@openvtc/trust-tasks 0.2.54 → 0.2.56

package/src/device/heartbeat/0.1/payload.ts

@@ -23,9 +23,42 @@ export interface DeviceHeartbeatPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface DeviceHeartbeatResponsePayload {
+  /**
+   * Authoritative timestamp — consumers MAY use to detect clock drift.
+   */
+  serverTime: string;
+  /**
+   * Operations the maintainer queued for this device while it was offline. The consumer MUST execute these in order before any other op.
+   */
+  queuedOperations?: QueuedOperation[];
+  /**
+   * Tells the consumer whether to call vault/sync.
+   */
+  syncHint?: "up-to-date" | "sync-due" | "full-resync-required";
+  ext?: Ext;
+}
+export interface QueuedOperation {
+  /**
+   * Discriminator. The framework currently supports wipe; future versions may add others.
+   */
+  kind: "wipe" | "policy-reload" | "config-update";
+  /**
+   * The full Trust Task document the consumer would have received if it had been online (e.g. a device/wipe/0.1 document). Consumer verifies and executes as if it had been received normally.
+   */
+  task: {
+    [k: string]: unknown | undefined;
+  };
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/heartbeat/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = DeviceHeartbeatPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/device/heartbeat/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = DeviceHeartbeatResponsePayload;

package/src/device/heartbeat/0.2/payload.ts

@@ -23,9 +23,42 @@ export interface DeviceHeartbeatPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface DeviceHeartbeatResponsePayload {
+  /**
+   * Authoritative timestamp — consumers MAY use to detect clock drift.
+   */
+  serverTime: string;
+  /**
+   * Operations the maintainer queued for this device while it was offline. The consumer MUST execute these in order before any other op.
+   */
+  queuedOperations?: QueuedOperation[];
+  /**
+   * Tells the consumer whether to call vault/sync.
+   */
+  syncHint?: "upToDate" | "syncDue" | "fullResyncRequired";
+  ext?: Ext;
+}
+export interface QueuedOperation {
+  /**
+   * Discriminator. The framework currently supports wipe; future versions may add others.
+   */
+  kind: "wipe" | "policyReload" | "configUpdate";
+  /**
+   * The full Trust Task document the consumer would have received if it had been online (e.g. a device/wipe/0.1 document). Consumer verifies and executes as if it had been received normally.
+   */
+  task: {
+    [k: string]: unknown | undefined;
+  };
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/heartbeat/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = DeviceHeartbeatPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/device/heartbeat/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = DeviceHeartbeatResponsePayload;

package/src/device/list/0.1/payload.ts

@@ -15,6 +15,20 @@ export type Capability =
   | "device-admin"
   | "sign"
   | "key-mint";
+/**
+ * Discriminator: is this consumer a user-driven Companion or a headless Service?
+ */
+export type ConsumerKind = Companion | Service;
+/**
+ * Producer-supplied attestation at registration time, verifiable by the maintainer against the platform's attestation infrastructure. Tagged union over the discriminator `kind`.
+ */
+export type DeviceAttestation =
+  | WebAuthnAttestation
+  | AppleAppAttest
+  | PlayIntegrity
+  | Tpm
+  | NitroEnclave
+  | NoAttestation;
 
