@openvtc/trust-tasks 0.27.2 → 0.27.4

package/src/vtc/_shared/0.1/community-room.ts

@@ -14,4 +14,4 @@ export interface VTCSharedCommunityOwnedRoomDefinitions {
  * The definitions this shared schema publishes, hoisted to one declaration each.
  * See "../../../_shared/components.js".
  */
-export type { CommunityRoom, CommunityRoomV2, MemberAction, MemberActions, MemberState, Offer, OfferCredentials, OfferV2, Reason, Renewal, RenewalCredentials, RoomDescription, RoomLabel, RoomMember, RoomMembership, RoomTag, RoomTags } from "../../../_shared/components.js";
+export type { CommunityRoom, CommunityRoomV2_VtcV0_1 as CommunityRoomV2, MemberAction, MemberActions, MemberState, Offer, OfferCredentials, OfferV2, Reason, Renewal, RenewalCredentials, RoomDescription, RoomLabel, RoomMember, RoomMembership, RoomTag, RoomTags } from "../../../_shared/components.js";

package/src/vtc/_shared/0.1/room-storage.ts

@@ -14,4 +14,4 @@ export interface VTCSharedRoomStorageDefinitions {
  * The definitions this shared schema publishes, hoisted to one declaration each.
  * See "../../../_shared/components.js".
  */
-export type { ConfigState, CredentialState_VtcV0_1 as CredentialState, EffectiveLimits, ExternalAccountContextId, ExternalAccountId, GcsSettings, HostedRoom, LimitSource, LimitTarget, LocalSettings, ObjectPrefix, S3Settings, StorageAuth_VtcV0_1 as StorageAuth, StorageConfig_VtcV0_1 as StorageConfig, StorageConfigFacts_VtcV0_1 as StorageConfigFacts, StorageConfigId, StorageHealth, StorageKind, StorageSettings, WalrusSettings } from "../../../_shared/components.js";
+export type { ConfigState, CredentialState_VtcV0_1 as CredentialState, EffectiveLimits, ExternalAccountContextId, ExternalAccountId, GcsSettings, HostedRoom_VtcV0_1 as HostedRoom, LimitSource, LimitTarget, LocalSettings, ObjectPrefix, S3Settings, StorageAuth_VtcV0_1 as StorageAuth, StorageConfig_VtcV0_1 as StorageConfig, StorageConfigFacts_VtcV0_1 as StorageConfigFacts, StorageConfigId, StorageHealth, StorageKind, StorageSettings, WalrusSettings } from "../../../_shared/components.js";

package/src/vtc/_shared/0.3/community-room.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/_shared/0.3/community-room.schema.json
+ */
+
+/**
+ * Shared types for rooms a community owns rather than merely hosts: the vtc/rooms/community/* tasks an administrator runs them with, and the vtc/rooms/offers/* tasks a member collects and accepts an admission with. The community is the room's owner; the community's own VTA holds the room's signing key and, on a sealed tier, the community's place in its MLS group. The community holds no room key and no group secret. What it records here is the owner's own record of whom it admitted — never read when the community serves the room as its host, where authorization is the room's credential chain and nothing else. Version 0.3 changes nothing here but where `HostedRoom` comes from: `room` resolves to vtc/_shared/0.3/room-storage, whose `HostedRoom` instants are RFC 3339 strings; every other referenced definition stays at 0.1. Not itself a Trust Task specification (the `_shared` folder is skipped by the registry build and the codegen).
+ */
+export interface VTCSharedCommunityOwnedRoomDefinitions {
+  [k: string]: unknown | undefined;
+}
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { CommunityRoomV2_VtcV0_3 as CommunityRoomV2, RoomDescription, RoomLabel, RoomTag, RoomTags } from "../../../_shared/components.js";

package/src/vtc/_shared/0.3/room-storage.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/_shared/0.3/room-storage.schema.json
+ */
+
+/**
+ * Shared types for the host-side administration of files in the data rooms a community hosts: the vtc/storage/configs/*, vtc/storage/credentials/set, vtc/rooms/get, vtc/rooms/limits/set, vtc/rooms/usage and vtc/rooms/storage/* tasks. A storage config is one named backend — a local directory, an S3-compatible bucket, a Google Cloud Storage bucket or Walrus — with its own account and credentials. Every room is assigned to exactly one config, which receives its new uploads; one config serves any number of rooms; every blob remembers the config it was written to, so reassigning a room strands nothing. Limits, usage and blob shapes come from rooms/_shared/0.1/blobs.schema.json. No member of any type here carries a secret: a credential is referred to by mode, account and fingerprint, never by value. Version 0.2 adds `roleArn` to `ambient` authentication (the IAM role an S3 config's ambient identity assumes), the `notAllowed` credential status for a mode the host no longer permits, and `SealedStorageCredential`, the cleartext a `sealed` credential is carried in; the rules for using an `ambient` or `sealed` credential are vtc/storage/configs/create/0.2's. Version 0.3 changes only `HostedRoom`: its instants `epochExpiresAt`, `createdAt` and `updatedAt` are RFC 3339 date-time strings rather than integer seconds, under the registry-wide convention that an instant is a string named `*At`. Not itself a Trust Task specification (the `_shared` folder is skipped by the registry build and the codegen).
+ */
+export interface VTCSharedRoomStorageDefinitions {
+  [k: string]: unknown | undefined;
+}
+
+/**
+ * The definitions this shared schema publishes, hoisted to one declaration each.
+ * See "../../../_shared/components.js".
+ */
+export type { HostedRoom_VtcV0_3 as HostedRoom } from "../../../_shared/components.js";

