@chitmark/sdk 0.6.5 → 0.8.0

package/dist/{trusted-ip-Ngrp6dUP.d.cts → trusted-ip-BvSjdU80.d.cts}

@@ -1,5 +1,30 @@
+/** Explicit sender-constrained credential profile. No static-key fallback. */
+interface CredentialProvider {
+    headers(input: {
+        url: string;
+        method: string;
+        signal: AbortSignal;
+    }): Promise<{
+        Authorization: string;
+        DPoP: string;
+    }>;
+}
+interface WorkloadCredential {
+    accessToken: string;
+    expiresAt: number;
+    trustExpiresAt: number;
+    revocationValidUntil: number;
+}
+declare function createDPoPCredentialProvider(options: {
+    privateKey: CryptoKey;
+    publicJwk: JsonWebKey;
+    /** Issuer-specific authenticated exchange. Must bind tokens to publicJwk. */
+    load: (signal: AbortSignal) => Promise<WorkloadCredential>;
+    refreshTimeoutMs?: number;
+}): CredentialProvider;
+
 /**
- * Shared API types for Chitmark by Open Agent Ledger.
+ * Shared API types for Chitmark.
  * Aligns with openapi/openapi.yaml and SDK.md.
  */
 /** Routing decision from verify. When degraded, this is always "challenge". */
@@ -20,11 +45,11 @@ type Action = "signup" | "trial_activation" | "api_key" | "demo_request" | "quot
  * Not "Chitmark challenged/denied a legitimate user" — that is
  * `context.decisionCosts.falseChallenge` / `falseDeny` on verify.
  */
-type Outcome = "credit_burn" | "multi_account_cluster" | "abuse_confirmed" | "converted" | "chargeback" | "churned" | "false_positive";
+type Outcome = "credit_burn" | "multi_account_cluster" | "abuse_confirmed" | "converted" | "chargeback" | "churned" | "grant_applied" | "export_executed" | "false_positive";
 /** Asymmetric-cost challenge methods (best → worst for anti-abuse).
  * `payment_preauth` validates a payment-provider setup result; it does not
  * transfer funds or authorize a purchase. */
-type ChallengeMethod = "payment_preauth" | "proof_of_work" | "device_attestation" | "web_bot_auth_stepup" | "email_otp";
+type ChallengeMethod = "payment_preauth" | "proof_of_work" | "tenant_step_up" | "device_attestation" | "web_bot_auth_stepup" | "email_otp";
 /** Client-side PII minimization mode. Default is hashed. Raw is opt-in only. */
 type PiiMode = "raw" | "hashed" | "none";
 /** Environment target; selects default base URL. */
@@ -147,7 +172,15 @@ interface VerifyContext {
     [key: string]: unknown;
 }
 /** Request body for POST /v1/verify. */
+interface ActionBinding {
+    /** Tenant-scoped opaque principal reference for sensitive actions. */
+    subject?: string;
+    digest: string;
+    challengeId?: string;
+    eventId?: string;
+}
 interface VerifyRequest {
+    actionBinding?: ActionBinding;
     idempotencyKey?: string;
     action: Action;
     /** Binding id you supply for this action attempt. Prefer high-entropy,
@@ -210,6 +243,7 @@ interface FeedbackResponse {
 type ChallengeRiskTier = "default" | "elevated" | "severe";
 /** Request body for POST /v1/challenge: issue or complete. */
 interface ChallengeRequest {
+    pendingReceipt?: string;
     /** eventId from the verify verdict that routed to challenge. */
     eventId: string;
     /** Binding id you supply for one action attempt. Prefer high-entropy,
@@ -235,6 +269,9 @@ interface ChallengeRequest {
 }
 /** Server-verified completion proof. */
 type ChallengeProof = {
+    type: "tenant_step_up";
+    assertion: string;
+} | {
     type: "proof_of_work";
     /** First nonce where sha256(`${challengeId}:${seed}:${nonce}`) hex starts with `difficulty` zero nibbles. */
     nonce: string;
@@ -248,6 +285,9 @@ interface ChallengeResponse {
     challengeId: string;
     method: ChallengeMethod;
     instructions: {
+        type: "tenant_step_up";
+        nonce: string;
+    } | {
         type: "pow";
         /** Leading zero nibbles required. Sealed at issue; completion validates this value. */
         difficulty: number;
@@ -268,7 +308,8 @@ interface ChallengeResponse {
 }
 /** Response from POST /v1/challenge (completion mode).
