@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/policy/list/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/policy/list/0.1/payload.schema.json
  */
 
+import type { Ext, PolicyModule } from "../../../_shared/components.js";
+
+
 export interface PolicyListPayload {
   contextId?: string;
   enabledOnly?: boolean;
@@ -10,43 +13,15 @@ export interface PolicyListPayload {
   cursor?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PolicyListResponsePayload {
   policies: PolicyModule[];
   truncated: boolean;
   cursor?: string;
   ext?: Ext;
 }
-export interface PolicyModule {
-  id: string;
-  /**
-   * Human-readable name (e.g. "default vault policy", "bank-site step-up").
-   */
-  name: string;
-  description?: string;
-  /**
-   * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
-   */
-  module: string;
-  /**
-   * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
-   */
-  appliesTo?: string[];
-  /**
-   * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
-   */
-  priority?: number;
-  enabled?: boolean;
-  version: number;
-  createdAt: string;
-  updatedAt: string;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PolicyModule };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/list/0.1" as const;
@@ -327,6 +302,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -340,5 +316,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/policy/list/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/policy/list/0.2/payload.schema.json
  */
 
+import type { Ext, PolicyModule } from "../../../_shared/components.js";
+
+
 export interface PolicyListPayload {
   contextId?: string;
   enabledOnly?: boolean;
@@ -10,43 +13,15 @@ export interface PolicyListPayload {
   cursor?: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PolicyListResponsePayload {
   policies: PolicyModule[];
   truncated: boolean;
   cursor?: string;
   ext?: Ext;
 }
-export interface PolicyModule {
-  id: string;
-  /**
-   * Human-readable name (e.g. "default vault policy", "bank-site step-up").
-   */
-  name: string;
-  description?: string;
-  /**
-   * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
-   */
-  module: string;
-  /**
-   * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
-   */
-  appliesTo?: string[];
-  /**
-   * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
-   */
-  priority?: number;
-  enabled?: boolean;
-  version: number;
-  createdAt: string;
-  updatedAt: string;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PolicyModule };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/list/0.2" as const;
@@ -327,6 +302,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -340,5 +316,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/policy/upsert/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/policy/upsert/0.1/payload.schema.json
  */
 
+import type { Ext, PolicyModule } from "../../../_shared/components.js";
+
+
 export interface PolicyUpsertPayload {
   id?: string;
   expectedVersion?: number;
@@ -17,42 +20,14 @@ export interface PolicyUpsertPayload {
   enabled?: boolean;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PolicyUpsertResponsePayload {
   policy: PolicyModule;
   created: boolean;
   ext?: Ext;
 }
-export interface PolicyModule {
-  id: string;
-  /**
-   * Human-readable name (e.g. "default vault policy", "bank-site step-up").
-   */
-  name: string;
-  description?: string;
-  /**
-   * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
-   */
-  module: string;
-  /**
-   * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
-   */
-  appliesTo?: string[];
-  /**
-   * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
-   */
-  priority?: number;
-  enabled?: boolean;
-  version: number;
-  createdAt: string;
-  updatedAt: string;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PolicyModule };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/upsert/0.1" as const;
@@ -347,6 +322,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -360,5 +336,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/policy/upsert/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/policy/upsert/0.2/payload.schema.json
  */
 
+import type { Ext, PolicyModule } from "../../../_shared/components.js";
+
+
 export interface PolicyUpsertPayload {
   id?: string;
   expectedVersion?: number;
@@ -17,42 +20,14 @@ export interface PolicyUpsertPayload {
   enabled?: boolean;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 export interface PolicyUpsertResponsePayload {
   policy: PolicyModule;
   created: boolean;
   ext?: Ext;
 }
-export interface PolicyModule {
-  id: string;
-  /**
-   * Human-readable name (e.g. "default vault policy", "bank-site step-up").
-   */
-  name: string;
-  description?: string;
-  /**
-   * Rego source code. The maintainer's evaluator entry point is the package's `decision` rule, returning a PolicyDecision.
-   */
-  module: string;
-  /**
-   * List of trust contexts this policy applies to. Empty array = applies to all contexts (the default policy).
-   */
-  appliesTo?: string[];
-  /**
-   * When multiple policies match a request, evaluation order is by priority descending. The first to return a non-`null` decision wins.
-   */
-  priority?: number;
-  enabled?: boolean;
-  version: number;
-  createdAt: string;
-  updatedAt: string;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PolicyModule };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/policy/upsert/0.2" as const;
@@ -347,6 +322,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -360,5 +336,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/provision/integration/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/provision/integration/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * What the holder is asking the maintainer to do. Tagged on `type`; see `TemplateBootstrapAsk` and `AdminRotationAsk`.
  */
@@ -29,6 +32,9 @@ export interface ProvisionIntegrationPayload {
    * When `true`, the maintainer provisions the target context inline if it does not already exist. Requires super-admin role on the maintainer; context-admin callers MUST receive `provision/integration:forbidden` against a missing context. Idempotent when the context already exists.
    */
   createContext?: boolean;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
 /**
@@ -167,12 +173,6 @@ export interface DataIntegrityProof {
   proofValue: string;
   [k: string]: unknown | undefined;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Carried in a Trust Task document whose type is https://trusttasks.org/spec/provision/integration/0.1#response. The sealed `bundle` is the secret-bearing artefact; `summary` is non-secret audit metadata.
  */
@@ -186,7 +186,7 @@ export interface ProvisionIntegrationResponsePayload {
    */
   digest: string;
   summary: ProvisionSummary;
-  ext?: Ext1;
+  ext?: Ext;
 }
 /**
  * Non-secret audit metadata. MUST NOT include any private key material; the bundle is the only secret-bearing field.
@@ -241,12 +241,9 @@ export interface ProvisionSummary {
    */
   contextCreated?: boolean;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/provision/integration/0.1" as const;
@@ -1001,6 +998,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -1014,5 +1012,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: false,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/provision/integration/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/provision/integration/0.2/payload.schema.json
  */
 
