@openvtc/trust-tasks 0.20.2 → 0.20.3

package/src/git-ns/bridge/result/0.1/payload.ts

@@ -0,0 +1,321 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/git-ns/bridge/result/0.1/payload.schema.json
+ */
+
+import type { Ext, ForgeId, RepoResource } from "../../../../_shared/components.js";
+
+
+/**
+ * The bridge reports how a job ended. Exactly one result is sent per job; the VTC updates the repository's state, bootstrap status and forge id from it.
+ */
+export interface GitNamespacesBridgeJobResultPayload {
+  /**
+   * The job, as git-ns/bridge/job named it.
+   */
+  jobId: string;
+  /**
+   * `succeeded` — every step was applied. `failed` — nothing was applied. `partial` — some steps were applied and at least one failed; `steps` says which. Every step is check-then-apply, so the VTC may send the job again.
+   */
+  outcome: "succeeded" | "failed" | "partial";
+  /**
+   * The repository the job touched, as the forge now reports it. Present whenever the job reached a repository.
+   */
+  repo?: {
+    resource: RepoResource;
+    forgeId: ForgeId;
+  };
+  /**
+   * Per-step outcomes, in the order they ran.
+   */
+  steps?: {
+    /**
+     * The step name, from the adapter's plan.
+     */
+    step: string;
+    /**
+     * `applied` — changed the forge. `unchanged` — already as required. `failed` — could not be applied. `skipped` — not attempted because an earlier step failed.
+     */
+    outcome: "applied" | "unchanged" | "failed" | "skipped";
+    /**
+     * Human-readable detail, typically for a failure.
+     */
+    detail?: string;
+  }[];
+  /**
+   * Why the job failed or stopped partway. Present when `outcome` is not `succeeded`.
+   */
+  error?: {
+    /**
+     * Forge-neutral: `nameTaken`, `notFound`, `forbidden` (the bridge's forge credentials lack a permission), `notCapable` (this forge or namespace cannot do it), `rateLimited`, `expired` (a begin* job's person never completed it), `forgeError`. A bridge MAY use others.
+     */
+    code: string;
+    message?: string;
+  };
+  ext?: Ext;
+}
+/**
+ * The VTC has recorded the result.
+ */
+export interface GitNamespacesBridgeJobResultResponsePayload {
+  jobId: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, ForgeId, RepoResource };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/git-ns/bridge/result/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = GitNamespacesBridgeJobResultPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/git-ns/bridge/result/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = GitNamespacesBridgeJobResultResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/git-ns/bridge/result/0.1",
+  "title": "Git Namespaces — Bridge Job Result — payload",
+  "description": "The bridge reports how a job ended. Exactly one result is sent per job; the VTC updates the repository's state, bootstrap status and forge id from it.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "jobId",
+    "outcome"
+  ],
+  "properties": {
+    "jobId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "The job, as git-ns/bridge/job named it."
+    },
+    "outcome": {
+      "type": "string",
+      "enum": [
+        "succeeded",
+        "failed",
+        "partial"
+      ],
+      "description": "`succeeded` — every step was applied. `failed` — nothing was applied. `partial` — some steps were applied and at least one failed; `steps` says which. Every step is check-then-apply, so the VTC may send the job again."
+    },
+    "repo": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "resource",
+        "forgeId"
+      ],
+      "description": "The repository the job touched, as the forge now reports it. Present whenever the job reached a repository.",
+      "properties": {
+        "resource": {
+          "$ref": "#/$defs/RepoResource"
+        },
+        "forgeId": {
+          "$ref": "#/$defs/ForgeId"
+        }
+      }
+    },
+    "steps": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "step",
+          "outcome"
+        ],
+        "properties": {
+          "step": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64,
+            "pattern": "^[a-z][A-Za-z0-9]*$",
+            "description": "The step name, from the adapter's plan."
+          },
+          "outcome": {
+            "type": "string",
+            "enum": [
+              "applied",
+              "unchanged",
+              "failed",
+              "skipped"
+            ],
+            "description": "`applied` — changed the forge. `unchanged` — already as required. `failed` — could not be applied. `skipped` — not attempted because an earlier step failed."
+          },
+          "detail": {
+            "type": "string",
+            "maxLength": 1024,
+            "description": "Human-readable detail, typically for a failure."
+          }
+        }
+      },
+      "description": "Per-step outcomes, in the order they ran."
+    },
+    "error": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "code"
+      ],
+      "description": "Why the job failed or stopped partway. Present when `outcome` is not `succeeded`.",
+      "properties": {
+        "code": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64,
+          "pattern": "^[a-z][A-Za-z0-9]*$",
+          "description": "Forge-neutral: `nameTaken`, `notFound`, `forbidden` (the bridge's forge credentials lack a permission), `notCapable` (this forge or namespace cannot do it), `rateLimited`, `expired` (a begin* job's person never completed it), `forgeError`. A bridge MAY use others."