  * Session-state change only: does not authorize the action. Re-verify with
- * `context.challengeId` and proceed only on non-degraded allow. */
+ * `context.challengeId` for standalone challenges or the original action
+ * binding plus the challenge and event IDs for operation-bound challenges. */
 interface ChallengeCompletionResponse {
     /** Friction satisfied for boundTo; not permission to continue without re-verify. */
     ok: true;
@@ -280,7 +321,9 @@ interface ChallengeCompletionResponse {
 /** Client constructor options. */
 interface ChitmarkOptions {
     /** API key (Bearer). Use process.env.CHITMARK_API_KEY. */
-    apiKey: string;
+    apiKey?: string;
+    /** Explicit DPoP authentication; mutually exclusive with apiKey. */
+    credentialProvider?: CredentialProvider;
     /**
      * Timeout/error behavior. Fixed to "challenge": never allow silent bypass.
      * @default "challenge"
@@ -317,6 +360,219 @@ interface ChitmarkErrorBody {
     code?: string;
 }
 
+interface AttributionAgentProof {
+    linkId: string;
+    nonce: string;
+    issuedAt: number;
+    signature: string;
+}
+interface AttributionResolveOptions {
+    request: {
+        url?: string;
+        headers: Headers | Record<string, string | string[] | undefined>;
+    };
+    /** Explicit site origin for requests with a relative URL, such as IncomingMessage. */
+    site?: string;
+    /** Opaque credential supplied by the integrating server, never a raw browser cookie. */
+    session?: string;
+    agentProof?: AttributionAgentProof;
+    piiMode?: PiiMode;
+    idempotencyKey?: string;
+}
+interface AttributionResult {
+    id: string;
+    agent: {
+        detected: boolean;
+        provider: string | null;
+        operator_verified: boolean;
+    };
+    identity: {
+        recognized: boolean;
+        subject_id: string | null;
+        scope: "site" | null;
+        match: "none" | "existing_session" | "verified_identity_link";
+    };
+    principal: {
+        status: "unknown" | "previously_verified";
+        email: string | null;
+        email_verified: boolean | null;
+        current_delegation_verified: boolean | null;
+        document_verified: boolean | null;
+    };
+}
+interface AttributionLinkRequest {
+    enrollmentId: string;
+    site: string;
+    agentKey: {
+        kty: "OKP";
+        crv: "Ed25519";
+        x: string;
+    };
+    recipientKeyId: string;
+    emailConsent: boolean;
+    expiresAt: number;
+    principalProof: string;
+}
+interface AttributionLink {
+    id: string;
+    expires_at: number;
+}
+
+/** Integer USD cents. Customer purchases are separate from Chitmark subscriptions. */
+interface PaidResource {
+    resourceId: string;
+    version: number;
+    kind: "api_call" | "dataset" | "compute";
+    unit: "call" | "access" | "compute_second";
+    unitAmount: number;
+    currency: "usd";
+    minQuantity: number;
+    maxQuantity: number;
+    maxAmount: number;
+    quoteTtlSeconds: number;
+    accessTtlSeconds: number;
+    enabled: boolean;
+    refundTerms: "unused_only";
+}
+type ChargeBase = {
+    sellerTenantId: string;
+    idempotencyKey?: string;
+};
+type PurchaseRef = ChargeBase & {
+    purchaseId: string;
+};
+type ChargeRequest = (ChargeBase & {
+    operation: "resource";
+    resourceId: string;
+}) | (ChargeBase & {
+    operation: "quote";
+    resourceId: string;
+    quantity: number;
+    operationDigest: string;
+}) | (PurchaseRef & {
+    operation: "accept";
+    quoteVersion: string;
+    maxAmount: number;
+    currency: "usd";
+}) | (PurchaseRef & {
+    operation: "status" | "cancel" | "reconcile";
+}) | (PurchaseRef & {
+    operation: "permission";
+    allowed: boolean;
+    eventId?: string;
+}) | (PurchaseRef & {
+    operation: "reserve";
+    executionId: string;
+    operationDigest: string;
+    units: number;
+}) | (PurchaseRef & {
+    operation: "usage";
+    executionId: string;
+    sequence: number;
