@xema/omni-protocol 0.1.77 → 0.1.79

package/dist/validation.js

@@ -47,6 +47,7 @@ const ACCEPTANCE_MODES = membersOf({
 });
 const TRANSPORT_STATUSES = membersOf({ connecting: true, active: true, error: true });
 const AUTHENTICATION_METHODS = membersOf({ "browser-sso": true, credentials: true });
+const AUTHENTICATION_BROWSERS = membersOf({ system: true, omni: true });
 const AUTHENTICATION_STATUSES = membersOf({
     "signed-out": true, authenticating: true, authenticated: true, refreshing: true, expired: true,
 });
@@ -54,7 +55,7 @@ const BREAK_APPROVALS = membersOf({
     "not-requested": true, "awaiting-decision": true, granted: true, "starting-after-task": true, "in-effect": true,
 });
 const TEAM_AVAILABILITIES = membersOf({
-    ready: true, "on-task": true, "on-break": true, "signed-out": true,
+    ready: true, "on-task": true, "on-break": true, reserved: true, "signed-out": true,
 });
 const HANDLING_STEPS = membersOf({
     queued: true, offered: true, answered: true, held: true, muted: true, transferred: true, conferenced: true, unanswered: true,
@@ -82,7 +83,7 @@ const MEMBER_BREAKS = membersOf({
     "awaiting-decision": true, granted: true, "starting-after-task": true,
 });
 const OFFERABLE_PHASES = membersOf({
-    pending: true, confirmed: true, preview: true,
+    pending: true,
 });
 const PREVIEW_DEADLINES = membersOf({ calls: true, expires: true });
 const PHONES = membersOf({ softphone: true, deskPhone: true });
@@ -117,6 +118,16 @@ const isChannel = (value) => CHANNELS.includes(value);
 // ---------------------------------------------------------------------------
 const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const isFilled = (value) => typeof value === "string" && value.trim().length > 0;
+/** Error text must not invoke conversion methods supplied by an untrusted object or array. */
+function describeValue(value) {
+    if (value === null)
+        return "null";
+    if (typeof value === "object")
+        return Array.isArray(value) ? "an array" : "an object";
+    if (typeof value === "function")
+        return "a function";
+    return String(value);
+}
 /**
  * An RFC-3339 timestamp carrying a zone.
  *
@@ -124,9 +135,22 @@ const isFilled = (value) => typeof value === "string" && value.trim().length > 0
  * happens to be in, so two hosts would read the same wire value as two different instants. The
  * contract calls those invalid, and this is where that is enforced rather than assumed.
  */
-const isIsoTimestamp = (value) => typeof value === "string"
-    && /^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/.test(value)
-    && !Number.isNaN(Date.parse(value));
+const isIsoTimestamp = (value) => {
+    if (typeof value !== "string")
+        return false;
+    const match = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):\d{2}:\d{2}(?:\.\d+)?(?:[Zz]|[+-]\d{2}:\d{2})$/.exec(value);
+    if (match === null)
+        return false;
+    const year = Number(match[1]);
+    const month = Number(match[2]);
+    const day = Number(match[3]);
+    // RFC 3339 sections 5.6–5.7: days depend on the month/year and hours are 00–23.
+    // Date.parse alone normalizes February 30 and 24:00 into different instants.
+    const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    const daysInMonth = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][month - 1];
+    return daysInMonth !== undefined && day >= 1 && day <= daysInMonth
+        && Number(match[4]) < 24 && !Number.isNaN(Date.parse(value));
+};
 /** A non-negative integer count of seconds. */
 const isDurationSeconds = (value) => typeof value === "number" && Number.isInteger(value) && value >= 0;
 /** Opaque, non-empty, provider-issued. Never parsed and never compared across providers. */
@@ -168,7 +192,7 @@ class Collector {
         return this.require(isIsoTimestamp(value), rule, path, "must be an RFC-3339 timestamp carrying a zone, such as 2026-08-21T09:00:00Z");
     }
     oneOf(value, allowed, rule, path) {
-        return this.require(typeof value === "string" && allowed.includes(value), rule, path, `must be one of ${allowed.join(", ")}; received ${String(value)}`);
+        return this.require(typeof value === "string" && allowed.includes(value), rule, path, `must be one of ${allowed.join(", ")}; received ${describeValue(value)}`);
     }
 }
 // ---------------------------------------------------------------------------
@@ -279,9 +303,8 @@ function validateIdleCapabilities(value, channel, path, into) {
         }
         else {
             validateBrowserAccess(browser.access, `${path}.personalBrowser.access`, into);
-            if (browser.accessAppliesTo !== undefined) {
-                into.oneOf(browser.accessAppliesTo, ACCESS_APPLIES_TO, "manifest.personalBrowser.accessAppliesTo", `${path}.personalBrowser.accessAppliesTo`);
-            }
+            // Stated, never defaulted: an absent value read as all-navigation was a second spelling of one fact.
