I think the fedi spec does attatchments pretty much right (except for the not so strict whether the key is always present when empty, whether it is a string, or an array, cause different implementations do it each of these ways because fuck you other server)