@openvtc/trust-tasks 0.23.8 → 0.24.0

package/src/external/accounts/secret/set/0.1/payload.ts

@@ -0,0 +1,248 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/external/accounts/secret/set/0.1/payload.schema.json
+ */
+
+import type { AccountContextId, AccountId, Ext, SealedTransferBundle, SecretFingerprint } from "../../../../../_shared/components.js";
+
+
+/**
+ * Set a static external account's secret, sealed to the custodian. Write-only. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface ExternalAccountsSecretSetPayload {
+  context: AccountContextId;
+  id: AccountId;
+  /**
+   * The `keyId` keys/import-wrapping-key returned with the wrapping key `sealedSecret` is sealed to. The custodian opens the bundle with that key only, and discards it whether or not the bundle opens, so a failed attempt cannot be retried against the same key.
+   */
+  wrappingKeyId: string;
+  sealedSecret: SealedTransferBundle;
+  ext?: Ext;
+}
+export interface ExternalAccountsSecretSetResponsePayload {
+  fingerprint: SecretFingerprint;
+  setAt: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AccountContextId, AccountId, Ext, SealedTransferBundle, SecretFingerprint };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/external/accounts/secret/set/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ExternalAccountsSecretSetPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/external/accounts/secret/set/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ExternalAccountsSecretSetResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/external/accounts/secret/set/0.1",
+  "title": "External Accounts — Secret — Set — payload",
+  "description": "Set a static external account's secret, sealed to the custodian. Write-only. The outer document members are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "context",
+    "id",
+    "wrappingKeyId",
+    "sealedSecret"
+  ],
+  "properties": {
+    "context": {
+      "$ref": "#/$defs/AccountContextId"
+    },
+    "id": {
+      "$ref": "#/$defs/AccountId"
+    },
+    "wrappingKeyId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "The `keyId` keys/import-wrapping-key returned with the wrapping key `sealedSecret` is sealed to. The custodian opens the bundle with that key only, and discards it whether or not the bundle opens, so a failed attempt cannot be retried against the same key."
+    },
+    "sealedSecret": {
+      "$ref": "#/$defs/SealedTransferBundle"
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "External Accounts — Secret — Set — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "fingerprint",
+        "setAt"
+      ],
+      "properties": {
+        "fingerprint": {
+          "$ref": "#/$defs/SecretFingerprint"
+        },
+        "setAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "SecretFingerprint": {
+      "title": "SecretFingerprint",
+      "type": "string",
+      "pattern": "^hmacsha256:[A-Za-z0-9_-]{22}$",
+      "maxLength": 33,
+      "description": "Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest."
+    },
+    "SealedTransferBundle": {
+      "title": "SealedTransferBundle",
+      "type": "string",
+      "minLength": 64,
+      "maxLength": 65536,
+      "pattern": "^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$",
+      "description": "A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload or an ExternalCredentialPayload. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \"the response\" from ever holding a usable secret, whatever transport carried the document."
+    },
+    "AccountId": {
+      "title": "AccountId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "description": "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist."
+    },
+    "AccountContextId": {
+      "title": "AccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "External Accounts — Secret — Set — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "fingerprint",
+        "setAt"
+      ],
+      "properties": {
+        "fingerprint": {
+          "$ref": "#/$defs/SecretFingerprint"
+        },
+        "setAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "SecretFingerprint": {
+      "title": "SecretFingerprint",
+      "type": "string",
+      "pattern": "^hmacsha256:[A-Za-z0-9_-]{22}$",
+      "maxLength": 33,
+      "description": "Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest."
+    },
+    "SealedTransferBundle": {
+      "title": "SealedTransferBundle",
+      "type": "string",
+      "minLength": 64,
+      "maxLength": 65536,
+      "pattern": "^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$",
+      "description": "A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload or an ExternalCredentialPayload. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \"the response\" from ever holding a usable secret, whatever transport carried the document."
+    },
+    "AccountId": {
+      "title": "AccountId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "description": "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist."
+    },
+    "AccountContextId": {
+      "title": "AccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/external/accounts/setup/0.1/payload.ts

@@ -0,0 +1,355 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/external/accounts/setup/0.1/payload.schema.json
+ */
+
+import type { AccountContextId, AccountId, AccountSetupArtifacts, AuthModel, Ext } from "../../../../_shared/components.js";
+
+
+/**
+ * Generate the provider-side setup for an external account. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface ExternalAccountsSetupPayload {
+  context: AccountContextId;
+  id: AccountId;
+  ext?: Ext;
+}
+export interface ExternalAccountsSetupResponsePayload {
+  setup: AccountSetupArtifacts;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AccountContextId, AccountId, AccountSetupArtifacts, AuthModel, Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/external/accounts/setup/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ExternalAccountsSetupPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/external/accounts/setup/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ExternalAccountsSetupResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/external/accounts/setup/0.1",
+  "title": "External Accounts — Setup — payload",
+  "description": "Generate the provider-side setup for an external account. The outer document members are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "context",
+    "id"
+  ],
+  "properties": {
+    "context": {
+      "$ref": "#/$defs/AccountContextId"
+    },
+    "id": {
+      "$ref": "#/$defs/AccountId"
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "External Accounts — Setup — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "setup"
+      ],
+      "properties": {
+        "setup": {
+          "$ref": "#/$defs/AccountSetupArtifacts"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "AccountSetupArtifacts": {
+      "title": "AccountSetupArtifacts",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "model",
+        "artifacts",
+        "steps"
+      ],
+      "description": "What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.",
+      "properties": {
+        "model": {
+          "$ref": "#/$defs/AuthModel"
+        },
+        "artifacts": {
+          "type": "array",
+          "maxItems": 16,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "name",
+              "mediaType",
+              "content"
+            ],
+            "properties": {
+              "name": {
+                "type": "string",
+                "maxLength": 128,
+                "pattern": "^[A-Za-z0-9._-]+$",
+                "description": "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`."
+              },
+              "mediaType": {
+                "type": "string",
+                "maxLength": 128,
+                "pattern": "^[a-z]+/[a-z0-9.+-]+$"
+              },
+              "content": {
+                "type": "string",
+                "maxLength": 65536
+              }
+            }
+          }
+        },
+        "steps": {
+          "type": "array",
+          "maxItems": 32,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "description"
+            ],
+            "properties": {
+              "description": {
+                "type": "string",
+                "maxLength": 1024
+              },
+              "command": {
+                "type": "string",
+                "maxLength": 8192,
+                "description": "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`."
+              }
+            }
+          }
+        }
+      }
+    },
+    "AuthModel": {
+      "title": "AuthModel",
+      "type": "string",
+      "enum": [
+        "aws-roles-anywhere",
+        "gcp-wif-pinned",
+        "azure-cert",
+        "oauth2-private-key-jwt",
+        "s3-static-presign",
+        "sui-signer",
+        "static-secret"
+      ],
+      "description": "How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\n\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role."
+    },
+    "AccountId": {
+      "title": "AccountId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "description": "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist."
+    },
+    "AccountContextId": {
+      "title": "AccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "External Accounts — Setup — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "setup"
+      ],
+      "properties": {
+        "setup": {
+          "$ref": "#/$defs/AccountSetupArtifacts"
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "AccountSetupArtifacts": {
+      "title": "AccountSetupArtifacts",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "model",
+        "artifacts",
+        "steps"
+      ],
+      "description": "What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.",
+      "properties": {
+        "model": {
+          "$ref": "#/$defs/AuthModel"
+        },
+        "artifacts": {
+          "type": "array",
+          "maxItems": 16,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "name",
+              "mediaType",
+              "content"
+            ],
+            "properties": {
+              "name": {
+                "type": "string",
+                "maxLength": 128,
+                "pattern": "^[A-Za-z0-9._-]+$",
+                "description": "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`."
+              },
+              "mediaType": {
+                "type": "string",
+                "maxLength": 128,
+                "pattern": "^[a-z]+/[a-z0-9.+-]+$"
+              },
+              "content": {
+                "type": "string",
+                "maxLength": 65536
+              }
+            }
+          }
+        },
+        "steps": {
+          "type": "array",
+          "maxItems": 32,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "description"
+            ],
+            "properties": {
+              "description": {
+                "type": "string",
+                "maxLength": 1024
+              },
+              "command": {
+                "type": "string",
+                "maxLength": 8192,
+                "description": "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`."
+              }
+            }
+          }
+        }
+      }
+    },
+    "AuthModel": {
+      "title": "AuthModel",
+      "type": "string",
+      "enum": [
+        "aws-roles-anywhere",
+        "gcp-wif-pinned",
+        "azure-cert",
+        "oauth2-private-key-jwt",
+        "s3-static-presign",
+        "sui-signer",
+        "static-secret"
+      ],
+      "description": "How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\n\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role."
+    },
+    "AccountId": {
+      "title": "AccountId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "description": "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist."
+    },
+    "AccountContextId": {
+      "title": "AccountContextId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: false,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: false,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;