+            into.oneOf(browser.accessAppliesTo, ACCESS_APPLIES_TO, "manifest.personalBrowser.accessAppliesTo", `${path}.personalBrowser.accessAppliesTo`);
         }
     }
     if (value.dial !== undefined) {
@@ -310,7 +333,7 @@ function validateDialOutcomes(manifest, path, into) {
         into.require(!dials, "manifest.dialOutcomes.required", path, "a manifest that declares dial says how a dial ends: dialOutcomes with answered and at least one way of not reaching");
         return;
     }
-    if (!into.require(manifest.channel === "voice", "manifest.dialOutcomes.channel", path, `a ${String(manifest.channel)} provider dials nothing and declares no dial outcomes`))
+    if (!into.require(manifest.channel === "voice", "manifest.dialOutcomes.channel", path, `a ${describeValue(manifest.channel)} provider dials nothing and declares no dial outcomes`))
         return;
     if (!Array.isArray(declared) || declared.length === 0) {
         into.add("manifest.dialOutcomes.shape", path, "dialOutcomes is a non-empty array of the outcomes the platform distinguishes");
@@ -318,7 +341,7 @@ function validateDialOutcomes(manifest, path, into) {
     }
     declared.forEach((outcome, index) => {
         if (into.oneOf(outcome, DIAL_OUTCOMES, "manifest.dialOutcome", `${path}[${index}]`) && declared.indexOf(outcome) !== index) {
-            into.add("manifest.dialOutcome.unique", `${path}[${index}]`, `duplicate dial outcome: ${String(outcome)}`);
+            into.add("manifest.dialOutcome.unique", `${path}[${index}]`, `duplicate dial outcome: ${describeValue(outcome)}`);
         }
     });
     into.require(declared.includes("answered"), "manifest.dialOutcomes.answered", path, "a dial that reached its destination is stated, never inferred: dialOutcomes includes answered");
@@ -336,7 +359,7 @@ function validateDialOutcomes(manifest, path, into) {
 function validatePhones(manifest, path, into) {
     const declared = manifest.phones;
     if (manifest.channel !== "voice") {
-        into.require(declared === undefined, "manifest.phones.channel", path, `a ${String(manifest.channel)} provider has no call to hear and declares no phones`);
+        into.require(declared === undefined, "manifest.phones.channel", path, `a ${describeValue(manifest.channel)} provider has no call to hear and declares no phones`);
         return;
     }
     if (!Array.isArray(declared) || declared.length === 0) {
@@ -345,7 +368,7 @@ function validatePhones(manifest, path, into) {
     }
     declared.forEach((phone, index) => {
         if (into.oneOf(phone, PHONES, "manifest.phone", `${path}[${index}]`) && declared.indexOf(phone) !== index) {
-            into.add("manifest.phone.unique", `${path}[${index}]`, `duplicate phone: ${String(phone)}`);
+            into.add("manifest.phone.unique", `${path}[${index}]`, `duplicate phone: ${describeValue(phone)}`);
         }
     });
 }
@@ -358,13 +381,13 @@ export function validatePhone(value, manifest, path = "context.phone") {
     const channel = isPlainObject(manifest) ? manifest.channel : undefined;
     const phones = isPlainObject(manifest) && Array.isArray(manifest.phones) ? manifest.phones : [];
     if (channel !== "voice") {
-        into.require(value === undefined, "context.phone.unexpected", path, `a ${String(channel)} login has no call to hear and chooses no phone`);
+        into.require(value === undefined, "context.phone.unexpected", path, `a ${describeValue(channel)} login has no call to hear and chooses no phone`);
         return into.violations;
     }
     if (!into.require(value !== undefined, "context.phone.required", path, "a voice login says how the agent hears the call: one of the manifest's phones"))
         return into.violations;
     if (into.oneOf(value, PHONES, "context.phone", path)) {
-        into.require(phones.includes(value), "context.phone.unsupported", path, `the host chose ${String(value)} and the manifest lists ${phones.length === 0 ? "no phones" : phones.join(", ")}`);
+        into.require(phones.includes(value), "context.phone.unsupported", path, `the host chose ${describeValue(value)} and the manifest lists ${phones.length === 0 ? "no phones" : phones.map(describeValue).join(", ")}`);
     }
     return into.violations;
 }
@@ -401,7 +424,7 @@ export function validateManifest(manifest, path = "manifest") {
     else {
         methods.forEach((method, index) => {
             if (into.oneOf(method, AUTHENTICATION_METHODS, "manifest.authenticationMethod", `${path}.authenticationMethods[${index}]`) && methods.indexOf(method) !== index) {
-                into.add("manifest.authenticationMethod.unique", `${path}.authenticationMethods[${index}]`, `duplicate authentication method: ${String(method)}`);
+                into.add("manifest.authenticationMethod.unique", `${path}.authenticationMethods[${index}]`, `duplicate authentication method: ${describeValue(method)}`);
             }
         });
     }
@@ -568,8 +591,7 @@ function validateCustomCapabilities(value, path, into) {
         into.oneOf(custom.ui.control, CUSTOM_UI_CONTROLS, "task.custom.ui.control", `${at}.ui.control`);
         into.filled(custom.ui.label, "task.custom.ui.label", `${at}.ui.label`, "a custom control needs a label");
         into.oneOf(custom.ui.placement, CUSTOM_UI_PLACEMENTS, "task.custom.ui.placement", `${at}.ui.placement`);
-        if (custom.ui.render !== undefined)
-            into.oneOf(custom.ui.render, CUSTOM_RENDERS, "task.custom.ui.render", `${at}.ui.render`);
+        into.oneOf(custom.ui.render, CUSTOM_RENDERS, "task.custom.ui.render", `${at}.ui.render`);
         if (custom.prompt !== undefined) {
             if (!isPlainObject(custom.prompt) || !Array.isArray(custom.prompt.fields)) {
                 into.add("task.custom.prompt.shape", `${at}.prompt`, "a prompt is an object with the fields the agent fills");
@@ -585,6 +607,10 @@ function validateCustomCapabilities(value, path, into) {
                     into.filled(field.name, "task.custom.prompt.field.name", `${where}.name`, "a prompt field needs a name");
                     into.filled(field.label, "task.custom.prompt.field.label", `${where}.label`, "a prompt field needs a label");
                     into.oneOf(field.type, CREDENTIAL_FIELD_TYPES, "task.custom.prompt.field.type", `${where}.type`);
+                    if (field.required !== undefined)
+                        into.require(typeof field.required === "boolean", "task.custom.prompt.field.required", `${where}.required`, "required must be a boolean when present");
+                    if (field.autocomplete !== undefined)
+                        into.require(typeof field.autocomplete === "string", "task.custom.prompt.field.autocomplete", `${where}.autocomplete`, "autocomplete must be a string when present");
                 });
             }
         }
@@ -651,7 +677,7 @@ function validateLockedByInto(value, rule, path, levels, into) {
     if (!into.filled(value, rule, path, "lockedBy names the level that locked it"))
         return;
     into.require(value !== "person", `${rule}.person`, path, "a person never locks their own value");
-    into.require(levelIds(levels).includes(value), `${rule}.unknown`, path, `${String(value)} is not a level this manifest declares: in force are ${levelIds(levels).join(", ")}`);
+    into.require(levelIds(levels).includes(value), `${rule}.unknown`, path, `${describeValue(value)} is not a level this manifest declares: in force are ${levelIds(levels).join(", ")}`);
 }
 /** `{ lockedBy, reason? }` standing in for a value: who locked it, and a reason if given. */
 function validateLockedInto(value, rule, path, levels, into) {
@@ -661,8 +687,8 @@ function validateLockedInto(value, rule, path, levels, into) {
 }
 /** What every resolved value carries: who set it, and who locked it if anyone. */
 function validateResolvedInto(value, rule, path, levels, into) {
-    if (into.filled(value.setBy, `${rule}.setBy`, `${path}.setBy`, "setBy names who stated the value: a level, or provisioning")) {
-        into.require(value.setBy === "provider" || levelIds(levels).includes(value.setBy), `${rule}.setBy.unknown`, `${path}.setBy`, `${String(value.setBy)} is neither provisioning nor a level this manifest declares`);
+    if (into.filled(value.setBy, `${rule}.setBy`, `${path}.setBy`, "setBy names who stated the value: a level, or provider")) {
+        into.require(value.setBy === "provider" || levelIds(levels).includes(value.setBy), `${rule}.setBy.unknown`, `${path}.setBy`, `${describeValue(value.setBy)} is neither provider nor a level this manifest declares`);
     }
     if (value.lockedBy !== undefined)
         validateLockedByInto(value.lockedBy, `${rule}.lockedBy`, `${path}.lockedBy`, levels, into);
@@ -773,7 +799,7 @@ function validateTaskAttributes(value, path, into, levels) {
                 into.timestamp(attribute.at, "task.attribute.timestamp", `${at}.at`);
                 break;
             default:
-                into.add("task.attribute.type", `${at}.type`, `unsupported attribute type: ${String(attribute.type)}`);
+                into.add("task.attribute.type", `${at}.type`, `unsupported attribute type: ${describeValue(attribute.type)}`);
         }
     });
 }
@@ -824,7 +850,7 @@ function validateHandlingHistory(value, path, into, task = {}) {
             // the task is paused, and a mute only while its media is up. An open entry after that is a leg
             // nobody closed, which reads exactly like a leg running now.