+    usedUnits: number;
+    result: "delivered" | "failed" | "unknown";
+}) | (PurchaseRef & {
+    operation: "refund";
+    amount: number;
+}) | (ChargeBase & {
+    operation: "configure";
+    resource: PaidResource;
+}) | (ChargeBase & {
+    operation: "budget";
+    buyerTenantId: string;
+    limit: number;
+});
+interface ChargeQuote {
+    version: string;
+    sellerTenantId: string;
+    buyerTenantId: string;
+    actingAgent: string;
+    resource: PaidResource;
+    quantity: number;
+    amount: number;
+    currency: "usd";
+    operationDigest: string;
+    expiresAt: number;
+    accessUntil: number;
+}
+interface ChargeExecution {
+    executionId: string;
+    /** Original seller-owned verify event captured at reservation, when required. */
+    eventId?: string;
+    units: number;
+    usedUnits: number;
+    sequence: number;
+    state: "reserved" | "delivered" | "failed" | "unknown";
+    leaseUntil: number;
+}
+interface ChargePurchase {
+    purchaseId: string;
+    quote: ChargeQuote;
+    accepted: boolean;
+    permission: {
+        allowed: boolean;
+        source: "seller";
+        eventId?: string;
+    };
+    payment: {
+        state: "pending" | "authorized" | "settled" | "failed" | "canceled" | "partially_refunded" | "refunded" | "disputed" | "unknown";
+        authorizedAmount: number;
+        capturedAmount: number;
+        refundedAmount: number;
+        refundState?: "none" | "pending" | "succeeded" | "failed" | "unknown";
+        disputedAmount: number;
+        providerFee: number | null;
+        checkedAt: number | null;
+        source: "provider";
+    };
+    delivery: {
+        source: "seller_report";
+        executions: ChargeExecution[];
+    };
+    stopped: boolean;
+    refundRequestedAmount: number;
+    createdAt: number;
+    updatedAt: number;
+    checkoutUrl?: string;
+}
+type ChargeResponse = {
+    ok: true;
+    purchase: ChargePurchase;
+    next: "accept" | "pay" | "wait" | "seller_permission" | "execute" | "reconcile" | "complete";
+    reservation?: {
+        executionId: string;
+        granted: boolean;
+        leaseUntil: number;
+    };
+} | {
+    ok: true;
+    resource: PaidResource;
+} | {
+    ok: true;
+    budget: {
+        limit: number;
+        committed: number;
+    };
+};
+/** Operational summary, never an execution authorization. Seller cost is optional
+ * application evidence; absent cost/fees leaves margin unknown. */
+declare function summarizeCharge(p: ChargePurchase, now?: number, sellerCostCents?: number): {
+    paidCompletion: boolean;
+    billedCents: number;
+    sellerReportedDeliveredCents: number;
+    deliveredUnits: number;
+    unresolvedUnits: number;
+    unresolvedAgeUpperBoundMs: number | null;
+    refundedCents: number;
+    disputedCents: number;
+    captureFeeCents: number | null;
+    sellerNetAfterCaptureFeeCents: number | null;
+    sellerMarginCents: number | null;
+    duplicateCharges: null;
+    duplicateEffects: null;
+    observedElapsedMs: number;
+};
+
 /**
  * Base error for all Chitmark client failures.
  */
@@ -393,7 +649,7 @@ interface VerdictTokenClaims {
     exp: number;
     degraded: boolean;
 }
-type VerdictTokenErrorCode = "malformed_token" | "wrong_algorithm" | "wrong_type" | "jwks_unavailable" | "unknown_kid" | "invalid_signature" | "expired" | "not_yet_valid" | "wrong_issuer" | "wrong_session" | "wrong_aud" | "wrong_tenant";
+type VerdictTokenErrorCode = "malformed_token" | "wrong_algorithm" | "wrong_type" | "jwks_unavailable" | "unknown_kid" | "invalid_signature" | "expired" | "not_yet_valid" | "wrong_issuer" | "wrong_session" | "wrong_aud" | "wrong_tenant" | "wrong_action_binding";
 declare class VerdictTokenError extends ChitmarkError {
     name: string;
     constructor(code: VerdictTokenErrorCode, message: string);
@@ -435,11 +691,35 @@ interface VerifyVerdictTokenOptions {
  * cross-service authorization, not optional hints.
