@openvtc/trust-tasks 0.28.22 → 0.28.24

package/src/messaging/mux/detach/0.1/payload.ts

@@ -0,0 +1,278 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/messaging/mux/detach/0.1/payload.schema.json
+ */
+
+import type { Ext, MuxDid } from "../../../../_shared/components.js";
+
+
+/**
+ * A principal removes session attaches from the connection that carries the request. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface MessagingMuxDetachPayload {
+  /**
+   * The member DIDs whose session attaches on this connection are removed. A DID appears at most once.
+   *
+   * @minItems 1
+   * @maxItems 256
+   */
+  dids: [MuxDid, ...MuxDid[]];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * The success response to a messaging/mux/detach request: every requested DID appears in `detached` or `notAttached`. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/detach/0.1#response.
+ */
+export interface MessagingMuxDetachResponsePayload {
+  /**
+   * DIDs whose session attach was removed. Each has left the connection, unless it is also listed in `retainedByGrant`.
+   *
+   * @maxItems 256
+   */
+  detached: MuxDid[];
+  /**
+   * DIDs that are also members through a stored grant: their session attach was removed, and they stay on the connection under the grant's scope. Revoke the grant with messaging/mux/revoke to remove them.
+   *
+   * @maxItems 256
+   */
+  retainedByGrant: MuxDid[];
+  /**
+   * DIDs that had no session attach on this connection. Nothing changed for them.
+   *
+   * @maxItems 256
+   */
+  notAttached: MuxDid[];
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, MuxDid };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/messaging/mux/detach/0.1" as const;
+
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = MessagingMuxDetachPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/messaging/mux/detach/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = MessagingMuxDetachResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/messaging/mux/detach/0.1",
+  "title": "Messaging — Mux Detach — payload",
+  "description": "A principal removes session attaches from the connection that carries the request. The outer document members are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "dids"
+  ],
+  "properties": {
+    "dids": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 256,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/MuxDid"
+      },
+      "description": "The member DIDs whose session attaches on this connection are removed. A DID appears at most once."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Messaging — Mux Detach — response payload",
+      "description": "The success response to a messaging/mux/detach request: every requested DID appears in `detached` or `notAttached`. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/detach/0.1#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "detached",
+        "retainedByGrant",
+        "notAttached"
+      ],
+      "properties": {
+        "detached": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/MuxDid"
+          },
+          "description": "DIDs whose session attach was removed. Each has left the connection, unless it is also listed in `retainedByGrant`."
+        },
+        "retainedByGrant": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/MuxDid"
+          },
+          "description": "DIDs that are also members through a stored grant: their session attach was removed, and they stay on the connection under the grant's scope. Revoke the grant with messaging/mux/revoke to remove them."
+        },
+        "notAttached": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/MuxDid"
+          },
+          "description": "DIDs that had no session attach on this connection. Nothing changed for them."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "MuxDid": {
+      "title": "MuxDid",
+      "type": "string",
+      "minLength": 7,
+      "maxLength": 2048,
+      "pattern": "^did:[a-z0-9]+:\\S+$",
+      "description": "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself."
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Messaging — Mux Detach — response payload",
+      "description": "The success response to a messaging/mux/detach request: every requested DID appears in `detached` or `notAttached`. Carried in a Trust Task document whose type is https://trusttasks.org/spec/messaging/mux/detach/0.1#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "detached",
+        "retainedByGrant",
+        "notAttached"
+      ],
+      "properties": {
+        "detached": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/MuxDid"
+          },
+          "description": "DIDs whose session attach was removed. Each has left the connection, unless it is also listed in `retainedByGrant`."
+        },
+        "retainedByGrant": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/MuxDid"
+          },
+          "description": "DIDs that are also members through a stored grant: their session attach was removed, and they stay on the connection under the grant's scope. Revoke the grant with messaging/mux/revoke to remove them."
+        },
+        "notAttached": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/MuxDid"
+          },
+          "description": "DIDs that had no session attach on this connection. Nothing changed for them."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "MuxDid": {
+      "title": "MuxDid",
+      "type": "string",
+      "minLength": 7,
+      "maxLength": 2048,
+      "pattern": "^did:[a-z0-9]+:\\S+$",
+      "description": "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;

package/src/messaging/mux/event/0.1/payload.ts

@@ -0,0 +1,371 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/messaging/mux/event/0.1/payload.schema.json
+ */
+
+import type { Ext, GrantId, MemberChangeReason, MuxDid, MuxNonce, MuxScope, MuxScopeValue, SessionId_MessagingMuxV0_1 as SessionId } from "../../../../_shared/components.js";
+
+
+/**
+ * A live, unstored event from a mediator to the principal of one mux connection: the connection is ready (with its nonce and limits), members attached or detached, or an inbound frame for a member refused. The members present depend on `event`; see the specification. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface MessagingMuxEventPayload {
+  /**
+   * Which event this is. Each kind carries the members the specification lists for it, and no others.
+   */
+  event: "ready" | "attached" | "detached" | "refused";
+  /**
+   * `ready` only, REQUIRED: this connection's identifier, which attach statements sign over.
