@axorum/client 0.0.0-stage → 1.1.0

package/dist/generated/agent-plane.d.ts

@@ -0,0 +1,1865 @@
+/**
+ * Wire types for the Axorum agent plane, generated from the frozen contract at
+ * `spec/openapi/agent-plane.v1.json`.
+ *
+ * DO NOT EDIT BY HAND — run `pnpm generate`.
+ *
+ * Field names are the wire's own: `snake_case` here means `snake_case` on the wire.
+ * Every `integer` in the contract is typed `bigint`, because the contract's integers
+ * include 128-bit money that a JavaScript `number` silently truncates; `src/json.ts`
+ * decodes and encodes them to match.
+ */
+export interface paths {
+    "/api/v1/accounts/{id}/balance": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** `GET /api/v1/accounts/{id}/balance` — an account's net balance. */
+        get: operations["get_balance"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/currencies": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * `GET /api/v1/currencies` — the ledger's currency registry.
+         * @description Any bound agent may read it, with the same attestation its intents carry. A
+         *     rail reads it at boot with its `[gate] attestation` and refuses to become ready
+         *     unless its currency is declared at the scale it parses amounts at. The
+         *     registry is the deployment's configuration, not a party's data, so it is not
+         *     owner-scoped. It is bounded by `max_currencies` and sits inside the read
+         *     ceiling.
+         */
+        get: operations["currencies"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/intents": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * `POST /api/v1/intents` — submit an intent envelope.
+         * @description Commits at the current server tick with the boundary wall-clock. A committed
+         *     but forbidden transaction (`ForbiddenRejected`) is a **success** — 200 with
+         *     `posted:false` — not a transport error.
+         */
+        post: operations["submit_intent"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/obligations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * `GET /api/v1/obligations?actor=…` — the duties the **calling agent's party**
+         *     owes.
+         */
+        get: operations["get_obligations"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/policies/active": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** `GET /api/v1/policies/active` — the id of the policy in force, or `null`. */
+        get: operations["active_policy"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/transactions/{txn_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * `GET /api/v1/transactions/{txn_id}` — the stored record (idempotent replay
+         *     lookup without resubmitting).
+         */
+        get: operations["get_transaction"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/transactions/{txn_id}/receipt": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * `GET /api/v1/transactions/{txn_id}/receipt` — the signed receipt,
+         *     re-minted deterministically from the stored record and re-signed
+         *     (`spec/evidence-signing.md` §3.6 surface 2). Byte-identical to the inline
+         *     receipt the submission carried, because both are minted from the applied
+         *     record's facts and Ed25519 is deterministic.
+         */
+        get: operations["get_receipt"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/usages/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** `GET /api/v1/usages/{id}` — one usage balance, readable only by its owner. */
+        get: operations["get_usage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        /** @description A concrete action reference with bound argument values. */
+        ActionTerm: {
+            /**
+             * @description The action being referenced, e.g. `post`.
+             * @example post
+             */
+            action: string;
+            /** @description The argument values bound by parameter name. */
+            bindings: {
+                [key: string]: components["schemas"]["Value"];
+            };
+        };
+        /** @description The `GET /api/v1/policies/active` response. */
+        ActivePolicyResponse: {
+            /**
+             * @description The id of the policy in force (`pol_…`), or `null` if none is.
+             *
+             *     Always present — `null` is emitted explicitly, never omitted.
+             */
+            policy: string | null;
+        };
+        /**
+         * @description What the agent receives back — the outcome typology.
+         *
+         *     A `ForbiddenRejected` verdict arrives here with `posted: false` on a **200**:
+         *     the transaction reached the commit point, was judged, and the refusal was
+         *     recorded. It is a protocol success, not a transport failure.
+         */
+        AgentOutcome: {
+            /**
+             * Format: int64
+             * @description Authoritative ledger tick of this exact transaction occurrence.
+             */
+            commit_tick: bigint;
+            /**
+             * @description Present exactly when `replayed` is: `true` when the ledger compared this
+             *     retry's content with the stored intent and they matched, `false` when it
+             *     had no stored content to compare with. That happens only for an id
+             *     committed before 1.0.0 whose content hash the old log never recorded,
+             *     retried by the party that committed it (or by any party, when the
+             *     committer was never recorded either), and only until the replay window
+             *     that follows the upgrade expires: every
+             *     id committed on 1.0.0 carries its hash. A `false` replay still posted
+             *     nothing; it means the retry's content was not checked, so a caller that
+             *     changed it learns nothing from this answer about the change. Absent
+             *     (never `null`) on a first answer.
+             */
+            content_verified?: boolean;
+            /**
+             * @description The lowercase-hex SHA-256 of the justification the transaction was
+             *     committed with. On a replay it is the committed one, not the one the
+             *     retry sent, and it matches the receipt's; only a replay with
+             *     `content_verified: false` of an id folded before 1.0.0 carries the
+             *     retry's, because no committed hash was kept.
+             */
+            justification_hash: string;
+            /** @description Every open obligation this party owes or may perform after the commit. */
+            obligations_pending: components["schemas"]["ObligationInstance"][];
+            /** @description The policy in force at commit time. */
+            policy: string;
+            /**
+             * @description Whether the entries were posted. `false` **iff** the verdict is
+             *     `ForbiddenRejected`.
+             */
+            posted: boolean;
+            /** @description The audit trail. */
+            provenance: components["schemas"]["OutcomeProvenance"];
+            /**
+             * @description The signed receipt — present only when the deployment signs artifacts
+             *     and the signing sidecar answered. **Absent is not an error**: the
+             *     commit stands either way, and `GET /transactions/{txn_id}/receipt`
+             *     re-mints the identical receipt once signing is restored.
+             */
+            receipt?: components["schemas"]["Envelope"];
+            /**
+             * @description Why the intent was refused — present **iff** `posted` is `false`, and
+             *     absent (never `null`) on every outcome that posted. Branch on
+             *     `refusal.code`; for policy-specific reasons, branch on
+             *     `refusal.rule.name`, which you declared.
+             *
+             *     Not covered by `receipt`: the receipt signs the provenance and the
+             *     policy hash, and the refusal is derived from them deterministically,
+             *     so a verifier recomputes it from signed facts rather than trusting
+             *     these bytes.
+             */
+            refusal?: components["schemas"]["Refusal"];
+            /**
+             * @description `true` when this answer replays an earlier commit of the same
+             *     `transaction` id with the same content: the ledger judged and posted
+             *     **once**, on the first submit, and this retry changed nothing. Every
+             *     other field is the original answer's. Absent (never `false`, never
+             *     `null`) on a first answer.
+             */
+            replayed?: boolean;
+            /** @description The transaction id — an echo of the submission. */
+            transaction: string;
+            /** @description The five-member deontic verdict. */
+            verdict: components["schemas"]["Verdict"];
+        };
+        /** @description A monetary amount in integer minor units. */
+        Amount: {
+            /**
+             * @description The ISO-4217-style currency the minor units are denominated in.
+             * @example USD
+             */
+            currency: string;
+            /**
+             * @description The value in minor units (e.g. cents).
+             *
+             *     **A 128-bit integer, emitted as a bare JSON number.** Its range exceeds
+             *     what an IEEE-754 double represents exactly, so a client whose JSON parser
+             *     decodes numbers as doubles (JavaScript's `JSON.parse`, notably) must decode
+             *     this field as a big integer to avoid silent precision loss on large values.
+             *     No standard numeric `format` expresses this range, which is why it is spelled
+             *     out here instead.
+             * @example 50000
+             */
+            minor: bigint;
+        };
+        /**
+         * @description The structured error body every non-2xx agent-plane response carries.
+         *
+         *     `error` is a **stable `snake_case` code** an authoring loop can branch on —
+         *     never an internal type or variant name — and `message` is human prose. Some
+         *     codes carry extra structured fields alongside (documented per-field below); a
+         *     client should branch on `error` and ignore fields it does not know.
+         */
+        ApiError: {
+            /** @description The offending action (`capability_mapping`). */
+            action?: string;
+            /** @description The policy actually in force (`stale_policy`, `policy_pin_mismatch`). */
+            active?: string;
+            /**
+             * @description What the caller must change (`substrate_rejected` with `kind:
+             *     "validation"`), present only when the refusal broke no law but was
+             *     malformed in a way the caller can fix; a body carries `law` or `cause`,
+             *     never both.
+             *
+             *     An **open** vocabulary. The known values are below
+             *     (and in `spec/fixtures/causes-v1.json`); a client MUST tolerate a value
+             *     it does not know, because a later contract may add a cause without a
+             *     major version. Fall back to `message`.
