@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/policy/evaluate/0.1/payload.ts

@@ -3,14 +3,8 @@
  * Source: specs/policy/evaluate/0.1/payload.schema.json
  */
 
-/**
- * A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.
- */
-export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
-/**
- * Discriminator: is this consumer a user-driven Companion or a headless Service?
- */
-export type ConsumerKind = Companion | Service;
+import type { AndroidApp_VaultV0_1 as AndroidApp, Companion_DeviceV0_1 as Companion, ConsumerKind_DeviceV0_1 as ConsumerKind, Did_VaultV0_1 as Did, Ext, IosApp_VaultV0_1 as IosApp, PolicyDecision_PolicyV0_1 as PolicyDecision, PolicyInput_PolicyV0_1 as PolicyInput, Service_DeviceV0_1 as Service, SiteTarget_VaultV0_1 as SiteTarget, WebOrigin_VaultV0_1 as WebOrigin } from "../../../_shared/components.js";
+
 
 /**
  * Dry-run a policy decision against a synthetic PolicyInput. Returns the policy decision plus a trace of which policy modules matched and which rules fired. Used by the policy-editor UI to verify changes before save and by admins to diagnose unexpected deny/allow outcomes.
@@ -25,75 +19,6 @@ export interface PolicyEvaluatePayload {
   includeTrace?: boolean;
   ext?: Ext;
 }
-/**
- * The structured input fed to a policy evaluator on every vault/proxy-login, vault/release, and policy/evaluate call.
- */
-export interface PolicyInput {
-  request: {
-    kind: "proxy_login" | "release" | "step_up_response";
-  };
-  site: SiteTarget;
-  contextId: string;
-  consumer: {
-    did: string;
-    kind?: ConsumerKind;
-    deviceId?: string;
-    lastUserVerificationAt?: string;
-    networkClass?: "unknown" | "home" | "corp" | "public" | "vpn";
-  };
-}
-export interface WebOrigin {
-  kind: "web-origin";
-  /**
-   * Web origin per RFC 6454 (scheme + host + optional port), e.g. "https://github.com". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.
-   */
-  origin: string;
-}
-export interface Did {
-  kind: "did";
-  /**
-   * DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.
-   */
-  did: string;
-}
-export interface IosApp {
-  kind: "ios-app";
-  /**
-   * iOS bundle identifier in reverse-DNS form (e.g. "com.github.stwalkerster.codehub"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).
-   */
-  bundleId: string;
-  /**
-   * Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.
-   */
-  teamId?: string;
-}
-export interface AndroidApp {
-  kind: "android-app";
-  /**
-   * Android package name in reverse-DNS form (e.g. "com.github.android").
-   */
-  packageName: string;
-  /**
-   * SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).
-   *
-   * @minItems 1
-   */
-  sha256CertFingerprints: [string, ...string[]];
-}
-export interface Companion {
-  kind: "companion";
-  formFactor: "browser" | "mobile" | "desktop";
-}
-export interface Service {
-  kind: "service";
-  serviceKind: "mediator" | "ai-agent" | "daemon";
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PolicyEvaluateResponsePayload {
   decision: PolicyDecision;
   /**
@@ -106,28 +31,9 @@ export interface PolicyEvaluateResponsePayload {
   trace?: string[];
   ext?: Ext;
 }
-export interface PolicyDecision {
-  decision: "allow" | "deny" | "require_step_up";
-  /**
-   * When decision == "allow", whether the maintainer should proxy-login or release-for-fill. Default: proxy.
-   */
-  mode?: "proxy" | "fill";
-  /**
-   * When decision == "require_step_up", which method to demand.
-   */
-  stepUp?: {
-    method: "webauthn-uv" | "push-approval" | "totp";
-    ttlSeconds?: number;
-  };
-  /**
-   * When decision == "allow", maximum lifetime of the issued session blob / released secret.
-   */
-  ttlSecondsCap?: number;
-  /**
-   * Human-readable explanation for diagnostic display.
-   */
-  explanation?: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AndroidApp, Companion, ConsumerKind, Did, Ext, IosApp, PolicyDecision, PolicyInput, Service, SiteTarget, WebOrigin };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/evaluate/0.1" as const;
@@ -205,7 +111,8 @@ export const PAYLOAD_SCHEMA = {
         "trace": {
           "type": "array",
           "items": {
-            "type": "string"
+            "type": "string",
+            "maxLength": 1024
           },
           "description": "Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging."
         },
@@ -278,6 +185,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "explanation": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Human-readable explanation for diagnostic display."
         }
       }
@@ -533,7 +441,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "trace": {
           "type": "array",
           "items": {
-            "type": "string"
+            "type": "string",
+            "maxLength": 1024
           },
           "description": "Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging."
         },
@@ -606,6 +515,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "explanation": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Human-readable explanation for diagnostic display."
         }
       }
@@ -845,6 +755,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -858,5 +769,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/policy/evaluate/0.2/payload.ts

