@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/auth/step-up/approve-response/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/step-up/approve-response/0.2/payload.schema.json
  */
 
+import type { AuthenticatorAssertionResponseLogin, Ext, Session } from "../../../../_shared/components.js";
+
+
 /**
  * How the approver demonstrated the factor backing this elevation. A tagged union on `kind`. When `evidence` is absent the elevation is gated solely by the document's framework `proof` (equivalent to `kind: did-signed`). When `kind: webauthn` is supplied, the carried WebAuthn assertion over `challenge` is the gate and the framework `proof` MAY be omitted.
  */
@@ -47,35 +50,19 @@ export interface DidSigned {
 }
 export interface WebAuthn {
   kind: "webauthn";
+  /**
+   * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects "passkey".
+   */
   assertion: AuthenticatorAssertionResponseLogin;
 }
-/**
- * The unmodified AuthenticatorAssertionResponse from the platform WebAuthn API (`navigator.credentials.get` / ASAuthorization / Credential Manager). Its `clientDataJSON` challenge MUST equal the step-up `challenge`. The relying party verifies it per WebAuthn Level 2 §7.2 exactly as auth/passkey/login/finish does; the assertion is the gate and `amr` reflects "passkey".
- */
-export interface AuthenticatorAssertionResponseLogin {
-  id: string;
-  rawId: string;
-  type: "public-key";
-  response: {
-    clientDataJSON: string;
-    authenticatorData: string;
-    signature: string;
-    userHandle?: string | null;
-  };
-  authenticatorAttachment?: "platform" | "cross-platform";
-  clientExtensionResults?: {};
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.1#response.
  */
 export interface AuthStepUpApproveResponseRelyingPartyAck {
   status: "elevated" | "rejected";
+  /**
+   * Present when status is `elevated`. The session's updated amr/acr after the approval was applied.
+   */
   session?: Session;
   /**
    * Present when status is `rejected` (e.g. "challenge expired", "session not found", "acr ceiling exceeded").
@@ -83,44 +70,9 @@ export interface AuthStepUpApproveResponseRelyingPartyAck {
   reason?: string;
   ext?: Ext;
 }
-/**
- * Present when status is `elevated`. The session's updated amr/acr after the approval was applied.
- */
-export interface Session {
-  /**
-   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
-   */
-  id: string;
-  /**
-   * The authenticated party's VID (typically a DID URL).
-   */
-  subject: string;
-  /**
-   * ISO-8601 timestamp when the session was created.
-   */
-  issuedAt: string;
-  /**
-   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
-   */
-  expiresAt: string;
-  /**
-   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
-   *
-   * @minItems 1
-   */
-  amr?: [string, ...string[]];
-  /**
-   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
-   */
-  acr?: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AuthenticatorAssertionResponseLogin, Ext, Session };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-response/0.2" as const;
@@ -182,6 +134,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "deniedReason": {
       "type": "string",
+      "maxLength": 500,
       "description": "Required when decision is `denied`. Human-readable rationale the user provided (or which the approver inferred)."
     },
     "grantedAcr": {
@@ -259,6 +212,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "reason": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Present when status is `rejected` (e.g. \"challenge expired\", \"session not found\", \"acr ceiling exceeded\")."
         },
         "ext": {
@@ -457,6 +411,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "reason": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Present when status is `rejected` (e.g. \"challenge expired\", \"session not found\", \"acr ceiling exceeded\")."
         },
         "ext": {
@@ -599,6 +554,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -612,5 +568,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/step-up/policy/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/step-up/policy/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * The relying party's (ACL maintainer's) system-wide step-up policy: the per-operation-class floor that decides whether — and how — a step-up to a higher assurance level is required before a gated operation proceeds. Set by an administrator; resolved per request against per-entry overrides (see acl/_shared AclEntry.stepUp).
  */
@@ -15,6 +18,9 @@ export interface AuthStepUpPolicyPayload {
    * The system-wide minimum step-up requirement per operation-class — the maintainer-owned floor. Per-entry `stepUp` settings on an AclEntry MAY raise the requirement for a given subject but MUST NOT lower it (additive-only). The effective requirement for a request is the strictest of (matching floor, caller's per-entry setting).
    */
   floors: StepUpFloor[];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
 export interface StepUpFloor {
@@ -31,12 +37,6 @@ export interface StepUpFloor {
    */
   allowAal1IfNonEscalating?: boolean;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The policy the maintainer now holds after applying the request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/policy/0.1#response.
  */
@@ -49,15 +49,12 @@ export interface AuthStepUpPolicyResponsePayload {
    * The effective floors the maintainer now holds (canonicalized: deduplicated by `operation`, defaults materialized).
    */
   floors: StepUpFloor[];
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/policy/0.1" as const;
 