+             *
+             *     | cause | meaning | what to do next |
+             *     |---|---|---|
+             *     | `unknown_account` | an entry names an account the ledger has not provisioned | provision the account, or post to one that exists |
+             *     | `account_revoked` | an entry names a revoked account | post to an active account |
+             *     | `currency_mismatch` | an amount's currency differs from its account's, mandate's, usage balance's, deferral's or register's | submit the amount in that currency |
+             *     | `non_positive_amount` | an amount is zero or negative | make every entry amount positive |
+             *     | `entry_count` | too few or too many entries | submit at least two legs and no more than the ledger's bound |
+             *     | `amount_overflow` | an amount or a running total is out of the representable range | split the transaction into smaller amounts |
+             *     | `unknown_mandate` | the intent charges a mandate the ledger does not hold | charge a mandate the ledger holds, or have a principal issue it |
+             *     | `mandate_revoked` | the intent charges a revoked mandate | charge an active mandate |
+             *     | `unknown_usage` | the ledger records an owner for a usage balance that is not open, an inconsistency no intent can cause (a move naming a missing balance answers usage_not_owned) | nothing the caller can change; report it to the operator |
+             *     | `usage_not_owned` | the intent moves a usage balance its agent does not own, or one that does not exist (both answer alike, so a usage id reveals nothing) | move a usage balance the acting agent owns |
+             *     | `unknown_deferral` | the intent recognizes from a deferral the ledger does not hold | recognize from a deferral the ledger holds |
+             *     | `unknown_counterparty` | a counterparty the intent names is not in the imported registry | import the counterparty, or name a registered one |
+             *     | `counterparty_mandate_unresolved` | a counterparty-scoped cap needs a mandate charge the intent does not carry, or whose root cannot be resolved | charge the intent to a mandate whose chain resolves to a root |
+             *     | `undeclared_action` | the action is not declared by the policy in force | use an action the policy declares, or ask a principal to declare it |
+             *     | `missing_param` | a parameter the action declares, or a rule reads, is not bound | bind every parameter the action declares |
+             *     | `unexpected_param` | a parameter is bound that the action does not declare | remove the parameters the action does not declare |
+             *     | `param_type_mismatch` | a parameter is bound with a value of the wrong type | bind the parameter with the type the action declares |
+             *     | `period_closed` | the intent posts into a closed or unknown fiscal period | post into an open fiscal period |
+             *     | `undeclared_currency` | the intent, or an instrument it opens, is in a currency the deployment never declared | use a declared currency, or ask the operator to declare it (`[currencies]`) |
+             * @example unknown_account
+             */
+            cause?: string;
+            /** @description The currencies the spend moved (`multi_currency_mandate_charge`). */
+            currencies?: string[];
+            /**
+             * @description The stable `snake_case` error code.
+             *
+             *     Reachable on the agent plane:
+             *
+             *     | code | status | meaning |
+             *     |---|---|---|
+             *     | `invalid_transaction_id` | 400 | the path segment is not a transaction id |
+             *     | `invalid_account_id` | 400 | the path segment is not an account id |
+             *     | `unknown_agent` | 401 | the `agent://` URI is not bound |
+             *     | `attestation` | 403 | the PASETO attestation was rejected |
+             *     | `unknown_transaction` | 404 | no such transaction |
+             *     | `unknown_account` | 404 | no such account |
+             *     | `stale_policy` | 409 | the pinned policy is not the one in force (pre-check); carries `pinned`/`active` |
+             *     | `policy_pin_mismatch` | 409 | the policy changed between check and record; **nothing was written**; carries `pinned`/`active` |
+             *     | `no_active_policy` | 409 | no policy is in force |
+             *     | `transaction_reused` | 409 | the transaction id was committed with different content; **nothing was written**; carries `stored_content_hash`/`submitted_content_hash`, present only to the party that committed the id; for an id whose stored content is unknown (committed before 1.0.0) it is raised, with neither hash, for any party but the one that committed the id, which gets a replay with `content_verified: false` |
+             *     | `stale_idempotency_key` | 409 | the envelope's `minted_at_ms` is older than the advertised idempotency window less a 5-minute skew margin; **nothing was written**; checked only when the heartbeat runs |
+             *     | `body_too_large` | 413 | the request body is larger than the route accepts; refused before the handler ran; **nothing was written** |
+             *     | `unsupported_media_type` | 415 | the request body was not sent as `Content-Type: application/json`; refused before the handler ran; **nothing was written** |
+             *     | `not_primary` | 421 | cluster mode: a mutation reached a non-primary; carries `primary_api_addr` |
+             *     | `invalid_envelope` | 422 | the request body is not JSON, is cut short, or does not fit the envelope; the message gives the serde path and a short reason and never repeats a value from the body; refused before the handler ran; **nothing was written** |
+             *     | `invalid_agent_uri` | 422 | the `agent://` URI is malformed; carries `uri` |
+             *     | `capability_mapping` | 422 | the action maps to no capability; carries `action` |
+             *     | `rail_capability_mapping` | 422 | the declared rail's name maps to no valid capability path |
+             *     | `multi_currency_mandate_charge` | 422 | a mandate-bound spend moved outflow in >1 currency; carries `currencies` |
+             *     | `invalid_key_mint` | 422 | the retry key's mint time is refused: `minted_at_ms` or the `UUIDv7` transaction id's own time is more than the 5-minute skew margin ahead of the service's clock, or the two differ by more than it; the message names the check and its bound; **nothing was written** |
+             *     | `invalid_fulfillment` | 422 | the selected duties cannot be fulfilled by this intent; no mutation and no target existence or ownership disclosure |
+             *     | `substrate_rejected` | 422 | the ledger refused the transaction; carries `kind: "validation"`, and `law` when a conservation law fired or `cause` when the caller must change the intent |
+             *     | `gateway_error` | 422 | a gateway rejection with no more specific code |
+             *     | `substrate_rejected` | 507 | a ledger capacity bound was breached; carries `kind: "capacity"` |
+             *     | `snapshot_capacity` | 507 | cluster mode: the next snapshot frame, with this commit in it, would pass half the snapshot store; **nothing was written**; `Retry-After` names when a sweep evicts enough aged ids, a lower bound after a view change, and is absent when ageing alone cannot make room (an operator resizes the store) or the heartbeat is off |
+             *     | `idempotency_window_full` | 507 | the idempotency index is at its byte budget; refused at apply: **no ledger state changed and the id is not recorded**; ids held inside the window still replay; `Retry-After` names when a sweep evicts enough aged ids, a lower bound after a view change, and is absent when ageing alone cannot make room or the heartbeat is off |
+             *     | `idempotency_seed_refused` | 500 | the ledger refused this primary's idempotency seed; **this request was not proposed and nothing was written**; terminal: do not retry (no `Retry-After`) |
+             *     | `commit_unavailable` | 503 | cluster mode: the request was proposed and its commit could not be confirmed; **in doubt**: it may yet commit; carries `reason` |
+             *     | `idempotency_unseeded` | 503 | the idempotency index is not seeded yet; **this request was not written and will not be**: the primary stopped it before proposing it, or a replica that had not applied the seed refused it at apply; retry the same request. Says nothing about the transaction id, which an earlier attempt may still commit |
+             *     | `not_normal` | 503 | cluster mode: the replica is in a view change or a recovery; **this request was not proposed and nothing was written**; retry the same request shortly: once the change ends, the replica proposes it or answers `421 not_primary`. Says nothing about the transaction id, which an earlier attempt may still commit |
+             *     | `archive_pressure` | 503 | cluster mode: the primary holds more records for its local archive than its ceiling allows and takes no client write until the archive catches up; **this request was not proposed and nothing was written**; retry the same request later. Says nothing about the transaction id, which an earlier attempt may still commit |
+             *     | `quarantined` | 503 | replay verification found a divergence on this node; **this request was not proposed and nothing was written**; it does not clear on its own |
+             *     | `proposal_refused` | 500 | cluster mode: the node refused the proposal for a reason this build does not name; **this request was not proposed and nothing was written** |
+             * @example unknown_transaction
+             */
+            error: string;
+            /** @description `"validation"` (422) or `"capacity"` (507) (`substrate_rejected`). */
+            kind?: string;
+            /**
+             * @description The substrate conservation law the transaction would have broken
+             *     (`substrate_rejected` with `kind: "validation"`), present only on a
+             *     genuine law violation and absent on malformed input (an unknown or
+             *     revoked account, a non-positive amount, too few entries). An **open**
+             *     vocabulary: a client MUST tolerate a law it does not know and fall back
+             *     to `message`. The laws are specified under `spec/`:
+             *
+             *     | law | invariant | spec |
+             *     |---|---|---|
+             *     | `conservative` | debits equal credits, per currency | substrate law 1 |
+             *     | `authorization_conservation` | `0 ≤ executed ≤ ceiling` on a mandate | `authorization-conservation-law-sketch.md` §3 |
+             *     | `revenue_cost_matching` | `0 ≤ recognized ≤ deferred` | substrate law 4 |
+             *     | `usage_balance_conservation` | `0 ≤ billed ≤ metered ≤ consumed` | `usage-conservation-law.md` §3–4 |
+             *     | `period_close_roll_forward` | a period closes only once ended, with nothing posted past its end | `period-close-law.md` §2 |
+             * @example usage_balance_conservation
+             */
+            law?: string;
+            /**
+             * @description Human-readable prose. For `policy_pin_mismatch` this is plain
+             *     compliance-English stating that nothing was recorded.