             if (entry.step === "held") {
-                into.require(task.phase === "paused", "task.handlingHistory.held.open", `${at}.seconds`, `a held entry without seconds is a hold still running, and the task is ${String(task.phase)}: the hold has ended, and its duration is stated`);
+                into.require(task.phase === "paused", "task.handlingHistory.held.open", `${at}.seconds`, `a held entry without seconds is a hold still running, and the task is ${describeValue(task.phase)}: the hold has ended, and its duration is stated`);
             }
             if (entry.step === "muted") {
                 into.require(task.media !== "ended" && task.phase !== "completing", "task.handlingHistory.muted.open", `${at}.seconds`, "a muted entry without seconds is a mute still running, and the call is over: the provider closes every open leg at the instant the media ends, and the duration is stated");
@@ -851,7 +877,7 @@ function validateHandlingHistory(value, path, into, task = {}) {
             if (entry[field] === undefined)
                 continue;
             if (into.filled(entry[field], `task.handlingHistory.${field}`, `${at}.${field}`, `${field} must not be empty when present`)) {
-                into.require(dialled, `task.handlingHistory.${field}.unexpected`, `${at}.${field}`, `${String(entry.step)} dialled nothing; ${field} belongs on transferred, conferenced, or unanswered`);
+                into.require(dialled, `task.handlingHistory.${field}.unexpected`, `${at}.${field}`, `${describeValue(entry.step)} dialled nothing; ${field} belongs on transferred, conferenced, or unanswered`);
             }
         }
     });
@@ -859,7 +885,11 @@ function validateHandlingHistory(value, path, into, task = {}) {
 /** Present only while consulting, and only on voice: elsewhere there is nobody to consult. */
 const TASK_MEDIA_STATES = membersOf({ started: true, ended: true });
 /** Real-time media is a voice affair, and its state is one of two words. */
-function validateTaskMedia(value, channel, phase, path, into) {
+/** Whether a host dial is ringing the party: the party entry carries `stage: "ringing"` and the host's `dialId`. */
+function partyRingingByHost(task) {
+    return Array.isArray(task.onCall) && task.onCall.some(entry => isPlainObject(entry) && entry.role === "party" && entry.stage === "ringing" && typeof entry.dialId === "string");
+}
+function validateTaskMedia(task, value, channel, phase, path, into) {
     if (value === undefined)
         return;
     if (!into.require(channel === "voice", "task.media.channel", path, `a ${channel} task carries no real-time media state`))
@@ -867,7 +897,9 @@ function validateTaskMedia(value, channel, phase, path, into) {
     if (into.oneOf(value, TASK_MEDIA_STATES, "task.media", path)) {
         // Nothing is acquired while pending, and a preview has placed no call: media names a task whose
         // work has begun, on a snapshot as on the event, or a host would open the microphone on an offer.
-        into.require(!WORK_NOT_BEGUN.includes(phase), "task.media.beforeWork", path, `a ${String(phase)} task has no media: audio arrives once its work has begun`);
+        // The one task not yet at work that has audio is one whose party the host is dialling: ring-back
+        // is audio, and every host-placed dial's media starts on dialling.
+        into.require(!WORK_NOT_BEGUN.includes(phase) || partyRingingByHost(task), "task.media.beforeWork", path, `a ${describeValue(phase)} task has no media: audio arrives once its work has begun, or once the host is dialling its party`);
     }
 }
 const WORK_NOT_BEGUN = ["pending", "confirmed", "preview"];
@@ -1075,7 +1107,7 @@ function validateTaskInto(task, context, path, into) {
     }
     // The channel is fixed per provider by its manifest, so a task claiming another one is a
     // task Omni would render with the wrong controls.
-    into.require(task.channel === context.channel, "task.channel", `${path}.channel`, `a ${context.channel} provider may not publish a ${String(task.channel)} task`);
+    into.require(task.channel === context.channel, "task.channel", `${path}.channel`, `a ${context.channel} provider may not publish a ${describeValue(task.channel)} task`);
     if (task.reference !== undefined) {
         into.filled(task.reference, "task.reference", `${path}.reference`, "a reference must not be empty when present");
     }
@@ -1100,7 +1132,7 @@ function validateTaskInto(task, context, path, into) {
     if (Array.isArray(task.onCall) && task.onCall.length > 0 && (task.phase === "completing" || task.media === "ended")) {
         into.add("task.onCall.ended", `${path}.onCall`, `the call has ended (${task.phase === "completing" ? "the task is completing" : "its media ended"}) and onCall still names people on it: the room is who is on the call now, and now nobody is`);
     }
-    validateTaskMedia(task.media, context.channel, task.phase, `${path}.media`, into);
+    validateTaskMedia(task, task.media, context.channel, task.phase, `${path}.media`, into);
     validateLeadAssist(task.leadAssist, context.channel, `${path}.leadAssist`, into);
     validateAssisting(task.assisting, context.channel, `${path}.assisting`, into);
     validateMonitoring(task.monitoring, context.channel, `${path}.monitoring`, into);
@@ -1217,7 +1249,9 @@ function validateBreakState(value, path, into) {
     if (value.imposed !== undefined) {
         validateImposedBreak(value.imposed, `${path}.imposed`, into);
         // An imposed break is a break somebody placed; beside `not-requested` there is no break.