 /**
  * List DeviceBindings known to the maintainer, optionally filtered by consumer kind, capability, status, and last-seen time.
@@ -40,9 +54,123 @@ export interface DeviceListPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface DeviceListResponsePayload {
+  devices: DeviceBinding[];
+  truncated: boolean;
+  cursor?: string;
+  ext?: Ext;
+}
+export interface DeviceBinding {
+  /**
+   * Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.
+   */
+  deviceId: string;
+  /**
+   * The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.
+   */
+  consumerDid: string;
+  consumerKind: ConsumerKind;
+  /**
+   * Human-readable name (e.g. "Glenn's MacBook — Chrome", "iPhone 17").
+   */
+  displayName: string;
+  /**
+   * Free-form platform descriptor (e.g. "macOS 16 / Chrome 142", "iOS 19.1", "Android 16", "Linux/x86_64"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.
+   */
+  platform?: string;
+  attestation?: DeviceAttestation;
+  /**
+   * Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.
+   */
+  pushCapable?: boolean;
+  keyCustody?: KeyCustody;
+  /**
+   * Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.
+   */
+  capabilities?: Capability[];
+  registeredAt: string;
+  /**
+   * Updated on every device/heartbeat and on any successful auth.
+   */
+  lastSeenAt?: string;
+  /**
+   * Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.
+   */
+  disabledAt?: string;
+  /**
+   * Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).
+   */
+  wipedAt?: string;
+  ext?: Ext;
+}
+export interface Companion {
+  kind: "companion";
+  formFactor: "browser" | "mobile" | "desktop";
+}
+export interface Service {
+  kind: "service";
+  serviceKind: "mediator" | "ai-agent" | "daemon";
+}
+export interface WebAuthnAttestation {
+  kind: "webauthn";
+  /**
+   * WebAuthn Authenticator AAGUID (UUID).
+   */
+  aaguid: string;
+  /**
+   * Base64url-encoded WebAuthn attestation statement, when supplied by the platform.
+   */
+  attestationStatement?: string;
+}
+export interface AppleAppAttest {
+  kind: "apple-app-attest";
+  keyId: string;
+  attestation: string;
+}
+export interface PlayIntegrity {
+  kind: "play-integrity";
+  token: string;
+}
+export interface Tpm {
+  kind: "tpm";
+  quote: string;
+}
+export interface NitroEnclave {
+  kind: "nitro-enclave";
+  quote: string;
+}
+/**
+ * No device-level attestation is available. Maintainers MAY still register the device but SHOULD apply stricter policy (shorter session TTL, more frequent step-up).
+ */
+export interface NoAttestation {
+  kind: "none";
+}
+/**
+ * How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.
+ */
+export interface KeyCustody {
+  /**
+   * `hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.
+   */
+  tier: "hardware" | "software";
+  /**
+   * JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).
+   */
+  signingAlg?: string;
+  /**
+   * Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).
+   */
+  keyAgreementCurve?: string;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/list/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = Capability;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/device/list/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = DeviceListResponsePayload;

package/src/device/list/0.2/payload.ts

@@ -15,6 +15,20 @@ export type Capability =
   | "deviceAdmin"
   | "sign"
   | "keyMint";
+/**
+ * Discriminator: is this consumer a user-driven Companion or a headless Service?
+ */
+export type ConsumerKind = Companion | Service;
+/**
+ * Producer-supplied attestation at registration time, verifiable by the maintainer against the platform's attestation infrastructure. Tagged union over the discriminator `kind`.
+ */
+export type DeviceAttestation =
+  | WebAuthnAttestation
+  | AppleAppAttest
+  | PlayIntegrity
+  | Tpm
+  | NitroEnclave
+  | NoAttestation;
 