+             */
+            message: string;
+            /** @description The policy the request pinned (`stale_policy`, `policy_pin_mismatch`). */
+            pinned?: string;
+            /**
+             * @description The primary's API origin, as the replica that answered last knew it
+             *     (`not_primary`): the `[cluster.node] api_addr` the primary advertises. A
+             *     hint, not a redirect: it can name a primary that has just died.
+             *
+             *     Itself nullable: `not_primary` carries the key with a `null` value when the
+             *     primary's origin is unknown.
+             */
+            primary_api_addr?: string | null;
+            /**
+             * @description Why the commit is unconfirmed / the node is not primary
+             *     (`commit_unavailable`, `not_primary`).
+             */
+            reason?: string;
+            /**
+             * @description The lowercase-hex SHA-256 content hash of the intent already committed
+             *     under this transaction id (`transaction_reused`). Present only to the
+             *     party that committed the id: to any other party it would reveal what
+             *     that party intended, so its refusal carries neither hash.
+             */
+            stored_content_hash?: string;
+            /**
+             * @description The lowercase-hex SHA-256 content hash of the intent this request
+             *     submitted (`transaction_reused`). Present only to the party that
+             *     committed the id, with `stored_content_hash`.
+             */
+            submitted_content_hash?: string;
+            /** @description The offending URI (`invalid_agent_uri`, `unknown_agent`). */
+            uri?: string;
+        };
+        /** @description The `GET /api/v1/accounts/{id}/balance` response. */
+        BalanceResponse: {
+            /** @description The account, echoed back **exactly as supplied** in the path. */
+            account: string;
+            /**
+             * @description The account's net balance in minor units.
+             *
+             *     **A 128-bit integer, emitted as a bare JSON number** — see the note on
+             *     `Amount.minor`: decode it as a big integer, not a double, or large values
+             *     lose precision silently.
+             * @example 50000
+             */
+            balance: bigint;
+        };
+        /**
+         * @description One clause of the refusing forbid's guard and the literal that satisfied
+         *     it (the first satisfied literal, where evaluation stopped).
+         */
+        Condition: {
+            /**
+             * Format: int32
+             * @description The zero-based clause position in the rule's guard.
+             */
+            clause: bigint;
+            /**
+             * Format: int32
+             * @description The index into `figures` of the comparison this literal made.
+             */
+            figure?: bigint;
+            /**
+             * @description What the literal tested. An **open** vocabulary:
+             *
+             *     | kind | the literal compared |
+             *     |---|---|
+             *     | `register_cap` | an aggregate register to a constant |
+             *     | `counterparty_limit` | an amount to a counterparty's registry-carried limit |
+             *     | `mandate_cap` | a mandate's spent / ceiling / remaining / projected quantity to a cap |
+             *     | `counterparty_list` | membership in the approved-counterparty list |
+             *     | `chart_of_accounts` | membership in the chart of accounts |
+             *     | `posting_period` | membership in an open fiscal period |
+             *     | `posted_balance` | a posted balance to an amount |
+             *     | `time_window` | the event clock to a constant |
+             *     | `actor` | the acting party to a party |
+             *     | `param` | an intent parameter to a constant or another parameter |
+             * @example register_cap
+             */
+            kind: string;
+            /**
+             * Format: int32
+             * @description The zero-based literal position within the clause.
+             */
+            literal: bigint;
+            /**
+             * @description Present and `true` when the literal is negated; a negated literal is
+             *     satisfied when its comparison is false.
+             */
+            negated?: boolean;
+            /**
+             * @description The intent parameter the literal reads, when it reads one.
+             * @example payee
+             */
+            param?: string;
+        };
+        /**
+         * @description A declared currency the policy in force cannot let some action commit in.
+         *
+         *     Every intent on one of `actions` in this currency is refused at commit with
+         *     `422` and `cause: "currency_mismatch"`, whatever its parameters: a register
+         *     the action feeds sums money in another currency, and a register never mixes
+         *     two. An agent cannot change that. Pay in a currency with no warning, or hand
+         *     `remedy` to a human operator.
+         *
+         *     Only the actions are named. Which register closes each one is policy
+         *     structure, reported on the admin plane.
+         */
+        CurrencyWarning: {
+            /**
+             * @description The actions refused in this currency, in canonical (sorted) order.
+             *     Never empty.
+             * @example [
+             *       "purchase"
+             *     ]
+             */
+            actions: string[];
+            /**
+             * @description Why the warning is here. An **open** vocabulary; the known value is below.
+             *
+             *     | code | meaning |
+             *     |---|---|
+             *     | `DSL3002` | the policy in force refuses `actions` in this currency |
+             *
+             *     The same code `axorum policy check --currencies` prints for the same
+             *     finding. A client MUST tolerate a code it does not know.
+             * @example DSL3002
+             */
+            code: string;
+            /**
+             * @description What an operator does about it, verbatim: the same sentence
+             *     `spec/fixtures/remedies-v1.json` pins for the `policy_currency` remedy.
+             * @example the policy in force does not speak EUR: activate a policy whose aggregates are in EUR
+             */
+            remedy: string;
+        };
+        /** @description The `GET /api/v1/currencies` response: the ledger's currency registry. */
+        DeclaredCurrencies: {
+            /**
+             * @description Every standing declaration, in canonical (sorted) code order. Empty
+             *     means nothing is declared, and the ledger then refuses every intent that
+             *     names a currency.
+             */
+            currencies: components["schemas"]["DeclaredCurrency"][];
+        };
+        /** @description One standing declaration in the ledger's currency registry. */
+        DeclaredCurrency: {
+            /**
+             * @description The declared currency code: three to eight uppercase ASCII letters.
+             * @example USD
+             */
+            currency: string;
+            /**
+             * Format: int32
+             * @description How many decimal digits one minor unit of the currency is worth: `2` for
+             *     `USD` (a stored `1250` is $12.50), `6` for `USDC`, `0` for `JPY`.
+             * @example 2
+             */
+            exponent: bigint;
+            /**
+             * @description Present only when the policy in force refuses some action in this
+             *     currency whatever the proposal; omitted, never `null`, otherwise.
+             */
+            warning?: components["schemas"]["CurrencyWarning"];
+        };
+        /** @description A single journal leg: a positive amount posted to one side of one account. */
+        Entry: {
+            /**
+             * @description The account this leg posts to (`acc_…`).
+             * @example acc_2n4kqx21g5bty927z2tj955css
+             */
+            account: string;
+            /** @description The positive amount posted (magnitude only — `side` carries the sign). */
+            amount: components["schemas"]["Amount"];
+            /** @description Whether the leg is a debit or a credit. */
+            side: components["schemas"]["Side"];
+        };
+        /**
+         * @description A detached-payload signature envelope — `axorum.evidence.v0`
+         *     (`spec/evidence-signing.md` §3.1, committed JSON Schema at
+         *     `spec/schemas/axorum.evidence.v0.schema.json`). The `payload` carries the
+         *     exact signed bytes (base64), so verification needs nothing but this
+         *     envelope and the deployment's published key list — no server, no
+         *     canonicalization.
+         */
+        Envelope: {
+            /**
+             * @description The operator-set deployment identifier — whose ledger signed this.
+             *     Inside the signed message: no artifact transplants across deployments.
+             */
+            deployment: string;
+            /**
+             * @description The signing key's id: lowercase-hex SHA-256 of the 32-byte Ed25519
+             *     public key, resolvable in the published key list.
+             */
+            key_id: string;
+            /**
+             * @description The artifact kind — for a receipt, `receipt`. One of the six closed
+             *     kind strings; the kind is inside the signed message, so a signature
+             *     cannot be replayed across kinds.
+             * @example receipt
+             */
+            kind: string;
+            /**
+             * @description The exact payload bytes, standard base64 (for a receipt: the compact
+             *     `axorum.receipt.v0` JSON).
+             */
+            payload: string;
+            /** @description The 64-byte Ed25519 signature, 128 lowercase hex characters. */
+            signature: string;
+            /**
+             * @description The envelope format version — always `axorum.evidence.v0`.
+             * @example axorum.evidence.v0
+             */
+            version: string;
+        };
+        /**
+         * @description One exact comparison the refusing forbid's guard made.
+         *
+         *     **Every amount is a 128-bit integer emitted as a bare JSON number** in
+         *     minor units of `currency` (a plain count when `currency` is absent), like
+         *     `Amount.minor`: decode it as a big integer.
+         *
+         *     **Disclosure.** `current`, `compared` and `headroom` are a cell's running
+         *     total, and a cell may accumulate other parties' activity, so they are
+         *     present only for the caller's own cells: a `per_party` register (always
+         *     the acting party's cell) and the agent's own mandate, the one the intent
+         *     charges (on a refusal, the bound mandate the cap was evaluated against). A
+         *     bound agent's non-spend intent charges nothing, so its own mandate's
+         *     figure is withheld too, deliberately. Every other figure omits all three
+         *     (absent means withheld from this caller, never zero) and keeps `source`,
+         *     its register or mandate fields, `op`, `negated`, `currency`, `attempted`,
+         *     `limit` and `held`. A counterparty cell always names the counterparty the
+         *     intent itself named. `current` and `compared` are present together or not
+         *     at all, and `headroom` only beside them.
+         */
+        Figure: {
+            /**
+             * @description This intent's own contribution.
+             * @example 50000
+             */
+            attempted: bigint;
+            /**
+             * @description What was compared against `limit`: `current + attempted` for a
+             *     projected read, `current` otherwise. Absent exactly when `current` is.
+             * @example 170000
+             */
+            compared?: bigint;
+            /** @description The counterparty cell, for a counterparty-scoped register. */
+            counterparty?: components["schemas"]["FigureCounterparty"];
+            /**
+             * @description The currency the amounts are counted in; absent for a count register.
+             * @example USD
+             */
+            currency?: string;
+            /**
+             * @description The quantity before this intent. Absent when the cell is not the
+             *     caller's own (see **Disclosure**).
+             * @example 120000
+             */
+            current?: bigint;
+            /**
+             * Format: int32
+             * @description The deployment's declared minor-unit exponent for `currency`; absent
+             *     when the currency is undeclared.
+             * @example 2
+             */
+            exponent?: bigint;
+            /**
+             * @description The largest `attempted` for which this literal would not have held;
+             *     zero or negative when no amount clears it. Absent when the comparison
+             *     does not bound the attempt, and always absent when `current` is.
+             * @example 30000
+             */
+            headroom?: bigint;
+            /** @description Whether the literal was satisfied, polarity applied. */
+            held: boolean;
+            /**
+             * @description The right-hand side of the comparison.
+             * @example 150000
+             */
+            limit: bigint;
+            /** @description The spending mandate read (`mand_…`). */
+            mandate?: string;
+            /** @description Present and `true` when the literal is negated. */
+            negated?: boolean;
+            /**
+             * @description The comparison as the policy wrote it. An **open** vocabulary: `eq`,
+             *     `ne`, `lt`, `le`, `gt`, `ge`, `in`.
+             * @example gt
+             */
+            op: string;
+            /**
+             * @description Which mandate quantity was read. An **open** vocabulary: `spent`,
+             *     `ceiling`, `remaining`, `projected`.
+             * @example projected
+             */
+            quantity?: string;
+            /**
+             * @description The aggregate register read.
+             * @example daily_vendor_spend
+             */
+            register?: string;
+            /**
+             * @description How the register partitions its accumulation. An **open** vocabulary:
+             *     `per_party`, `per_role`, `per_counterparty`, `per_rail`, `global`.
+             * @example per_counterparty
+             */
+            scope?: string;
+            /**
+             * @description What was read. An **open** vocabulary: `register` (carries `register`,
+             *     `window`, `scope`) or `mandate` (carries `mandate`, `quantity`).
+             * @example register
+             */
+            source: string;
+            /** @description The window the register accumulates over. */
+            window?: components["schemas"]["FigureWindow"];
+        };
+        /** @description The counterparty cell a counterparty-scoped register read resolved to. */
+        FigureCounterparty: {
+            /**
+             * @description The registry's display name, when it has one.
+             * @example Acme Corp
+             */
+            display_name?: string;
+            /**
+             * @description The registry-resolved counterparty key.
+             * @example acme
+             */
+            key: string;
+        };
+        /** @description The window a register figure accumulates over. */
+        FigureWindow: {
+            /**
+             * @description An **open** vocabulary: `rolling`, `calendar`, `unbounded`.
+             * @example rolling
+             */
+            kind: string;
+            /**
+             * Format: int64
+             * @description The window's width in ticks; absent for `unbounded`.
+             * @example 86400
+             */
+            ticks?: bigint;
+        };
+        /** @description What an agent submits — the intent protocol. */
+        IntentEnvelope: {
+            /** @description The proposed deontic action and its typed bindings. */
+            action: components["schemas"]["ActionTerm"];
+            /**
+             * @description The agent's `agent://` URI, e.g.
+             *     `agent://example.com/agent/clerk_01h455vb4pex5vsknk084sn02q`.
+             * @example agent://example.com/agent/clerk_01h455vb4pex5vsknk084sn02q
+             */
+            agent: string;
+            /** @description The PASETO v4.public capability attestation proving the agent may act. */
+            attestation: string;
+            /**
+             * @description The **bill** move this intent carries, if any: a signed delta on a usage
+             *     balance's `billed` running total — the financial recognition of metering.
+             *     Billing past `metered` is billing without a meter basis and is refused.
+             *     Omitted when absent, like `consume_usage`.
+             */
+            bill_usage?: components["schemas"]["UsageMove"];
+            /**
+             * @description The **consume** move this intent carries, if any: a signed delta on a
+             *     usage balance's `consumed` running total — the ground-truth event that the
+             *     agent used a metered resource.
+             *
+             *     **Omitted entirely** when the intent consumes nothing — the key is absent,
+             *     never `null`. A move that would break the usage-balance conservation law
+             *     (`0 ≤ billed ≤ metered ≤ consumed`) is refused `422` (`substrate_rejected`,
+             *     `kind: "validation"`) and **nothing posts**.
+             */
+            consume_usage?: components["schemas"]["UsageMove"];
+            /** @description The accounting journal legs. Debits and credits must balance per currency. */
+            entries: components["schemas"]["Entry"][];
+            /** @description Lowercase-hex SHA-256 digests of external evidence the agent references. */
+            evidence: string[];
+            fulfills?: string[];
+            /**
+             * @description The agent's stated reason. Hashed at the gateway; the hash goes on-ledger,
+             *     the text is retained off-ledger by the caller.
+             */
+            justification: string;
+            /**
+             * @description The **meter** move this intent carries, if any: a signed delta on a usage
+             *     balance's `metered` running total — the measurement recognition of
+             *     consumption. Metering past `consumed` is phantom usage and is refused.
+             *     Omitted when absent, like `consume_usage`.
+             */
+            meter_usage?: components["schemas"]["UsageMove"];
+            /**
+             * Format: int64
+             * @description When the retry key behind `transaction` was minted, in whole
+             *     milliseconds since the Unix epoch. Required: an envelope without it is
+             *     refused `422 invalid_envelope`, and nothing is recorded. A retry restates
+             *     the first attempt's mint time, not the time of the retry.
+             *
+             *     A deployment that runs a heartbeat refuses new work
+             *     `409 stale_idempotency_key`, recording nothing, once the key is older
+             *     than the `axorum-idempotency-window-seconds` window less a 5-minute
+             *     clock-skew margin, because past that point the id may no longer be held
+             *     and a resubmission could commit twice. A retry of an id the deployment
+             *     still holds replays however old its key. Outside the intent's content: a
+             *     resubmission restating the same key replays, and a caller-chosen id sent
+             *     with its true mint time passes exactly as a freshly minted one does.
+             * @example 1758643200000
+             */
+            minted_at_ms: bigint;
+            /**
+             * @description The policy the agent believes is in force (`pol_…`) — the staleness pin.
