@openvtc/trust-tasks 0.2.55 → 0.2.56

package/src/auth/passkey/enroll/finish/0.2/payload.ts

@@ -56,9 +56,40 @@ export interface AuthenticatorAssertionResponseLogin {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Acknowledgement of the registered credential. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/finish/0.2#response.
+ */
+export interface AuthPasskeyEnrollFinishResponsePayload {
+  /**
+   * base64url-encoded WebAuthn credential id, durable identifier for later management.
+   */
+  credentialId: string;
+  /**
+   * The VID the credential is now bound to. Echoed for symmetry with finish-time error responses.
+   */
+  subject: string;
+  /**
+   * The label persisted with the credential.
+   */
+  deviceLabel?: string;
+  registeredAt: string;
+  ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/finish/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyEnrollFinish;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/finish/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyEnrollFinishResponsePayload;

package/src/auth/passkey/enroll/invite/0.1/payload.ts

@@ -35,9 +35,36 @@ export interface AuthPasskeyEnrollInvite {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The issued invite. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/invite/0.1#response.
+ */
+export interface AuthPasskeyEnrollInviteResponsePayload {
+  invite: {
+    /**
+     * Opaque single-use invite token. The invitee presents it to the consumer during enrollment. ≥128 bits entropy.
+     */
+    token: string;
+    /**
+     * Operator-shareable URL that, when opened in a WebAuthn-capable browser, drives the enrollment ceremony. Contains the token as a query parameter.
+     */
+    url: string;
+  };
+  /**
+   * Echo of the invitee's VID.
+   */
+  subject: string;
+  expiresAt: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/invite/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyEnrollInvite;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/invite/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyEnrollInviteResponsePayload;

package/src/auth/passkey/enroll/start/0.1/payload.ts

@@ -19,9 +19,89 @@ export interface AuthPasskeyEnrollStart {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Server-issued WebAuthn creation options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/start/0.1#response.
+ */
+export interface AuthPasskeyEnrollStartResponsePayload {
+  /**
+   * Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim.
+   */
+  enrollmentId: string;
+  options: PublicKeyCredentialCreationOptions;
+  ext?: Ext1;
+}
+/**
+ * PublicKeyCredentialCreationOptions for navigator.credentials.create.
+ */
+export interface PublicKeyCredentialCreationOptions {
+  /**
+   * base64url-encoded one-time nonce.
+   */
+  challenge: string;
+  rp: {
+    id: string;
+    name: string;
+  };
+  user: {
+    /**
+     * base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.
+     */
+    id: string;
+    name: string;
+    displayName: string;
+  };
+  /**
+   * @minItems 1
+   */
+  pubKeyCredParams: [
+    {
+      type: "public-key";
+      /**
+       * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
+       */
+      alg: number;
+    },
+    ...{
+      type: "public-key";
+      /**
+       * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
+       */
+      alg: number;
+    }[]
+  ];
+  timeout?: number;
+  excludeCredentials?: PublicKeyCredentialDescriptor[];
+  authenticatorSelection?: {
+    authenticatorAttachment?: "platform" | "cross-platform";
+    requireResidentKey?: boolean;
+    residentKey?: "discouraged" | "preferred" | "required";
+    userVerification?: "discouraged" | "preferred" | "required";
+  };
+  attestation?: "none" | "indirect" | "direct" | "enterprise";
+}
+export interface PublicKeyCredentialDescriptor {
+  type: "public-key";
+  /**
+   * base64url-encoded credential id.
+   */
+  id: string;
+  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/start/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyEnrollStart;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/start/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyEnrollStartResponsePayload;

package/src/auth/passkey/enroll/start/0.2/payload.ts

@@ -19,9 +19,103 @@ export interface AuthPasskeyEnrollStart {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Server-issued WebAuthn creation options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/enroll/start/0.2#response.
+ */
+export interface AuthPasskeyEnrollStartResponsePayload {
+  /**
+   * Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim.
+   */
+  enrollmentId: string;
+  options: PublicKeyCredentialCreationOptions;
+  uvOptions?: PublicKeyCredentialRequestOptions;
+  ext?: Ext1;
+}
+/**
+ * PublicKeyCredentialCreationOptions for navigator.credentials.create.
+ */
+export interface PublicKeyCredentialCreationOptions {
+  /**
+   * base64url-encoded one-time nonce.
+   */
+  challenge: string;
+  rp: {
+    id: string;
+    name: string;
+  };
+  user: {
+    /**
+     * base64url-encoded user handle. SHOULD be a stable opaque identifier — never reuse a human-readable username here.
+     */
+    id: string;
+    name: string;
+    displayName: string;
+  };
+  /**
+   * @minItems 1
+   */
+  pubKeyCredParams: [
+    {
+      type: "public-key";
+      /**
+       * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
+       */
+      alg: number;
+    },
+    ...{
+      type: "public-key";
+      /**
+       * COSE algorithm identifier (e.g. -8 Ed25519, -7 ES256, -257 RS256).
+       */
+      alg: number;
+    }[]
+  ];
+  timeout?: number;
+  excludeCredentials?: PublicKeyCredentialDescriptor[];
+  authenticatorSelection?: {
+    authenticatorAttachment?: "platform" | "cross-platform";
+    requireResidentKey?: boolean;
+    residentKey?: "discouraged" | "preferred" | "required";
+    userVerification?: "discouraged" | "preferred" | "required";
+  };
+  attestation?: "none" | "indirect" | "direct" | "enterprise";
+}
+export interface PublicKeyCredentialDescriptor {
+  type: "public-key";
+  /**
+   * base64url-encoded credential id.
+   */
+  id: string;
+  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
+}
+/**
+ * New in 0.2. PublicKeyCredentialRequestOptions for a concurrent user-verification ceremony against the subject's EXISTING credentials. Present when the consumer requires re-authentication to add an authenticator — normally whenever the subject already has one. Absent for a first enrollment, when there is nothing to re-authenticate against. When present the producer MUST run both ceremonies and return both results to finish.
+ */
+export interface PublicKeyCredentialRequestOptions {
+  /**
+   * base64url-encoded one-time nonce.
+   */
+  challenge: string;
+  timeout?: number;
+  rpId?: string;
+  allowCredentials?: PublicKeyCredentialDescriptor[];
+  userVerification?: "discouraged" | "preferred" | "required";
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/start/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyEnrollStart;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/enroll/start/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyEnrollStartResponsePayload;

package/src/auth/passkey/list/0.1/payload.ts

@@ -15,9 +15,56 @@ export interface AuthPasskeyList {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/list/0.1#response.
+ */
+export interface AuthPasskeyListResponsePayload {
+  /**
+   * Every passkey currently bound to the producer's subject. MAY be empty — a subject who authenticates by other means has no passkeys, which is not an error. Consumers SHOULD sort by registeredAt descending.
+   */
+  credentials: RegisteredCredential[];
+  ext?: Ext1;
+}
+/**
+ * A passkey already bound to a subject, as listed by `auth/passkey/list` and targeted by `auth/passkey/revoke/*`. This is the auth service's own management view of a credential — not a WebAuthn dictionary — so its members are camelCase per SPEC.md §4.10. The exception is `transports`, whose values are the externally-owned WebAuthn transport tokens and are carried verbatim.
+ */
+export interface RegisteredCredential {
+  /**
+   * Durable identifier for this credential, as issued by `auth/passkey/enroll/finish`: the base64url-encoded WebAuthn credential id. Opaque to the producer — it MUST be echoed verbatim when revoking and MUST NOT be parsed.
+   */
+  credentialId: string;
+  /**
+   * Operator-facing label captured at enrollment (e.g. "Alice's MacBook Pro"). Absent when the subject enrolled without one. Consumers MUST NOT synthesize a label, because an invented one is indistinguishable from a chosen one to somebody deciding which credential to revoke.
+   */
+  deviceLabel?: string;
+  /**
+   * WebAuthn transport hints reported by the authenticator at enrollment (`usb`, `nfc`, `ble`, `internal`, `hybrid`, …). Externally owned and carried verbatim. Deliberately not an enum — unlike `CredentialDescriptor.transports`, which the consumer itself emits, these values were reported by a third-party authenticator, the WebAuthn transport registry grows independently of this specification, and an unrecognized token here is a display concern rather than a validation failure.
+   */
+  transports?: string[];
+  /**
+   * When the credential was bound to the subject.
+   */
+  registeredAt: string;
+  /**
+   * When this credential last completed an assertion. Absent if it never has, or if the consumer does not track usage. Those two cases are deliberately NOT distinguished: a nullable variant cannot survive the round-trip through generated bindings, which map absent and null onto the same optional, so a distinction stated here would not be one any conforming implementation could rely on. Consumers that need to advertise "usage is not tracked" SHOULD say so under `ext`.
+   */
+  lastUsedAt?: string;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/list/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyList;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/list/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyListResponsePayload;

