@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/auth/passkey/login/finish/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/login/finish/0.1/payload.schema.json
  */
 
+import type { AuthenticatorAssertionResponseLogin, Ext, Session, TokenBundle } from "../../../../../_shared/components.js";
+
+
 /**
  * Submit the WebAuthn assertion that completes a passkey login or step-up ceremony. On success the auth service issues a session (login) or elevates an existing session's acr (step-up).
  */
@@ -11,121 +14,31 @@ export interface AuthPasskeyLoginFinish {
    * The authId issued by the matching login/start response. Echoed verbatim.
    */
   authId: string;
+  /**
+   * AuthenticatorAssertionResponse as returned by `navigator.credentials.get`. Binary fields base64url-encoded.
+   */
   credential: AuthenticatorAssertionResponseLogin;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * AuthenticatorAssertionResponse as returned by `navigator.credentials.get`. Binary fields base64url-encoded.
- */
-export interface AuthenticatorAssertionResponseLogin {
-  id: string;
-  rawId: string;
-  type: "public-key";
-  response: {
-    clientDataJSON: string;
-    authenticatorData: string;
-    signature: string;
-    userHandle?: string | null;
-  };
-  authenticatorAttachment?: "platform" | "cross-platform";
-  clientExtensionResults?: {};
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/login/finish/0.1#response. For `purpose: login` the payload includes the new session + tokens; for `purpose: step-up` only the elevated session is included (the producer's existing tokens are unchanged — they now carry a higher acr at the next token introspection).
  */
 export interface AuthPasskeyLoginFinishResponsePayload {
   session: Session;
   purpose: "login" | "step-up";
-  tokens?: TokenBundle;
-  ext?: Ext3;
-}
-/**
- * A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).
- */
-export interface Session {
-  /**
-   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
-   */
-  id: string;
   /**
-   * The authenticated party's VID (typically a DID URL).
+   * Present when `purpose: login` (a new session). Absent for `step-up` — the producer's existing tokens remain valid and now carry the elevated acr.
    */
-  subject: string;
-  /**
-   * ISO-8601 timestamp when the session was created.
-   */
-  issuedAt: string;
-  /**
-   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
-   */
-  expiresAt: string;
-  /**
-   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
-   *
-   * @minItems 1
-   */
-  amr?: [string, ...string[]];
-  /**
-   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
-   */
-  acr?: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
-/**
- * Present when `purpose: login` (a new session). Absent for `step-up` — the producer's existing tokens remain valid and now carry the elevated acr.
- */
-export interface TokenBundle {
-  /**
-   * Bearer-style access token. Consumers presenting this token to downstream services prove the holder of the original session. Format is consumer-defined — JWT is common, but opaque strings are also valid.
-   */
-  accessToken: string;
-  /**
-   * Long-lived token redeemable via auth/refresh for a new access token. MAY be absent when the issuer does not support refresh.
-   */
-  refreshToken?: string;
-  /**
-   * Token presentation scheme. Almost always "Bearer"; reserved for future schemes.
-   */
-  tokenType: string;
-  /**
-   * Seconds from issuance until the access token expires.
-   */
-  expiresIn: number;
-  /**
-   * Seconds from issuance until the refresh token expires, when one was issued.
-   */
-  refreshExpiresIn?: number;
-  /**
-   * Capability tags effective on this token. Format is consumer-defined; the framework imposes no syntax.
-   */
-  scope?: string[];
-  ext?: Ext2;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext2 {
-  [k: string]: unknown | undefined;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext3 {
-  [k: string]: unknown | undefined;
+  tokens?: TokenBundle;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAssertionResponseLogin, Ext, Session, TokenBundle };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/login/finish/0.1" as const;
 
@@ -600,6 +513,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -613,5 +527,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/passkey/login/finish/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/login/finish/0.2/payload.schema.json
  */
 