@@ -3,14 +3,8 @@
  * Source: specs/policy/evaluate/0.2/payload.schema.json
  */
 
-/**
- * A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.
- */
-export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
-/**
- * Discriminator: is this consumer a user-driven Companion or a headless Service?
- */
-export type ConsumerKind = Companion | Service;
+import type { AndroidApp_VaultV0_2 as AndroidApp, Companion_DeviceV0_2 as Companion, ConsumerKind_DeviceV0_2 as ConsumerKind, Did_VaultV0_2 as Did, Ext, IosApp_VaultV0_2 as IosApp, PolicyDecision_PolicyV0_2 as PolicyDecision, PolicyInput_PolicyV0_2 as PolicyInput, Service_DeviceV0_2 as Service, SiteTarget_VaultV0_2 as SiteTarget, WebOrigin_VaultV0_2 as WebOrigin } from "../../../_shared/components.js";
+
 
 /**
  * Dry-run a policy decision against a synthetic PolicyInput. Returns the policy decision plus a trace of which policy modules matched and which rules fired. Used by the policy-editor UI to verify changes before save and by admins to diagnose unexpected deny/allow outcomes.
@@ -25,75 +19,6 @@ export interface PolicyEvaluatePayload {
   includeTrace?: boolean;
   ext?: Ext;
 }
-/**
- * The structured input fed to a policy evaluator on every vault/proxy-login, vault/release, and policy/evaluate call.
- */
-export interface PolicyInput {
-  request: {
-    kind: "proxyLogin" | "release" | "stepUpResponse";
-  };
-  site: SiteTarget;
-  contextId: string;
-  consumer: {
-    did: string;
-    kind?: ConsumerKind;
-    deviceId?: string;
-    lastUserVerificationAt?: string;
-    networkClass?: "unknown" | "home" | "corp" | "public" | "vpn";
-  };
-}
-export interface WebOrigin {
-  kind: "webOrigin";
-  /**
-   * Web origin per RFC 6454 (scheme + host + optional port), e.g. "https://github.com". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.
-   */
-  origin: string;
-}
-export interface Did {
-  kind: "did";
-  /**
-   * DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.
-   */
-  did: string;
-}
-export interface IosApp {
-  kind: "iosApp";
-  /**
-   * iOS bundle identifier in reverse-DNS form (e.g. "com.github.stwalkerster.codehub"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).
-   */
-  bundleId: string;
-  /**
-   * Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.
-   */
-  teamId?: string;
-}
-export interface AndroidApp {
-  kind: "androidApp";
-  /**
-   * Android package name in reverse-DNS form (e.g. "com.github.android").
-   */
-  packageName: string;
-  /**
-   * SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).
-   *
-   * @minItems 1
-   */
-  sha256CertFingerprints: [string, ...string[]];
-}
-export interface Companion {
-  kind: "companion";
-  formFactor: "browser" | "mobile" | "desktop";
-}
-export interface Service {
-  kind: "service";
-  serviceKind: "mediator" | "aiAgent" | "daemon";
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PolicyEvaluateResponsePayload {
   decision: PolicyDecision;
   /**
@@ -106,28 +31,9 @@ export interface PolicyEvaluateResponsePayload {
   trace?: string[];
   ext?: Ext;
 }
-export interface PolicyDecision {
-  decision: "allow" | "deny" | "requireStepUp";
-  /**
-   * When decision == "allow", whether the maintainer should proxy-login or release-for-fill. Default: proxy.
-   */
-  mode?: "proxy" | "fill";
-  /**
-   * When decision == "require_step_up", which method to demand.
-   */
-  stepUp?: {
-    method: "webauthnUv" | "pushApproval" | "totp";
-    ttlSeconds?: number;
-  };
-  /**
-   * When decision == "allow", maximum lifetime of the issued session blob / released secret.
-   */
-  ttlSecondsCap?: number;
-  /**
-   * Human-readable explanation for diagnostic display.
-   */
-  explanation?: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AndroidApp, Companion, ConsumerKind, Did, Ext, IosApp, PolicyDecision, PolicyInput, Service, SiteTarget, WebOrigin };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/evaluate/0.2" as const;
@@ -205,7 +111,8 @@ export const PAYLOAD_SCHEMA = {
         "trace": {
           "type": "array",
           "items": {
-            "type": "string"
+            "type": "string",
+            "maxLength": 1024
           },
           "description": "Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging."
         },
@@ -278,6 +185,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "explanation": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Human-readable explanation for diagnostic display."
         }
       }
@@ -533,7 +441,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "trace": {
           "type": "array",
           "items": {
-            "type": "string"
+            "type": "string",
+            "maxLength": 1024
           },
           "description": "Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging."
         },
@@ -606,6 +515,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "explanation": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Human-readable explanation for diagnostic display."
         }
       }
@@ -845,6 +755,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -858,5 +769,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/policy/evaluate/0.3/payload.ts