+             *     A stale pin is refused `409` and nothing is written.
+             * @example pol_2s5479gmf7bhrsavd5awacb0fg
+             */
+            policy: string;
+            /**
+             * @description The payment rail this intent arrived over, if a rail sidecar submitted it
+             *     — `x402`, `acp`, `ap2`, `tap`. Omitted when absent, like `consume_usage`.
+             *
+             *     **Attested, then recorded.** The gateway admits a rail declaration only
+             *     from a bearer whose attested capabilities cover `<identity>/rail/<rail>`;
+             *     naming a rail the token does not cover is rejected before evaluation
+             *     (403, like any other capability failure). The capability attests the
+             *     right to *declare* the rail, not that the payment crossed that wire. It
+             *     is provenance for reporting — which sidecar says it gated this — and a
+             *     `per rail` aggregate register accrues by it, so a policy's rail budgets
+             *     turn on it even though no verdict reads it directly as a condition.
+             *
+             *     A validated name (`[a-z0-9_]`, non-empty, ≤ 64 bytes), open rather than
+             *     enumerated, so a rail Axorum has never heard of can still label itself.
+             * @example x402
+             */
+            rail?: string;
+            /**
+             * @description The **client-minted** transaction id (`txn_…`) — the substrate's
+             *     idempotency key. Re-submitting a committed id replays its outcome.
+             * @example txn_7w5b4trnc7b2ja027jyyb64395
+             */
+            transaction: string;
+        };
+        /**
+         * @description The ERP source-version markers the verdict was decided under.
+         *
+         *     Every field is **omitted** when its domain had not been imported at decision
+         *     time — absence is meaningful, and is not the same as `null`.
+         */
+        MasterDataBasis: {
+            /** @description The counterparty registry in force. Omitted if never imported. */
+            counterparties_version?: string;
+            /** @description The fiscal calendar in force. Omitted if never imported. */
+            fiscal_periods_version?: string;
+            /** @description The chart of accounts in force. Omitted if never imported. */
+            gl_accounts_version?: string;
+        };
+        /** @description A live obligation instance — a duty bound to an actor at a tick. */
+        ObligationInstance: {
+            /** @description The obligated action — performing it discharges this instance. */
+            action: components["schemas"]["ActionTerm"];
+            /** @description The actor the obligation binds (`party_…`). */
+            actor: string;
+            /**
+             * Format: int64
+             * @description The tick the instance was anchored at (its activation tick).
+             */
+            anchor: bigint;
+            /**
+             * Format: int64
+             * @description The tick after which the instance breaches, or `null` if it has no
+             *     deadline.
+             *
+             *     **Always present** — a deadline-free obligation emits an explicit `null`
+             *     rather than omitting the key.
+             */
+            deadline: bigint | null;
+            /** @description The deterministic instance id (`obl_…`). */
+            id: string;
+            /** @description Original action whose values were captured into this contract. */
+            origin_action: components["schemas"]["ActionTerm"];
+            /**
+             * Format: int64
+             * @description Tick of the originating transaction occurrence, retained through reparations.
+             */
+            origin_tick: bigint;
+            /** @description Transaction that originally incurred the duty. */
+            origin_transaction: string;
+            /** @description Parent breached duty for a reparation, otherwise null. */
+            parent: string | null;
+            /** @description Authenticated party authorized to perform this duty. */
+            performer: string;
+            /** @description Policy whose obligation contract remains in force for this duty. */
+            policy: string;
+            /** @description The rule this instance was created from (`rule_…`). */
+            rule: string;
+            /** @description The instance's lifecycle state. */
+            state: components["schemas"]["ObligationState"];
+        };
+        /** @description The obligation state changes recorded by one evaluation. */
+        ObligationOutcomes: {
+            /** @description Obligation instances created (born active) by this evaluation (`obl_…`). */
+            created: string[];
+            /** @description Obligation instances discharged (`obl_…`). */
+            discharged: string[];
+            /** @description Obligation instances violated (`obl_…`). */
+            violated: string[];
+        };
+        /**
+         * @description The obligation lifecycle state machine.
+         * @enum {string}
+         */
+        ObligationState: "Dormant" | "Active" | "Discharged" | "Violated" | "Waived" | "Expired";
+        /** @description The `GET /api/v1/obligations` response: duties a party owes or is authorized to perform. */
+        ObligationsResponse: {
+            /**
+             * @description The actor, echoed back **exactly as supplied** in the query — a party id
+             *     or the DSL party name, not the canonicalized id.
+             */
+            actor: string;
+            /** @description Every open obligation this party owes or is authorized to perform. */
+            pending: components["schemas"]["ObligationInstance"][];
+        };
+        /**
+         * @description The provenance carried by a committed transaction's outcome.
+         *
+         *     An **externally tagged** union with a twist: `Recorded` is an object
+         *     (`{"Recorded": {…}}`) but `Archived` is a bare string (`"Archived"`). A client
+         *     must accept both forms.
+         *
+         *     `Archived` means the transaction committed but its record has been folded out
+         *     of the live tail by rolling compaction. The retained `verdict` / `posted` /
+         *     `policy` on the enclosing outcome are still true; the full audit trail must be
+         *     read from the archived report.
+         */
+        OutcomeProvenance: {
+            /** @description The full, self-contained audit trail from the evaluator (the normal case). */
+            Recorded: components["schemas"]["Provenance"];
+        } | "Archived";
+        /**
+         * @description The self-contained audit record accompanying every verdict.
+         *
+         *     Given the committed transaction and the referenced policy bundle, an auditor
+         *     replaying the evaluation must obtain this identical record.
+         */
+        Provenance: {
+            /**
+             * @description The rules applicable to the input (`rule_…`), in descending-priority
+             *     encounter order.
+             */
+            applied: string[];
+            /**
+             * @description The defeaters that fired, each a **two-element array** pairing the rule id
+             *     it defeated with the `unless`-clause name that defeated it, e.g.
+             *     `[["rule_1a2b…", "over_ceiling"]]`.
+             */
+            defeated: [
+                string,
+                string
+            ][];
+            /** @description The delegation(s) the actor acted under (`deleg_…`). */
+            delegation: string[];
+            /**
+             * @description External evidence bound at commit, carried verbatim as lowercase-hex
+             *     SHA-256 digests.
+             */
+            evidence: string[];
+            /**
+             * @description The replicated master-data version(s) the verdict was decided under.
+             *
+             *     **Omitted entirely** unless the governing policy consults a reference set
+             *     — the key is absent, and is never `null`.
+             */
+            master_data?: components["schemas"]["MasterDataBasis"];
+            /** @description The obligation state changes this evaluation produced. */
+            obligations: components["schemas"]["ObligationOutcomes"];
+            /** @description The content-addressed id of the governing policy bundle (`pol_…`). */
+            policy: string;
+            /**
+             * Format: int32
+             * @description The evaluation-semantics version under which the verdict was decided.
+             *
+             *     **Omitted entirely** for a pre-versioning record; the key is absent, and
+             *     is never `null`.
+             */
+            semantics?: bigint;
+            /** @description The verdict reached. */
+            verdict: components["schemas"]["Verdict"];
+            /**
+             * @description The norm that determined the verdict (`rule_…`), or `null` if none did.
+             *
+             *     **Always present** — an undetermined verdict emits an explicit `null`.
+             */
+            winning: string | null;
+        };
+        /**
+         * @description The body of a `429`: the rate limiter's own error shape, not the agent plane's `ApiError`.
+         *
+         *     The limiter answers before any agent-plane handler runs, so its refusal is
+         *     acton-service's `RATE_LIMIT_EXCEEDED` body. What a client does is the same
+         *     whatever it says: wait the response's `Retry-After` and re-send.
+         */
+        RateLimited: {
+            /** @description `RATE_LIMIT_EXCEEDED`. */
+            code: string;
+            /** @description Human prose: `Too many requests`. */
+            error: string;
+            /**
+             * Format: int32
+             * @description `429`.
+             */
+            status: bigint;
+        };
+        /**
+         * @description A replicated master-data set a policy can test membership in.
+         * @enum {string}
+         */
+        ReferenceSet: "ApprovedCounterparties" | "GlAccounts" | "OpenFiscalPeriods";
+        /**
+         * @description Why a refused intent was refused (`AgentOutcome.refusal`).
+         *
+         *     A stable machine `code`, the `rule` that fired when one did, the guard
+         *     `conditions` and exact `figures` behind a forbid, the norms their own
+         *     exceptions `set_aside`, and a plain-English `explanation` that says what to
+         *     do next. Every list is omitted when empty.
+         *
+         *     **Every refusal vocabulary is open**: `code`, the condition `kind`, the
+         *     figure `source`, `op`, `scope`, `quantity` and window `kind`, and the
+         *     set-aside `modality` (like `ErrorBody.law` and `ErrorBody.cause`). A client
+         *     MUST tolerate a value it does not know, because a later contract may add
+         *     one without a major version, and fall back to `explanation`.
+         */
+        Refusal: {
+            /**
+             * @description The stable `snake_case` refusal code. An **open** vocabulary: a
+             *     client must accept a code it does not know and fall back to
+             *     `explanation`.
+             *
+             *     | code | meaning | `rule` |
+             *     |---|---|---|
+             *     | `forbidden_by_rule` | a forbid rule in the judging policy won and no permit overrode it | present: the forbid |
+             *     | `not_delegated` | a permit matched and its conditions held, but no delegation to the acting agent covers it | present: the highest-priority such permit |
+             *     | `denied_by_default` | no rule permitted the action for this actor, so the policy's default deny applied | absent |
+             *     | `reason_archived` | the refused record has been archived, so this replay cannot carry the reason | absent |
+             * @example forbidden_by_rule
+             */
+            code: string;
+            /**
+             * @description For `forbidden_by_rule` only: one entry per clause of the forbid's
+             *     guard, naming the literal that satisfied it. Omitted when empty.
+             */
+            conditions?: components["schemas"]["Condition"][];
+            /** @description A plain-English explanation of the refusal and what to do next. */
+            explanation: string;
+            /**
+             * @description For `forbidden_by_rule` only: every register and mandate comparison the
+             *     forbid's guard made, in evaluation order. `conditions[].figure` indexes
+             *     this list. Omitted when empty.
+             */
+            figures?: components["schemas"]["Figure"][];
+            /**
+             * @description The rule behind the refusal — present exactly when `code` is
+             *     `forbidden_by_rule` (the winning forbid) or `not_delegated` (the permit
+             *     no delegation covers).
+             */
+            rule?: components["schemas"]["RefusingRule"];
+            /**
+             * @description Norms their own `unless` clause set aside for this intent. Omitted when
+             *     empty.
+             */
+            set_aside?: components["schemas"]["SetAside"][];
+        };
+        /**
+         * @description The rule that refused an intent, named from the policy that judged it
+         *     (`AgentOutcome.policy`), not whichever policy is in force when the
+         *     answer is read.
+         */
+        RefusingRule: {
+            /**
+             * @description The rule's id (`rule_…`), the same id `provenance.Recorded.winning`
+             *     carries.
+             * @example rule_133a287fqyatytd2n3ntyy7mv9
+             */
+            id: string;
+            /**
+             * @description The rule's name as declared in the policy source. Absent when the
+             *     server could not read the judging policy's source.
+             * @example no_unapproved_vendors
+             */
+            name?: string;
+        };
+        /** @description A norm its own `unless` clause set aside for this intent. */
+        SetAside: {
+            /**
+             * @description The exception that set the rule aside.
+             * @example after_hours
+             */
+            exception: string;
+            /**
+             * @description The defeated rule's modality. An **open** vocabulary: `permitted`,
+             *     `obligated`, `forbidden`.
+             * @example permitted
+             */
+            modality: string;
+            /** @description The defeated rule. */
+            rule: components["schemas"]["RefusingRule"];
+        };
+        /**
+         * @description The side of a journal entry.
+         * @enum {string}
+         */
+        Side: "Debit" | "Credit";
+        /**
+         * @description The stored ledger record for one transaction — **an opaque object in this
+         *     version of the contract.**
+         *
+         *     This endpoint returns the raw normative-log record. That record's own shape is
+         *     not yet frozen: it is a tagged union over every kind of ledger event, and its
+         *     transaction arm carries the full evaluation proposal and decision. Pinning a
+         *     schema for it here would mean publishing a **guess** at a shape that is still
+         *     moving — precisely the dishonesty this contract exists to prevent — so it is
+         *     declared a free-form object and clients should treat it as opaque JSON.
+         *
+         *     It gets its real, frozen contract in the forthcoming API extraction.
+         *
+         *     What **is** guaranteed today: the record of a committed transaction carries a
+         *     `posted` boolean, and a recorded refusal appears with `posted: false`.
+         */
+        TransactionRecord: {
+            [key: string]: unknown;
+        };
+        /**
+         * @description The `GET /api/v1/usages/{id}` response: one usage balance, readable only by the
+         *     party that owns it.
+         *
+         *     The wire shape is `axorum_report::UsageBalanceReport`'s own fields at the top level
+         *     with the compliance-English narration embedded as `text` — the `ReportBody` flatten
+         *     the writer serializes. It is mirrored here rather than derived for the usual reason
+         *     (see the module docs): `UsageId` and `CurrencyCode` are foreign newtypes with
+         *     hand-written `Serialize` impls that emit plain strings, and a derive would describe
+         *     their innards instead.
+         *
+         *     **Every counter is a 128-bit integer emitted as a bare JSON number** — the same rule
+         *     as `Amount.minor`, and it matters more here than anywhere else on the agent plane:
+         *     this is the *only* money read the contract exposes, `consume` has no ceiling, and a
+         *     balance can lawfully outgrow `u64`. Decode these as big integers, never as doubles,
+         *     or large figures lose precision silently. (The TypeScript generator's
+         *     integer→`bigint` rewrite keys off exactly this.)
+         */
+        UsageBalanceReport: {
+            /**
+             * @description The running total **billed** — the financial recognition of metering, in minor
+             *     units. Never above `metered`, by the law.
+             * @example 4000
+             */
+            billed: bigint;
+            /**
+             * @description The running total **consumed** — the ground-truth event, in minor units.
+             * @example 10000
+             */
+            consumed: bigint;
+            /**
+             * @description The single currency/unit every move against this balance must match.
+             * @example USD
+             */
+            currency: string;
+            /**
+             * @description The running total **metered** — the measurement recognition of consumption, in
+             *     minor units. Never above `consumed`, by the law.
+             * @example 6500
+             */
+            metered: bigint;
+            /** @description Whether the chain has reconciled: `consumed = metered = billed`. */
+            reconciled: boolean;
+            /** @description The balance narrated in compliance English, with exact money figures. */
+            text: string;
+            /**
+             * @description The un-billed headroom (`metered − billed`): metering recognized but not yet
+             *     billed. Never negative, by the law.
+             * @example 2500
+             */
+            unbilled: bigint;
+            /**
+             * @description The un-metered headroom (`consumed − metered`): consumption recognized but not
+             *     yet measured. Never negative, by the law.
+             * @example 3500
+             */
+            unmetered: bigint;
+            /**
+             * @description The usage-balance id (`usage_…`), as a string.
+             * @example usage_2n4kqx21g5bty927z2tj955css
+             */
+            usage: string;
+        };
+        /**
+         * @description A single **usage move**: a signed delta against one usage balance's counter,
+         *     carried on an intent as `consume_usage` / `meter_usage` / `bill_usage`.
+         *
+         *     The three moves of one intent are validated **together** against the combined
+         *     post-state, so a single intent may consume, meter, and bill the same amount.
+         *     Usage balances are opened on the admin plane and are unscoped in v0 (no owning
+         *     party — the substrate law is what refuses every chain violation).
+         */
+        UsageMove: {
+            /**
+             * @description The signed delta, denominated in the balance's currency/unit: positive
+             *     recognizes fresh consumption/metering/billing, negative a correction that
+             *     unwinds it. Carries `Amount`'s 128-bit-integer caveat: decode `minor` as a
+             *     big integer, not a double.
+             */
+            amount: components["schemas"]["Amount"];
+            /**
+             * @description The usage balance the move lands on (`usage_…`).
+             * @example usage_2s5479gmf7bhrsavd5awacb0fg
+             */
+            usage: string;
+        };
+        /**
+         * @description A typed literal in the deontic AST.
+         *
+         *     An **externally tagged** union: exactly one key, the variant name — e.g.
+         *     `{"Int": 3}` or `{"Amount": {"minor": 500, "currency": "USD"}}`.
+         */
+        Value: {
+            /** @description A boolean. */
+            Bool: boolean;
+        } | {
+            /**
+             * Format: int64
+             * @description A 64-bit signed integer (counts, quantities — never money).