package/src/auth/passkey/login/finish/0.1/payload.ts

@@ -36,9 +36,104 @@ export interface AuthenticatorAssertionResponseLogin {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/login/finish/0.1#response. For `purpose: login` the payload includes the new session + tokens; for `purpose: step-up` only the elevated session is included (the producer's existing tokens are unchanged — they now carry a higher acr at the next token introspection).
+ */
+export interface AuthPasskeyLoginFinishResponsePayload {
+  session: Session;
+  purpose: "login" | "step-up";
+  tokens?: TokenBundle;
+  ext?: Ext3;
+}
+/**
+ * A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).
+ */
+export interface Session {
+  /**
+   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
+   */
+  id: string;
+  /**
+   * The authenticated party's VID (typically a DID URL).
+   */
+  subject: string;
+  /**
+   * ISO-8601 timestamp when the session was created.
+   */
+  issuedAt: string;
+  /**
+   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
+   */
+  expiresAt: string;
+  /**
+   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
+   *
+   * @minItems 1
+   */
+  amr?: [string, ...string[]];
+  /**
+   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
+   */
+  acr?: string;
+  ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
+/**
+ * Present when `purpose: login` (a new session). Absent for `step-up` — the producer's existing tokens remain valid and now carry the elevated acr.
+ */
+export interface TokenBundle {
+  /**
+   * Bearer-style access token. Consumers presenting this token to downstream services prove the holder of the original session. Format is consumer-defined — JWT is common, but opaque strings are also valid.
+   */
+  accessToken: string;
+  /**
+   * Long-lived token redeemable via auth/refresh for a new access token. MAY be absent when the issuer does not support refresh.
+   */
+  refreshToken?: string;
+  /**
+   * Token presentation scheme. Almost always "Bearer"; reserved for future schemes.
+   */
+  tokenType: string;
+  /**
+   * Seconds from issuance until the access token expires.
+   */
+  expiresIn: number;
+  /**
+   * Seconds from issuance until the refresh token expires, when one was issued.
+   */
+  refreshExpiresIn?: number;
+  /**
+   * Capability tags effective on this token. Format is consumer-defined; the framework imposes no syntax.
+   */
+  scope?: string[];
+  ext?: Ext2;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext2 {
+  [k: string]: unknown | undefined;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext3 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/login/finish/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyLoginFinish;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/login/finish/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyLoginFinishResponsePayload;

package/src/auth/passkey/login/finish/0.2/payload.ts

@@ -36,9 +36,104 @@ export interface AuthenticatorAssertionResponseLogin {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/login/finish/0.1#response. For `purpose: login` the payload includes the new session + tokens; for `purpose: step-up` only the elevated session is included (the producer's existing tokens are unchanged — they now carry a higher acr at the next token introspection).
+ */
+export interface AuthPasskeyLoginFinishResponsePayload {
+  session: Session;
+  purpose: "login" | "stepUp";
+  tokens?: TokenBundle;
+  ext?: Ext3;
+}
+/**
+ * A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).
+ */
+export interface Session {
+  /**
+   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
+   */
+  id: string;
+  /**
+   * The authenticated party's VID (typically a DID URL).
+   */
+  subject: string;
+  /**
+   * ISO-8601 timestamp when the session was created.
+   */
+  issuedAt: string;
+  /**
+   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
+   */
+  expiresAt: string;
+  /**
+   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
+   *
+   * @minItems 1
+   */
+  amr?: [string, ...string[]];
+  /**
+   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
+   */
+  acr?: string;
+  ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
+/**
+ * Present when `purpose: login` (a new session). Absent for `stepUp` — the producer's existing tokens remain valid and now carry the elevated acr.
+ */
+export interface TokenBundle {
+  /**
+   * Bearer-style access token. Consumers presenting this token to downstream services prove the holder of the original session. Format is consumer-defined — JWT is common, but opaque strings are also valid.
+   */
+  accessToken: string;
+  /**
+   * Long-lived token redeemable via auth/refresh for a new access token. MAY be absent when the issuer does not support refresh.
+   */
+  refreshToken?: string;
+  /**
+   * Token presentation scheme. Almost always "Bearer"; reserved for future schemes.
+   */
+  tokenType: string;
+  /**
+   * Seconds from issuance until the access token expires.
+   */
+  expiresIn: number;
+  /**
+   * Seconds from issuance until the refresh token expires, when one was issued.
+   */
+  refreshExpiresIn?: number;
+  /**
+   * Capability tags effective on this token. Format is consumer-defined; the framework imposes no syntax.
+   */
+  scope?: string[];
+  ext?: Ext2;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext2 {
+  [k: string]: unknown | undefined;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext3 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/login/finish/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyLoginFinish;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/login/finish/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyLoginFinishResponsePayload;

package/src/auth/passkey/login/start/0.1/payload.ts

@@ -23,9 +23,53 @@ export interface AuthPasskeyLoginStart {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Server-issued WebAuthn request options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/login/start/0.1#response.
+ */
+export interface AuthPasskeyLoginStartResponsePayload {
+  /**
+   * Opaque server handle correlating this start with the matching finish.
+   */
+  authId: string;
+  options: PublicKeyCredentialRequestOptions;
+  ext?: Ext1;
+}
+/**
+ * PublicKeyCredentialRequestOptions for navigator.credentials.get.
+ */
+export interface PublicKeyCredentialRequestOptions {
+  /**
+   * base64url-encoded one-time nonce.
+   */
+  challenge: string;
+  timeout?: number;
+  rpId?: string;
+  allowCredentials?: PublicKeyCredentialDescriptor[];
+  userVerification?: "discouraged" | "preferred" | "required";
+}
+export interface PublicKeyCredentialDescriptor {
+  type: "public-key";
+  /**
+   * base64url-encoded credential id.
+   */
+  id: string;
+  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/login/start/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyLoginStart;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/login/start/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyLoginStartResponsePayload;

package/src/auth/passkey/login/start/0.2/payload.ts

@@ -23,9 +23,53 @@ export interface AuthPasskeyLoginStart {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Server-issued WebAuthn request options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/login/start/0.1#response.
+ */
+export interface AuthPasskeyLoginStartResponsePayload {
+  /**
+   * Opaque server handle correlating this start with the matching finish.
+   */
+  authId: string;
+  options: PublicKeyCredentialRequestOptions;
+  ext?: Ext1;
+}
+/**
+ * PublicKeyCredentialRequestOptions for navigator.credentials.get.
+ */
+export interface PublicKeyCredentialRequestOptions {
+  /**
+   * base64url-encoded one-time nonce.
+   */
+  challenge: string;
+  timeout?: number;
+  rpId?: string;
+  allowCredentials?: PublicKeyCredentialDescriptor[];
+  userVerification?: "discouraged" | "preferred" | "required";
+}
+export interface PublicKeyCredentialDescriptor {
+  type: "public-key";
+  /**
+   * base64url-encoded credential id.
+   */
+  id: string;
+  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/login/start/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyLoginStart;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/login/start/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyLoginStartResponsePayload;