@oxy.so/contracts 1.0.0

package/dist/esm/inference/routingPolicy.js

@@ -0,0 +1,315 @@
+/**
+ * Routing policy — the customer-facing routing configuration.
+ *
+ * Stored under an Oxy account or application (the control plane owns it),
+ * executed by the data plane, which owns execution. Every request records the
+ * exact `{routingPolicyId, policyVersion}` it was served under, so a route
+ * decision months old can be explained against the policy that was in force,
+ * not against the policy that exists now.
+ *
+ * Two rules shape the fallback controls:
+ *
+ *  - **Same-model deployment failover is not cross-model fallback.** Moving
+ *    between two deployments of the SAME revision is an availability decision
+ *    and is on by default; serving a DIFFERENT model is a substitution the
+ *    customer must have authorized by name.
+ *  - **A request for a concrete model is never silently replaced.** Cross-model
+ *    fallback is an explicit list of references, and a switch that uses it emits
+ *    a customer-visible route-switch event.
+ *
+ * The controls are flat and independent, matching what Console renders — which
+ * means contradictory combinations are EXPRESSIBLE and must therefore be
+ * REJECTED, rather than being quietly resolved by whichever field the executor
+ * happens to read first. That rejection is `routingPolicySchema`'s refinement.
+ *
+ * **The policy itself never crosses to the data plane.** What crosses is
+ * {@link authorizedRouteSchema} — the candidate routes that SURVIVED these
+ * controls, in preference order — plus {@link routingPolicyReferenceSchema} as
+ * provenance for the receipt. The data plane holds no control value and needs
+ * none: it fails over by taking the next entry. See ADR 0017.
+ *
+ * Decided in: docs/adr/0008-catalogue-concept-separation.md,
+ * docs/adr/0017-authorized-routes-in-the-envelope.md, issue #972 workstream 6.
+ */
+import { z } from "zod";
+import { deploymentIdSchema, inferenceProviderSlugSchema, inferenceRegionSchema, inferenceTimestampSchema, modelReferenceSchema, oxyAccountIdSchema, oxyApplicationIdSchema, routingProfileIdSchema, } from "./identifiers.js";
+import { kaanaCredentialHandleSchema } from "./providerConnection.js";
+import { exactDecimalSchema, currencyCodeSchema, unitPriceSchema, } from "./money.js";
+/**
+ * What a policy resolves to when a caller names no model.
+ *
+ * A discriminated union rather than two optional fields, so "which one did the
+ * customer configure" is never a question about which field is non-null.
+ */
+export const routingTargetSchema = z.discriminatedUnion("kind", [
+    z
+        .object({
+        kind: z.literal("model"),
+        modelReference: modelReferenceSchema,
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal("routing_profile_id"),
+        routingProfileId: routingProfileIdSchema,
+    })
+        .strict(),
+]);
+/**
+ * Which account or application a policy governs.
+ *
+ * Application-scoped policies are the common case; an account-scoped policy is
+ * the floor its applications inherit, and inheritance is resolved by the control
+ * plane before a policy reaches the data plane.
+ */
+export const routingPolicyScopeSchema = z.discriminatedUnion("kind", [
+    z
+        .object({ kind: z.literal("account"), accountId: oxyAccountIdSchema })
+        .strict(),
+    z
+        .object({
+        kind: z.literal("application"),
+        accountId: oxyAccountIdSchema,
+        applicationId: oxyApplicationIdSchema,
+    })
+        .strict(),
+]);
+/**
+ * The fallback controls, kept together so a reviewer sees all three at once.
+ *
+ * `authorizedCrossModel` is a list of model references the customer has
+ * explicitly permitted as substitutes — never a boolean, because "allow
+ * fallback" without naming the destination is exactly the silent substitution
+ * the invariant forbids.
+ */
+export const routingFallbackPolicySchema = z
+    .object({
+    disabled: z.boolean(),
+    sameModelDeployment: z.boolean(),
+    authorizedCrossModel: z.array(modelReferenceSchema).default([]),
+})
+    .strict();
+/**
+ * A versioned routing policy.
+ *
+ * `policyVersion` is the CUSTOMER's revision of their own configuration and is
+ * unrelated to `schemaVersion`, which is the version of this wire shape. They
+ * are two different clocks: a customer edits their policy without any contract
+ * change, and a contract change does not renumber anybody's policy.
+ */
+export const routingPolicySchema = z
+    .object({
+    /** See `version.ts`: exchanged with the data plane on its own. */
+    schemaVersion: z.literal(2),
+    routingPolicyId: z.string().min(1).max(128),
+    policyVersion: z.number().int().positive().safe(),
+    scope: routingPolicyScopeSchema,
+    /** Absent when every request must name its own model. */
+    defaultTarget: routingTargetSchema.optional(),
+    /** Empty means "no allowlist" — every provider qualifies unless denied. */
+    providerAllowlist: z.array(inferenceProviderSlugSchema).default([]),
+    providerDenylist: z.array(inferenceProviderSlugSchema).default([]),
+    /** Empty means "no residency constraint". */
+    allowedRegions: z.array(inferenceRegionSchema).default([]),
+    deniedRegions: z.array(inferenceRegionSchema).default([]),
+    requireZeroDataRetention: z.boolean(),
+    prohibitTrainingOnCustomerData: z.boolean(),
+    /** Ceilings on what a route may cost the customer, quoted like catalogue prices. */
+    maxPricePerUnit: z.array(unitPriceSchema).default([]),
+    maxPricePerRequest: z
+        .object({ amount: exactDecimalSchema, currency: currencyCodeSchema })
+        .strict()
+        .optional(),
+    /** What to optimise for among the routes that qualify. */
+    optimiseFor: z.enum(["price", "latency", "throughput", "balanced"]),
+    /** Serve only from Oxy's own hosting of open-weight models. */
+    oxyHostedOnly: z.boolean(),
+    /** License / usage-right constraints. Empty license list means unconstrained. */
+    allowedLicenseIds: z.array(z.string().min(1).max(128)).default([]),
+    requireCommercialUseRights: z.boolean(),
+    fallback: routingFallbackPolicySchema,
+    /** Whether the customer's own provider credentials may or must be used. */
+    byokPreference: z.enum(["disabled", "prefer", "require"]),
+    /** Enterprise reserved capacity rather than shared endpoints. */
+    dedicatedCapacity: z.enum(["disabled", "prefer", "require"]),
+    updatedAt: inferenceTimestampSchema,
+})
+    .superRefine((policy, ctx) => {
+    // "Requires a denied provider": the allowlist is the requirement, so a
+    // provider named in both lists is a policy that can never resolve. This is
+    // also the shape an Oxy-hosted-only policy takes when it pins a provider it
+    // has itself denied — whether a provider is Oxy-hosted is a property of the
+    // catalogue entry, not of its slug, so the data plane resolves it, not this
+    // schema.
+    const denied = new Set(policy.providerDenylist);
+    for (const [index, provider] of policy.providerAllowlist.entries()) {
+        if (denied.has(provider)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["providerAllowlist", index],
+                message: `provider ${provider} is both required by the allowlist and denied`,
+            });
+        }
+    }
+    const deniedRegions = new Set(policy.deniedRegions);
+    for (const [index, region] of policy.allowedRegions.entries()) {
+        if (deniedRegions.has(region)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["allowedRegions", index],
+                message: `region ${region} is both allowed and denied`,
+            });
+        }
+    }
+    // Fallback disabled is an instruction to fail the request rather than serve
+    // it elsewhere. Combined with a fallback route it is not a strict policy but
+    // an ambiguous one, and the ambiguity resolves differently in each executor.
+    if (policy.fallback.disabled && policy.fallback.sameModelDeployment) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["fallback", "sameModelDeployment"],
+            message: "fallback is disabled, so same-model deployment failover cannot be enabled",
+        });
+    }
+    if (policy.fallback.disabled &&
+        policy.fallback.authorizedCrossModel.length > 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["fallback", "authorizedCrossModel"],
+            message: "fallback is disabled, so no cross-model fallback may be authorized",
+        });
+    }
+    // BYOK routes run on the customer's own upstream provider account, which is
+    // by definition not Oxy's hosting.
+    if (policy.oxyHostedOnly && policy.byokPreference === "require") {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["byokPreference"],
+            message: "an Oxy-hosted-only policy cannot also require a customer provider credential",
+        });
+    }
+    const ceilingUnits = policy.maxPricePerUnit.map((ceiling) => ceiling.unit);
+    if (new Set(ceilingUnits).size !== ceilingUnits.length) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["maxPricePerUnit"],
+            message: "a unit may carry only one price ceiling",
+        });
+    }
+    if (policy.maxPricePerRequest !== undefined) {
+        for (const [index, ceiling] of policy.maxPricePerUnit.entries()) {
+            if (ceiling.currency !== policy.maxPricePerRequest.currency) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path: ["maxPricePerUnit", index, "currency"],
+                    message: "every price ceiling in one policy must use the same currency",
+                });
+            }
+        }
+    }
+});
+/**
+ * The reference a request records: which policy, at which of the customer's own
+ * revisions. Embedded in the request envelope and in the settled receipt, so a
+ * charge can be explained against the exact configuration that produced it.
+ */
+export const routingPolicyReferenceSchema = z
+    .object({
+    routingPolicyId: z.string().min(1).max(128),
+    policyVersion: z.number().int().positive().safe(),
+})
+    .strict();
+/* -------------------------------------------------------------------------- */
+/*  Pre-authorized routes                                                     */
+/* -------------------------------------------------------------------------- */
+/**
+ * What every authorized route carries, whichever kind it is.
+ *
+ * Exactly what EXECUTING a route needs, and nothing a policy could be
+ * re-derived from. There is no price, no data-retention flag, no licence id and
+ * no availability scope here: those are the values the control plane already
+ * evaluated to put this entry in the list, and repeating them would invite the
+ * data plane to evaluate them a second time — differently, in another language.
+ *
+ * `regions` is plural and matches `modelDeploymentSchema.regions`, because a
+ * deployment declares every ATTESTED region it MAY serve from and choosing among
+ * them is routing execution (ADR 0006). Oxy checked the whole set against the
+ * customer's residency controls as a SUBSET, so any non-empty region in this
+ * list is one the policy permits and the data plane's choice among them cannot
+ * escape it. An empty list means no location was attested and can only survive a
+ * request with no explicit regional control; it never means global. Collapsing
+ * the set to one invented region would make Oxy take a decision the boundary
+ * assigns elsewhere.
+ */
+const authorizedRouteFields = {
+    /** Which concrete endpoint. Opaque to customers; the data plane's own key. */
+    deploymentId: deploymentIdSchema,
+    /** Always revision-pinned: the entry names the exact weights to serve. */
+    modelReference: modelReferenceSchema,
+    provider: inferenceProviderSlugSchema,
+    regions: z.array(inferenceRegionSchema),
+    /**
+     * Exact customer credential binding. Absence means a platform credential;
+     * presence names the immutable Kaana generation this route may use.
+     */
+    customerProviderCredential: z
+        .object({
+        credentialHandle: kaanaCredentialHandleSchema,
+        credentialRevision: z.number().int().positive().safe(),
+        ownerAccountId: oxyAccountIdSchema,
+        connectionId: z.string().min(1).max(128),
+        environment: z.enum(["development", "staging", "production"]),
+    })
+        .strict()
+        .optional(),
+};
+/**
+ * One route the control plane has already authorized for one request.
+ *
+ * **Authorization is an ENTRY, never a boolean.** The same stance
+ * `inference_routing_policy_fallbacks` takes in storage: being allowed to serve
+ * a route IS appearing here, and every entry names its destination. A flag
+ * saying "substitution allowed" without naming the destination is exactly the
+ * silent substitution the platform forbids, and it invents a "flag set, list
+ * empty" state somebody then has to decide what to do with.
+ *
+ * Discriminated on `substitution`, relative to the FIRST entry — the primary
+ * route Oxy resolved:
+ *
+ *  - `same_model` serves the same model line as the primary. This is
+ *    availability failover between deployments of one model.
+ *  - `cross_model` serves a DIFFERENT model line, and is expressible only with
+ *    `authorizedByPolicy: true` as a literal. So "a model was substituted
+ *    without the customer authorizing it" is not a sentence this contract can
+ *    say — the same construction `inferenceRouteSwitchDetailSchema` uses to make
+ *    the resulting route-switch event unreportable.
+ */
+export const authorizedRouteSchema = z
+    .discriminatedUnion("substitution", [
+    z
+        .object({
+        substitution: z.literal("same_model"),
+        ...authorizedRouteFields,
+    })
+        .strict(),
+    z
+        .object({
+        substitution: z.literal("cross_model"),
+        ...authorizedRouteFields,
+        /** Literal `true`: an unauthorized substitution cannot be expressed. */
+        authorizedByPolicy: z.literal(true),
+    })
+        .strict(),
+])
+    .superRefine((route, ctx) => {
+    // Same rule as `modelDeploymentSchema`: a route serves specific weights. An
+    // unpinned entry would leave the data plane choosing a revision, which is
+    // the one substitution the customer never authorized by naming a model.