+import type { AuthenticatorAssertionResponseLogin, Ext, Session, TokenBundle } from "../../../../../_shared/components.js";
+
+
 /**
  * Submit the WebAuthn assertion that completes a passkey login or step-up ceremony. On success the auth service issues a session (login) or elevates an existing session's acr (step-up).
  */
@@ -11,121 +14,31 @@ export interface AuthPasskeyLoginFinish {
    * The authId issued by the matching login/start response. Echoed verbatim.
    */
   authId: string;
+  /**
+   * AuthenticatorAssertionResponse as returned by `navigator.credentials.get`. Binary fields base64url-encoded.
+   */
   credential: AuthenticatorAssertionResponseLogin;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * AuthenticatorAssertionResponse as returned by `navigator.credentials.get`. Binary fields base64url-encoded.
- */
-export interface AuthenticatorAssertionResponseLogin {
-  id: string;
-  rawId: string;
-  type: "public-key";
-  response: {
-    clientDataJSON: string;
-    authenticatorData: string;
-    signature: string;
-    userHandle?: string | null;
-  };
-  authenticatorAttachment?: "platform" | "cross-platform";
-  clientExtensionResults?: {};
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/login/finish/0.1#response. For `purpose: login` the payload includes the new session + tokens; for `purpose: step-up` only the elevated session is included (the producer's existing tokens are unchanged — they now carry a higher acr at the next token introspection).
  */
 export interface AuthPasskeyLoginFinishResponsePayload {
   session: Session;
   purpose: "login" | "stepUp";
-  tokens?: TokenBundle;
-  ext?: Ext3;
-}
-/**
- * A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).
- */
-export interface Session {
-  /**
-   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
-   */
-  id: string;
   /**
-   * The authenticated party's VID (typically a DID URL).
+   * Present when `purpose: login` (a new session). Absent for `stepUp` — the producer's existing tokens remain valid and now carry the elevated acr.
    */
-  subject: string;
-  /**
-   * ISO-8601 timestamp when the session was created.
-   */
-  issuedAt: string;
-  /**
-   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
-   */
-  expiresAt: string;
-  /**
-   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
-   *
-   * @minItems 1
-   */
-  amr?: [string, ...string[]];
-  /**
-   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
-   */
-  acr?: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
-/**
- * Present when `purpose: login` (a new session). Absent for `stepUp` — the producer's existing tokens remain valid and now carry the elevated acr.
- */
-export interface TokenBundle {
-  /**
-   * Bearer-style access token. Consumers presenting this token to downstream services prove the holder of the original session. Format is consumer-defined — JWT is common, but opaque strings are also valid.
-   */
-  accessToken: string;
-  /**
-   * Long-lived token redeemable via auth/refresh for a new access token. MAY be absent when the issuer does not support refresh.
-   */
-  refreshToken?: string;
-  /**
-   * Token presentation scheme. Almost always "Bearer"; reserved for future schemes.
-   */
-  tokenType: string;
-  /**
-   * Seconds from issuance until the access token expires.
-   */
-  expiresIn: number;
-  /**
-   * Seconds from issuance until the refresh token expires, when one was issued.
-   */
-  refreshExpiresIn?: number;
-  /**
-   * Capability tags effective on this token. Format is consumer-defined; the framework imposes no syntax.
-   */
-  scope?: string[];
-  ext?: Ext2;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext2 {
-  [k: string]: unknown | undefined;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext3 {
-  [k: string]: unknown | undefined;
+  tokens?: TokenBundle;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAssertionResponseLogin, Ext, Session, TokenBundle };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/login/finish/0.2" as const;
 
@@ -600,6 +513,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -613,5 +527,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/passkey/login/start/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/login/start/0.1/payload.schema.json
  */
 
+import type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions } from "../../../../../_shared/components.js";
+
+
 /**
  * Ask the auth service to begin a WebAuthn authentication ceremony. The response carries PublicKeyCredentialRequestOptions for `navigator.credentials.get`.
  */
@@ -15,14 +18,11 @@ export interface AuthPasskeyLoginStart {
    * Producer-declared intent. `login` issues a new session; `step-up` elevates an existing session's `acr`. The consumer's behaviour on the matching finish differs accordingly.
    */
   purpose?: "login" | "step-up";
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Server-issued WebAuthn request options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/login/start/0.1#response.
  */
@@ -31,45 +31,19 @@ export interface AuthPasskeyLoginStartResponsePayload {
    * Opaque server handle correlating this start with the matching finish.
    */
   authId: string;
-  options: PublicKeyCredentialRequestOptions;
-  ext?: Ext1;
-}
-/**
- * PublicKeyCredentialRequestOptions for navigator.credentials.get.
- */
-export interface PublicKeyCredentialRequestOptions {
-  /**
-   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
-   *
-   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
-   *
-   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
-   */
-  extensions?: {};
   /**
-   * base64url-encoded one-time nonce.
+   * PublicKeyCredentialRequestOptions for navigator.credentials.get.
    */
-  challenge: string;
-  timeout?: number;
-  rpId?: string;
-  allowCredentials?: PublicKeyCredentialDescriptor[];
-  userVerification?: "discouraged" | "preferred" | "required";
-}
-export interface PublicKeyCredentialDescriptor {
-  type: "public-key";
+  options: PublicKeyCredentialRequestOptions;
   /**
-   * base64url-encoded credential id.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  id: string;
-  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/login/start/0.1" as const;
 
@@ -356,6 +330,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -369,5 +344,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/passkey/login/start/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/login/start/0.2/payload.schema.json
  */
 
+import type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions } from "../../../../../_shared/components.js";
+
+
 /**
  * Ask the auth service to begin a WebAuthn authentication ceremony. The response carries PublicKeyCredentialRequestOptions for `navigator.credentials.get`.
  */
@@ -15,14 +18,11 @@ export interface AuthPasskeyLoginStart {
    * Producer-declared intent. `login` issues a new session; `stepUp` elevates an existing session's `acr`. The consumer's behaviour on the matching finish differs accordingly.
    */
   purpose?: "login" | "stepUp";
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Server-issued WebAuthn request options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/login/start/0.1#response.
  */
@@ -31,45 +31,19 @@ export interface AuthPasskeyLoginStartResponsePayload {
    * Opaque server handle correlating this start with the matching finish.
    */
   authId: string;
-  options: PublicKeyCredentialRequestOptions;
-  ext?: Ext1;
-}
-/**
- * PublicKeyCredentialRequestOptions for navigator.credentials.get.
- */
-export interface PublicKeyCredentialRequestOptions {
-  /**
-   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
-   *
-   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
-   *
-   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
-   */
-  extensions?: {};
   /**
-   * base64url-encoded one-time nonce.
+   * PublicKeyCredentialRequestOptions for navigator.credentials.get.
    */
-  challenge: string;
-  timeout?: number;
-  rpId?: string;
-  allowCredentials?: PublicKeyCredentialDescriptor[];
-  userVerification?: "discouraged" | "preferred" | "required";
-}
-export interface PublicKeyCredentialDescriptor {
-  type: "public-key";
+  options: PublicKeyCredentialRequestOptions;
   /**
-   * base64url-encoded credential id.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  id: string;
-  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/login/start/0.2" as const;
 
@@ -356,6 +330,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -369,5 +344,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/passkey/revoke/finish/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/revoke/finish/0.1/payload.schema.json
  */
 
+import type { AuthenticatorAssertionResponseLogin, Ext } from "../../../../../_shared/components.js";
+
+
 /**
  * Submit the user-verification assertion that completes a passkey revocation. On success the auth service unbinds the credential named at start. The payload carries no target — the revocationId is bound to it server-side.
  */
@@ -11,31 +14,15 @@ export interface AuthPasskeyRevokeFinish {
    * The revocationId issued by the matching auth/passkey/revoke/start response. Echoed verbatim.
    */
   revocationId: string;
+  /**
+   * AuthenticatorAssertionResponse as returned by navigator.credentials.get over the uvOptions from start. Binary fields base64url-encoded.
+   */
   uvCredential: AuthenticatorAssertionResponseLogin;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * AuthenticatorAssertionResponse as returned by navigator.credentials.get over the uvOptions from start. Binary fields base64url-encoded.
- */
-export interface AuthenticatorAssertionResponseLogin {
-  id: string;
-  rawId: string;
-  type: "public-key";
-  response: {
-    clientDataJSON: string;
-    authenticatorData: string;
-    signature: string;
-    userHandle?: string | null;
-  };
-  authenticatorAttachment?: "platform" | "cross-platform";
-  clientExtensionResults?: {};
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Acknowledgement of the removed credential. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/revoke/finish/0.1#response.
  */
@@ -52,15 +39,15 @@ export interface AuthPasskeyRevokeFinishResponsePayload {
    * How many passkeys the subject still has. Never zero — the last-credential refusal at start guarantees it. Present so a subject who has just pruned an estate knows what they have left without a second round-trip.
    */
   remaining: number;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAssertionResponseLogin, Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/revoke/finish/0.1" as const;
 
@@ -335,6 +322,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -348,5 +336,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/passkey/revoke/start/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/passkey/revoke/start/0.1/payload.schema.json
  */
 
+import type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions } from "../../../../../_shared/components.js";
+
+
 /**
  * Ask the auth service to begin revoking one of the subject's passkeys. The response carries PublicKeyCredentialRequestOptions for a fresh user-verification ceremony; nothing is removed until the matching auth/passkey/revoke/finish presents the assertion.
  */
@@ -11,14 +14,11 @@ export interface AuthPasskeyRevokeStart {
    * The credential to revoke, as returned by auth/passkey/list. Echoed verbatim; opaque to the producer.
    */
   credentialId: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Server-issued re-authentication options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/revoke/start/0.1#response.
  */
@@ -27,45 +27,19 @@ export interface AuthPasskeyRevokeStartResponsePayload {
    * Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim. The consumer binds it to the target credentialId server-side, so the finish carries no target of its own.
    */
   revocationId: string;
-  uvOptions: PublicKeyCredentialRequestOptions;
-  ext?: Ext1;
-}
-/**
- * PublicKeyCredentialRequestOptions for navigator.credentials.get — a fresh user-verification ceremony proving a human with an enrolled authenticator is present right now. userVerification SHOULD be "required".
- */
-export interface PublicKeyCredentialRequestOptions {
-  /**
-   * Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.
-   *
-   * This component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.
-   *
-   * Structure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later.
-   */
-  extensions?: {};
   /**
-   * base64url-encoded one-time nonce.
+   * PublicKeyCredentialRequestOptions for navigator.credentials.get — a fresh user-verification ceremony proving a human with an enrolled authenticator is present right now. userVerification SHOULD be "required".
    */
-  challenge: string;
-  timeout?: number;
-  rpId?: string;
-  allowCredentials?: PublicKeyCredentialDescriptor[];
-  userVerification?: "discouraged" | "preferred" | "required";
-}
-export interface PublicKeyCredentialDescriptor {
-  type: "public-key";
+  uvOptions: PublicKeyCredentialRequestOptions;
   /**
-   * base64url-encoded credential id.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  id: string;
-  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/revoke/start/0.1" as const;
 
@@ -347,6 +321,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -360,5 +335,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;