-        into.require(value.approval !== "not-requested", "break.imposed.approval", `${path}.imposed`, "an imposed break is a break in progress; not-requested says there is none");
+        // An imposed break is a break in progress or about to be: it travels with in-effect or
+        // starting-after-task and nothing else. Beside granted, the host would commit a break nobody asked for.
+        into.require(value.approval === "in-effect" || value.approval === "starting-after-task", "break.imposed.approval", `${path}.imposed`, `an imposed break is in effect or starting after the task; ${describeValue(value.approval)} says the agent asked, or that there is none`);
     }
     if (value.reasons === undefined)
         return;
@@ -1252,6 +1286,13 @@ function validateBreakState(value, path, into) {
     if (typeof value.activeReasonId === "string" && value.activeReasonId.length > 0) {
         into.require(seen.has(value.activeReasonId), "break.activeReasonId.known", `${path}.activeReasonId`, `activeReasonId names a reason the provider did not publish: ${value.activeReasonId}`);
     }
+    // A break in effect, or about to be, on a provider that publishes reasons is on one of them: an
+    // imposed one included, since the lead's place named it. A break of no kind is a break whose
+    // rules -- who may monitor through it, whether it counts -- nobody can apply.
+    ruleEvaluated("break.activeReasonId.required");
+    if (seen.size > 0 && (value.approval === "in-effect" || value.approval === "starting-after-task")) {
+        into.require(typeof value.activeReasonId === "string" && value.activeReasonId.length > 0, "break.activeReasonId.required", `${path}.activeReasonId`, `a break ${describeValue(value.approval)} on a provider that publishes reasons names the one it is on`);
+    }
 }
 export function validateTeamRoster(roster, path = "team", context = {}) {
     const into = new Collector();
@@ -1357,10 +1398,10 @@ export function validateSnapshot(snapshot, manifest, path = "snapshot", context
     }
     const channel = isPlainObject(manifest) && typeof manifest.channel === "string" ? manifest.channel : "voice";
     const levels = context.levels ?? manifestLevels(manifest);
-    into.oneOf(snapshot.transport, TRANSPORT_STATUSES, "snapshot.transport", `${path}.status`);
+    into.oneOf(snapshot.transport, TRANSPORT_STATUSES, "snapshot.transport", `${path}.transport`);
     if (into.filled(snapshot.loginId, "snapshot.loginId", `${path}.loginId`, "a snapshot needs the login id it belongs to")
         && context.loginId !== undefined) {
-        into.require(snapshot.loginId === context.loginId, "snapshot.loginId.mismatch", `${path}.loginId`, `a snapshot for session ${String(snapshot.loginId)} on a login whose session is ${context.loginId}`);
+        into.require(snapshot.loginId === context.loginId, "snapshot.loginId.mismatch", `${path}.loginId`, `a snapshot for session ${describeValue(snapshot.loginId)} on a login whose session is ${context.loginId}`);
     }
     validateBreakState(snapshot.break, `${path}.break`, into);
     // The count is the provider's confirmation of how much work it answered with. Stated, never
@@ -1408,6 +1449,14 @@ export function validateSnapshot(snapshot, manifest, path = "snapshot", context
     // describes a state the agent cannot be in, whichever half is stale. The one exception is a
     // lead listening to a call during a break that is work of another sort -- coaching,
     // administrative, training -- and on no other.
+    // The converse: a committed break with nothing outstanding has begun. starting-after-task beside
+    // no task is a break waiting on work that does not exist, and an empty list reading as "still
+    // finishing" is the plausible nought.
+    ruleEvaluated("break.starting-after-task.tasks");
+    if (isPlainObject(snapshot.break) && snapshot.break.approval === "starting-after-task"
+        && Array.isArray(snapshot.tasks) && snapshot.tasks.length === 0) {
+        into.add("break.starting-after-task.tasks", `${path}.break.approval`, "a break starting after the task waits on a task, and the snapshot carries none: with nothing outstanding the break is in-effect");
+    }
     if (isPlainObject(snapshot.break) && snapshot.break.approval === "in-effect"
         && Array.isArray(snapshot.tasks) && snapshot.tasks.length > 0) {
         const listening = snapshot.tasks.every((task) => isPlainObject(task) && task.monitoring !== undefined);
@@ -1419,7 +1468,7 @@ export function validateSnapshot(snapshot, manifest, path = "snapshot", context
             const reasons = Array.isArray(state.reasons) ? state.reasons : [];
             const active = reasons.find((reason) => isPlainObject(reason) && reason.id === state.activeReasonId);
             const kind = isPlainObject(active) ? active.kind : undefined;
-            into.require(typeof kind === "string" && MONITORING_BREAK_KINDS.includes(kind), "snapshot.monitoring.break", `${path}.tasks`, `a lead listens during a ${MONITORING_BREAK_KINDS.join(", ")} break and no other; the active reason is ${kind === undefined ? "unstated" : String(kind)}`);
+            into.require(typeof kind === "string" && MONITORING_BREAK_KINDS.includes(kind), "snapshot.monitoring.break", `${path}.tasks`, `a lead listens during a ${MONITORING_BREAK_KINDS.join(", ")} break and no other; the active reason is ${kind === undefined ? "unstated" : describeValue(kind)}`);
         }
     }
     // Presence is the permission, and it cuts both ways: data a provider never declared a
@@ -1487,6 +1536,10 @@ function validateTaskOutcome(value, path, into) {
                 into.filled(value.destinationId, "event.taskEnded.outcome.transferred", `${path}.destinationId`, "a destinationId must not be empty when present");
             }
             break;
+        case "taken-over":
+            // A lead is not a directory item: the ending names the lead, and the host resolves the name.
+            into.require(isUserId(value.leadId), "event.taskEnded.outcome.takenOver", `${path}.leadId`, "a take-over names the lead who took the call, by user id");
+            break;
         case "cancelled":
             // One word covered the agent declining, the provider withdrawing and the party abandoning the
             // ring; a record that cannot tell them apart is not a record. by says who, as completed does.
