@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/consent/revoke/1.0/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/consent/revoke/1.0/payload.schema.json
  */
 
+import type { ConsentSubject, Ext, Kind } from "../../../_shared/components.js";
+
+
 /**
  * An operator revokes a standing consent grant.
  */
@@ -14,33 +17,6 @@ export interface ConsentRevokePayload {
   reason?: string;
   ext?: Ext;
 }
-/**
- * The platform-agnostic identifier of WHAT is being consented to: one conversation, for one agent.
- */
-export interface ConsentSubject {
-  /**
-   * Messaging-platform tag, e.g. "signal", "whatsapp", "slack".
-   */
-  platform: string;
-  /**
-   * The bridge's OPAQUE conversation handle (e.g. "sig-1a2b3c4d"). NEVER the raw platform address — the VTA never learns the phone number / chat id.
-   */
-  conversationRef: string;
-  /**
-   * The interaction kind: a 1:1 direct message, a multi-party group, or a broadcast channel.
-   */
-  kind: "dm" | "group" | "channel";
-  /**
-   * VID (DID) of the AI agent the conversation would reach.
-   */
-  agent: string;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface ConsentRevokeResponsePayload {
   /**
    * `revoked` = the grant was deleted. `notFound` = no grant existed for the subject.
@@ -49,6 +25,9 @@ export interface ConsentRevokeResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { ConsentSubject, Ext, Kind };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/consent/revoke/1.0" as const;
 
@@ -86,6 +65,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "reason": {
       "type": "string",
+      "maxLength": 1024,
       "description": "Optional operator note recorded in the audit trail."
     },
     "ext": {
@@ -259,6 +239,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -272,5 +253,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/credential-exchange/_shared/0.1/deferred-presentation.ts

@@ -9,3 +9,9 @@
 export interface CredentialExchangeSharedDeferredPresentationDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { DeferredPresentation, RequestedCredential } from "../../../_shared/components.js";

package/src/credential-exchange/issue/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/issue/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Issuer to holder: the issued credential. Exactly one of `credential_response` (cleartext, known holder over an authenticated channel) or `sealed` (an armored sealed-transfer bundle, for a secret-bearing credential or an unknown holder).
  */
@@ -20,12 +23,8 @@ export type CredentialExchangeIssuePayload = {
   [k: string]: unknown | undefined;
 };
 
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/issue/0.1" as const;
@@ -110,5 +109,6 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/credential-exchange/offer/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/offer/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Issuer to holder: an OID4VCI Credential Offer. Opens the issuance thread; the holder replies with credential-exchange/request.
  */
@@ -13,12 +16,9 @@ export interface CredentialExchangeOfferPayload {
   credential_offer: {};
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/offer/0.1" as const;
@@ -79,5 +79,6 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/credential-exchange/pending/approve/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/pending/approve/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * Approve a deferred presentation request. The holder mints the presentation against the verifier's original query and nonce and returns it; the deferral is then terminal.
  */
@@ -13,12 +16,6 @@ export interface CredentialExchangePendingApprovePayload {
   id: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface CredentialExchangePendingApproveResponsePayload {
   /**
    * The freshly-minted OID4VP `vp_token`, identical in shape to credential-exchange/present. It is returned rather than only delivered so the approving operator holds exactly what the verifier will receive. Bound to the ORIGINAL query's nonce and audience — which is why an expired deferral cannot be approved.
@@ -27,6 +24,9 @@ export interface CredentialExchangePendingApproveResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/pending/approve/0.1" as const;
 
@@ -153,6 +153,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -166,5 +167,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/credential-exchange/pending/deny/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/pending/deny/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * Refuse a deferred presentation request. Nothing is presented and the deferral becomes terminal.
  */
@@ -13,12 +16,6 @@ export interface CredentialExchangePendingDenyPayload {
   id: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface CredentialExchangePendingDenyResponsePayload {
   /**
    * The deferral that was refused.
@@ -31,6 +28,9 @@ export interface CredentialExchangePendingDenyResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/pending/deny/0.1" as const;
 
@@ -169,6 +169,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -182,5 +183,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/credential-exchange/pending/list/0.1/payload.ts

@@ -3,18 +3,15 @@
  * Source: specs/credential-exchange/pending/list/0.1/payload.schema.json
  */
 