  */
 declare function verifyVerdictToken(token: string, options: VerifyVerdictTokenOptions): Promise<VerdictTokenClaims>;
+/** Actions whose receipts require `tenant_step_up` proof and a bound subject. */
+declare const SENSITIVE_RECEIPT_ACTIONS: readonly ["api_key", "data_export", "session_establish", "privilege_elevate", "authenticator_replace", "recovery_contact_change", "session_use", "privilege_change", "release_deploy", "bulk_mutation", "commitment_change", "agent_effect", "agent_escalation", "quote_generate", "queue_priority"];
+type SensitiveReceiptAction = (typeof SENSITIVE_RECEIPT_ACTIONS)[number];
+interface VerifyActionReceiptOptions extends Omit<VerifyVerdictTokenOptions, "aud" | "issuer" | "leewaySeconds"> {
+    audience: string;
+    action: "trial_activation" | SensitiveReceiptAction;
+    subject?: string;
+    environment: "test" | "live";
+    surface: string;
+    digest: string;
+    policy: string;
+    proof: "none" | "pow_severe" | "tenant_step_up";
+}
+interface ActionReceiptClaims extends VerdictTokenClaims {
+    action: "trial_activation" | SensitiveReceiptAction;
+    subject?: string;
+    environment: "test" | "live";
+    surface: string;
+    digest: string;
+    policy: string;
+    proof: "none" | "pow_severe" | "tenant_step_up";
+    enforcementMode: "enforce";
+}
+/** Verify authorization for an exact operation, using trusted expected values. */
+declare function verifyActionReceipt(token: string, options: VerifyActionReceiptOptions): Promise<ActionReceiptClaims>;
 
 /**
- * Official Chitmark client (Open Agent Ledger): three verbs:
- * verify, feedback, challenge. Trust decisions on agent-mediated actions,
- * tuned by business outcomes.
+ * Official Chitmark client: security operations and the paid-access lifecycle.
+ * Trust decisions on agent-mediated actions, tuned by business outcomes.
  *
  * @example
  * ```ts
@@ -451,7 +731,16 @@ declare function verifyVerdictToken(token: string, options: VerifyVerdictTokenOp
  * ```
  */
 declare class Chitmark {
-    private readonly apiKey;
+    readonly attribution: {
+        resolve: (input: AttributionResolveOptions) => Promise<AttributionResult>;
+        get: (id: string) => Promise<AttributionResult>;
+        createLink: (input: AttributionLinkRequest, idempotencyKey?: string) => Promise<AttributionLink>;
+        revokeLink: (id: string) => Promise<void>;
+    };
+    /** Paid access lifecycle. Transport uncertainty must be resumed, never treated as payment. */
+    charge(request: ChargeRequest): Promise<ChargeResponse>;
+    private readonly apiKey?;
+    private readonly credentialProvider?;
     private readonly baseUrl;
     private readonly timeoutMs;
     private readonly piiMode;
@@ -499,7 +788,8 @@ declare class Chitmark {
     /**
      * Complete a challenge by submitting its solved proof. Clears only the bound
      * session, once. Does not authorize the action: re-verify with
-     * `context.challengeId` and proceed only on non-degraded allow.
+     * `context.challengeId` for standalone challenges or the original action
+     * binding plus the challenge and event IDs for operation-bound challenges.
      */
     completeChallenge(request: {
         eventId: string;
@@ -523,6 +813,7 @@ declare class Chitmark {
         method: string;
         body?: unknown;
         idempotencyKey?: string;
+        timeoutMs?: number;
     }): Promise<T>;
     /** Public accessors for inspection / tests. */
     get config(): {
@@ -594,6 +885,163 @@ declare function isEligibleAllow(verdict: Verdict): verdict is EligibleAllowVerd
  */
 declare function verdictToHttpStatus(verdict: Verdict): ChitmarkHttpStatus;
 
+/** Server-owned operation for the trial credit grant profile. Use opaque IDs. */
+interface TrialCreditOperation {
+    operationId: string;
+    target: string;
+    quota: number;
+    recipient?: string;
+}
+/** Hash the exact operation that will be executed. IDs are case sensitive. */
+declare function trialCreditOperationDigest(operation: TrialCreditOperation): Promise<string>;
+
+/** Offline evidence only. These APIs never grant execution authority or fetch trust. */
+type EvidenceKey = {
+    kid: string;
+    jwk: Record<string, unknown>;
+    notBefore: number;
+    notAfter: number;
+    revokedAt?: number;
+    compromisedAt?: number;
+};
+type EvidenceSigningKey = {
+    kty?: string;