+             */
+            Int: bigint;
+        } | {
+            /** @description A monetary amount. */
+            Amount: components["schemas"]["Amount"];
+        } | {
+            /** @description UTF-8 text. */
+            Text: string;
+        } | {
+            /** @description A reference to a party by id (`party_…`). */
+            Party: string;
+        } | {
+            /** @description A transaction identity (`txn_…`). */
+            Transaction: string;
+        } | {
+            /** @description A role name. */
+            Role: string;
+        } | {
+            /**
+             * Format: int64
+             * @description An event-clock point.
+             */
+            Tick: bigint;
+        } | {
+            /** @description An action type name. */
+            Action: string;
+        } | {
+            /** @description A named replicated reference set (membership tests only). */
+            SetRef: components["schemas"]["ReferenceSet"];
+        };
+        /**
+         * @description The outcome of evaluating a transaction against the policy in force.
+         *
+         *     `ForbiddenRejected` is the **recorded refusal** — it arrives on a `200` with
+         *     `posted: false`.
+         * @enum {string}
+         */
+        Verdict: "Permitted" | "ForbiddenRejected" | "ForbiddenRecorded" | "ObligatedPending" | "ObligatedFulfilled";
+    };
+    responses: {
+        /**
+         * @description The rate limiter refused the request before any handler read it, so **nothing was read or written**. Wait `Retry-After` seconds and re-send the same request; a submission keeps its `transaction` id. The body is the limiter's own shape (`RateLimited`), not `ApiError`.
+         *
+         *     A request is counted in its agent's own bucket when it carries an `Authorization: Bearer` attestation that verifies against a trusted issuer, is unexpired, and names a bound agent; otherwise in its address's bucket.
+         */
+        RateLimited: {
+            headers: {
+                /** @description Whole seconds to wait before re-sending, at least 1. Always present on a 429. */
+                "Retry-After"?: bigint;
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["RateLimited"];
+            };
+        };
+    };
+    parameters: never;
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    get_balance: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /**
+                 * @description The account id (`acc_…`).
+                 * @example acc_2n4kqx21g5bty927z2tj955css
+                 */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /**
+             * @description The account's net balance.
+             *
+             *     Readable only by the party that **owns** the account.
+             */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["BalanceResponse"];
+                };
+            };
+            /** @description `invalid_account_id` — the path segment is not an account id. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `unauthorized` — no `Authorization: Bearer <attestation>` was presented; or `unknown_agent` — the attested `agent://` URI is not bound to a party. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `attestation` — the attestation was rejected (bad signature, expired, or an untrusted issuer). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `unknown_account` — no such account, **or** the account is not the calling party's: owned by another party, or opened with no owner at all (fail-closed — readable by nobody). The cases are deliberately indistinguishable: an account id is never an existence oracle across a tenant boundary. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            429: components["responses"]["RateLimited"];
+        };
+    };
+    currencies: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /**
+             * @description Every declared currency and its minor-unit exponent, in canonical (sorted) code order. An intent that names any other currency is refused with `422` and `cause: "undeclared_currency"`. An empty list means nothing is declared.
+             *
+             *     A currency carries a `warning` when the policy in force refuses some action in it whatever the proposal: every intent on one of `warning.actions` in that currency is refused at commit. An agent cannot change that; pay in a currency with no warning, or hand `warning.remedy` to a human operator.
+             */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DeclaredCurrencies"];
+                };
+            };
+            /** @description `unauthorized` — no `Authorization: Bearer <attestation>` was presented; or `unknown_agent` — the attested `agent://` URI is not bound to a party. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `attestation` — the attestation was rejected (bad signature, expired, or an untrusted issuer). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            429: components["responses"]["RateLimited"];
+        };
+    };
+    submit_intent: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** @description The intent envelope: identity (`agent` + `attestation`), the accounting view (`entries`), the deontic view (`action`), the policy pin, external `evidence`, and the agent's `justification`. */
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["IntentEnvelope"];
+            };
+        };
+        responses: {
+            /**
+             * @description The intent reached the commit point and was judged.
+             *
+             *     **This includes a refusal.** If the policy in force forbids the action, the verdict is `ForbiddenRejected` and `posted` is `false` — the refusal was *recorded*, and that recording is the result. It is still a 200. Clients must branch on `verdict`/`posted`, never on the status code, to learn whether the entries posted.
+             *
+             *     Re-submitting an already-committed `transaction` id with the **same content** replays its stored outcome (client-minted ids are the substrate's idempotency key) rather than double-posting; the replayed answer carries `replayed: true` and `content_verified: true`, and is otherwise the original answer's bytes. The same id with different content is a `409 transaction_reused`. An id committed before 1.0.0 whose content hash the old log never recorded has nothing to compare with: until the replay window after the upgrade expires, a retry of it by the party that committed it replays with `content_verified: false` and posts nothing, as does a retry by any party when the committer was never recorded either; any other party gets the `409 transaction_reused`.
+             *
+             *     A retry is answered **before** admission: once the caller authenticates, a committed id with the same content replays even if its pin is no longer the policy in force, its currency is not declared, or its `minted_at_ms` is older than the replay window, and different content is `409 transaction_reused`. Only a new id faces the pin, currency admission and the key window.
+             */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AgentOutcome"];
+                };
+            };
+            /** @description `unknown_agent` — the `agent://` URI is not bound to a party. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `attestation` — the PASETO v4.public capability attestation was rejected (bad signature, expired, wrong audience, or an untrusted issuer). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /**
+             * @description The policy pin did not hold and **nothing was written**.
+             *
+             *     - `stale_policy` — the pre-propose fast path: the pinned policy is not the one in force. Carries `pinned` and `active`. A retry of a committed id never gets it: the retry replays whatever it pins.
+             *     - `policy_pin_mismatch` — the race-closing apply-time check: the policy in force changed between the request being checked and it being recorded. Carries `pinned` and `active`, and a plain compliance-English `message` stating that nothing was recorded. Identical body on the standalone and cluster paths.
+             *     - `no_active_policy` — no policy is in force at all.
+             *
+             *     For these three: re-read `GET /api/v1/policies/active` and resubmit against the policy now in force.
+             *
+             *     - `transaction_reused` — the `transaction` id was already committed with **different** content (a different agent, entries, action, rail or usage move). Nothing was written. To the party that committed the id it carries `stored_content_hash` and `submitted_content_hash`, and none of the content; to any other party it carries neither hash. Choose a fresh id for a new intent; resubmit the original content unchanged to read the stored outcome back. When the stored content is unknown (an id committed before 1.0.0), raised with neither hash for any party but the one that committed the id.
+             *     - `stale_idempotency_key` — the envelope's `minted_at_ms` is older than the `axorum-idempotency-window-seconds` window less a 5-minute clock-skew margin, so the id may no longer be held and a resubmission could commit twice. Nothing was written. Read the id back to learn whether it committed, and mint a new transaction id for a new attempt. Checked only when the deployment runs a heartbeat, and only for new work: a retry of an id the deployment still holds replays however old its key.