+import type { DeferredPresentation, Ext, RequestedCredential } from "../../../../_shared/components.js";
+
+
 /**
  * List the presentation requests this holder deferred for consent and that can still be acted on. Takes no parameters: the caller's authenticated identity is the scope, and a holder agent answers only for its own wallet.
  */
 export interface CredentialExchangePendingListPayload {
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface CredentialExchangePendingListResponsePayload {
   /**
    * The actionable deferrals. A consumer MUST omit records that are already terminal or past their `expiresAt` — they cannot be approved, so listing them would offer the approver a decision that is guaranteed to fail. An empty array means nothing is awaiting a decision.
@@ -22,54 +19,9 @@ export interface CredentialExchangePendingListResponsePayload {
   pending: DeferredPresentation[];
   ext?: Ext;
 }
-/**
- * One presentation request awaiting the holder's decision, as the approver sees it.
- *
- * This is deliberately **not** the stored record. A consumer also retains the original DCQL query so an approval can re-present byte-faithfully against the verifier's original nonce; that is machinery, not a decision input, and is not exposed here. What is exposed is exactly what an approver needs to answer "should I disclose this": who is asking, why, and precisely which claims of which held credentials would leave the wallet.
- */
-export interface DeferredPresentation {
-  /**
-   * Approval handle for this deferral — the value `pending/approve` and `pending/deny` act on.
-   */
-  id: string;
-  /**
-   * The verifier that asked. An approved presentation binds to this audience, so approving is a decision about *this* party and not a standing permission.
-   */
-  verifierDid: string;
-  /**
-   * Every held credential the query would disclose, resolved against what the holder actually holds. This is the authorization surface: the approver is consenting to these claims leaving the wallet, not to the query in the abstract.
-   */
-  requested: RequestedCredential[];
-  /**
-   * The verifier's stated reason, carried through from the query. Purpose binding: an approver decides against a stated why, never a bare request.
-   */
-  purpose: string;
-  /**
-   * When the deferral was recorded.
-   */
-  createdAt: string;
-  /**
-   * After this the deferral is stale and approval MUST refuse — the verifier's nonce is no longer fresh, so any presentation minted against it would fail the verifier's own replay check.
-   */
-  expiresAt: string;
-}
-/**
- * One held credential a deferred query asked for, and the claims of it that would be disclosed.
- */
-export interface RequestedCredential {
-  /**
-   * The DCQL `credential_query_id` this held credential satisfied.
-   */
-  credentialQueryId: string;
-  /**
-   * The held credential that would satisfy it.
-   */
-  credentialId: string;
-  /**
-   * The claims the query asks to disclose from this credential. An empty array means the query matched the credential without naming claims — a consumer SHOULD treat that as a request for the whole credential and present it to the approver as such.
-   */
-  claims: string[];
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DeferredPresentation, Ext, RequestedCredential };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/pending/list/0.1" as const;
@@ -171,6 +123,7 @@ export const PAYLOAD_SCHEMA = {
         "purpose": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 500,
           "description": "The verifier's stated reason, carried through from the query. Purpose binding: an approver decides against a stated why, never a bare request."
         },
         "createdAt": {
@@ -291,6 +244,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "purpose": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 500,
           "description": "The verifier's stated reason, carried through from the query. Purpose binding: an approver decides against a stated why, never a bare request."
         },
         "createdAt": {
@@ -351,6 +305,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -364,5 +319,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/credential-exchange/present/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/present/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Holder to verifier: an OID4VP vp_token carrying the selectively-disclosed, holder-bound presentation. Replies on the query thread.
  */
@@ -13,12 +16,9 @@ export interface CredentialExchangePresentPayload {
   vp_token: string | {};
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/present/0.1" as const;
@@ -82,5 +82,6 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/credential-exchange/query/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/query/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Verifier to holder: an OID4VP DCQL query, a freshness nonce, and a mandatory stated purpose. The holder answers with credential-exchange/present, or defers for consent.
  */
@@ -21,12 +24,9 @@ export interface CredentialExchangeQueryPayload {
   purpose: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/query/0.1" as const;
@@ -68,6 +68,7 @@ export const PAYLOAD_SCHEMA = {
     "purpose": {
       "type": "string",
       "minLength": 1,
+      "maxLength": 500,
       "description": "The verifier's stated reason for asking, shown to the holder. REQUIRED and never empty: purpose binding means a verifier cannot ask for a credential without saying why, and a holder cannot be asked to consent to an unstated use."
     },
     "ext": {
@@ -99,5 +100,6 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/credential-exchange/request/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/credential-exchange/request/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Holder to issuer: an OID4VCI Credential Request carrying the holder's key-binding proof. Replies on the offer thread.
  */
@@ -13,12 +16,9 @@ export interface CredentialExchangeRequestPayload {
   credential_request: {};
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/credential-exchange/request/0.1" as const;
@@ -79,5 +79,6 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;