 /**
  * List DeviceBindings known to the maintainer, optionally filtered by consumer kind, capability, status, and last-seen time.
@@ -40,9 +54,123 @@ export interface DeviceListPayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface DeviceListResponsePayload {
+  devices: DeviceBinding[];
+  truncated: boolean;
+  cursor?: string;
+  ext?: Ext;
+}
+export interface DeviceBinding {
+  /**
+   * Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.
+   */
+  deviceId: string;
+  /**
+   * The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.
+   */
+  consumerDid: string;
+  consumerKind: ConsumerKind;
+  /**
+   * Human-readable name (e.g. "Glenn's MacBook — Chrome", "iPhone 17").
+   */
+  displayName: string;
+  /**
+   * Free-form platform descriptor (e.g. "macOS 16 / Chrome 142", "iOS 19.1", "Android 16", "Linux/x86_64"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.
+   */
+  platform?: string;
+  attestation?: DeviceAttestation;
+  /**
+   * Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.
+   */
+  pushCapable?: boolean;
+  keyCustody?: KeyCustody;
+  /**
+   * Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.
+   */
+  capabilities?: Capability[];
+  registeredAt: string;
+  /**
+   * Updated on every device/heartbeat and on any successful auth.
+   */
+  lastSeenAt?: string;
+  /**
+   * Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.
+   */
+  disabledAt?: string;
+  /**
+   * Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).
+   */
+  wipedAt?: string;
+  ext?: Ext;
+}
+export interface Companion {
+  kind: "companion";
+  formFactor: "browser" | "mobile" | "desktop";
+}
+export interface Service {
+  kind: "service";
+  serviceKind: "mediator" | "aiAgent" | "daemon";
+}
+export interface WebAuthnAttestation {
+  kind: "webauthn";
+  /**
+   * WebAuthn Authenticator AAGUID (UUID).
+   */
+  aaguid: string;
+  /**
+   * Base64url-encoded WebAuthn attestation statement, when supplied by the platform.
+   */
+  attestationStatement?: string;
+}
+export interface AppleAppAttest {
+  kind: "appleAppAttest";
+  keyId: string;
+  attestation: string;
+}
+export interface PlayIntegrity {
+  kind: "playIntegrity";
+  token: string;
+}
+export interface Tpm {
+  kind: "tpm";
+  quote: string;
+}
+export interface NitroEnclave {
+  kind: "nitroEnclave";
+  quote: string;
+}
+/**
+ * No device-level attestation is available. Maintainers MAY still register the device but SHOULD apply stricter policy (shorter session TTL, more frequent step-up).
+ */
+export interface NoAttestation {
+  kind: "none";
+}
+/**
+ * How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.
+ */
+export interface KeyCustody {
+  /**
+   * `hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.
+   */
+  tier: "hardware" | "software";
+  /**
+   * JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).
+   */
+  signingAlg?: string;
+  /**
+   * Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).
+   */
+  keyAgreementCurve?: string;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/list/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = Capability;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/device/list/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = DeviceListResponsePayload;

package/src/device/register/0.1/payload.ts

@@ -17,6 +17,18 @@ export type DeviceAttestation =
   | Tpm
   | NitroEnclave
   | NoAttestation;
+/**
+ * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each.
+ */
+export type Capability =
+  | "vault-read"
+  | "vault-write"
+  | "proxy-login"
+  | "fill-release"
+  | "policy-admin"
+  | "device-admin"
+  | "sign"
+  | "key-mint";
 
 /**
  * Public discovery surface that wraps the maintainer's existing two-phase enrolment (provision-integration → acl/swap-key). A new Companion or Service hands the maintainer its long-term VTA-derived key, its consumer kind, display name, and an optional device attestation; the maintainer creates the DeviceBinding and returns it. Phase 1 (provision-integration) is assumed to have already happened — this task is the post-bootstrap claim step.
@@ -98,9 +110,79 @@ export interface KeyCustody {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface DeviceRegisterResponsePayload {
+  binding: DeviceBinding;
+  ext?: Ext;
+}
+export interface DeviceBinding {
+  /**
+   * Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.
+   */
+  deviceId: string;
+  /**
+   * The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.
+   */
+  consumerDid: string;
+  consumerKind: ConsumerKind;
+  /**
+   * Human-readable name (e.g. "Glenn's MacBook — Chrome", "iPhone 17").
+   */
+  displayName: string;
+  /**
+   * Free-form platform descriptor (e.g. "macOS 16 / Chrome 142", "iOS 19.1", "Android 16", "Linux/x86_64"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.
+   */
+  platform?: string;
+  attestation?: DeviceAttestation;
+  /**
+   * Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.
+   */
+  pushCapable?: boolean;
+  keyCustody?: KeyCustody1;
+  /**
+   * Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.
+   */
+  capabilities?: Capability[];
+  registeredAt: string;
+  /**
+   * Updated on every device/heartbeat and on any successful auth.
+   */
+  lastSeenAt?: string;
+  /**
+   * Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.
+   */
+  disabledAt?: string;
+  /**
+   * Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).
+   */
+  wipedAt?: string;
+  ext?: Ext;
+}
+/**
+ * How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.
+ */
+export interface KeyCustody1 {
+  /**
+   * `hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.
+   */
+  tier: "hardware" | "software";
+  /**
+   * JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).
+   */
+  signingAlg?: string;
+  /**
+   * Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).
+   */
+  keyAgreementCurve?: string;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/register/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ConsumerKind;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/device/register/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = DeviceRegisterResponsePayload;