+             */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `body_too_large`: the request body is larger than this route accepts. It was refused before it was read as an intent, so nothing was written. */
+            413: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `unsupported_media_type`: the request body was not sent as `Content-Type: application/json`. Nothing was written; resend it with that header. */
+            415: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `not_primary` — cluster mode: this mutation reached a non-primary replica. This attempt may or may not have been recorded: a primary stepping down can answer so after proposing it. Carries `primary_api_addr`, the primary's API origin as this replica last knew it: a hint that can trail a failover. Re-send the same transaction id through the configured endpoints. */
+            421: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description The request was well-formed HTTP but could not be recorded: `invalid_envelope` (the body is not JSON, is cut short, or does not fit the envelope, for example a missing required field; the `message` gives the serde path and a short reason and never repeats a value from the body; refused before the intent was read, so nothing was written), `invalid_agent_uri` (carries `uri`), `capability_mapping` (the action maps to no capability the attestation grants; carries `action`), `multi_currency_mandate_charge` (carries `currencies`), `invalid_key_mint` (the retry key's `minted_at_ms`, or the time a UUIDv7 `transaction` id records, is more than a 5-minute clock-skew margin ahead of the service's clock, or the two differ by more than it; the `message` names the check and its bound; nothing was written; send the time the id was minted, as it was first sent), `substrate_rejected` with `kind: "validation"` (the ledger refused it — unbalanced legs, unknown account, a breached mandate ceiling, a matching-law violation, or a usage-law violation: metering past consumption, billing past metering, a correction below zero, an unknown or wrong-currency usage balance — the `message` is the compliance-English refusal with exact figures, and nothing posted; `law` names the law it would have broken, or `cause` names what to change when it broke none), or `gateway_error` for a rejection with no more specific code. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            429: components["responses"]["RateLimited"];
+            /** @description `idempotency_seed_refused` — cluster mode: the ledger refused this primary's idempotency seed, so this request was not proposed and nothing was written. Terminal: no `Retry-After`, and a retry reaches the same refusal until an operator steps the primary down. `proposal_refused` — cluster mode: the node refused the proposal for a reason this build does not name, so this request was not proposed and nothing was written. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `commit_unavailable` — cluster mode: the request was proposed and its commit could not be confirmed (timeout, node gone, or an ambiguous view change). It may or may not have landed; retry (submission is idempotent by `transaction` id) or consult `GET /api/v1/transactions/{txn_id}`. `idempotency_unseeded` — this request was not written and will not be, because the idempotency index is not seeded yet (a new or just-upgraded cluster, or one without a quorum); retry it. That says nothing about the transaction id: an earlier attempt with the same id, sent to an earlier primary, may still commit. `not_normal` — cluster mode: the replica is in a view change or a recovery, so this request was not proposed and nothing was written; retry it shortly. `archive_pressure` — cluster mode: the primary's local archive is past its hold ceiling, so this request was not proposed and nothing was written; retry it later. `quarantined` — replay verification found a divergence on this node, so this request was not proposed and nothing was written; it does not clear on its own, and an operator must resolve it. None of these three says anything about the transaction id. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `substrate_rejected` with `kind: "capacity"` — a ledger capacity bound was breached. `idempotency_window_full`: the idempotency index is at its byte budget, so this id cannot be held. Nothing was written, and ids already held still replay. `Retry-After` names the earliest sweep that evicts enough aged ids, a lower bound after a view change; it is absent when ageing alone cannot make room or the heartbeat is off. Retry the same request. `snapshot_capacity`, cluster mode: the primary's next snapshot frame, with this commit in it, would pass half its snapshot store. Nothing was written. `Retry-After` as for `idempotency_window_full`; absent, only an operator resizing the store makes room. */
+            507: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+        };
+    };
+    get_obligations: {
+        parameters: {
+            query?: {
+                /**
+                 * @description The actor: a party id (`party_…`) or a DSL party name (derived to its id).
+                 *
+                 *     **Optional, and no longer the thing that selects whose duties are returned.**
+                 *     The answer is always scoped to the party the *credential* is bound to; this
+                 *     is an assertion the service checks against that party (a mismatch is a
+                 *     `403`), kept so a caller can be explicit about who it thinks it is. Omit it
+                 *     and the caller's own party is used.
+                 */
+                actor?: string | null;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /**
+             * @description The **calling party's** open obligations. A duty-free party is not an error — it answers 200 with an empty `pending` list.
+             *
+             *     Whose duties these are is decided by the credential, never by `?actor=`.
+             */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ObligationsResponse"];
+                };
+            };
+            /** @description `unauthorized` — no `Authorization: Bearer <attestation>` was presented; or `unknown_agent` — the attested `agent://` URI is not bound to a party. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `attestation` — the attestation was rejected (bad signature, expired, or an untrusted issuer); or `forbidden` — `?actor=` named a party other than the one the calling agent is bound to. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            429: components["responses"]["RateLimited"];
+        };
+    };
+    active_policy: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /**
+             * @description The policy in force, or `{"policy": null}` if none is.
+             *
+             *     This is the endpoint to re-read after a `409` (`stale_policy` / `policy_pin_mismatch`) before resubmitting an intent: its value is what the envelope's `policy` pin must carry.
+             */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ActivePolicyResponse"];
+                };
+            };
+            429: components["responses"]["RateLimited"];
+        };
+    };
+    get_transaction: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /**
+                 * @description The client-minted transaction id (`txn_…`).
+                 * @example txn_7w5b4trnc7b2ja027jyyb64395
+                 */
+                txn_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /**
+             * @description The stored ledger record. Reading it is the idempotent replay lookup — it tells you what a previously-submitted `transaction` id did without resubmitting it.
+             *
+             *     A recorded refusal is present here like any other record, with `posted: false`.
+             *
+             *     Readable only by the party that proposed it.
+             */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TransactionRecord"];
+                };
+            };
+            /** @description `invalid_transaction_id` — the path segment is not a transaction id. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `unauthorized` — no `Authorization: Bearer <attestation>` was presented; or `unknown_agent` — the attested `agent://` URI is not bound to a party. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `attestation` — the attestation was rejected (bad signature, expired, or an untrusted issuer). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `unknown_transaction` — no such transaction, **or** the transaction belongs to another party. The two are deliberately indistinguishable: a transaction id is never an existence oracle across a tenant boundary. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            429: components["responses"]["RateLimited"];
+        };
+    };
+    get_receipt: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /**
+                 * @description The client-minted transaction id (`txn_…`).
+                 * @example txn_7w5b4trnc7b2ja027jyyb64395
+                 */
+                txn_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /**
+             * @description The signed receipt: an `axorum.evidence.v0` envelope whose base64 `payload` is the `axorum.receipt.v0` facts of the applied record. Verifiable fully offline against the deployment's published key list (`GET /api/verification-keys.json`) — see the committed JSON Schemas under `spec/schemas/`. Re-minted from the stored record on every fetch and byte-identical across fetches and to the inline `receipt` the original submission carried.
+             *
+             *     A recorded refusal's receipt is a first-class receipt (`verdict: ForbiddenRejected`, `posted: false`) — signed proof the refusal was recorded.
+             *
+             *     Readable only by the party that proposed the transaction.
+             */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Envelope"];
+                };
+            };
+            /** @description `invalid_transaction_id` — the path segment is not a transaction id. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `unauthorized` — no `Authorization: Bearer <attestation>` was presented; or `unknown_agent` — the attested `agent://` URI is not bound to a party. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `attestation` — the attestation was rejected (bad signature, expired, or an untrusted issuer). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `unknown_transaction` — no such transaction, the transaction belongs to another party, **or** its record has been archived out of the live tail. All deliberately indistinguishable (no existence oracle; no archived-vs-foreign oracle either). The commit-time inline receipt is the durable artifact for anything that outlives the tail. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            429: components["responses"]["RateLimited"];
+            /** @description `signing_not_configured` — this deployment does not sign artifacts; or `signing_unavailable` — the signing service did not answer (the transaction is committed and unaffected; retry once signing is restored). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+        };
+    };
+    get_usage: {
+        parameters: {
+            query?: {
+                /** @description `json` (default) or `text` for the compliance-English narration alone. */
+                format?: string;
+            };
+            header?: never;
+            path: {
+                /**
+                 * @description The usage-balance id (`usage_…`).
+                 * @example usage_2n4kqx21g5bty927z2tj955css
+                 */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /**
+             * @description The balance's three running totals (`consumed`/`metered`/`billed`), the derived headrooms, and whether the chain has reconciled — narrated in compliance English with exact figures.
+             *
+             *     Readable only by the party that **owns** the balance.
+             *
+             *     Every counter is a 128-bit integer on the wire: decode as a big integer, not a double. `consume` has no ceiling, so a balance can lawfully outgrow `u64`.
+             */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["UsageBalanceReport"];
+                };
+            };
+            /** @description `invalid_usage_id` — the path segment is not a usage-balance id. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `unauthorized` — no `Authorization: Bearer <attestation>` was presented; or `unknown_agent` — the attested `agent://` URI is not bound to a party. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `attestation` — the attestation was rejected (bad signature, expired, or an untrusted issuer). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `unknown_usage` — no such usage balance, **or** the balance is not the calling party's: owned by another party, or opened with no owner at all (fail-closed — readable by nobody). The cases are deliberately indistinguishable: a usage id is never an existence oracle across a tenant boundary. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description `substrate_rejected` (`kind: "validation"`, `cause: "undeclared_currency"`) — the balance is the caller's and exists, but its currency was never declared, so its amounts cannot be rendered at the right scale. An operator declares it (`axorum currency declare`); the message names the code. Only ever answered after the ownership check, so it reveals nothing a `404` hides. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            429: components["responses"]["RateLimited"];
+        };
+    };
+}
+/**
+ * The capabilities this contract's server advertises in
+ * `info["x-axorum-capabilities"]` of `GET /api/openapi.json`: each token names a
+ * guarantee beyond the contract version. A client ignores tokens it does not
+ * know; an empty list promises nothing more.
+ */
+export declare const capabilities: readonly string[];
+//# sourceMappingURL=agent-plane.d.ts.map