+   */
+  sessionId?: SessionId;
+  /**
+   * `ready` only, REQUIRED: this connection's nonce, which attach statements sign over.
+   */
+  muxNonce?: MuxNonce;
+  /**
+   * `ready` only, REQUIRED: the most members this connection may carry.
+   */
+  maxDidsPerConnection?: number;
+  /**
+   * `ready` only, REQUIRED: the longest `exp − iat` a grant may have.
+   */
+  maxGrantLifetimeSeconds?: number;
+  /**
+   * `ready` only, OPTIONAL: the longest an attach statement's `exp` may lie after its `iat`.
+   */
+  maxAttachLifetimeSeconds?: number;
+  /**
+   * `ready` only, OPTIONAL: when the principal's authentication of this connection expires and the connection closes. An attach statement's `exp` may not be later.
+   */
+  sessionExpiresAt?: string;
+  /**
+   * `ready` only, REQUIRED: how many messaging/mux/notice documents wait in the principal's inbox. Non-zero means the principal must drain them before it trusts its member set.
+   */
+  pendingNotices?: number;
+  /**
+   * `attached` and `detached` only, REQUIRED: the members that changed, batched. A larger change is split across several events.
+   *
+   * @minItems 1
+   * @maxItems 1000
+   */
+  dids?: [MemberChange, ...MemberChange[]];
+  /**
+   * `refused` only, REQUIRED: the lowercase hex SHA-256 of the refused frame's exact bytes — the identifier `tsp-ack` already uses.
+   */
+  frameId?: string;
+  /**
+   * `refused` only, OPTIONAL: the frame's sender, when the mediator could read it.
+   */
+  sender?: MuxDid;
+  /**
+   * `refused` only, OPTIONAL: the member DID or principal the frame was addressed to, when the mediator could read it.
+   */
+  receiver?: MuxDid;
+  /**
+   * `refused` only, REQUIRED: the mediator's stable refusal code, the same code a traffic-monitor `refused` event reports.
+   */
+  code?: string;
+  /**
+   * `refused` only, OPTIONAL: a short human-readable explanation. Never message content.
+   */
+  reason?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * One member's change in an `attached` or `detached` event.
+ */
+export interface MemberChange {
+  /**
+   * The member DID.
+   */
+  did: MuxDid;
+  /**
+   * Why the member changed: an AttachReason value in an `attached` event, a DetachReason value in a `detached` event.
+   */
+  reason: MemberChangeReason;
+  /**
+   * The grant concerned, where the member is or was attached through one.
+   */
+  grantId?: GrantId;
+  /**
+   * `attached` only: the scope now in force for the member.
+   */
+  scope?: MuxScope;
+  /**
+   * `attached` only: when the membership lapses unless renewed.
+   */
+  expiresAt?: string;
+  /**
+   * `attached` only: false while the member DID's own direct connection keeps its live traffic.
+   */
+  deliveryActive?: boolean;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, GrantId, MemberChangeReason, MuxDid, MuxNonce, MuxScope, MuxScopeValue, SessionId };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/messaging/mux/event/0.1" as const;
+
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = MessagingMuxEventPayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/messaging/mux/event/0.1",
+  "title": "Messaging — Mux Event — payload",
+  "description": "A live, unstored event from a mediator to the principal of one mux connection: the connection is ready (with its nonce and limits), members attached or detached, or an inbound frame for a member refused. The members present depend on `event`; see the specification. The outer document members are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "event"
+  ],
+  "properties": {
+    "event": {
+      "type": "string",
+      "enum": [
+        "ready",
+        "attached",
+        "detached",
+        "refused"
+      ],
+      "description": "Which event this is. Each kind carries the members the specification lists for it, and no others."
+    },
+    "sessionId": {
+      "$ref": "#/$defs/SessionId",
+      "description": "`ready` only, REQUIRED: this connection's identifier, which attach statements sign over."
+    },
+    "muxNonce": {
+      "$ref": "#/$defs/MuxNonce",
+      "description": "`ready` only, REQUIRED: this connection's nonce, which attach statements sign over."
+    },
+    "maxDidsPerConnection": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "`ready` only, REQUIRED: the most members this connection may carry."
+    },
+    "maxGrantLifetimeSeconds": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "`ready` only, REQUIRED: the longest `exp − iat` a grant may have."
+    },
+    "maxAttachLifetimeSeconds": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "`ready` only, OPTIONAL: the longest an attach statement's `exp` may lie after its `iat`."
+    },
+    "sessionExpiresAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "`ready` only, OPTIONAL: when the principal's authentication of this connection expires and the connection closes. An attach statement's `exp` may not be later."
+    },
+    "pendingNotices": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "`ready` only, REQUIRED: how many messaging/mux/notice documents wait in the principal's inbox. Non-zero means the principal must drain them before it trusts its member set."
+    },
+    "dids": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 1000,
+      "items": {
+        "$ref": "#/$defs/MemberChange"
+      },
+      "description": "`attached` and `detached` only, REQUIRED: the members that changed, batched. A larger change is split across several events."
