package/src/policy/_shared/0.1/policy.ts

@@ -9,3 +9,9 @@
 export interface PolicySharedDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { PolicyDecision_PolicyV0_1 as PolicyDecision, PolicyInput_PolicyV0_1 as PolicyInput, PolicyModule } from "../../../_shared/components.js";

package/src/policy/_shared/0.2/policy.ts

@@ -9,3 +9,9 @@
 export interface PolicySharedDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { PolicyDecision_PolicyV0_2 as PolicyDecision, PolicyInput_PolicyV0_2 as PolicyInput, PolicyModule } from "../../../_shared/components.js";

package/src/policy/_shared/0.3/policy.ts

@@ -9,3 +9,9 @@
 export interface PolicySharedDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { PolicyDecision_PolicyV0_3 as PolicyDecision, PolicyInput_PolicyV0_3 as PolicyInput, PolicyModule } from "../../../_shared/components.js";

package/src/policy/activate/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/policy/activate/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 export interface PolicyActivatePayload {
   /**
    * The id of the policy module to make active for `purpose`.
@@ -18,12 +21,6 @@ export interface PolicyActivatePayload {
   contextId?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PolicyActivateResponsePayload {
   /**
    * The id now active for `purpose` — equal to the request `id`.
@@ -44,6 +41,9 @@ export interface PolicyActivateResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/activate/0.1" as const;
 

package/src/policy/active/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/policy/active/0.1/payload.schema.json
  */
 
+import type { Ext, PolicyModule } from "../../../_shared/components.js";
+
+
 export interface PolicyActivePayload {
   /**
    * Return the active binding for this decision slot only. Omitted = return every active binding (optionally scoped by contextId).
@@ -14,12 +17,6 @@ export interface PolicyActivePayload {
   contextId?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PolicyActiveResponsePayload {
   /**
    * The active (contextId, purpose) -> policy bindings that matched the request. Zero entries when the requested purpose has no active policy; the full set when purpose is omitted. Unpaginated — the active set has one entry per purpose, which is small by construction.
@@ -38,31 +35,9 @@ export interface ActiveBinding {
   contextId?: string;
   policy: PolicyModule;
 }
-export interface PolicyModule {
-  id: string;
-  /**
-   * Human-readable name (e.g. "default vault policy", "bank-site step-up").
-   */
-  name: string;
-  description?: string;
-  /**
-   * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
-   */
-  module: string;
-  /**
-   * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
-   */
-  appliesTo?: string[];
-  /**
-   * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
-   */
-  priority?: number;
-  enabled?: boolean;
-  version: number;
-  createdAt: string;
-  updatedAt: string;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PolicyModule };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/active/0.1" as const;

package/src/policy/delete/0.1/payload.ts

@@ -3,24 +3,24 @@
  * Source: specs/policy/delete/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 export interface PolicyDeletePayload {
   id: string;
   expectedVersion?: number;
   reason?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PolicyDeleteResponsePayload {
   id: string;
   deletedAt: string;
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/delete/0.1" as const;
 

package/src/policy/evaluate/0.1/payload.ts

@@ -3,14 +3,8 @@
  * Source: specs/policy/evaluate/0.1/payload.schema.json
  */
 
-/**
- * A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.
- */
-export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
-/**
- * Discriminator: is this consumer a user-driven Companion or a headless Service?
- */
-export type ConsumerKind = Companion | Service;
+import type { AndroidApp_VaultV0_1 as AndroidApp, Companion_DeviceV0_1 as Companion, ConsumerKind_DeviceV0_1 as ConsumerKind, Did_VaultV0_1 as Did, Ext, IosApp_VaultV0_1 as IosApp, PolicyDecision_PolicyV0_1 as PolicyDecision, PolicyInput_PolicyV0_1 as PolicyInput, Service_DeviceV0_1 as Service, SiteTarget_VaultV0_1 as SiteTarget, WebOrigin_VaultV0_1 as WebOrigin } from "../../../_shared/components.js";
+
 
 /**
  * Dry-run a policy decision against a synthetic PolicyInput. Returns the policy decision plus a trace of which policy modules matched and which rules fired. Used by the policy-editor UI to verify changes before save and by admins to diagnose unexpected deny/allow outcomes.
@@ -25,75 +19,6 @@ export interface PolicyEvaluatePayload {
   includeTrace?: boolean;
   ext?: Ext;
 }
-/**
- * The structured input fed to a policy evaluator on every vault/proxy-login, vault/release, and policy/evaluate call.
- */
-export interface PolicyInput {
-  request: {
-    kind: "proxy_login" | "release" | "step_up_response";
-  };
-  site: SiteTarget;
-  contextId: string;
-  consumer: {
-    did: string;
-    kind?: ConsumerKind;
-    deviceId?: string;
-    lastUserVerificationAt?: string;
-    networkClass?: "unknown" | "home" | "corp" | "public" | "vpn";
-  };
-}
-export interface WebOrigin {
-  kind: "web-origin";
-  /**
-   * Web origin per RFC 6454 (scheme + host + optional port), e.g. "https://github.com". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.
-   */
-  origin: string;
-}
-export interface Did {
-  kind: "did";
-  /**
-   * DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.
-   */
-  did: string;
-}
-export interface IosApp {
-  kind: "ios-app";
-  /**
-   * iOS bundle identifier in reverse-DNS form (e.g. "com.github.stwalkerster.codehub"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).
-   */
-  bundleId: string;
-  /**
-   * Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.
-   */
-  teamId?: string;
-}
-export interface AndroidApp {
-  kind: "android-app";
-  /**
-   * Android package name in reverse-DNS form (e.g. "com.github.android").
-   */
-  packageName: string;
-  /**
-   * SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).
-   *
-   * @minItems 1
-   */
-  sha256CertFingerprints: [string, ...string[]];
-}
-export interface Companion {
-  kind: "companion";
-  formFactor: "browser" | "mobile" | "desktop";
-}
-export interface Service {
-  kind: "service";
-  serviceKind: "mediator" | "ai-agent" | "daemon";
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PolicyEvaluateResponsePayload {
   decision: PolicyDecision;
   /**
@@ -106,28 +31,9 @@ export interface PolicyEvaluateResponsePayload {
   trace?: string[];
   ext?: Ext;
 }
-export interface PolicyDecision {
-  decision: "allow" | "deny" | "require_step_up";
-  /**
-   * When decision == "allow", whether the maintainer should proxy-login or release-for-fill. Default: proxy.
-   */
-  mode?: "proxy" | "fill";
-  /**
-   * When decision == "require_step_up", which method to demand.
-   */
-  stepUp?: {
-    method: "webauthn-uv" | "push-approval" | "totp";
-    ttlSeconds?: number;
-  };
-  /**
-   * When decision == "allow", maximum lifetime of the issued session blob / released secret.
-   */
-  ttlSecondsCap?: number;
-  /**
-   * Human-readable explanation for diagnostic display.
-   */
-  explanation?: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AndroidApp, Companion, ConsumerKind, Did, Ext, IosApp, PolicyDecision, PolicyInput, Service, SiteTarget, WebOrigin };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/evaluate/0.1" as const;