@@ -3,18 +3,8 @@
  * Source: specs/policy/evaluate/0.3/payload.schema.json
  */
 
-/**
- * Multibase-encoded multihash over the RFC 8785 (JCS) canonicalization of the payload, salted with the request challenge, present when a delegated-execution consent flow must bind approval to this exact payload. Absent when no consent binding is in play.
- */
-export type DigestMultibase = string;
-/**
- * A single binding target for a vault entry. Tagged union over the discriminator `kind`. A VaultEntry's `targets` array MAY mix any number of these.
- */
-export type SiteTarget = WebOrigin | Did | IosApp | AndroidApp;
-/**
- * Discriminator: is this consumer a user-driven Companion or a headless Service?
- */
-export type ConsumerKind = Companion | Service;
+import type { AndroidApp_VaultV0_2 as AndroidApp, Companion_DeviceV0_2 as Companion, ConsumerKind_DeviceV0_2 as ConsumerKind, Did_VaultV0_2 as Did, DigestMultibase, Ext, IosApp_VaultV0_2 as IosApp, PolicyDecision_PolicyV0_3 as PolicyDecision, PolicyInput_PolicyV0_3 as PolicyInput, Service_DeviceV0_2 as Service, SiteTarget_VaultV0_2 as SiteTarget, WebOrigin_VaultV0_2 as WebOrigin } from "../../../_shared/components.js";
+
 
