@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/keys/create/0.1/payload.ts

@@ -3,24 +3,13 @@
  * Source: specs/keys/create/0.1/payload.schema.json
  */
 
-/**
- * Algorithm to generate.
- */
-export type KeyType = "ed25519" | "x25519" | "p256";
-/**
- * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).
- */
-export type KeyType1 = "ed25519" | "x25519" | "p256";
-/**
- * Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.
- */
-export type KeyStatus = "active" | "revoked";
-/**
- * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.
- */
-export type KeyOrigin = "derived" | "imported" | "internal";
+import type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType } from "../../../_shared/components.js";
+
 
 export interface KeysCreatePayload {
+  /**
+   * Algorithm to generate.
+   */
   keyType: KeyType;
   /**
    * Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian. MUST NOT be combined with `internal: true`, which derives from no seed and records no path — a request carrying both is contradictory and the maintainer SHOULD reject it.
@@ -48,69 +37,25 @@ export interface KeysCreatePayload {
    * Scope to file the key under. Absence is the most restrictive reading, not a wildcard — see KeyRecord.contextId.
    */
   contextId?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/create request: the record the custodian now holds. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/create/0.1#response.
  */
 export interface KeysCreateResponsePayload {
-  key: KeyRecord;
-  ext?: Ext1;
-}
-/**
- * The realized record, carrying the public half. The private half is never returned.
- */
-export interface KeyRecord {
-  /**
-   * Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.
-   */
-  keyId: string;
-  keyType: KeyType1;
-  status: KeyStatus;
   /**
-   * The public half, multibase-encoded. The private half is never carried by any keys/* response.
+   * The realized record, carrying the public half. The private half is never returned.
    */
-  publicKey: string;
-  /**
-   * Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.
-   */
-  derivationPath?: string;
-  /**
-   * Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.
-   */
-  seedId?: number;
-  origin?: KeyOrigin;
-  /**
-   * Optional human-readable label. Operator-facing only; carries no authorization meaning.
-   */
-  label?: string;
-  /**
-   * Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.
-   */
-  contextId?: string;
-  /**
-   * RFC 3339 timestamp at which the key was created or imported.
-   */
-  createdAt: string;
-  /**
-   * RFC 3339 timestamp of the last change to the record (rename, revocation).
-   */
-  updatedAt?: string;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  key: KeyRecord;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/create/0.1" as const;
 
@@ -165,6 +110,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "label": {
       "type": "string",
+      "maxLength": 256,
       "description": "Optional human-readable label for the resulting record."
     },
     "contextId": {
@@ -248,6 +194,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "label": {
           "type": "string",
+          "maxLength": 256,
           "description": "Optional human-readable label. Operator-facing only; carries no authorization meaning."
         },
         "contextId": {
@@ -378,6 +325,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "label": {
           "type": "string",
+          "maxLength": 256,
           "description": "Optional human-readable label. Operator-facing only; carries no authorization meaning."
         },
         "contextId": {
@@ -443,6 +391,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -456,5 +405,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/keys/derive-and-sign/0.1/payload.ts

@@ -3,23 +3,16 @@
  * Source: specs/keys/derive-and-sign/0.1/payload.schema.json
  */
 
-/**
- * Algorithm to derive. MUST be one that can sign.
- */
-export type KeyType = "ed25519" | "x25519" | "p256";
-/**
- * Signature algorithm. MUST be compatible with the derived key's type.
- */
-export type SignAlgorithm = "EdDSA" | "ES256";
-/**
- * `EdDSA` pairs with an `ed25519` key; `ES256` pairs with a `p256` key. An `x25519` key performs key agreement and can sign nothing, so no algorithm here is valid for one. The enumeration is closed: an unrecognised algorithm is refused rather than silently substituted with a supported one.
- */
-export type SignAlgorithm1 = "EdDSA" | "ES256";
+import type { Ext, KeyType, SignAlgorithm } from "../../../_shared/components.js";
+
 
 /**
  * Derive a key at a path and sign with it in one step, without adding a stored key record.
  */
 export interface KeysDeriveAndSignPayload {
+  /**
+   * Algorithm to derive. MUST be one that can sign.
+   */
   keyType: KeyType;
   /**
    * Hierarchical-deterministic path to derive at. The same path against the same seed always yields the same key, which is what makes this reproducible rather than ephemeral.
@@ -29,15 +22,15 @@ export interface KeysDeriveAndSignPayload {
    * The exact bytes to sign, base64url-encoded without padding. Signed verbatim — not parsed, canonicalized or wrapped.
    */
   payload: string;
+  /**
+   * Signature algorithm. MUST be compatible with the derived key's type.
+   */
   algorithm: SignAlgorithm;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/derive-and-sign request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/derive-and-sign/0.1#response.
  */
@@ -50,16 +43,13 @@ export interface KeysDeriveAndSignResponsePayload {
    * Signature bytes, base64url-encoded without padding.
    */
   signature: string;
-  algorithm: SignAlgorithm1;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  algorithm: SignAlgorithm;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, KeyType, SignAlgorithm };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/derive-and-sign/0.1" as const;
 