@@ -1510,7 +1563,7 @@ function validateTaskOutcome(value, path, into) {
             }
             break;
         default:
-            into.add("event.taskEnded.outcome.type", `${path}.type`, `unsupported outcome: ${String(value.type)}`);
+            into.add("event.taskEnded.outcome.type", `${path}.type`, `unsupported outcome: ${describeValue(value.type)}`);
     }
 }
 function validateQueueSummary(value, path, into) {
@@ -1558,7 +1611,7 @@ export function validateEventEnvelope(envelope, manifest, path = "event", contex
     into.filled(envelope.id, "event.id", `${path}.id`, "an event needs an id");
     if (into.filled(envelope.loginId, "event.loginId", `${path}.loginId`, "an event needs the login id it belongs to")
         && context.loginId !== undefined) {
-        into.require(envelope.loginId === context.loginId, "event.loginId.mismatch", `${path}.loginId`, `an event for session ${String(envelope.loginId)} on a login whose session is ${context.loginId}`);
+        into.require(envelope.loginId === context.loginId, "event.loginId.mismatch", `${path}.loginId`, `an event for session ${describeValue(envelope.loginId)} on a login whose session is ${context.loginId}`);
     }
     const idle = isPlainObject(manifest) && isPlainObject(manifest.idleCapabilities) ? manifest.idleCapabilities : {};
     into.timestamp(envelope.occurredAt, "event.occurredAt", `${path}.occurredAt`);
@@ -1604,10 +1657,12 @@ export function validateEventEnvelope(envelope, manifest, path = "event", contex
             validateTaskInto(event.task, { channel, levels, autoAcceptTasks: context.autoAcceptTasks, dialOutcomesDeclared: manifestDials(manifest), locked: context.locked }, `${at}.task`, into);
             break;
         case "task-media-started":
+            into.require(channel === "voice", "event.media.channel", `${at}.type`, "only a voice provider publishes media transitions");
             into.require(isTaskId(event.taskId), "event.taskMediaStarted.taskId", `${at}.taskId`, "a task id is required");
             into.require(isAllocationId(event.allocationId), "event.taskMediaStarted.allocationId", `${at}.allocationId`, "an event about a task names its allocation");
             break;
         case "task-media-ended":
+            into.require(channel === "voice", "event.media.channel", `${at}.type`, "only a voice provider publishes media transitions");
             into.require(isTaskId(event.taskId), "event.taskMediaEnded.taskId", `${at}.taskId`, "a task id is required");
             into.require(isAllocationId(event.allocationId), "event.taskMediaEnded.allocationId", `${at}.allocationId`, "an event about a task names its allocation");
             break;
@@ -1621,7 +1676,7 @@ export function validateEventEnvelope(envelope, manifest, path = "event", contex
             // Only a distinction the manifest declared: an undeclared word is a guess dressed as a code.
             const declared = isPlainObject(manifest) && Array.isArray(manifest.dialOutcomes) ? manifest.dialOutcomes : undefined;
             if (into.oneOf(event.outcome, DIAL_OUTCOMES, "event.dialOutcome.outcome", `${at}.outcome`)) {
-                into.require(declared !== undefined && declared.includes(event.outcome), "event.dialOutcome.undeclared", `${at}.outcome`, `the manifest does not declare ${String(event.outcome)} among its dialOutcomes`);
+                into.require(declared !== undefined && declared.includes(event.outcome), "event.dialOutcome.undeclared", `${at}.outcome`, `the manifest does not declare ${describeValue(event.outcome)} among its dialOutcomes`);
             }
             if (event.taskId !== undefined)
                 into.require(isTaskId(event.taskId), "event.dialOutcome.taskId", `${at}.taskId`, "taskId must be a task id when present");
@@ -1681,7 +1736,7 @@ export function validateEventEnvelope(envelope, manifest, path = "event", contex
             }
             break;
         default:
-            into.add("event.type", `${at}.type`, `unsupported event type: ${String(event.type)}`);
+            into.add("event.type", `${at}.type`, `unsupported event type: ${describeValue(event.type)}`);
     }
     return into.violations;
 }
@@ -1917,7 +1972,7 @@ export function validateHostReport(report, path = "host") {
         into.require(input.mutedBy === undefined, "host.audio.input.mutedBy.unexpected", `${at}.mutedBy`, "an unavailable input was not silenced; it is absent");
     }
     else {
-        into.add("host.audio.input.status", `${at}.status`, `an input is available or unavailable, not ${String(input.status)}`);
+        into.add("host.audio.input.status", `${at}.status`, `an input is available or unavailable, not ${describeValue(input.status)}`);
     }
     const output = report.audio.output;
     const out = `${path}.audio.output`;
@@ -1940,7 +1995,7 @@ export function validateHostReport(report, path = "host") {
         into.require(output.mutedBy === undefined, "host.audio.output.mutedBy.unexpected", `${out}.mutedBy`, "an unavailable output was not silenced; it is absent");
     }
     else {
-        into.add("host.audio.output.status", `${out}.status`, `an output is available or unavailable, not ${String(output.status)}`);
+        into.add("host.audio.output.status", `${out}.status`, `an output is available or unavailable, not ${describeValue(output.status)}`);
     }
     return into.violations;
 }
@@ -1971,25 +2026,8 @@ export function validateTaskCommand(command, task, path = "command") {
         : [...new Set([...TASK_COMMAND_NAMES.voice, ...TASK_COMMAND_NAMES.chat, ...TASK_COMMAND_NAMES.email])];
     if (type === "custom") {
         into.filled(command.name, "command.custom.name", `${path}.name`, "a custom command names the control it presses");
-        if (task === undefined)
-            return into.violations;
-        // Held to the task: the control it presses is one the task published, and what the control asked for travels with it.
-        const custom = isPlainObject(task) && isPlainObject(task.capabilities) ? task.capabilities.custom : undefined;
-        const control = Array.isArray(custom) ? custom.filter(isPlainObject).find(entry => entry.id === command.name) : undefined;
-        if (control === undefined) {
-            into.add("command.capability.custom", path, `custom ${String(command.name)} presses a control the task never published`);
-            return into.violations;
-        }
-        if (isPlainObject(control.prompt) && Array.isArray(control.prompt.fields)) {
-            for (const field of control.prompt.fields.filter(isPlainObject)) {
-                if (typeof field.name === "string") {
-                    into.require(typeof command[field.name] === "string" && command[field.name].length > 0, "command.custom.prompt", `${path}.${field.name}`, `the control asked for ${field.name} and the command does not carry it`);
-                }
-            }
-        }
-        return into.violations;
     }
-    if (!into.require(typeof type === "string" && names.includes(type), "command.type", `${path}.type`, channel === undefined ? `unsupported command: ${String(type)}` : `a ${channel} task has no ${String(type)} command`)) {
+    if (type !== "custom" && !into.require(typeof type === "string" && names.includes(type), "command.type", `${path}.type`, channel === undefined ? `unsupported command: ${describeValue(type)}` : `a ${channel} task has no ${describeValue(type)} command`)) {
         return into.violations;
     }
     const dial = (rule) => into.filled(command.dialId, rule, `${path}.dialId`, "a command that dials carries the host's dialId");
@@ -2007,7 +2045,7 @@ export function validateTaskCommand(command, task, path = "command") {
                     into.filled(command.destinationId, "command.transfer.destinationId", `${path}.destinationId`, "a transfer names the directory item it goes to");
                 }
                 else {
-                    into.require(command.dialId === undefined && command.destinationId === undefined, "command.transfer.unexpected", path, `${String(command.action)} names no destination: there is exactly one it could mean`);
+                    into.require(command.dialId === undefined && command.destinationId === undefined, "command.transfer.unexpected", path, `${describeValue(command.action)} names no destination: there is exactly one it could mean`);
                 }
             }
             break;
@@ -2041,7 +2079,7 @@ export function validateTaskCommand(command, task, path = "command") {
         default:
             break;
     }
-    if (!isPlainObject(task))
+    if (task === undefined)
         return into.violations;
     // The task the command is held to has to be one the wire published. A host's own mapping of it,
     // handed in for want of the original, is not, and checking a command against it would be
@@ -2049,25 +2087,45 @@ export function validateTaskCommand(command, task, path = "command") {
     // only to a task that stands.
     const published = new Collector();
     validateTaskInto(task, { channel: channel ?? "voice" }, `${path}.task`, published);
-    if (published.violations.length > 0) {
+    if (published.violations.length > 0 || !isPlainObject(task)) {
         into.add("command.task", `${path}.task`, `the task the command is held to is not one the wire published (${published.violations.map(v => v.rule).join(", ")}): pass the task as the provider sent it, or validate the command's shape alone`);
         return into.violations;
     }
+    if (type === "custom") {
+        // Held to the task: the control it presses is one the task published, and what the control asked for travels with it.
+        const custom = isPlainObject(task) && isPlainObject(task.capabilities) ? task.capabilities.custom : undefined;
+        const control = Array.isArray(custom) ? custom.filter(isPlainObject).find(entry => entry.id === command.name) : undefined;
+        if (control === undefined) {
+            into.add("command.capability.custom", path, `custom ${describeValue(command.name)} presses a control the task never published`);
+            return into.violations;
+        }
+        if (isPlainObject(control.ui) && control.ui.control === "toggle") {
+            into.require(typeof command.on === "boolean", "command.custom.on", `${path}.on`, "a custom toggle carries the state it wants as a boolean");
+        }
+        if (isPlainObject(control.prompt) && Array.isArray(control.prompt.fields)) {
+            for (const field of control.prompt.fields.filter(isPlainObject)) {
+                if (typeof field.name === "string" && (field.required === true || command[field.name] !== undefined)) {
+                    into.require(typeof command[field.name] === "string" && (field.required !== true || command[field.name].length > 0), "command.custom.prompt", `${path}.${field.name}`, `${field.name} must be a string when supplied, and a required field must have a value`);
+                }
+            }
+        }
+        return into.violations;
+    }
     // What the task has to offer or be in for the command to be issuable.
     const capabilities = isPlainObject(task.capabilities) ? task.capabilities : {};
     const offered = (name) => {
         const declared = capabilities[name];
         if (declared === undefined) {
-            into.add(`command.capability.${name}`, path, `${String(type)} needs the ${name} capability, and the task does not offer it`);
+            into.add(`command.capability.${name}`, path, `${describeValue(type)} needs the ${name} capability, and the task does not offer it`);
             return false;
         }
         if (isLocked(declared)) {
-            into.add("command.capability.locked", path, `${name} stands locked by ${String(declared.lockedBy)}: the control is present without permission`);
+            into.add("command.capability.locked", path, `${name} stands locked by ${describeValue(declared.lockedBy)}: the control is present without permission`);
             return false;
         }
         return true;
     };
-    const inPhase = (rule, ...phases) => into.require(phases.includes(String(task.phase)), rule, path, `${String(type)} belongs to ${phases.join(" or ")}, and the task is ${String(task.phase)}`);
+    const inPhase = (rule, ...phases) => into.require(typeof task.phase === "string" && phases.includes(task.phase), rule, path, `${describeValue(type)} belongs to ${phases.join(" or ")}, and the task is ${describeValue(task.phase)}`);
     // A control on the contact acts on a contact being handled. Before in-progress there is nothing
     // to act on yet, and in completing the handling has ended: a call with nobody on it, a
     // conversation closed. What a capability offers, the phase decides whether there is anything to use it on.
@@ -2076,7 +2134,7 @@ export function validateTaskCommand(command, task, path = "command") {
     const listed = (name) => {
         const declared = capabilities[name];
         const directory = isPlainObject(declared) && Array.isArray(declared.destinations) ? declared.destinations.filter(isPlainObject) : [];
-        into.require(directory.some(item => item.id === command.destinationId), "command.destination.unknown", `${path}.destinationId`, `${String(command.destinationId)} is not a destination the task's ${name} directory offered`);
+        into.require(directory.some(item => item.id === command.destinationId), "command.destination.unknown", `${path}.destinationId`, `${describeValue(command.destinationId)} is not a destination the task's ${name} directory offered`);
     };
     const onCall = Array.isArray(task.onCall) ? task.onCall.filter(isPlainObject) : [];
     switch (type) {
@@ -2119,7 +2177,7 @@ export function validateTaskCommand(command, task, path = "command") {
                     listed("warmTransfer");
             }
             else if (command.action === "complete" || command.action === "cancel") {
-                into.require(onCall.some(entry => entry.role === "consulted"), "command.transfer.consulted", path, `${String(command.action)} needs a consulted entry on onCall: without one there is nothing to complete or cancel`);
+                into.require(onCall.some(entry => entry.role === "consulted"), "command.transfer.consulted", path, `${describeValue(command.action)} needs a consulted entry on onCall: without one there is nothing to complete or cancel`);
             }
             break;
         case "lead-assist":
@@ -2131,7 +2189,7 @@ export function validateTaskCommand(command, task, path = "command") {
                 }
             }
             else {
-                into.require(task.assisting !== undefined, "command.leadAssist.assisting", path, `${String(command.action)} is the lead's own act on a call they joined: the task carries assisting`);
+                into.require(task.assisting !== undefined, "command.leadAssist.assisting", path, `${describeValue(command.action)} is the lead's own act on a call they joined: the task carries assisting`);
             }
             break;
         case "conference": {
@@ -2145,7 +2203,7 @@ export function validateTaskCommand(command, task, path = "command") {
                     into.require(others.some(entry => entry.role !== "party"), "command.conference.remove.alone", path, "removing the party would leave the agent alone: that is end-call");
                 }
                 else if (isFilled(command.destinationId)) {
-                    into.require(onCall.some(entry => entry.role === "conferenced" && entry.destinationId === command.destinationId), "command.conference.remove.unknown", path, `no conferenced entry on onCall has destinationId ${String(command.destinationId)}`);
+                    into.require(onCall.some(entry => entry.role === "conferenced" && entry.destinationId === command.destinationId), "command.conference.remove.unknown", path, `no conferenced entry on onCall has destinationId ${describeValue(command.destinationId)}`);
                     into.require(others.length > 1, "command.conference.remove.alone", path, "removing the last other person would leave the agent alone: that is end-call");
                 }
             }
@@ -2160,9 +2218,12 @@ export function validateTaskCommand(command, task, path = "command") {
                 into.require(command.disposition === undefined, "command.complete.disposition.unexpected", `${path}.disposition`, "the task declares no dispositions; complete travels with no code");
                 into.require(command.notes === undefined, "command.complete.notes.unexpected", `${path}.notes`, "the task declares no dispositions; complete travels with no notes");
             }
+            else if (dispositions === true) {
+                into.require(command.disposition === undefined, "command.complete.disposition.unexpected", `${path}.disposition`, "a bare dispositions control publishes no code, so complete carries none");
+            }
             else if (isPlainObject(dispositions)) {
                 if (Array.isArray(dispositions.codes) && command.disposition !== undefined) {
-                    into.require(dispositions.codes.some(code => isPlainObject(code) && code.id === command.disposition), "command.complete.disposition.unknown", `${path}.disposition`, `${String(command.disposition)} is not a code the task published`);
+                    into.require(dispositions.codes.some(code => isPlainObject(code) && code.id === command.disposition), "command.complete.disposition.unknown", `${path}.disposition`, `${describeValue(command.disposition)} is not a code the task published`);
                 }
                 if (dispositions.required === true) {
                     into.require(command.disposition !== undefined, "command.complete.disposition.required", `${path}.disposition`, "the task requires a disposition and complete carries none");
@@ -2186,7 +2247,8 @@ export function validateTaskCommand(command, task, path = "command") {
 const RESULT_STATUSES = {
     execute: { success: "applied", failure: "failed" },
     dial: { success: "dialling", failure: "failed" },
-    setCapacity: { success: "applied", failure: "failed" },
+    // A statement, not a request: taken, never refused.
+    setCapacity: { success: "applied", failure: undefined },
     requestBreak: { success: "requested", failure: "failed" },
     commitBreak: { success: "committed", failure: "failed" },
     cancelBreak: { success: "cancelled", failure: "failed" },
@@ -2215,21 +2277,34 @@ export function validateResult(result, method, path = "result", dialId) {
         into.add("result.shape", path, `${method} must answer an object`);
         return into.violations;
     }
+    if (method === "openMedia" && result.status !== "opened") {
+        into.require(result.session === undefined, "result.session.unexpected", `${path}.session`, "only opened carries a media session");
+    }
     if (result.status === statuses.success) {
         into.require(result.failure === undefined, "result.failure.unexpected", `${path}.failure`, `${statuses.success} carries no failure`);
         if (method === "openMedia") {
-            into.require(isPlainObject(result.session), "result.session", `${path}.session`, "opened carries the media session");
+            if (isPlainObject(result.session)) {
+                // Streams may come from another realm, and Node conformance runs have no MediaStream
+                // constructor. Check the boundary shape without claiming to verify live audio.
+                into.require(isPlainObject(result.session.remoteAudio), "result.session.remoteAudio", `${path}.session.remoteAudio`, "an opened session carries its remote audio stream");
+                for (const method of ["setMuted", "close"]) {
+                    into.require(typeof result.session[method] === "function", `result.session.${method}`, `${path}.session.${method}`, `a media session implements ${method}`);
+                }
+            }
+            else {
+                into.add("result.session", `${path}.session`, "opened carries the media session");
+            }
         }
         if (dials) {
             if (into.filled(result.dialId, "result.dialId", `${path}.dialId`, "dialling restates the dialId the host sent") && dialId !== undefined) {
-                into.require(result.dialId === dialId, "result.dialId.mismatch", `${path}.dialId`, `the host dialled ${dialId} and the provider answered for ${String(result.dialId)}`);
+                into.require(result.dialId === dialId, "result.dialId.mismatch", `${path}.dialId`, `the host dialled ${dialId} and the provider answered for ${describeValue(result.dialId)}`);
             }
         }
         else {
             into.require(result.dialId === undefined, "result.dialId.unexpected", `${path}.dialId`, `${statuses.success} dialled nothing and names no dial`);
         }
     }
-    else if (result.status === statuses.failure) {
+    else if (statuses.failure !== undefined && result.status === statuses.failure) {
         if (result.failure === undefined) {
             into.add("result.failure.required", `${path}.failure`, `${statuses.failure} carries the failure that says why`);
         }
@@ -2238,7 +2313,7 @@ export function validateResult(result, method, path = "result", dialId) {
         }
     }
     else {
-        into.add("result.status", `${path}.status`, `${method} answers ${statuses.success} or ${statuses.failure}, not ${String(result.status)}`);
+        into.add("result.status", `${path}.status`, `${method} answers ${statuses.success} or ${statuses.failure}, not ${describeValue(result.status)}`);
     }
     return into.violations;
 }
@@ -2351,7 +2426,7 @@ function validateMonitorControl(value, path, into) {
     }
     value.forEach((mode, index) => {
         if (into.oneOf(mode, MONITOR_MODES, "authentication.capability.team.monitorControl.mode", `${path}[${index}]`) && value.indexOf(mode) !== index) {
-            into.add("authentication.capability.team.monitorControl.unique", `${path}[${index}]`, `duplicate monitor mode: ${String(mode)}`);
+            into.add("authentication.capability.team.monitorControl.unique", `${path}[${index}]`, `duplicate monitor mode: ${describeValue(mode)}`);
         }
     });
     into.require(value.includes("monitor"), "authentication.capability.team.monitorControl.monitor", path, "whisper and barge begin from a monitor: a lead who may listen in any mode may monitor");
@@ -2368,7 +2443,7 @@ function validateAuthenticationFailureInto(value, path, into) {
         return;
     }
     if (into.filled(value.code, "authentication.failure.code", `${path}.code`, "a failure needs a code") && value.code.startsWith("omni.")) {
-        into.require(OMNI_FAILURE_CODES.includes(value.code), "failure.code.unknown", `${path}.code`, `${String(value.code)} is not a failure code this contract defines`);
+        into.require(OMNI_FAILURE_CODES.includes(value.code), "failure.code.unknown", `${path}.code`, `${describeValue(value.code)} is not a failure code this contract defines`);
     }
     into.filled(value.message, "authentication.failure.message", `${path}.message`, "a failure needs a message");
     into.require(typeof value.retryable === "boolean", "authentication.failure.retryable", `${path}.retryable`, "a failure must say whether it is retryable");
@@ -2376,7 +2451,7 @@ function validateAuthenticationFailureInto(value, path, into) {
         into.require(value.retryable === false, "authentication.failure.phone.retryable", `${path}.retryable`, "a phone the platform does not permit for this agent is configuration: trying again does not change it, so the refusal is not retryable");
     }
     if (value.retryAfterMs !== undefined) {
-        into.require(typeof value.retryAfterMs === "number" && value.retryAfterMs >= 0, "authentication.failure.retryAfterMs", `${path}.retryAfterMs`, "retryAfterMs must be a non-negative number when present");
+        into.require(typeof value.retryAfterMs === "number" && Number.isFinite(value.retryAfterMs) && value.retryAfterMs >= 0, "authentication.failure.retryAfterMs", `${path}.retryAfterMs`, "retryAfterMs must be a non-negative number when present");
     }
     if (value.field !== undefined)
         into.filled(value.field, "authentication.failure.field", `${path}.field`, "field names a declared credentials field when present");
@@ -2386,6 +2461,42 @@ export function validateAuthenticationFailure(failure, path = "failure") {
     validateAuthenticationFailureInto(failure, path, into);
     return into.violations;
 }
+function validateAuthenticationChallenge(value, path, into) {
+    if (!isPlainObject(value)) {
+        into.add("authentication.result.challenge", path, "interaction-required carries the challenge to put to the person");
+        return;
+    }
+    into.filled(value.flowId, "authentication.challenge.flowId", `${path}.flowId`, "a challenge names the flow to complete or cancel");
+    if (!into.oneOf(value.method, AUTHENTICATION_METHODS, "authentication.challenge.method", `${path}.method`))
+        return;
+    if (value.method === "browser-sso") {
+        into.filled(value.authorizationUrl, "authentication.challenge.authorizationUrl", `${path}.authorizationUrl`, "browser SSO carries the authorization URL to open");
+        into.oneOf(value.browser, AUTHENTICATION_BROWSERS, "authentication.challenge.browser", `${path}.browser`);
+    }
+    else if (!Array.isArray(value.fields)) {
+        into.add("authentication.challenge.fields", `${path}.fields`, "credentials carries the fields to render");
+    }
+    else {
+        const seen = new Set();
+        value.fields.forEach((field, index) => {
+            const at = `${path}.fields[${index}]`;
+            if (!isPlainObject(field)) {
+                into.add("authentication.challenge.field.shape", at, "a credentials field must be an object");
+                return;
+            }
+            if (into.filled(field.name, "authentication.challenge.field.name", `${at}.name`, "a credentials field needs a name")) {
+                into.require(!seen.has(field.name), "authentication.challenge.field.unique", `${at}.name`, "each credentials field has its own key in the submitted values");
+                seen.add(field.name);
+            }
+            into.filled(field.label, "authentication.challenge.field.label", `${at}.label`, "a credentials field needs a label");
+            into.oneOf(field.type, CREDENTIAL_FIELD_TYPES, "authentication.challenge.field.type", `${at}.type`);
+            if (field.required !== undefined)
+                into.require(typeof field.required === "boolean", "authentication.challenge.field.required", `${at}.required`, "required must be a boolean when present");
+            if (field.autocomplete !== undefined)
+                into.require(typeof field.autocomplete === "string", "authentication.challenge.field.autocomplete", `${at}.autocomplete`, "autocomplete must be a string when present");
+        });
+    }
+}
 /**
  * What `start()` or `complete()` answered: a challenge or a rejection from `start`, a login or a
  * rejection from `complete`. A rejection carries a failure the host can show, and a login is held
@@ -2401,13 +2512,17 @@ export function validateAuthenticationResult(result, method, path = "result", co
         validateAuthenticationFailureInto(result.failure, `${path}.failure`, into);
     }
     else if (method === "start" && result.status === "interaction-required") {
-        into.require(isPlainObject(result.challenge), "authentication.result.challenge", `${path}.challenge`, "interaction-required carries the challenge to put to the person");
+        validateAuthenticationChallenge(result.challenge, `${path}.challenge`, into);
+        into.require(result.failure === undefined, "authentication.failure.unexpected", `${path}.failure`, "an authentication challenge carries no failure");
     }
     else if (method === "complete" && result.status === "authenticated") {
         into.violations.push(...validateAuthenticationState(result, path, context));
     }
     else {
-        into.add("authentication.result.status", `${path}.status`, `${method} answers ${method === "start" ? "interaction-required" : "authenticated"} or rejected, not ${String(result.status)}`);
+        into.add("authentication.result.status", `${path}.status`, `${method} answers ${method === "start" ? "interaction-required" : "authenticated"} or rejected, not ${describeValue(result.status)}`);
+    }
+    if (result.status !== "interaction-required") {
+        into.require(result.challenge === undefined, "authentication.challenge.unexpected", `${path}.challenge`, "only interaction-required carries a challenge");
     }
     return into.violations;
 }