package/src/credentials/_shared/0.1/credentials.ts

@@ -13,3 +13,9 @@
 export interface CredentialsSharedIssuanceAndRevocationDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { CredentialId, CredentialReference, RevocationReceipt } from "../../../_shared/components.js";

package/src/credentials/_shared/0.2/credentials.ts

@@ -13,3 +13,9 @@
 export interface CredentialsSharedIssuanceAndRevocationDefinitions {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { CredentialId, IssuedCredentialBase } from "../../../_shared/components.js";

package/src/device/_shared/0.1/device-binding.ts

@@ -9,3 +9,9 @@
 export interface DeviceBindingSharedDefinitionForTheDeviceSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { Capability_DeviceV0_1 as Capability, ConsumerKind_DeviceV0_1 as ConsumerKind, DeviceAttestation_DeviceV0_1 as DeviceAttestation, DeviceBinding_DeviceV0_1 as DeviceBinding, KeyCustody, PushRegistration, WakeHandle, WakeTriggerPolicy } from "../../../_shared/components.js";

package/src/device/_shared/0.2/device-binding.ts

@@ -9,3 +9,9 @@
 export interface DeviceBindingSharedDefinitionForTheDeviceSpecFamily {
   [k: string]: unknown | undefined;
 }
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { Capability_DeviceV0_2 as Capability, ConsumerKind_DeviceV0_2 as ConsumerKind, DeviceAttestation_DeviceV0_2 as DeviceAttestation, DeviceBinding_DeviceV0_2 as DeviceBinding, KeyCustody, PushRegistration, WakeHandle, WakeTriggerPolicy } from "../../../_shared/components.js";

package/src/device/disable/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/device/disable/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Disable a Companion or Service. The maintainer revokes the device's ACL entry, refuses subsequent authentication, and emits sync events so other devices learn of the disable. Distinct from device/wipe: disable is a passive denial; wipe additionally instructs the target to destroy its local cache.
  */
@@ -11,18 +14,15 @@ export interface DeviceDisablePayload {
   reason?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DeviceDisableResponsePayload {
   deviceId: string;
   disabledAt: string;
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/disable/0.1" as const;
 
@@ -154,6 +154,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -167,5 +168,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/device/heartbeat/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/device/heartbeat/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Periodic check-in from a Companion or Service. Refreshes `lastSeenAt`, carries optional state digests, and gives the maintainer a chance to deliver queued operations (notably queued wipes for targets that were offline at issuance).
  */
@@ -17,12 +20,6 @@ export interface DeviceHeartbeatPayload {
   vaultSeq?: number;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DeviceHeartbeatResponsePayload {
   /**
    * Authoritative timestamp — consumers MAY use to detect clock drift.
@@ -51,6 +48,9 @@ export interface QueuedOperation {
   };
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/heartbeat/0.1" as const;
 
@@ -252,6 +252,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -265,5 +266,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/device/heartbeat/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/device/heartbeat/0.2/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Periodic check-in from a Companion or Service. Refreshes `lastSeenAt`, carries optional state digests, and gives the maintainer a chance to deliver queued operations (notably queued wipes for targets that were offline at issuance).
  */
@@ -17,12 +20,6 @@ export interface DeviceHeartbeatPayload {
   vaultSeq?: number;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface DeviceHeartbeatResponsePayload {
   /**
    * Authoritative timestamp — consumers MAY use to detect clock drift.
@@ -51,6 +48,9 @@ export interface QueuedOperation {
   };
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/heartbeat/0.2" as const;
 
@@ -252,6 +252,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -265,5 +266,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;