@@ -254,6 +244,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -267,5 +258,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/keys/derive-and-sign-document/0.1/payload.ts

@@ -3,15 +3,16 @@
  * Source: specs/keys/derive-and-sign-document/0.1/payload.schema.json
  */
 
-/**
- * Algorithm to derive. MUST be one that can sign.
- */
-export type KeyType = "ed25519" | "x25519" | "p256";
+import type { Ext, KeyType } from "../../../_shared/components.js";
+
 
 /**
  * Derive a key at a path and return the supplied JSON document with a Data Integrity proof grafted on. Unlike keys/derive-and-sign, the custodian canonicalizes the document itself.
  */
 export interface KeysDeriveAndSignDocumentPayload {
+  /**
+   * Algorithm to derive. MUST be one that can sign.
+   */
   keyType: KeyType;
   /**
    * Hierarchical-deterministic path to derive at.
@@ -25,14 +26,11 @@ export interface KeysDeriveAndSignDocumentPayload {
    * Proof purpose to record in the generated proof. Absent means `assertionMethod`.
    */
   proofPurpose?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/derive-and-sign-document request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/derive-and-sign-document/0.1#response.
  */
@@ -45,15 +43,12 @@ export interface KeysDeriveAndSignDocumentResponsePayload {
    * The document with the Data Integrity `proof` grafted on.
    */
   document: {};
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, KeyType };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/derive-and-sign-document/0.1" as const;
 
@@ -222,6 +217,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -235,5 +231,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/keys/import/0.1/payload.ts

@@ -3,10 +3,16 @@
  * Source: specs/keys/import/0.1/payload.schema.json
  */
 
+import type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType } from "../../../_shared/components.js";
+
+
 /**
  * Hand an externally-created private key to a custodian. Exactly one carrier member MUST be present; the choice of carrier is a confidentiality decision, not a formatting one.
  */
 export type KeysImportPayload = {
+  /**
+   * Algorithm of the key being imported. The custodian MUST verify the supplied material is of this type rather than trusting the claim.
+   */
   keyType: KeyType;
   /**
    * The private key inside an armored sealed-transfer bundle, encrypted to the custodian's own public key. The only carrier that keeps the key confidential from every intermediary, including a transport terminator, so it is the one to prefer.
@@ -28,88 +34,28 @@ export type KeysImportPayload = {
    * Scope to file the imported key under. Absence is the most restrictive reading, not a wildcard — see KeyRecord.contextId.
    */
   contextId?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 } & {
   [k: string]: unknown | undefined;
 };
-/**
- * Algorithm of the key being imported. The custodian MUST verify the supplied material is of this type rather than trusting the claim.
- */
-export type KeyType = "ed25519" | "x25519" | "p256";
-/**
- * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).
- */
-export type KeyType1 = "ed25519" | "x25519" | "p256";
-/**
- * Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.
- */
-export type KeyStatus = "active" | "revoked";
-/**
- * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.
- */
-export type KeyOrigin = "derived" | "imported" | "internal";
 
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/import request: the record the custodian now holds. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/import/0.1#response.
  */
 export interface KeysImportResponsePayload {
-  key: KeyRecord;
-  ext?: Ext1;
-}
-/**
- * The realized record. `origin` is `imported` and `derivationPath` is absent — an imported key is not reproducible from any seed the custodian holds.
- */
-export interface KeyRecord {
   /**
-   * Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.
+   * The realized record. `origin` is `imported` and `derivationPath` is absent — an imported key is not reproducible from any seed the custodian holds.
    */
-  keyId: string;
-  keyType: KeyType1;
-  status: KeyStatus;
-  /**
-   * The public half, multibase-encoded. The private half is never carried by any keys/* response.
-   */
-  publicKey: string;
-  /**
-   * Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.
-   */
-  derivationPath?: string;
-  /**
-   * Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.
-   */
-  seedId?: number;
-  origin?: KeyOrigin;
-  /**
-   * Optional human-readable label. Operator-facing only; carries no authorization meaning.
-   */
-  label?: string;
-  /**
-   * Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.
-   */
-  contextId?: string;
-  /**
-   * RFC 3339 timestamp at which the key was created or imported.
-   */
-  createdAt: string;
-  /**
-   * RFC 3339 timestamp of the last change to the record (rename, revocation).
-   */
-  updatedAt?: string;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  key: KeyRecord;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/import/0.1" as const;
 
@@ -177,6 +123,7 @@ export const PAYLOAD_SCHEMA = {
     },
     "label": {
       "type": "string",
+      "maxLength": 256,
       "description": "Optional human-readable label for the resulting record."
     },
     "contextId": {
@@ -260,6 +207,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "label": {
           "type": "string",
+          "maxLength": 256,
           "description": "Optional human-readable label. Operator-facing only; carries no authorization meaning."
         },
         "contextId": {
@@ -390,6 +338,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "label": {
           "type": "string",
+          "maxLength": 256,
           "description": "Optional human-readable label. Operator-facing only; carries no authorization meaning."
         },
         "contextId": {
@@ -455,6 +404,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -468,5 +418,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/keys/list/0.1/payload.ts