+    crv?: string;
+    alg?: string;
+    x?: string;
+    y?: string;
+    d?: string;
+    ext?: boolean;
+    key_ops?: string[];
+};
+declare class EvidenceError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+declare function evidenceAssert(value: unknown, code: string): asserts value;
+/** Restricted canonical JSON: ASCII strings/keys, safe integers, arrays and plain objects. */
+declare function canonicalEvidence(value: unknown): string;
+declare function evidenceHash(value: string): Promise<string>;
+declare function evidenceKeyAt(history: EvidenceKey[], kid: string, at: number): EvidenceKey;
+declare function verifyEvidenceSignature(token: string, typ: string, history: EvidenceKey[], at: number): Promise<Record<string, unknown>>;
+declare function signEvidence(payload: object, typ: string, kid: string, jwk: EvidenceSigningKey): Promise<string>;
+type PortableRecord = {
+    id: string;
+    eventId: string;
+    kind: "decision" | "execution" | "outcome";
+    occurredAt: number;
+    recordedAt: number;
+    policyRevision: string | null;
+    result: string;
+    source: "decision_service" | "customer_report";
+    receipt: string | null;
+};
+type EvidenceManifest = {
+    version: 1;
+    issuer: "https://portal.chitmark.com";
+    purpose: "historical_evidence";
+    tenantId: string;
+    startAt: number;
+    endAt: number;
+    createdAt: number;
+    sourceAsOf: number;
+    timeBasis: "issuer_and_ingestion_clocks_not_independent_time";
+    completeness: "unknown";
+    gaps: string[];
+    retention: {
+        deleteAfter: number;
+        recipient: string;
+        exportedCopies: "recipient_controlled";
+        redaction: "minimized";
+    };
+    records: PortableRecord[];
+};
+declare function validateManifest(value: EvidenceManifest, tenantId: string): void;
+type EvidenceBundle = {
+    manifest: EvidenceManifest;
+    signature: string;
+};
+declare function verifyEvidenceBundle(bundle: EvidenceBundle, options: {
+    tenantId: string;
+    recipient: string;
+    trustedKeys: EvidenceKey[];
+    now: number;
+}): Promise<{
+    purpose: "historical_evidence";
+    executionAuthorized: false;
+    integrity: "valid";
+    completeness: "unknown";
+    outcomeTruth: "not_established";
+    gaps: string[];
+}>;
+/** The witness is supplied by the caller from an independently retained checkpoint,
+ * never taken from a bundle's own claims. Hash comparison binds the exact receipt. */
+declare function verifyHistoricalReceipt(token: string, options: {
+    tenantId: string;
+    session: string;
+    trustedKeys: EvidenceKey[];
+    witness?: {
+        tokenHash: string;
+        observedAt: number;
+    };
+}): Promise<{
+    purpose: "historical_evidence";
+    executionAuthorized: false;
+    eventId: string;
+    policyRevision: string | null;
+    timeIntegrity: string;
+}>;
+
+type EvidenceCheckpoint = {
+    version: 1;
+    tenantId: string;
+    epoch: string;
+    expiresAt: number;
+    size: number;
+    root: string;
+    observedAt: number;
+};
+type Commitment = {
+    id: string;
+    salt: string;
+    record: object;
+    ingestedAt: number;
+};
+declare const evidenceCommitment: (cp: Pick<EvidenceCheckpoint, "tenantId" | "epoch" | "expiresAt">, record: object, salt: string) => Promise<string>;
+/** Bounded linear commitment proof, not a public transparency log or a minimal Merkle proof. */
+declare function checkpointFromCommitments(input: {
+    tenantId: string;
+    epoch: string;
+    expiresAt: number;
+    observedAt: number;
+    commitments: string[];
+}): Promise<EvidenceCheckpoint>;
+declare function verifyCheckpointAppend(older: EvidenceCheckpoint, newer: EvidenceCheckpoint, appended: string[] | null, options: {
+    tenantId: string;
+    now: number;
+}): Promise<{
+    status: "unavailable";
+    completeness: "unknown";
+} | {
+    status: "consistent";
+    completeness: "unknown";
+}>;
+declare function verifyCheckpointInclusion(checkpoint: EvidenceCheckpoint, proof: {
+    index: number;
+    record: object;
+    salt: string;
+    commitments: string[];
+} | null, options: {
+    tenantId: string;
+    now: number;
+}): Promise<{
+    status: "unavailable";
+    completeness: "unknown";
+} | {
+    status: "included";
+    completeness: "unknown";
+}>;
+
 /**
  * Resolve a client IP for verify subject signals from a Fetch Request.
