@openvtc/trust-tasks 0.2.55 → 0.2.56

package/src/auth/passkey/revoke/finish/0.1/payload.ts

@@ -36,9 +36,39 @@ export interface AuthenticatorAssertionResponseLogin {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Acknowledgement of the removed credential. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/revoke/finish/0.1#response.
+ */
+export interface AuthPasskeyRevokeFinishResponsePayload {
+  /**
+   * The credential that was removed. Echoed from the server-side binding rather than from the request, so the producer can confirm the ceremony destroyed what they intended.
+   */
+  credentialId: string;
+  /**
+   * When the credential was unbound.
+   */
+  revokedAt: string;
+  /**
+   * How many passkeys the subject still has. Never zero — the last-credential refusal at start guarantees it. Present so a subject who has just pruned an estate knows what they have left without a second round-trip.
+   */
+  remaining: number;
+  ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/revoke/finish/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyRevokeFinish;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/revoke/finish/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyRevokeFinishResponsePayload;

package/src/auth/passkey/revoke/start/0.1/payload.ts

@@ -19,9 +19,53 @@ export interface AuthPasskeyRevokeStart {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Server-issued re-authentication options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/revoke/start/0.1#response.
+ */
+export interface AuthPasskeyRevokeStartResponsePayload {
+  /**
+   * Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim. The consumer binds it to the target credentialId server-side, so the finish carries no target of its own.
+   */
+  revocationId: string;
+  uvOptions: PublicKeyCredentialRequestOptions;
+  ext?: Ext1;
+}
+/**
+ * PublicKeyCredentialRequestOptions for navigator.credentials.get — a fresh user-verification ceremony proving a human with an enrolled authenticator is present right now. userVerification SHOULD be "required".
+ */
+export interface PublicKeyCredentialRequestOptions {
+  /**
+   * base64url-encoded one-time nonce.
+   */
+  challenge: string;
+  timeout?: number;
+  rpId?: string;
+  allowCredentials?: PublicKeyCredentialDescriptor[];
+  userVerification?: "discouraged" | "preferred" | "required";
+}
+export interface PublicKeyCredentialDescriptor {
+  type: "public-key";
+  /**
+   * base64url-encoded credential id.
+   */
+  id: string;
+  transports?: ("usb" | "nfc" | "ble" | "internal" | "hybrid")[];
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/revoke/start/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyRevokeStart;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/revoke/start/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyRevokeStartResponsePayload;

package/src/auth/refresh/0.1/payload.ts

@@ -23,9 +23,103 @@ export interface AuthRefresh {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Issued by the auth service when the presented refresh token is valid. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/refresh/0.1#response.
+ */
+export interface AuthRefreshResponsePayload {
+  session?: Session;
+  tokens: TokenBundle;
+  ext?: Ext3;
+}
+/**
+ * Optional session snapshot. Consumers SHOULD include it so the producer can refresh client-side state (acr changes after step-up, scope changes after policy edits) without a separate whoami call.
+ */
+export interface Session {
+  /**
+   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
+   */
+  id: string;
+  /**
+   * The authenticated party's VID (typically a DID URL).
+   */
+  subject: string;
+  /**
+   * ISO-8601 timestamp when the session was created.
+   */
+  issuedAt: string;
+  /**
+   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
+   */
+  expiresAt: string;
+  /**
+   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
+   *
+   * @minItems 1
+   */
+  amr?: [string, ...string[]];
+  /**
+   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
+   */
+  acr?: string;
+  ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
+/**
+ * New access token. If the consumer's policy rotates refresh tokens on each use, a new refreshToken is included; otherwise the producer continues using the previously-issued one.
+ */
+export interface TokenBundle {
+  /**
+   * Bearer-style access token. Consumers presenting this token to downstream services prove the holder of the original session. Format is consumer-defined — JWT is common, but opaque strings are also valid.
+   */
+  accessToken: string;
+  /**
+   * Long-lived token redeemable via auth/refresh for a new access token. MAY be absent when the issuer does not support refresh.
+   */
+  refreshToken?: string;
+  /**
+   * Token presentation scheme. Almost always "Bearer"; reserved for future schemes.
+   */
+  tokenType: string;
+  /**
+   * Seconds from issuance until the access token expires.
+   */
+  expiresIn: number;
+  /**
+   * Seconds from issuance until the refresh token expires, when one was issued.
+   */
+  refreshExpiresIn?: number;
+  /**
+   * Capability tags effective on this token. Format is consumer-defined; the framework imposes no syntax.
+   */
+  scope?: string[];
+  ext?: Ext2;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext2 {
+  [k: string]: unknown | undefined;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext3 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/refresh/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthRefresh;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/refresh/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthRefreshResponsePayload;

