@openvtc/trust-tasks 0.14.2 → 0.16.0

package/src/vta/passkey-vms/enroll-challenge/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vta/passkey-vms/enroll-challenge/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * Request a fresh WebAuthn registration challenge for adding a passkey verificationMethod to a VTA-managed DID. Step 1 of the two-step enrolment ceremony (challenge → submit). The producer must hold the admin role on the target DID's context.
  */
@@ -15,14 +18,11 @@ export interface VTAPasskeyVMEnrollChallengePayload {
    * Optional operator-supplied label for the new passkey (e.g. "MacBook Touch ID"). Carried through to the WebAuthn user name and, if the ceremony completes, to the published verificationMethod.
    */
   label?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The server-issued WebAuthn registration challenge. All byte-valued fields are base64url-encoded (no padding); the browser passes the decoded bytes to navigator.credentials.create.
  */
@@ -59,15 +59,15 @@ export interface VTAPasskeyVMEnrollChallengeResponsePayload {
    * Suggested ceremony timeout in milliseconds. Advisory; the authenticator and browser apply their own limits.
    */
   timeoutMs?: number;
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/passkey-vms/enroll-challenge/0.1" as const;
 
@@ -151,6 +151,7 @@ export const PAYLOAD_SCHEMA = {
         "rpName": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 64,
           "description": "Human-readable Relying-Party name."
         },
         "userHandle": {
@@ -161,11 +162,13 @@ export const PAYLOAD_SCHEMA = {
         "userName": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 64,
           "description": "WebAuthn user name (e.g. the DID or the operator-supplied label)."
         },
         "userDisplayName": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 64,
           "description": "WebAuthn user display name."
         },
         "timeoutMs": {
@@ -231,6 +234,7 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "rpName": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 64,
           "description": "Human-readable Relying-Party name."
         },
         "userHandle": {
@@ -241,11 +245,13 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         "userName": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 64,
           "description": "WebAuthn user name (e.g. the DID or the operator-supplied label)."
         },
         "userDisplayName": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 64,
           "description": "WebAuthn user display name."
         },
         "timeoutMs": {
@@ -283,6 +289,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -296,5 +303,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/passkey-vms/enroll-submit/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vta/passkey-vms/enroll-submit/0.1/payload.schema.json
  */
 
+import type { Ext, PasskeyVerificationMethod } from "../../../../_shared/components.js";
+
+
 /**
  * Finalise passkey enrolment by submitting the WebAuthn registration result for a ceremony opened by vta/passkey-vms/enroll-challenge. The VTA re-derives the Multikey from attestationObject.authData and rejects on mismatch with the browser-claimed publicKeyMultibase — the browser's value is NOT trusted as authoritative. On success the VTA appends the verificationMethod to the DID document via a WebVH log entry. All byte-valued fields are base64url-encoded (no padding).
  */
@@ -47,65 +50,32 @@ export interface VTAPasskeyVMEnrollSubmitPayload {
    * Optional operator-supplied label (e.g. "MacBook Touch ID"), carried through to the published verificationMethod.
    */
   label?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Successful enrolment. The verificationMethod has already been appended to the DID document via a WebVH log entry at the returned version.
  */
 export interface VTAPasskeyVMEnrollSubmitResponsePayload {
+  /**
+   * The verificationMethod entry exactly as it now appears in the DID document. `publicKeyMultibase` here is the server-re-derived key, which is authoritative.
+   */
   verificationMethod: PasskeyVerificationMethod;
   /**
    * The WebVH log-entry version that recorded the change (e.g. "3-Qm…").
    */
   webvhVersion: string;
-  ext?: Ext1;
-}
-/**
- * The verificationMethod entry exactly as it now appears in the DID document. `publicKeyMultibase` here is the server-re-derived key, which is authoritative.
- */
-export interface PasskeyVerificationMethod {
-  /**
-   * The verificationMethod id as it appears in the DID document: `<did>#passkey-<base64url(sha256(credentialId))>`. The fragment is content-derived so a verifier can locate this VM by recomputing `sha256(credential.id)`.
-   */
-  id: string;
-  /**
-   * Always `Multikey`. The WebAuthn public key is published in W3C Multikey form so DID resolvers and verifiers need no WebAuthn-specific knowledge to consume it.
-   */
-  type: "Multikey";
   /**
-   * The DID this verificationMethod is published on (the DID being augmented).
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  controller: string;
-  /**
-   * W3C Multikey (multibase) encoding of the WebAuthn credential public key. This is the value a verifier validates a WebAuthn assertion against. Re-derived server-side from the attestation at enrolment — never trusted from the browser (see vta/passkey-vms/enroll-submit).
-   */
-  publicKeyMultibase: string;
-  /**
-   * The WebAuthn `credential.id` (base64url, no padding). Lets a verifier recompute `sha256(credentialId)` and match the assertion to this VM's `id` fragment.
-   */
-  webauthnCredentialId: string;
-  /**
-   * Transport hints reported by the authenticator (e.g. `internal`, `hybrid`, `usb`, `nfc`, `ble`). Advisory only — verifiers MUST NOT make trust decisions based on transport hints.
-   */
-  webauthnTransports?: string[];
-  /**
-   * Optional operator-supplied human-readable label (e.g. "MacBook Touch ID"). Informational; not authoritative and not a security input.
-   */
-  label?: string;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PasskeyVerificationMethod };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/passkey-vms/enroll-submit/0.1" as const;
 
@@ -404,6 +374,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -417,5 +388,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/passkey-vms/list/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vta/passkey-vms/list/0.1/payload.schema.json
  */
 
+import type { Ext, PasskeyVerificationMethod } from "../../../../_shared/components.js";
+
+
 /**
  * List every passkey verificationMethod currently published on a VTA-managed DID. Admin-gated read. The returned entries are the same Multikey verificationMethods that appear in the DID document.
  */
@@ -11,14 +14,11 @@ export interface VTAPasskeyVMListPayload {
    * The DID whose passkey verificationMethods to enumerate. The producer MUST hold the admin role on this DID's context.
    */
   did: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * The passkey verificationMethods currently on the DID.
  */
@@ -27,45 +27,15 @@ export interface VTAPasskeyVMListResponsePayload {
    * Every passkey verificationMethod published on the DID. Empty when none are enrolled.
    */
   verificationMethods: PasskeyVerificationMethod[];
-  ext?: Ext1;
-}
-export interface PasskeyVerificationMethod {
-  /**
-   * The verificationMethod id as it appears in the DID document: `<did>#passkey-<base64url(sha256(credentialId))>`. The fragment is content-derived so a verifier can locate this VM by recomputing `sha256(credential.id)`.
-   */
-  id: string;
   /**
-   * Always `Multikey`. The WebAuthn public key is published in W3C Multikey form so DID resolvers and verifiers need no WebAuthn-specific knowledge to consume it.
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
    */
-  type: "Multikey";
-  /**
-   * The DID this verificationMethod is published on (the DID being augmented).
-   */
-  controller: string;
-  /**
-   * W3C Multikey (multibase) encoding of the WebAuthn credential public key. This is the value a verifier validates a WebAuthn assertion against. Re-derived server-side from the attestation at enrolment — never trusted from the browser (see vta/passkey-vms/enroll-submit).
-   */
-  publicKeyMultibase: string;
-  /**
-   * The WebAuthn `credential.id` (base64url, no padding). Lets a verifier recompute `sha256(credentialId)` and match the assertion to this VM's `id` fragment.
-   */
-  webauthnCredentialId: string;
-  /**
-   * Transport hints reported by the authenticator (e.g. `internal`, `hybrid`, `usb`, `nfc`, `ble`). Advisory only — verifiers MUST NOT make trust decisions based on transport hints.
-   */
-  webauthnTransports?: string[];
-  /**
-   * Optional operator-supplied human-readable label (e.g. "MacBook Touch ID"). Informational; not authoritative and not a security input.
-   */
-  label?: string;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PasskeyVerificationMethod };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/passkey-vms/list/0.1" as const;
 
@@ -303,6 +273,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -316,5 +287,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/passkey-vms/revoke/0.1/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vta/passkey-vms/revoke/0.1/payload.schema.json
  */
 