package/src/vtc/admin/events/subscribe/0.5/payload.ts

@@ -0,0 +1,318 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/admin/events/subscribe/0.5/payload.schema.json
+ */
+
+import type { Ext, ResumeToken, Topic_VtcAdminEventsV0_4 as Topic } from "../../../../../_shared/components.js";
+
+
+/**
+ * Open an administrator console's live channel of hint-only events. The success response is the first document on a stream that then carries vtc/admin/events/event/0.4 documents; over HTTPS that stream is the streamed response of bindings/https/0.3 §2.1. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface VTCAdminEventsSubscribePayload {
+  /**
+   * The topics the console renders. The community narrows this to the topics the caller may read and reports the result as the response's `topics`.
+   *
+   * @minItems 1
+   * @maxItems 10
+   */
+  topics:
+    | [Topic]
+    | [Topic, Topic]
+    | [Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic, Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic, Topic, Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic, Topic, Topic, Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic, Topic, Topic, Topic, Topic, Topic, Topic];
+  /**
+   * The last `resumeToken` the console received on an earlier stream, to resume from (named `since` before 0.5). A token the community does not recognise, has expired, or minted for another caller is not an error: the stream starts fresh and the response says `resumed: false`.
+   */
+  resumeToken?: ResumeToken;
+  ext?: Ext;
+}
+/**
+ * The subscription as granted, sent as the first document on the stream. Failures use trust-task-error and open no stream.
+ */
+export interface VTCAdminEventsSubscribeResponsePayload {
+  /**
+   * The effective topics: those requested that the caller may read. The community sends events for these and no others. A requested topic missing here is one the caller may not read, and the console MUST NOT present it as live.
+   *
+   * @minItems 1
+   * @maxItems 10
+   */
+  topics:
+    | [Topic]
+    | [Topic, Topic]
+    | [Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic, Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic, Topic, Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic, Topic, Topic, Topic, Topic, Topic]
+    | [Topic, Topic, Topic, Topic, Topic, Topic, Topic, Topic, Topic, Topic];
+  /**
+   * The longest the community lets the stream go without sending anything. Over HTTPS the heartbeat is an SSE comment. A console that receives nothing for twice this interval MUST treat the stream as dead.
+   */
+  heartbeatSeconds: number;
+  /**
+   * `true` when the community recognised the request's `resumeToken` and will send a hint for every effective topic that changed after it. `false` when no `resumeToken` was given or it could not be honoured; the console MUST then re-fetch every effective topic, because it may have missed changes.
+   */
+  resumed: boolean;
+  /**
+   * The stream position as of this response, so that a console that disconnects before its first event still has a token to resume from.
+   */
+  resumeToken: ResumeToken;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, ResumeToken, Topic };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/admin/events/subscribe/0.5" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCAdminEventsSubscribePayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/admin/events/subscribe/0.5#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCAdminEventsSubscribeResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vtc/admin/events/subscribe/0.5",
+  "title": "VTC Admin Events — Subscribe — payload",
+  "description": "Open an administrator console's live channel of hint-only events. The success response is the first document on a stream that then carries vtc/admin/events/event/0.4 documents; over HTTPS that stream is the streamed response of bindings/https/0.3 §2.1. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "topics"
+  ],
+  "properties": {
+    "topics": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 10,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/Topic"
+      },
+      "description": "The topics the console renders. The community narrows this to the topics the caller may read and reports the result as the response's `topics`."
+    },
+    "resumeToken": {
+      "$ref": "#/$defs/ResumeToken",
+      "description": "The last `resumeToken` the console received on an earlier stream, to resume from (named `since` before 0.5). A token the community does not recognise, has expired, or minted for another caller is not an error: the stream starts fresh and the response says `resumed: false`."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Admin Events — Subscribe — response payload",
+      "description": "The subscription as granted, sent as the first document on the stream. Failures use trust-task-error and open no stream.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "topics",
+        "heartbeatSeconds",
+        "resumed",
+        "resumeToken"
+      ],
+      "properties": {
+        "topics": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 10,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/Topic"
+          },
+          "description": "The effective topics: those requested that the caller may read. The community sends events for these and no others. A requested topic missing here is one the caller may not read, and the console MUST NOT present it as live."
+        },
+        "heartbeatSeconds": {
+          "type": "integer",
+          "minimum": 5,
+          "maximum": 60,
+          "description": "The longest the community lets the stream go without sending anything. Over HTTPS the heartbeat is an SSE comment. A console that receives nothing for twice this interval MUST treat the stream as dead."
+        },
+        "resumed": {
+          "type": "boolean",
+          "description": "`true` when the community recognised the request's `resumeToken` and will send a hint for every effective topic that changed after it. `false` when no `resumeToken` was given or it could not be honoured; the console MUST then re-fetch every effective topic, because it may have missed changes."
+        },
+        "resumeToken": {
+          "$ref": "#/$defs/ResumeToken",
+          "description": "The stream position as of this response, so that a console that disconnects before its first event still has a token to resume from."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "ResumeToken": {
+      "title": "ResumeToken",
+      "description": "Opaque, community-minted position in one caller's event stream. A console MUST NOT parse, construct or order it; it only hands the latest one back as `since` when it re-subscribes. A community binds it to the caller it was minted for and treats a token minted for anyone else as unknown.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "pattern": "^[A-Za-z0-9._~-]+$"
+    },
+    "Topic": {
+      "title": "Topic",
+      "description": "One kind of change a console can be told about. A closed set: a topic not listed here is a new MINOR version of this component, not an `ext` member, because each topic is bound to the read that authorizes it.",
+      "type": "string",
+      "enum": [
+        "actions",
+        "acknowledgements",
+        "joinRequests",
+        "members",
+        "singleAdminMode",
+        "config",
+        "rooms",
+        "directory",
+        "groups",
+        "communityRooms"
+      ]
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Admin Events — Subscribe — response payload",
+      "description": "The subscription as granted, sent as the first document on the stream. Failures use trust-task-error and open no stream.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "topics",
+        "heartbeatSeconds",
+        "resumed",
+        "resumeToken"
+      ],
+      "properties": {
+        "topics": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 10,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/Topic"
+          },
+          "description": "The effective topics: those requested that the caller may read. The community sends events for these and no others. A requested topic missing here is one the caller may not read, and the console MUST NOT present it as live."
+        },
+        "heartbeatSeconds": {
+          "type": "integer",
+          "minimum": 5,
+          "maximum": 60,
+          "description": "The longest the community lets the stream go without sending anything. Over HTTPS the heartbeat is an SSE comment. A console that receives nothing for twice this interval MUST treat the stream as dead."
+        },
+        "resumed": {
+          "type": "boolean",
+          "description": "`true` when the community recognised the request's `resumeToken` and will send a hint for every effective topic that changed after it. `false` when no `resumeToken` was given or it could not be honoured; the console MUST then re-fetch every effective topic, because it may have missed changes."
+        },
+        "resumeToken": {
+          "$ref": "#/$defs/ResumeToken",
+          "description": "The stream position as of this response, so that a console that disconnects before its first event still has a token to resume from."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "ResumeToken": {
+      "title": "ResumeToken",
+      "description": "Opaque, community-minted position in one caller's event stream. A console MUST NOT parse, construct or order it; it only hands the latest one back as `since` when it re-subscribes. A community binds it to the caller it was minted for and treats a token minted for anyone else as unknown.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "pattern": "^[A-Za-z0-9._~-]+$"
+    },
+    "Topic": {
+      "title": "Topic",
+      "description": "One kind of change a console can be told about. A closed set: a topic not listed here is a new MINOR version of this component, not an `ext` member, because each topic is bound to the read that authorizes it.",
+      "type": "string",
+      "enum": [
+        "actions",
+        "acknowledgements",
+        "joinRequests",
+        "members",
+        "singleAdminMode",
+        "config",
+        "rooms",
+        "directory",
+        "groups",
+        "communityRooms"
+      ]
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/vtc/auth/admin-session/0.2/payload.ts