@@ -3,24 +3,13 @@
  * Source: specs/keys/list/0.1/payload.schema.json
  */
 
-/**
- * Return only keys in this lifecycle state. Omitted returns every state, including revoked keys.
- */
-export type KeyStatus = "active" | "revoked";
-/**
- * Cryptographic algorithm the key material belongs to. `ed25519` signs (EdDSA), `x25519` performs key agreement and never signs, `p256` signs (ES256).
- */
-export type KeyType = "ed25519" | "x25519" | "p256";
-/**
- * Lifecycle state. Only an `active` key may be named in a signing request; a `revoked` key is retained so historic signatures remain attributable, and MUST NOT be reactivated.
- */
-export type KeyStatus1 = "active" | "revoked";
-/**
- * Where the private key came from. `derived` means the maintainer generated it from a seed it holds and can reproduce it from `derivationPath`; `imported` means it arrived from outside and exists only as stored material; `internal` means the maintainer generated it from a CSPRNG and it is reproducible from nothing at all. The distinction is operationally load-bearing: a `derived` key survives a seed restore, an `imported` one is lost unless it was backed up separately, and an `internal` one cannot be recovered by any means once the maintainer's storage is gone. This member is also the only way a consumer can confirm that a `keys/create` request for an `internal` key was honoured rather than silently downgraded to a derived one — see that specification's `internal` member.
- */
-export type KeyOrigin = "derived" | "imported" | "internal";
+import type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType } from "../../../_shared/components.js";
+
 
 export interface KeysListPayload {
+  /**
+   * Return only keys in this lifecycle state. Omitted returns every state, including revoked keys.
+   */
   status?: KeyStatus;
   /**
    * Return only keys filed under this scope.
@@ -34,14 +23,11 @@ export interface KeysListPayload {
    * Maximum records to return. The custodian MAY return fewer and MAY impose its own ceiling; `total` says how many matched.
    */
   limit?: number;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/list request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/list/0.1#response.
  */
@@ -62,53 +48,12 @@ export interface KeysListResponsePayload {
    * The page size actually applied, which MAY be smaller than the one requested.
    */
   limit: number;
-  ext?: Ext1;
-}
-export interface KeyRecord {
-  /**
-   * Maintainer-scoped identifier for the key. Stable for the key's lifetime except through an explicit `keys/rename`.
-   */
-  keyId: string;
-  keyType: KeyType;
-  status: KeyStatus1;
-  /**
-   * The public half, multibase-encoded. The private half is never carried by any keys/* response.
-   */
-  publicKey: string;
-  /**
-   * Hierarchical-deterministic path the key was derived at, when `origin` is `derived`. Absent for imported keys, which have no path.
-   */
-  derivationPath?: string;
-  /**
-   * Identifier of the seed the key was derived from, when the maintainer holds more than one. Absent for imported keys.
-   */
-  seedId?: number;
-  origin?: KeyOrigin;
-  /**
-   * Optional human-readable label. Operator-facing only; carries no authorization meaning.
-   */
-  label?: string;
-  /**
-   * Scope the key belongs to. **Absence is not 'every scope'** — a key with no context is reachable only by a caller with unrestricted authority over the maintainer, which is the more restrictive reading, and a consumer that treats absence as a wildcard inverts the guarantee.
-   */
-  contextId?: string;
-  /**
-   * RFC 3339 timestamp at which the key was created or imported.
-   */
-  createdAt: string;
-  /**
-   * RFC 3339 timestamp of the last change to the record (rename, revocation).
-   */
-  updatedAt?: string;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, KeyOrigin, KeyRecord, KeyStatus, KeyType };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/list/0.1" as const;
 
@@ -253,6 +198,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "label": {
           "type": "string",
+          "maxLength": 256,
           "description": "Optional human-readable label. Operator-facing only; carries no authorization meaning."
         },
         "contextId": {
@@ -404,6 +350,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "label": {
           "type": "string",
+          "maxLength": 256,
           "description": "Optional human-readable label. Operator-facing only; carries no authorization meaning."
         },
         "contextId": {
@@ -469,6 +416,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -482,5 +430,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/keys/rename/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/keys/rename/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * Change a key's identifier. The key material is untouched — only the name it is addressed by changes.
  */
@@ -15,14 +18,11 @@ export interface KeysRenamePayload {
    * The identifier it should be addressed by afterwards. MUST NOT collide with an existing record.
    */
   newKeyId: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The success response to a keys/rename request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/rename/0.1#response.
  */
@@ -35,15 +35,12 @@ export interface KeysRenameResponsePayload {
    * RFC 3339 timestamp of the rename.
    */
   updatedAt: string;
-  ext?: Ext1;
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/keys/rename/0.1" as const;
 
@@ -185,6 +182,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -198,5 +196,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;