package/src/auth/revoke-session/0.1/payload.ts

@@ -30,9 +30,31 @@ export type AuthRevokeSession = {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Acknowledgement carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/revoke-session/0.1#response.
+ */
+export interface AuthRevokeSessionResponsePayload {
+  /**
+   * Number of sessions invalidated by this call. Zero is a valid outcome (e.g. the named sessionId was already revoked).
+   */
+  revokedCount: number;
+  ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/revoke-session/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthRevokeSession;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/revoke-session/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthRevokeSessionResponsePayload;

package/src/auth/sessions/list/0.1/payload.ts

@@ -15,9 +15,63 @@ export interface AuthSessionsList {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/sessions/list/0.1#response.
+ */
+export interface AuthSessionsListResponsePayload {
+  /**
+   * Every active session the consumer holds for the producer's subject. Sorted MAY be by issuedAt descending; the framework imposes no ordering.
+   */
+  sessions: Session[];
+  ext?: Ext;
+}
+/**
+ * A logical authentication context bound to a subject. Producers and consumers exchange Session-shaped data in challenge issuance, authentication responses, and introspection (whoami).
+ */
+export interface Session {
+  /**
+   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
+   */
+  id: string;
+  /**
+   * The authenticated party's VID (typically a DID URL).
+   */
+  subject: string;
+  /**
+   * ISO-8601 timestamp when the session was created.
+   */
+  issuedAt: string;
+  /**
+   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
+   */
+  expiresAt: string;
+  /**
+   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
+   *
+   * @minItems 1
+   */
+  amr?: [string, ...string[]];
+  /**
+   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
+   */
+  acr?: string;
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/sessions/list/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthSessionsList;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/sessions/list/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthSessionsListResponsePayload;

package/src/auth/step-up/approve-request/0.1/payload.ts

@@ -67,9 +67,29 @@ export interface PublicKeyCredentialDescriptor {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.1#response.
+ */
+export interface AuthStepUpApproveRequestResponsePayload {
+  /**
+   * `accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set.
+   */
+  status: "accepted" | "refused";
+  /**
+   * Required when status is `refused`.
+   */
+  reason?: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-request/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthStepUpApproveRequest;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-request/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthStepUpApproveRequestResponsePayload;

package/src/auth/step-up/approve-request/0.2/payload.ts

@@ -67,9 +67,29 @@ export interface PublicKeyCredentialDescriptor {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Synchronous ack from the approver acknowledging it received the request and will (or will not) deliver an approve-response. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-request/0.1#response.
+ */
+export interface AuthStepUpApproveRequestResponsePayload {
+  /**
+   * `accepted` means the approver received the request and will return an approve-response (typically via DIDComm). `refused` means it will not — `reason` MUST be set.
+   */
+  status: "accepted" | "refused";
+  /**
+   * Required when status is `refused`.
+   */
+  reason?: string;
+  ext?: Ext;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-request/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthStepUpApproveRequest;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-request/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthStepUpApproveRequestResponsePayload;

package/src/auth/step-up/approve-response/0.1/payload.ts

@@ -71,9 +71,65 @@ export interface AuthenticatorAssertionResponseLogin {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.1#response.
+ */
+export interface AuthStepUpApproveResponseRelyingPartyAck {
+  status: "elevated" | "rejected";
+  session?: Session;
+  /**
+   * Present when status is `rejected` (e.g. "challenge expired", "session not found", "acr ceiling exceeded").
+   */
+  reason?: string;
+  ext?: Ext;
+}
+/**
+ * Present when status is `elevated`. The session's updated amr/acr after the approval was applied.
+ */
+export interface Session {
+  /**
+   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
+   */
+  id: string;
+  /**
+   * The authenticated party's VID (typically a DID URL).
+   */
+  subject: string;
+  /**
+   * ISO-8601 timestamp when the session was created.
+   */
+  issuedAt: string;
+  /**
+   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
+   */
+  expiresAt: string;
+  /**
+   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
+   *
+   * @minItems 1
+   */
+  amr?: [string, ...string[]];
+  /**
+   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
+   */
+  acr?: string;
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-response/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = StepUpEvidence;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-response/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthStepUpApproveResponseRelyingPartyAck;