@@ -262,6 +259,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -275,5 +273,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/step-up/policy/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/auth/step-up/policy/0.2/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * The relying party's (ACL maintainer's) system-wide step-up policy: the per-operation-class floor that decides whether — and how — a step-up to a higher assurance level is required before a gated operation proceeds. Set by an administrator; resolved per request against per-entry overrides (see acl/_shared AclEntry.stepUp).
  */
@@ -15,6 +18,9 @@ export interface AuthStepUpPolicyPayload {
    * The system-wide minimum step-up requirement per operation-class — the maintainer-owned floor. Per-entry `stepUp` settings on an AclEntry MAY raise the requirement for a given subject but MUST NOT lower it (additive-only). The effective requirement for a request is the strictest of (matching floor, caller's per-entry setting).
    */
   floors: StepUpFloor[];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
 export interface StepUpFloor {
@@ -31,12 +37,6 @@ export interface StepUpFloor {
    */
   allowAal1IfNonEscalating?: boolean;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The policy the maintainer now holds after applying the request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/policy/0.1#response.
  */
@@ -49,15 +49,12 @@ export interface AuthStepUpPolicyResponsePayload {
    * The effective floors the maintainer now holds (canonicalized: deduplicated by `operation`, defaults materialized).
    */
   floors: StepUpFloor[];
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/policy/0.2" as const;
 
@@ -262,6 +259,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -275,5 +273,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/auth/whoami/0.1/payload.ts

@@ -3,22 +3,25 @@
  * Source: specs/auth/whoami/0.1/payload.schema.json
  */
 
+import type { Ext, Session } from "../../../_shared/components.js";
+
+
 /**
  * Introspect the current session. The proof on the document identifies the subject; the response carries what the auth service knows about them.
  */
 export interface AuthWhoami {
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The auth service's view of the producer. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/whoami/0.1#response.
  */
 export interface AuthWhoamiResponsePayload {
+  /**
+   * Current session state for the producer.
+   */
   session: Session;
   /**
    * Role assignments the auth service holds for the producer. Ecosystem-defined vocabulary.
@@ -28,53 +31,15 @@ export interface AuthWhoamiResponsePayload {
    * Capability tags effective on the producer's current session. Mirrors the issued TokenBundle.scope; included here so a producer can reconcile after policy edits without re-issuing tokens.
    */
   scopes?: string[];
-  ext?: Ext2;
-}
-/**
- * Current session state for the producer.
- */
-export interface Session {
-  /**
-   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
-   */
-  id: string;
-  /**
-   * The authenticated party's VID (typically a DID URL).
-   */
-  subject: string;
-  /**
-   * ISO-8601 timestamp when the session was created.
-   */
-  issuedAt: string;
-  /**
-   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
-   */
-  expiresAt: string;
-  /**
-   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
-   *
-   * @minItems 1
-   */
-  amr?: [string, ...string[]];
   /**
-   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  acr?: string;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext2 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, Session };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/whoami/0.1" as const;
 
@@ -328,6 +293,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -341,5 +307,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/chat/message/0.1/payload.ts

@@ -3,14 +3,8 @@
  * Source: specs/chat/message/0.1/payload.schema.json
  */
 
-/**
- * OPTIONAL. Multibase-encoded multihash over the attachment bytes, so the reference is itself verifiable and tamper-evident. Taken over the bytes as transferred, not over any JSON wrapper.
- */
-export type DigestMultibase = string;
-/**
- * Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the previous document, so a gap, reorder, or removal in the chain is detectable. The algorithm travels in the multihash rather than being fixed here.
- */
-export type DigestMultibase1 = string;
+import type { DigestMultibase, Ext } from "../../../_shared/components.js";
+
 
 /**
  * A conversational message exchanged between an AI agent and a messaging-platform bridge. Signed by its author (via the document `proof`) and hash-linked to the previous message in the conversation (`prev`), so a third party can verify each message's author and ordering after the transport has closed — for audit and dispute resolution. Conversations and contacts are referenced by opaque, bridge-issued handles, never raw platform addresses.
@@ -94,6 +88,9 @@ export interface AttachmentRef {
    * OPTIONAL. Size in bytes, if known ahead of fetch.
    */
   sizeBytes?: number;
+  /**
+   * OPTIONAL. Multibase-encoded multihash over the attachment bytes, so the reference is itself verifiable and tamper-evident. Taken over the bytes as transferred, not over any JSON wrapper.
+   */
   digest?: DigestMultibase;
 }
 /**
@@ -104,15 +101,15 @@ export interface ChainLink {
    * The `id` of the previous `chat/message` Trust Task document in this conversation.
    */
   id: string;
-  digest: DigestMultibase1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
+  /**
+   * Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the previous document, so a gap, reorder, or removal in the chain is detectable. The algorithm travels in the multihash rather than being fixed here.
+   */
+  digest: DigestMultibase;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DigestMultibase, Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/chat/message/0.1" as const;
 
@@ -161,6 +158,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "text": {
       "type": "string",
+      "maxLength": 16384,
       "description": "OPTIONAL. Plain-text body. Absent for attachment-only messages."
     },
     "mentions": {
@@ -219,6 +217,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "filename": {
           "type": "string",
+          "maxLength": 256,
           "description": "OPTIONAL. Suggested filename."
         },
         "mediaType": {
@@ -272,6 +271,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "displayName": {
           "type": "string",
+          "maxLength": 256,
           "description": "OPTIONAL. Human-readable name the source platform supplied for the participant. A non-authoritative rendering hint — never used for identity. Absent when the platform exposes no name in the mention."
         },
         "start": {
@@ -320,5 +320,6 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/config/_shared/0.1/config.ts

@@ -9,3 +9,9 @@
 export interface ConfigSharedDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { ConfigField, RejectedKey } from "../../../_shared/components.js";

package/src/config/patch/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/config/patch/0.1/payload.schema.json
  */
 
+import type { Ext, RejectedKey } from "../../../_shared/components.js";
+
+
 export interface ConfigPatchPayload {
   /**
    * A key -> value map of overrides to write. Keys are configuration keys; values are the desired new values. Wrapped in an object (rather than being the top-level payload) so the payload keeps a fixed, additionalProperties:false envelope. Each entry is validated independently — an invalid or unknown key is reported under `rejected` and does not block the rest.
@@ -12,12 +15,6 @@ export interface ConfigPatchPayload {
   };
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface ConfigPatchResponsePayload {
   /**
    * Keys whose new value is now in effect.
@@ -33,16 +30,9 @@ export interface ConfigPatchResponsePayload {
   rejected: RejectedKey[];
   ext?: Ext;
 }
-/**
- * A key a patch declined to apply, with the reason.
- */
-export interface RejectedKey {
-  key: string;
-  /**
-   * Why the key was rejected — unknown key, wrong type, out-of-range, allowlist mismatch, etc.
-   */
-  reason: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, RejectedKey };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/config/patch/0.1" as const;
@@ -155,6 +145,7 @@ export const PAYLOAD_SCHEMA = {
         "reason": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 1024,
           "description": "Why the key was rejected — unknown key, wrong type, out-of-range, allowlist mismatch, etc."
         }
       }
@@ -236,6 +227,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "reason": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 1024,
           "description": "Why the key was rejected — unknown key, wrong type, out-of-range, allowlist mismatch, etc."
         }
       }
@@ -254,6 +246,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -267,5 +260,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/config/reload/0.1/payload.ts

@@ -3,18 +3,15 @@
  * Source: specs/config/reload/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Re-apply hot-reloadable configuration to the running maintainer without a restart. Takes no parameters.
  */
 export interface ConfigReloadPayload {
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface ConfigReloadResponsePayload {
   /**
    * Keys whose live value was updated by the reload — the hot-reloadable keys whose stored value differed from what was running. A no-op reload returns an empty array. Restart-gated keys are never included; they need config/restart.
@@ -23,6 +20,9 @@ export interface ConfigReloadResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/config/reload/0.1" as const;
 
@@ -145,6 +145,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -158,5 +159,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/config/restart/0.1/payload.ts

@@ -3,18 +3,15 @@
  * Source: specs/config/restart/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Request a graceful restart so a process supervisor brings the maintainer back up with restart-gated configuration applied. Takes no parameters.
  */
 export interface ConfigRestartPayload {
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface ConfigRestartResponsePayload {
   /**
    * The process supervisor that will bring the maintainer back up, detected by the maintainer. An opaque maintainer-defined label — the framework does not enumerate it (e.g. `systemd`, `kubernetes`, or an explicit operator opt-in). A maintainer that detects no supervisor MUST refuse (see errorCodes) rather than exit unsupervised.
@@ -27,6 +24,9 @@ export interface ConfigRestartResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/config/restart/0.1" as const;
 
@@ -153,6 +153,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -166,5 +167,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;