@@ -0,0 +1,180 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/auth/admin-session/0.2/payload.schema.json
+ */
+
+import type { Ext } from "../../../../_shared/components.js";
+
+
+export interface VTCAuthAdminSessionPayload {
+  /**
+   * A currently-valid bearer access token issued by this community.
+   */
+  accessToken: string;
+  ext?: Ext;
+}
+export interface VTCAuthAdminSessionResponsePayload {
+  /**
+   * The cookie-backed session's identifier.
+   */
+  sessionId: string;
+  /**
+   * Session expiry, as an RFC 3339 date-time. Matches the presented token's — the exchange does not extend a session.
+   */
+  expiresAt: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/auth/admin-session/0.2" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCAuthAdminSessionPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/auth/admin-session/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCAuthAdminSessionResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vtc/auth/admin-session/0.2",
+  "title": "VTC Auth Admin Session — payload",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "accessToken"
+  ],
+  "properties": {
+    "accessToken": {
+      "type": "string",
+      "minLength": 1,
+      "description": "A currently-valid bearer access token issued by this community."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Auth Admin Session — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "sessionId",
+        "expiresAt"
+      ],
+      "properties": {
+        "sessionId": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The cookie-backed session's identifier."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "Session expiry, as an RFC 3339 date-time. Matches the presented token's — the exchange does not extend a session."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Auth Admin Session — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "sessionId",
+        "expiresAt"
+      ],
+      "properties": {
+        "sessionId": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The cookie-backed session's identifier."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "Session expiry, as an RFC 3339 date-time. Matches the presented token's — the exchange does not extend a session."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;