 /**
  * Dry-run a policy decision against a synthetic PolicyInput. Returns the policy decision plus a trace of which policy modules matched and which rules fired. Used by the policy-editor UI to verify changes before save and by admins to diagnose unexpected outcomes. 0.3 evaluates against the generalised PolicyInput (any Trust Task, carrying typeUri + side-effect/exposure classes) and can return the `requireConsent` decision.
@@ -29,98 +19,6 @@ export interface PolicyEvaluatePayload {
   includeTrace?: boolean;
   ext?: Ext;
 }
-/**
- * The structured input fed to a policy evaluator before dispatching a task. Generalised in 0.3 from the vault-flow triad to any Trust Task: `request.typeUri` identifies the task and `request.sideEffects` / `request.exposure` carry the authoritative SPEC §7.3 classifications the evaluator derives from the compiled handler.
- */
-export interface PolicyInput {
-  request: {
-    /**
-     * Type URI of the task being authorized — the evaluator's primary discriminator (e.g. https://trusttasks.org/spec/did-management/did/delete/0.1).
-     */
-    typeUri: string;
-    /**
-     * Optional coarse category retained from 0.2 (`proxyLogin` | `release` | `stepUpResponse` | …) for policies that switch on it. `typeUri` is authoritative in 0.3.
-     */
-    kind?: string;
-    /**
-     * The identifier the task acts on — the value at the spec's `subjectPath` (usually a DID). The evaluator checks the consumer's authority to act on this subject. Absent for subjectless tasks (discovery, list).
-     */
-    subject?: string;
-    payloadDigest?: DigestMultibase;
-    /**
-     * Authoritative integrity class (SPEC §7.3 item 13). The evaluator MUST derive this from the compiled handler it is about to invoke, not from the wire — the registry's declared value is advisory only.
-     */
-    sideEffects: "none" | "mutating" | "destructive";
-    /**
-     * Authoritative exposure class (SPEC §7.3 item 14), likewise derived from the compiled handler. `discloses` is the sensitivity of returned data; `actsAsSubject` is whether the subject's authority is exercised.
-     */
-    exposure: {
-      discloses: "none" | "metadata" | "secret";
-      actsAsSubject: boolean;
-    };
-  };
-  site: SiteTarget;
-  contextId: string;
-  consumer: {
-    did: string;
-    kind?: ConsumerKind;
-    deviceId?: string;
-    lastUserVerificationAt?: string;
-    networkClass?: "unknown" | "home" | "corp" | "public" | "vpn";
-  };
-}
-export interface WebOrigin {
-  kind: "webOrigin";
-  /**
-   * Web origin per RFC 6454 (scheme + host + optional port), e.g. "https://github.com". Compared by exact string equality after canonicalisation (lowercase host, default port elided). Consumers wanting subdomain coverage SHOULD add multiple targets, not encode a wildcard.
-   */
-  origin: string;
-}
-export interface Did {
-  kind: "did";
-  /**
-   * DID identifying the relying party (e.g. did:web:rp.example). The vault maintainer is responsible for any DID resolution required to act on this entry.
-   */
-  did: string;
-}
-export interface IosApp {
-  kind: "iosApp";
-  /**
-   * iOS bundle identifier in reverse-DNS form (e.g. "com.github.stwalkerster.codehub"). Compared by exact string equality. Matches when an iOS Companion identifies the requesting app via its bundle id (typically via the OS Credential Manager integration).
-   */
-  bundleId: string;
-  /**
-   * Optional Apple Developer Team identifier (10-character alphanumeric). When supplied, the maintainer SHOULD also verify the team id of the requesting app before matching — defense in depth against bundle-id squatting on jailbroken devices.
-   */
-  teamId?: string;
-}
-export interface AndroidApp {
-  kind: "androidApp";
-  /**
-   * Android package name in reverse-DNS form (e.g. "com.github.android").
-   */
-  packageName: string;
-  /**
-   * SHA-256 fingerprints of the app's signing certificates, in colon-separated hex (the format `apksigner` and the Play Console emit). At least one fingerprint MUST be present. The maintainer matches when ANY of the provided fingerprints matches the requesting app's signature — this supports apps signed by multiple keys (e.g. during certificate rotation via Play App Signing).
-   *
-   * @minItems 1
-   */
-  sha256CertFingerprints: [string, ...string[]];
-}
-export interface Companion {
-  kind: "companion";
-  formFactor: "browser" | "mobile" | "desktop";
-}
-export interface Service {
-  kind: "service";
-  serviceKind: "mediator" | "aiAgent" | "daemon";
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PolicyEvaluateResponsePayload {