+import type { Ext } from "../../../_shared/components.js";
+
+
 /**
  * What the holder is asking the maintainer to do. Tagged on `type`; see `TemplateBootstrapAsk` and `AdminRotationAsk`.
  */
@@ -29,6 +32,9 @@ export interface ProvisionIntegrationPayload {
    * When `true`, the maintainer provisions the target context inline if it does not already exist. Requires super-admin role on the maintainer; context-admin callers MUST receive `provision/integration:forbidden` against a missing context. Idempotent when the context already exists.
    */
   createContext?: boolean;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
 /**
@@ -167,12 +173,6 @@ export interface DataIntegrityProof {
   proofValue: string;
   [k: string]: unknown | undefined;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Carried in a Trust Task document whose type is https://trusttasks.org/spec/provision/integration/0.1#response. The sealed `bundle` is the secret-bearing artefact; `summary` is non-secret audit metadata.
  */
@@ -186,7 +186,7 @@ export interface ProvisionIntegrationResponsePayload {
    */
   digest: string;
   summary: ProvisionSummary;
-  ext?: Ext1;
+  ext?: Ext;
 }
 /**
  * Non-secret audit metadata. MUST NOT include any private key material; the bundle is the only secret-bearing field.
@@ -241,12 +241,9 @@ export interface ProvisionSummary {
    */
   contextCreated?: boolean;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/provision/integration/0.2" as const;
@@ -1001,6 +998,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -1014,5 +1012,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: false,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/provision/integration/0.3/payload.ts

@@ -3,14 +3,13 @@
  * Source: specs/provision/integration/0.3/payload.schema.json
  */
 
+import type { DigestMultibase, Ext } from "../../../_shared/components.js";
+
+
 /**
  * What the holder is asking the maintainer to do. Tagged on `type`; see `TemplateBootstrapAsk` and `AdminRotationAsk`.
  */
 export type BootstrapAsk = TemplateBootstrapAsk | AdminRotationAsk;
-/**
- * Digest over the armored ciphertext, for holders that pin the bundle out-of-band. Taken over the armored bytes exactly as carried in `bundle`, not over a canonicalization: the armor is the artifact, and re-armoring the same ciphertext does not have to reproduce the same bytes.
- */
-export type DigestMultibase = string;
 