+        },
+        "message": {
+          "type": "string",
+          "maxLength": 1024
+        }
+      }
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Git Namespaces — Bridge Job Result — response payload",
+      "description": "The VTC has recorded the result.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "jobId"
+      ],
+      "properties": {
+        "jobId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "ForgeId": {
+      "title": "ForgeId",
+      "description": "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64
+    },
+    "RepoResource": {
+      "title": "RepoResource",
+      "description": "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.",
+      "type": "string",
+      "maxLength": 455,
+      "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$"
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Git Namespaces — Bridge Job Result — response payload",
+      "description": "The VTC has recorded the result.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "jobId"
+      ],
+      "properties": {
+        "jobId": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "ForgeId": {
+      "title": "ForgeId",
+      "description": "An identifier the forge itself assigns — a repository id, a user or organisation id — carried as a string so a forge whose ids are not numbers needs no new version. GitHub and Forgejo ids are decimal integers written as strings (`\"812736451\"`). Unlike a name, it survives renames and transfers, which is why rights and bindings are keyed by it.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64
+    },
+    "RepoResource": {
+      "title": "RepoResource",
+      "description": "A forge-qualified resource naming exactly one repository: `<forge-host>/<owner>/<repo>`, lowercase.",
+      "type": "string",
+      "maxLength": 455,
+      "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+/[a-z0-9_-][a-z0-9._-]{0,99}/[a-z0-9_-][a-z0-9._-]{0,99}$"
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/git-ns/namespace/bind/0.1/payload.ts

@@ -0,0 +1,374 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/git-ns/namespace/bind/0.1/payload.schema.json
+ */
+
+import type { Ext, ForgeHost, GitNamespace, NamespaceId, Segment } from "../../../../_shared/components.js";
+
+
+/**
+ * A VTC administrator binds the VTC to one owner on one forge, so that the VTC governs who may create, own, maintain and commit to repositories under it. In bridge mode the response says where to send the forge owner to prove control; the namespace stays `pending` until that proof arrives.
+ */
+export interface GitNamespacesBindNamespacePayload {
+  /**
+   * The forge's host, lowercased.
+   */
+  forge: ForgeHost;
+  /**
+   * The organisation or user on that forge, lowercased.
+   */
+  owner: Segment;
+  /**
+   * `bridge` — a bridge service serving this forge proves control and then acts on the forge. `manual` — no automation; the binding admin declares the namespace and people with forge access carry out the forge-side steps.
+   */
+  mode: "bridge" | "manual";
+  ext?: Ext;
+}
+/**
+ * The namespace as recorded, and where to go next if it is still pending.
+ */
+export interface GitNamespacesBindNamespaceResponsePayload {
+  namespace: GitNamespace;
+  /**
+   * Present when the namespace is `pending`: where the administrator goes to prove control of the forge owner (install the community's forge app, or sign in to the forge and authorise the bridge).
+   */
+  next?: {
+    /**
+     * An https URL, single-use, carrying the bridge's binding nonce.
+     */
+    url: string;
+  };
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, ForgeHost, GitNamespace, NamespaceId, Segment };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/git-ns/namespace/bind/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = GitNamespacesBindNamespacePayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/git-ns/namespace/bind/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = GitNamespacesBindNamespaceResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/git-ns/namespace/bind/0.1",
+  "title": "Git Namespaces — Bind Namespace — payload",
+  "description": "A VTC administrator binds the VTC to one owner on one forge, so that the VTC governs who may create, own, maintain and commit to repositories under it. In bridge mode the response says where to send the forge owner to prove control; the namespace stays `pending` until that proof arrives.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "forge",
+    "owner",
+    "mode"
+  ],
+  "properties": {
+    "forge": {
+      "$ref": "#/$defs/ForgeHost",
+      "description": "The forge's host, lowercased."
+    },
+    "owner": {
+      "$ref": "#/$defs/Segment",
+      "description": "The organisation or user on that forge, lowercased."
+    },
+    "mode": {
+      "type": "string",
+      "enum": [
+        "bridge",
+        "manual"
+      ],
+      "description": "`bridge` — a bridge service serving this forge proves control and then acts on the forge. `manual` — no automation; the binding admin declares the namespace and people with forge access carry out the forge-side steps."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Git Namespaces — Bind Namespace — response payload",
+      "description": "The namespace as recorded, and where to go next if it is still pending.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "namespace"
+      ],
+      "properties": {
+        "namespace": {
+          "$ref": "#/$defs/GitNamespace"
+        },
+        "next": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "url"
+          ],
+          "description": "Present when the namespace is `pending`: where the administrator goes to prove control of the forge owner (install the community's forge app, or sign in to the forge and authorise the bridge).",
+          "properties": {
+            "url": {
+              "type": "string",
+              "format": "uri",
+              "maxLength": 2048,
+              "pattern": "^https://",
+              "description": "An https URL, single-use, carrying the bridge's binding nonce."