+    },
+    "frameId": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "`refused` only, REQUIRED: the lowercase hex SHA-256 of the refused frame's exact bytes — the identifier `tsp-ack` already uses."
+    },
+    "sender": {
+      "$ref": "#/$defs/MuxDid",
+      "description": "`refused` only, OPTIONAL: the frame's sender, when the mediator could read it."
+    },
+    "receiver": {
+      "$ref": "#/$defs/MuxDid",
+      "description": "`refused` only, OPTIONAL: the member DID or principal the frame was addressed to, when the mediator could read it."
+    },
+    "code": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "`refused` only, REQUIRED: the mediator's stable refusal code, the same code a traffic-monitor `refused` event reports."
+    },
+    "reason": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512,
+      "description": "`refused` only, OPTIONAL: a short human-readable explanation. Never message content."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "MemberChange": {
+      "title": "MemberChange",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "did",
+        "reason"
+      ],
+      "description": "One member's change in an `attached` or `detached` event.",
+      "properties": {
+        "did": {
+          "$ref": "#/$defs/MuxDid",
+          "description": "The member DID."
+        },
+        "reason": {
+          "$ref": "#/$defs/MemberChangeReason",
+          "description": "Why the member changed: an AttachReason value in an `attached` event, a DetachReason value in a `detached` event."
+        },
+        "grantId": {
+          "$ref": "#/$defs/GrantId",
+          "description": "The grant concerned, where the member is or was attached through one."
+        },
+        "scope": {
+          "$ref": "#/$defs/MuxScope",
+          "description": "`attached` only: the scope now in force for the member."
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "`attached` only: when the membership lapses unless renewed."
+        },
+        "deliveryActive": {
+          "type": "boolean",
+          "description": "`attached` only: false while the member DID's own direct connection keeps its live traffic."
+        }
+      }
+    },
+    "MuxScope": {
+      "title": "MuxScope",
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 16,
+      "items": {
+        "$ref": "#/$defs/MuxScopeValue"
+      },
+      "description": "A set of capabilities: a non-empty JSON array of MuxScopeValue, compared as a set — order is not significant and a repeated value collapses into one. Never empty: an empty scope is refused, never read as \"all\". There is no default scope anywhere — every attach and every grant names its scope explicitly. A scope is always bounded by the member DID's own access-control capabilities at the mediator."
+    },
+    "MuxScopeValue": {
+      "title": "MuxScopeValue",
+      "type": "string",
+      "enum": [
+        "receive",
+        "pickup",
+        "delete",
+        "send"
+      ],
+      "description": "One capability a member DID extends to a principal's connection. `receive`: live delivery of the member's inbound messages on the connection. `pickup`: message-pickup status and delivery requests naming the member as `recipient_did`, and inclusion in a raw-TSP inbox drain. `delete`: deleting the member's stored messages, including delete-on-ack and delete-on-send; a member without `delete` keeps its messages in its inbox until something holding `delete` collects them. `send`: the mediator accepts on this connection frames whose sender is the member DID — the frame is still signed or authcrypted with the member's own keys; the scope only lets the mediator accept it on this socket."
+    },
+    "GrantId": {
+      "title": "GrantId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^[A-Za-z0-9._:-]+$",
+      "description": "A grant's identifier, chosen by the member DID's signer and carried in its grant statement; a UUID is RECOMMENDED. A mediator refuses a grant whose identifier is already on the member DID's record."
+    },
+    "MemberChangeReason": {
+      "title": "MemberChangeReason",
+      "type": "string",
+      "enum": [
+        "connect",
+        "grant",
+        "attach",
+        "reactivated",
+        "revokedByMember",
+        "revokedByPrincipal",
+        "epochBumped",
+        "suspendedUnknownKey",
+        "keyRotated",
+        "expired",
+        "accountBlocked",
+        "superseded",
+        "admin",
+        "detachRequested",
+        "accountRemoved",
+        "resolutionFailed"
+      ],
+      "description": "The reason carried by one member's change in a messaging/mux/event `attached` or `detached` event: exactly the AttachReason values followed by the DetachReason values, with their meanings. An `attached` event carries only AttachReason values and a `detached` event only DetachReason values. One closed set rather than a union, so every generated binding types it as one enumeration; it MUST be kept equal to the two sets it joins."
+    },
+    "MuxDid": {
+      "title": "MuxDid",
+      "type": "string",
+      "minLength": 7,
+      "maxLength": 2048,
+      "pattern": "^did:[a-z0-9]+:\\S+$",
+      "description": "A DID, carried verbatim and compared by exact string equality. Unlike the messaging family's `Vid`, never a hash: the mediator resolves it to verify a statement signed by it. For a member DID reached over TSP, the TSP VID is the DID itself."
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "MuxNonce": {
+      "title": "MuxNonce",
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]{43}$",
+      "description": "32 random bytes, base64url without padding, that belong to exactly one connection and are never reused. Attach statements sign over it, which is what makes an attach statement unusable on any other connection."
+    },
+    "SessionId": {
+      "title": "SessionId",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "description": "The mediator's identifier for one authenticated connection, as announced in that connection's `ready` event."
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;