 /**
  * Relayer presents a VP-signed bootstrap request from an integration holder; the maintainer mints the integration's DIDs and admin credential from a registered DID template and ships the material back HPKE-sealed to the holder's ephemeral did:key. Two ask variants are supported: TemplateBootstrap (mint integration DID + optional admin DID) and AdminRotation (mint only the long-term admin DID).
@@ -33,6 +32,9 @@ export interface ProvisionIntegrationPayload {
    * When `true`, the maintainer provisions the target context inline if it does not already exist. Requires super-admin role on the maintainer; context-admin callers MUST receive `provision/integration:forbidden` against a missing context. Idempotent when the context already exists.
    */
   createContext?: boolean;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
 /**
@@ -171,12 +173,6 @@ export interface DataIntegrityProof {
   proofValue: string;
   [k: string]: unknown | undefined;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Carried in a Trust Task document whose type is https://trusttasks.org/spec/provision/integration/0.1#response. The sealed `bundle` is the secret-bearing artefact; `summary` is non-secret audit metadata.
  */
@@ -185,9 +181,12 @@ export interface ProvisionIntegrationResponsePayload {
    * OpenPGP-style ASCII-armored ciphertext of `SealedPayloadV1`. HPKE base mode, X25519-HKDF-SHA256 KEM, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`. Recipient is the X25519 derivation of `request.holder`'s Ed25519 pubkey.
    */
   bundle: string;
+  /**
+   * Digest over the armored ciphertext, for holders that pin the bundle out-of-band. Taken over the armored bytes exactly as carried in `bundle`, not over a canonicalization: the armor is the artifact, and re-armoring the same ciphertext does not have to reproduce the same bytes.
+   */
   digestMultibase?: DigestMultibase;
   summary: ProvisionSummary;
-  ext?: Ext1;
+  ext?: Ext;
 }
 /**
  * Non-secret audit metadata. MUST NOT include any private key material; the bundle is the only secret-bearing field.
@@ -242,12 +241,9 @@ export interface ProvisionSummary {
    */
   contextCreated?: boolean;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DigestMultibase, Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/provision/integration/0.3" as const;
@@ -1020,6 +1016,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -1033,5 +1030,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: false,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/push/provision/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/push/provision/0.1/payload.schema.json
  */
 
+import type { Ext, WakeTriggerPolicy } from "../../../_shared/components.js";
+
+
 /**
  * The controller VTA sets a wake handle's trigger allowlist on the push gateway — the DIDs permitted to wake the device. The gateway accepts it only from the handle's recorded controller VTA and enforces it on every push/wake. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
@@ -11,39 +14,24 @@ export interface PushProvisionPayload {
    * The opaque gateway-issued handle (from push/register) whose allowlist is being set.
    */
   handle: string;
-  policy: WakeTriggerPolicy;
-  ext?: Ext;
-}
-/**
- * The trigger allowlist the VTA computed by its own policy — the DIDs permitted to wake this handle (typically the device's mediator and/or the VTA itself). Empty disables waking.
- */
-export interface WakeTriggerPolicy {
   /**
-   * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
+   * The trigger allowlist the VTA computed by its own policy — the DIDs permitted to wake this handle (typically the device's mediator and/or the VTA itself). Empty disables waking.
    */
-  allowedTriggers: string[];
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
+  policy: WakeTriggerPolicy;
+  ext?: Ext;
 }
 export interface PushProvisionResponsePayload {
   handle: string;
-  policy: WakeTriggerPolicy1;
-  ext?: Ext;
-}
-/**
- * The effective allowlist the gateway recorded.
- */
-export interface WakeTriggerPolicy1 {
   /**
-   * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
+   * The effective allowlist the gateway recorded.
    */
-  allowedTriggers: string[];
+  policy: WakeTriggerPolicy;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, WakeTriggerPolicy };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/push/provision/0.1" as const;
 
@@ -219,6 +207,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -232,5 +221,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/push/provision/0.2/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/push/provision/0.2/payload.schema.json
  */
 
+import type { Ext, WakeTriggerPolicy } from "../../../_shared/components.js";
+
+
 /**
  * The controller VTA sets a wake handle's trigger allowlist on the push gateway — the DIDs permitted to wake the device. The gateway accepts it only from the handle's recorded controller VTA and enforces it on every push/wake. See the push wake-up binding (https://trusttasks.org/binding/push/0.1).
  */
@@ -11,39 +14,24 @@ export interface PushProvisionPayload {
    * The opaque gateway-issued handle (from push/register) whose allowlist is being set.
    */
   handle: string;
-  policy: WakeTriggerPolicy;
-  ext?: Ext;
-}
-/**
- * The trigger allowlist the VTA computed by its own policy — the DIDs permitted to wake this handle (typically the device's mediator and/or the VTA itself). Empty disables waking.
- */
-export interface WakeTriggerPolicy {
   /**
-   * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
+   * The trigger allowlist the VTA computed by its own policy — the DIDs permitted to wake this handle (typically the device's mediator and/or the VTA itself). Empty disables waking.
    */
-  allowedTriggers: string[];
-}
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
+  policy: WakeTriggerPolicy;
+  ext?: Ext;
 }
 export interface PushProvisionResponsePayload {
   handle: string;
-  policy: WakeTriggerPolicy1;
-  ext?: Ext;
-}
-/**
- * The effective allowlist the gateway recorded.
- */
-export interface WakeTriggerPolicy1 {
   /**
-   * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
+   * The effective allowlist the gateway recorded.
    */
-  allowedTriggers: string[];
+  policy: WakeTriggerPolicy;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, WakeTriggerPolicy };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/push/provision/0.2" as const;
 
@@ -219,6 +207,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -232,5 +221,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;