  *
@@ -605,4 +1053,4 @@ declare function verdictToHttpStatus(verdict: Verdict): ChitmarkHttpStatus;
  */
 declare function getTrustedClientIp(req: Request): string;
 
-export { type Action as A, VerdictTokenError as B, Chitmark as C, type Decision as D, type EligibleAllowVerdict as E, type FeedbackRequest as F, type VerdictTokenErrorCode as G, type VerifyVerdictTokenOptions as H, degradedChallengeVerdict as I, enforceDegradedNeverAllow as J, getTrustedClientIp as K, hashEmailSha256 as L, isEligibleAllow as M, minimizeFormData as N, type OnDegraded as O, type PiiMode as P, truncateIp as Q, verdictToHttpStatus as R, type Subject as S, verifyVerdictToken as T, type VerifyContext as V, type VerifyRequest as a, type Verdict as b, type ActorType as c, CHITMARK_HTTP_STATUS as d, CHITMARK_HTTP_STATUS_MEANING as e, type ChallengeCompletionResponse as f, type ChallengeMethod as g, type ChallengeProof as h, type ChallengeRequest as i, type ChallengeResponse as j, type ChallengeRiskTier as k, ChitmarkApiError as l, type ChitmarkEnv as m, ChitmarkError as n, type ChitmarkErrorBody as o, type ChitmarkHttpStatus as p, type ChitmarkOptions as q, type DecisionCosts as r, type EnforcementMode as s, type FeedbackResponse as t, type FeedbackSource as u, type FeedbackUnit as v, type Outcome as w, type Principal as x, VERDICT_TOKEN_ISSUER as y, type VerdictTokenClaims as z };
+export { type VerdictTokenClaims as $, type Action as A, type DecisionCosts as B, Chitmark as C, type Decision as D, type EligibleAllowVerdict as E, type EnforcementMode as F, type EvidenceBundle as G, type EvidenceCheckpoint as H, EvidenceError as I, type EvidenceKey as J, type EvidenceManifest as K, type EvidenceSigningKey as L, type FeedbackRequest as M, type FeedbackResponse as N, type FeedbackSource as O, type FeedbackUnit as P, type OnDegraded as Q, type Outcome as R, type PiiMode as S, type PortableRecord as T, type Principal as U, type VerifyContext as V, SENSITIVE_RECEIPT_ACTIONS as W, type SensitiveReceiptAction as X, type Subject as Y, type TrialCreditOperation as Z, VERDICT_TOKEN_ISSUER as _, type VerifyRequest as a, VerdictTokenError as a0, type VerdictTokenErrorCode as a1, type VerifyActionReceiptOptions as a2, type VerifyVerdictTokenOptions as a3, type WorkloadCredential as a4, canonicalEvidence as a5, checkpointFromCommitments as a6, createDPoPCredentialProvider as a7, degradedChallengeVerdict as a8, enforceDegradedNeverAllow as a9, summarizeCharge as aA, evidenceAssert as aa, evidenceCommitment as ab, evidenceHash as ac, evidenceKeyAt as ad, getTrustedClientIp as ae, hashEmailSha256 as af, isEligibleAllow as ag, minimizeFormData as ah, signEvidence as ai, trialCreditOperationDigest as aj, truncateIp as ak, validateManifest as al, verdictToHttpStatus as am, verifyActionReceipt as an, verifyCheckpointAppend as ao, verifyCheckpointInclusion as ap, verifyEvidenceBundle as aq, verifyEvidenceSignature as ar, verifyHistoricalReceipt as as, verifyVerdictToken as at, type ChargeExecution as au, type ChargePurchase as av, type ChargeQuote as aw, type ChargeRequest as ax, type ChargeResponse as ay, type PaidResource as az, type Verdict as b, type ActionBinding as c, type ActionReceiptClaims as d, type ActorType as e, type AttributionAgentProof as f, type AttributionLink as g, type AttributionLinkRequest as h, type AttributionResolveOptions as i, type AttributionResult as j, CHITMARK_HTTP_STATUS as k, CHITMARK_HTTP_STATUS_MEANING as l, type ChallengeCompletionResponse as m, type ChallengeMethod as n, type ChallengeProof as o, type ChallengeRequest as p, type ChallengeResponse as q, type ChallengeRiskTier as r, ChitmarkApiError as s, type ChitmarkEnv as t, ChitmarkError as u, type ChitmarkErrorBody as v, type ChitmarkHttpStatus as w, type ChitmarkOptions as x, type Commitment as y, type CredentialProvider as z };