   decision: PolicyDecision;
   /**
@@ -133,45 +31,9 @@ export interface PolicyEvaluateResponsePayload {
   trace?: string[];
   ext?: Ext;
 }
-export interface PolicyDecision {
-  decision: "allow" | "deny" | "requireStepUp" | "requireConsent";
-  /**
-   * Vault-flow-specific. When decision == "allow" for a proxy-login/release request, whether the maintainer should proxy-login or release-for-fill. Default: proxy. Ignored for other task kinds.
-   */
-  mode?: "proxy" | "fill";
-  /**
-   * When decision == "requireStepUp", which method to demand.
-   */
-  stepUp?: {
-    method: "webauthnUv" | "pushApproval" | "totp";
-    ttlSeconds?: number;
-  };
-  /**
-   * When decision == "requireConsent", the approver constraint the enforcement point MUST satisfy — a signed consent decision from the named set, bound to the request's payloadDigest — before executing.
-   */
-  requireConsent?: {
-    /**
-     * Named set of enrolled approver devices permitted to approve this task (resolved by the enforcement point against its device registry).
-     */
-    approverSet: string;
-    /**
-     * When true, the device that issued the request MUST NOT be accepted as the approver — forcing cross-device approval so a compromised requesting device cannot self-approve.
-     */
-    excludeRequester?: boolean;
-    /**
-     * Number of distinct approvers from the set required before the task may execute.
-     */
-    minApprovals?: number;
-  };
-  /**
-   * When decision == "allow", maximum lifetime of any issued session blob / released secret.
-   */
-  ttlSecondsCap?: number;
-  /**
-   * Human-readable explanation for diagnostic display.
-   */
-  explanation?: string;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AndroidApp, Companion, ConsumerKind, Did, DigestMultibase, Ext, IosApp, PolicyDecision, PolicyInput, Service, SiteTarget, WebOrigin };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/evaluate/0.3" as const;
@@ -249,7 +111,8 @@ export const PAYLOAD_SCHEMA = {
         "trace": {
           "type": "array",
           "items": {
-            "type": "string"
+            "type": "string",
+            "maxLength": 1024
           },
           "description": "Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging."
         },
@@ -348,6 +211,7 @@ export const PAYLOAD_SCHEMA = {
         },
         "explanation": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Human-readable explanation for diagnostic display."
         }
       }
@@ -654,7 +518,8 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "trace": {
           "type": "array",
           "items": {
-            "type": "string"
+            "type": "string",
+            "maxLength": 1024
           },
           "description": "Rego evaluator trace lines when `includeTrace: true`. Maintainer-defined format; primarily for human debugging."
         },
@@ -753,6 +618,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         },
         "explanation": {
           "type": "string",
+          "maxLength": 1024,
           "description": "Human-readable explanation for diagnostic display."
         }
       }
@@ -1043,6 +909,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -1056,5 +923,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/policy/get/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/policy/get/0.1/payload.schema.json
  */
 
+import type { Ext, PolicyModule } from "../../../_shared/components.js";
+
+
 export interface PolicyGetPayload {
   /**
    * The id of the policy module to fetch.
@@ -10,41 +13,13 @@ export interface PolicyGetPayload {
   id: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PolicyGetResponsePayload {
   policy: PolicyModule;
   ext?: Ext;
 }
-export interface PolicyModule {
-  id: string;
-  /**
-   * Human-readable name (e.g. "default vault policy", "bank-site step-up").
-   */
-  name: string;
-  description?: string;
-  /**
-   * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
-   */
-  module: string;
-  /**
-   * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
-   */
-  appliesTo?: string[];
-  /**
-   * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
-   */
-  priority?: number;
-  enabled?: boolean;
-  version: number;
-  createdAt: string;
-  updatedAt: string;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PolicyModule };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/get/0.1" as const;
@@ -297,6 +272,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -310,5 +286,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;