package/src/device/register/0.2/payload.ts

@@ -17,6 +17,18 @@ export type DeviceAttestation =
   | Tpm
   | NitroEnclave
   | NoAttestation;
+/**
+ * Fine-grained capability flag scoped to the device's allowed contexts. See SPEC.md for the full semantics of each.
+ */
+export type Capability =
+  | "vaultRead"
+  | "vaultWrite"
+  | "proxyLogin"
+  | "fillRelease"
+  | "policyAdmin"
+  | "deviceAdmin"
+  | "sign"
+  | "keyMint";
 
 /**
  * Public discovery surface that wraps the maintainer's existing two-phase enrolment (provision-integration → acl/swap-key). A new Companion or Service hands the maintainer its long-term VTA-derived key, its consumer kind, display name, and an optional device attestation; the maintainer creates the DeviceBinding and returns it. Phase 1 (provision-integration) is assumed to have already happened — this task is the post-bootstrap claim step.
@@ -98,9 +110,79 @@ export interface KeyCustody {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface DeviceRegisterResponsePayload {
+  binding: DeviceBinding;
+  ext?: Ext;
+}
+export interface DeviceBinding {
+  /**
+   * Maintainer-assigned opaque id for this device. Stable across the device's lifetime — never re-used after disable or wipe.
+   */
+  deviceId: string;
+  /**
+   * The long-term VTA-derived key (DID) the device authenticates with. Established via the ACL-swap pattern at registration.
+   */
+  consumerDid: string;
+  consumerKind: ConsumerKind;
+  /**
+   * Human-readable name (e.g. "Glenn's MacBook — Chrome", "iPhone 17").
+   */
+  displayName: string;
+  /**
+   * Free-form platform descriptor (e.g. "macOS 16 / Chrome 142", "iOS 19.1", "Android 16", "Linux/x86_64"). Producer-supplied at registration; consumer-supplied updates are accepted on heartbeat.
+   */
+  platform?: string;
+  attestation?: DeviceAttestation;
+  /**
+   * Whether this device has a usable push channel — i.e. it has registered a push token with a push gateway and conveyed the resulting opaque WakeHandle to its VTA via device/set-wake (https://trusttasks.org/binding/push/0.1). Informational visibility for device/list only. The raw platform push token is held ONLY by the gateway; the maintainer/VTA holds the opaque WakeHandle and the VTA-owned trigger allowlist, never the token. Set from the presence of a current WakeHandle for this device.
+   */
+  pushCapable?: boolean;
+  keyCustody?: KeyCustody1;
+  /**
+   * Capability bitset granted to this device (mirrors the ACL-side scope). Returned for inspection; mutated only via acl/change-role or device/disable.
+   */
+  capabilities?: Capability[];
+  registeredAt: string;
+  /**
+   * Updated on every device/heartbeat and on any successful auth.
+   */
+  lastSeenAt?: string;
+  /**
+   * Present when the device has been disabled (device/disable). Disabled devices cannot authenticate but their record is retained for audit.
+   */
+  disabledAt?: string;
+  /**
+   * Present when a wipe has been issued (device/wipe). Distinct from disabledAt — a wiped device is also disabled, but wipe additionally communicates a wipe-cache instruction that the device may or may not have executed (see device/wipe).
+   */
+  wipedAt?: string;
+  ext?: Ext;
+}
+/**
+ * How the device custodies its private key material (tier + algorithms). Maintainer policy input, mirroring `attestation` — a maintainer MAY apply stricter policy to `software`-tier devices. See docs/design-notes/mobile-key-custody-profile.md.
+ */
+export interface KeyCustody1 {
+  /**
+   * `hardware`: the key is non-exportable in the secure keystore (iOS Secure Enclave / Android StrongBox) and every signing / key-agreement operation runs in-chip — achievable only with P-256. `software`: the key is held in app memory during use, stored hardware-wrapped at rest. Maintainers MAY apply stricter policy (shorter sessions, more frequent step-up) to `software`-tier devices.
+   */
+  tier: "hardware" | "software";
+  /**
+   * JOSE `alg` of the holder's signing key, e.g. `ES256` (hardware-custodiable on mobile) or `EdDSA` (not).
+   */
+  signingAlg?: string;
+  /**
+   * Curve of the holder's keyAgreement key, e.g. `P-256` (hardware-custodiable on mobile) or `X25519` (not).
+   */
+  keyAgreementCurve?: string;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/register/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ConsumerKind;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/device/register/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = DeviceRegisterResponsePayload;

package/src/device/set-wake/0.1/payload.ts

@@ -37,9 +37,32 @@ export interface WakeHandle {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface DeviceSetWakeResponsePayload {
+  triggerPolicy?: WakeTriggerPolicy;
+  /**
+   * Whether the device now has a usable wake channel (true after a successful set, false after a clear).
+   */
+  pushCapable: boolean;
+  ext?: Ext;
+}
+/**
+ * The effective allowlist the VTA computed and provisioned to the gateway. Absent when the wake channel was cleared.
+ */
+export interface WakeTriggerPolicy {
+  /**
+   * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
+   */
+  allowedTriggers: string[];
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/set-wake/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = DeviceSetWakePayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/device/set-wake/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = DeviceSetWakeResponsePayload;

package/src/device/set-wake/0.2/payload.ts

@@ -37,9 +37,32 @@ export interface WakeHandle {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+export interface DeviceSetWakeResponsePayload {
+  triggerPolicy?: WakeTriggerPolicy;
+  /**
+   * Whether the device now has a usable wake channel (true after a successful set, false after a clear).
+   */
+  pushCapable: boolean;
+  ext?: Ext;
+}
+/**
+ * The effective allowlist the VTA computed and provisioned to the gateway. Absent when the wake channel was cleared.
+ */
+export interface WakeTriggerPolicy {
+  /**
+   * DIDs authorized to trigger a wake for this handle. An empty array means no party may wake the device (push effectively disabled while the handle exists). The gateway authenticates the trigger's DID before checking membership.
+   */
+  allowedTriggers: string[];
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/set-wake/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = DeviceSetWakePayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/device/set-wake/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = DeviceSetWakeResponsePayload;

package/src/device/wipe/0.1/payload.ts

@@ -31,9 +31,36 @@ export interface DeviceWipePayload {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Acknowledgement from the target device. Sent only when the target executes the wipe; absent if the target was offline or compromised. The maintainer treats the absence of a response as 'not confirmed' but considers the device neutralised because of the server-side defence-in-depth.
+ */
+export interface DeviceWipeResponsePayload {
+  deviceId: string;
+  scope: "cache" | "cache-and-keys" | "full";
+  completedAt: string;
+  diagnostics?: {
+    cacheBytesWiped?: number;
+    keysWiped?: number;
+    /**
+     * OS-level revocation hooks the target managed to invoke (e.g. "navigator.credentials.preventSilentAccess", "ASCredentialIdentityStore.removeAllCredentialIdentities").
+     */
+    osHooksInvoked?: string[];
+    /**
+     * Free-form reasons why the wipe was partial (e.g. "os-keychain-unavailable", "extension-storage-quota-exceeded").
+     */
+    partialReasons?: string[];
+  };
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/device/wipe/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = DeviceWipePayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/device/wipe/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = DeviceWipeResponsePayload;