+import type { Ext } from "../../../../_shared/components.js";
+
+
 /**
  * Remove a passkey verificationMethod from a VTA-managed DID document via a WebVH log entry. Admin-gated. The VM is identified by its URL fragment (everything after `#` in the verificationMethod id). The success response is an empty object — modelled as an object so future additive fields do not bump the version.
  */
@@ -15,27 +18,24 @@ export interface VTAPasskeyVMRevokePayload {
    * The verificationMethod URL fragment — everything after `#` in the VM id (e.g. `passkey-3q2r1s0tUvWxYz`). MUST NOT include the leading `#`.
    */
   fragment: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
   ext?: Ext;
 }
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Empty success body. The verificationMethod has been removed via a WebVH log entry. Modelled as an object so future additive fields (e.g. the resulting WebVH version) do not require a version bump.
  */
 export interface VTAPasskeyVMRevokeResponsePayload {
-  ext?: Ext1;
-}
-/**
- * Ecosystem-defined extension members per SPEC.md §4.5.1.
- */
-export interface Ext1 {
-  [k: string]: unknown | undefined;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/passkey-vms/revoke/0.1" as const;
 
@@ -153,6 +153,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -166,5 +167,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/services/disable/1.0/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/vta/services/disable/1.0/payload.schema.json
  */
 
-/**
- * Which transport a task is acting on. This is the discriminator: it selects which member of `config` is meaningful, and a payload naming one kind with another's config is malformed rather than merely ignored.
- */
-export type ServiceKind = "didcomm" | "rest" | "tsp" | "webauthn";
+import type { Ext, ServiceKind, ServiceMutationResult } from "../../../../_shared/components.js";
+
 
 /**
  * Request payload for vta/services/disable. Stops advertising a transport and republishes the log. For `didcomm` this schedules a drain rather than cutting delivery immediately — see `drainUntil` in the result.
@@ -19,12 +17,6 @@ export interface VTAServicesDisablePayload {
    */
   drainTtlSecs?: number;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Success response to vta/services/disable. Type https://trusttasks.org/spec/vta/services/disable/1.0#response.
  */
@@ -32,36 +24,9 @@ export interface VTAServicesDisableResponsePayload {
   result: ServiceMutationResult;
   ext?: Ext;
 }
-/**
- * The outcome of a change to an advertised service. Every member describes the **log entry the change produced**, because that is what the change actually is: the agent's DID document is the record, and a consumer that treats the response as a mere acknowledgement will miss that a redeploy may be required.
- */
-export interface ServiceMutationResult {
-  /**
-   * Version id of the new did:webvh log entry this change wrote. Joins the change to the document's history.
-   */
-  logEntryVersionId: string;
-  /**
-   * RFC 3339 instant the change took effect — the same instant stamped on the new log entry.
-   */
-  effectiveAt: string;
-  /**
-   * Present when the change scheduled a DIDComm drain. Its absence means no drain was scheduled, NOT that a drain finished instantly: a consumer reporting 'done' on an absent value would be right, and one reporting it on a present value would be wrong.
-   */
-  drainUntil?: string;
-  /**
-   * The mediator being drained, when `drainUntil` is present.
-   */
-  drainingMediator?: string;
-  /**
-   * The agent's own DID — subject of the log entry this change wrote. Carried so a caller can follow up without a second round trip.
-   */
-  vtaDid?: string;
-  /**
-   * True when the agent's DID is self-hosted. **The change is persisted locally but NOT published**: the operator must fetch the updated `did.jsonl` and redeploy before any verifier sees it. A consumer that ignores this reports success for a change no one else can observe yet.
-   */
-  serverless?: boolean;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, ServiceKind, ServiceMutationResult };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/services/disable/1.0" as const;
@@ -294,6 +259,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -307,5 +273,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/services/drain/cancel/1.0/payload.ts

@@ -3,6 +3,9 @@
  * Source: specs/vta/services/drain/cancel/1.0/payload.schema.json
  */
 
+import type { Ext } from "../../../../../_shared/components.js";
+
+
 /**
  * Request payload for vta/services/drain/cancel. Ends a drain early, dropping the mediator now instead of at `drainsUntil`. Messages still in flight through it are lost, which is the whole reason the drain window existed.
  */
@@ -13,12 +16,6 @@ export interface VTAServicesDrainCancelPayload {
   mediatorDid: string;
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Success response to vta/services/drain/cancel. Type https://trusttasks.org/spec/vta/services/drain/cancel/1.0#response.
  */
@@ -30,6 +27,9 @@ export interface VTAServicesDrainCancelResponsePayload {
   ext?: Ext;
 }
 
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/services/drain/cancel/1.0" as const;
 
@@ -152,6 +152,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -165,5 +166,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/services/drain/list/1.0/payload.ts

@@ -3,18 +3,15 @@
  * Source: specs/vta/services/drain/list/1.0/payload.schema.json
  */
 
+import type { DrainEntry, Ext } from "../../../../../_shared/components.js";
+
+
 /**
  * Request payload for vta/services/drain/list. Enumerates DIDComm mediators that are no longer advertised but are still accepting delivery.
  */
 export interface VTAServicesDrainListPayload {
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Success response to vta/services/drain/list. Type https://trusttasks.org/spec/vta/services/drain/list/1.0#response.
  */
@@ -25,24 +22,9 @@ export interface VTAServicesDrainListResponsePayload {
   entries: DrainEntry[];
   ext?: Ext;
 }
-/**
- * A DIDComm mediator that is no longer advertised but is still accepting delivery, so in-flight messages routed through it are not stranded.
- */
-export interface DrainEntry {
-  /**
-   * The mediator being drained.
-   */
-  mediatorDid: string;
-  /**
-   * Where it is still reachable for the remainder of the drain.
-   */
-  endpoint: string;
-  /**
-   * RFC 3339 instant after which the mediator is dropped and messages routed through it are lost.
-   */
-  drainsUntil: string;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { DrainEntry, Ext };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/services/drain/list/1.0" as const;
@@ -224,6 +206,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -237,5 +220,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: false,
   isRecipientRequired: true,
+  isIssuedAtRequired: false,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;

package/src/vta/services/enable/1.0/payload.ts

@@ -3,10 +3,8 @@
  * Source: specs/vta/services/enable/1.0/payload.schema.json
  */
 
-/**
- * Which transport a task is acting on. This is the discriminator: it selects which member of `config` is meaningful, and a payload naming one kind with another's config is malformed rather than merely ignored.
- */
-export type ServiceKind = "didcomm" | "rest" | "tsp" | "webauthn";
+import type { Ext, ServiceKind, ServiceMutationResult } from "../../../../_shared/components.js";
+
 
 /**
  * Request payload for vta/services/enable. Adds a transport to the agent's DID document and republishes the signed log. Enabling a transport already enabled is a conflict, not a no-op — use `update` to change its settings.
@@ -36,12 +34,6 @@ export interface VTAServicesEnablePayload {
   };
   ext?: Ext;
 }
-/**
- * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
- */
-export interface Ext {
-  [k: string]: unknown | undefined;
-}
 /**
  * Success response to vta/services/enable. Type https://trusttasks.org/spec/vta/services/enable/1.0#response.
  */
@@ -49,36 +41,9 @@ export interface VTAServicesEnableResponsePayload {
   result: ServiceMutationResult;
   ext?: Ext;
 }
-/**
- * The outcome of a change to an advertised service. Every member describes the **log entry the change produced**, because that is what the change actually is: the agent's DID document is the record, and a consumer that treats the response as a mere acknowledgement will miss that a redeploy may be required.
- */
-export interface ServiceMutationResult {
-  /**
-   * Version id of the new did:webvh log entry this change wrote. Joins the change to the document's history.
-   */
-  logEntryVersionId: string;
-  /**
-   * RFC 3339 instant the change took effect — the same instant stamped on the new log entry.
-   */
-  effectiveAt: string;
-  /**
-   * Present when the change scheduled a DIDComm drain. Its absence means no drain was scheduled, NOT that a drain finished instantly: a consumer reporting 'done' on an absent value would be right, and one reporting it on a present value would be wrong.
-   */
-  drainUntil?: string;
-  /**
-   * The mediator being drained, when `drainUntil` is present.
-   */
-  drainingMediator?: string;
-  /**
-   * The agent's own DID — subject of the log entry this change wrote. Carried so a caller can follow up without a second round trip.
-   */
-  vtaDid?: string;
-  /**
-   * True when the agent's DID is self-hosted. **The change is persisted locally but NOT published**: the operator must fetch the updated `did.jsonl` and redeploy before any verifier sees it. A consumer that ignores this reports success for a change no one else can observe yet.
-   */
-  serverless?: boolean;
-  ext?: Ext;
-}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, ServiceKind, ServiceMutationResult };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/vta/services/enable/1.0" as const;
@@ -333,6 +298,7 @@ export const SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: PAYLOAD_SCHEMA,
 } as const;
 
@@ -346,5 +312,6 @@ export const RESPONSE_SPEC = {
   isBearer: false,
   isProofRequired: true,
   isRecipientRequired: true,
+  isIssuedAtRequired: true,
   payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
 } as const;