+            }
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "GitNamespace": {
+      "title": "GitNamespace",
+      "description": "The VTC's binding to one owner on one forge.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "forge",
+        "owner",
+        "mode",
+        "state"
+      ],
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/NamespaceId"
+        },
+        "forge": {
+          "$ref": "#/$defs/ForgeHost"
+        },
+        "owner": {
+          "$ref": "#/$defs/Segment",
+          "description": "The organisation or user on the forge, lowercased."
+        },
+        "kind": {
+          "type": "string",
+          "enum": [
+            "organization",
+            "user"
+          ],
+          "description": "Whether the owner is an organisation or a personal account, as the forge reports it. Present once known: a bridge-mode namespace learns it when binding completes, and a manual-mode namespace MAY never learn it."
+        },
+        "mode": {
+          "type": "string",
+          "enum": [
+            "bridge",
+            "manual"
+          ],
+          "description": "`bridge` — a bridge service acts on the forge for this namespace (creates repositories, projects roles, reports drift). `manual` — no automation; people with forge access carry out the steps the VTC names, and the VTC governs the rights alone."
+        },
+        "state": {
+          "type": "string",
+          "enum": [
+            "pending",
+            "bound"
+          ],
+          "description": "`pending` — binding has started and the forge-side proof has not arrived yet. `bound` — the VTC governs rights under this namespace."
+        }
+      }
+    },
+    "Segment": {
+      "title": "Segment",
+      "description": "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 100,
+      "pattern": "^[a-z0-9_-][a-z0-9._-]*$"
+    },
+    "ForgeHost": {
+      "title": "ForgeHost",
+      "description": "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.",
+      "type": "string",
+      "minLength": 3,
+      "maxLength": 253,
+      "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$"
+    },
+    "NamespaceId": {
+      "title": "NamespaceId",
+      "description": "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Git Namespaces — Bind Namespace — response payload",
+      "description": "The namespace as recorded, and where to go next if it is still pending.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "namespace"
+      ],
+      "properties": {
+        "namespace": {
+          "$ref": "#/$defs/GitNamespace"
+        },
+        "next": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "url"
+          ],
+          "description": "Present when the namespace is `pending`: where the administrator goes to prove control of the forge owner (install the community's forge app, or sign in to the forge and authorise the bridge).",
+          "properties": {
+            "url": {
+              "type": "string",
+              "format": "uri",
+              "maxLength": 2048,
+              "pattern": "^https://",
+              "description": "An https URL, single-use, carrying the bridge's binding nonce."
+            }
+          }
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "GitNamespace": {
+      "title": "GitNamespace",
+      "description": "The VTC's binding to one owner on one forge.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "forge",
+        "owner",
+        "mode",
+        "state"
+      ],
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/NamespaceId"
+        },
+        "forge": {
+          "$ref": "#/$defs/ForgeHost"
+        },
+        "owner": {
+          "$ref": "#/$defs/Segment",
+          "description": "The organisation or user on the forge, lowercased."
+        },
+        "kind": {
+          "type": "string",
+          "enum": [
+            "organization",
+            "user"
+          ],
+          "description": "Whether the owner is an organisation or a personal account, as the forge reports it. Present once known: a bridge-mode namespace learns it when binding completes, and a manual-mode namespace MAY never learn it."
+        },
+        "mode": {
+          "type": "string",
+          "enum": [
+            "bridge",
+            "manual"
+          ],
+          "description": "`bridge` — a bridge service acts on the forge for this namespace (creates repositories, projects roles, reports drift). `manual` — no automation; people with forge access carry out the steps the VTC names, and the VTC governs the rights alone."
+        },
+        "state": {
+          "type": "string",
+          "enum": [
+            "pending",
+            "bound"
+          ],
+          "description": "`pending` — binding has started and the forge-side proof has not arrived yet. `bound` — the VTC governs rights under this namespace."
+        }
+      }
+    },
+    "Segment": {
+      "title": "Segment",
+      "description": "One lowercased owner or repository name. Forges compare these case-insensitively, so the wire form is always lowercase and a producer lowercases before sending. A leading `.` is refused, which rules out `.` and `..`.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 100,
+      "pattern": "^[a-z0-9_-][a-z0-9._-]*$"
+    },
+    "ForgeHost": {
+      "title": "ForgeHost",
+      "description": "The lowercased DNS host of a forge: `github.com`, a GitHub Enterprise Server host, `codeberg.org`, or a self-hosted Forgejo instance such as `git.example.org`. No scheme, no port, no path. The host is a segment of every resource, so a right never crosses forges.",
+      "type": "string",
+      "minLength": 3,
+      "maxLength": 253,
+      "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$"
+    },
+    "NamespaceId": {
+      "title": "NamespaceId",
+      "description": "The VTC's opaque identifier for a namespace, assigned when it is bound. Stable for the life of the binding; never reused for another binding.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;