package/src/auth/step-up/approve-response/0.2/payload.ts

@@ -71,9 +71,65 @@ export interface AuthenticatorAssertionResponseLogin {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * Acknowledgement the relying party returns after processing the approval. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/approve-response/0.1#response.
+ */
+export interface AuthStepUpApproveResponseRelyingPartyAck {
+  status: "elevated" | "rejected";
+  session?: Session;
+  /**
+   * Present when status is `rejected` (e.g. "challenge expired", "session not found", "acr ceiling exceeded").
+   */
+  reason?: string;
+  ext?: Ext;
+}
+/**
+ * Present when status is `elevated`. The session's updated amr/acr after the approval was applied.
+ */
+export interface Session {
+  /**
+   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
+   */
+  id: string;
+  /**
+   * The authenticated party's VID (typically a DID URL).
+   */
+  subject: string;
+  /**
+   * ISO-8601 timestamp when the session was created.
+   */
+  issuedAt: string;
+  /**
+   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
+   */
+  expiresAt: string;
+  /**
+   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
+   *
+   * @minItems 1
+   */
+  amr?: [string, ...string[]];
+  /**
+   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
+   */
+  acr?: string;
+  ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-response/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = StepUpEvidence;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/step-up/approve-response/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthStepUpApproveResponseRelyingPartyAck;

package/src/auth/step-up/policy/0.1/payload.ts

@@ -37,9 +37,35 @@ export interface StepUpFloor {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The policy the maintainer now holds after applying the request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/policy/0.1#response.
+ */
+export interface AuthStepUpPolicyResponsePayload {
+  /**
+   * The effective master switch the maintainer now holds.
+   */
+  enabled: boolean;
+  /**
+   * The effective floors the maintainer now holds (canonicalized: deduplicated by `operation`, defaults materialized).
+   */
+  floors: StepUpFloor[];
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/policy/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthStepUpPolicyPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/step-up/policy/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthStepUpPolicyResponsePayload;

package/src/auth/step-up/policy/0.2/payload.ts

@@ -37,9 +37,35 @@ export interface StepUpFloor {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The policy the maintainer now holds after applying the request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/step-up/policy/0.1#response.
+ */
+export interface AuthStepUpPolicyResponsePayload {
+  /**
+   * The effective master switch the maintainer now holds.
+   */
+  enabled: boolean;
+  /**
+   * The effective floors the maintainer now holds (canonicalized: deduplicated by `operation`, defaults materialized).
+   */
+  floors: StepUpFloor[];
+  ext?: Ext1;
+}
+/**
+ * Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/step-up/policy/0.2" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthStepUpPolicyPayload;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/step-up/policy/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthStepUpPolicyResponsePayload;

package/src/auth/whoami/0.1/payload.ts

@@ -15,9 +15,74 @@ export interface AuthWhoami {
 export interface Ext {
   [k: string]: unknown | undefined;
 }
+/**
+ * The auth service's view of the producer. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/whoami/0.1#response.
+ */
+export interface AuthWhoamiResponsePayload {
+  session: Session;
+  /**
+   * Role assignments the auth service holds for the producer. Ecosystem-defined vocabulary.
+   */
+  roles?: string[];
+  /**
+   * Capability tags effective on the producer's current session. Mirrors the issued TokenBundle.scope; included here so a producer can reconcile after policy edits without re-issuing tokens.
+   */
+  scopes?: string[];
+  ext?: Ext2;
+}
+/**
+ * Current session state for the producer.
+ */
+export interface Session {
+  /**
+   * Opaque, server-chosen session identifier. Stable for the lifetime of the session. Consumers MUST treat the value as opaque; no structure is implied.
+   */
+  id: string;
+  /**
+   * The authenticated party's VID (typically a DID URL).
+   */
+  subject: string;
+  /**
+   * ISO-8601 timestamp when the session was created.
+   */
+  issuedAt: string;
+  /**
+   * ISO-8601 timestamp when the session ceases to be valid. Producers SHOULD refresh before this time; consumers MUST reject after.
+   */
+  expiresAt: string;
+  /**
+   * Authentication Methods References per [RFC 8176]. Typical values: "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust agent approval). Multi-factor sessions list every method used.
+   *
+   * @minItems 1
+   */
+  amr?: [string, ...string[]];
+  /**
+   * Authentication Context Class Reference per [OIDC Core §2]. Profiles define their own values; the recommended set is "aal1" (single-factor DID auth), "aal2" (a second possession-or-biometric factor confirmed), and "aal3" (hardware-bound second factor).
+   */
+  acr?: string;
+  ext?: Ext1;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext1 {
+  [k: string]: unknown | undefined;
+}
+/**
+ * Ecosystem-defined extension members per SPEC.md §4.5.1.
+ */
+export interface Ext2 {
+  [k: string]: unknown | undefined;
+}
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/auth/whoami/0.1" as const;
 
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthWhoami;
+
 /** Trust Task response type URI (request type URI + "#response"). */
 export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/whoami/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthWhoamiResponsePayload;

package/src/chat/message/0.1/payload.ts

@@ -113,5 +113,5 @@ export interface Ext {
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/chat/message/0.1" as const;
 
-/** Trust Task response type URI (request type URI + "#response"). */
-export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/chat/message/0.1#response" as const;
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ChatMessagePayload;