+    if (!route.modelReference.includes("@")) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["modelReference"],
+            message: "an authorized route must pin an immutable revision (<publisher>/<model>@<revision>)",
+        });
+    }
+});

package/dist/esm/inference/streamEvents.js

@@ -0,0 +1,255 @@
+/**
+ * Normalized stream events — what the data plane emits and the Oxy edge
+ * forwards as SSE.
+ *
+ * One discriminated union, seven shapes, all carrying `requestId` and a
+ * monotonic `sequence`. `requestId` is on EVERY event rather than only the
+ * first because a proxy that re-frames or a client that reconnects would
+ * otherwise be holding events it cannot attribute; `sequence` is what makes a
+ * redelivered event detectable as a duplicate rather than as new output.
+ *
+ * The events are versioned INDIVIDUALLY (see `version.ts`): a stream is a long
+ * sequence of small messages from a producer that may be redeployed mid-stream,
+ * so the alternative — one version for the whole union — would force every
+ * event to move whenever any one of them changed.
+ *
+ * `route_switch` is the customer-visible receipt for an allowed re-route, and
+ * its shape carries the invariant: a switch to a DIFFERENT model can only be
+ * expressed with `authorizedByPolicy: true`, so an unauthorized substitution is
+ * not a thing the contract can say.
+ *
+ * Decided in: docs/adr/0010-public-api-compatibility.md, docs/adr/0008-catalogue-concept-separation.md.
+ */
+import { z } from 'zod';
+import { deploymentIdSchema, generationIdSchema, inferenceProviderSlugSchema, inferenceTimestampSchema, modelIdSchema, modelReferenceSchema, requestIdSchema, } from './identifiers.js';
+import { inferenceErrorSchema } from './errors.js';
+import { usageQuantitySchema, usageSourceSchema } from './money.js';
+/**
+ * The first event of every stream: what was actually resolved.
+ *
+ * Names the revision-pinned model and the serving provider, so a customer who
+ * asked for `<publisher>/<model>` learns which revision answered without having
+ * to wait for the receipt. Carries no deployment health, no route id and no
+ * upstream cost.
+ */
+export const inferenceStreamStartEventSchema = z.object({
+    /** See `version.ts`: each stream event is a whole message on the wire. */
+    schemaVersion: z.literal(1),
+    type: z.literal('start'),
+    requestId: requestIdSchema,
+    sequence: z.number().int().nonnegative().safe(),
+    generationId: generationIdSchema.optional(),
+    /** Always revision-pinned, even when the request named only the model. */
+    resolvedModelReference: modelReferenceSchema,
+    servingProvider: inferenceProviderSlugSchema,
+    startedAt: inferenceTimestampSchema,
+});
+/**
+ * A chunk of output.
+ *
+ * `channel` separates visible output from reasoning and refusals, because a
+ * client that renders reasoning as answer text is a product bug, not a display
+ * preference.
+ */
+export const inferenceStreamDeltaEventSchema = z.object({
+    /** See `version.ts`: each stream event is a whole message on the wire. */
+    schemaVersion: z.literal(1),
+    type: z.literal('delta'),
+    requestId: requestIdSchema,
+    sequence: z.number().int().nonnegative().safe(),
+    /** Which output of a multi-output response this chunk belongs to. */
+    outputIndex: z.number().int().nonnegative().safe(),
+    channel: z.enum(['output_text', 'reasoning', 'refusal']),
+    text: z.string(),
+});
+/**
+ * A tool call being streamed.
+ *
+ * `argumentsDelta` accumulates; `complete` marks the call finished so a client
+ * knows when the accumulated JSON text is worth parsing.
+ */
+export const inferenceStreamToolCallEventSchema = z.object({
+    /** See `version.ts`: each stream event is a whole message on the wire. */
+    schemaVersion: z.literal(1),
+    type: z.literal('tool_call'),
+    requestId: requestIdSchema,
+    sequence: z.number().int().nonnegative().safe(),
+    toolCallId: z.string().min(1).max(128),
+    /** Present on the first event of a call. */
+    name: z.string().min(1).max(128).optional(),
+    argumentsDelta: z.string().optional(),
+    complete: z.boolean(),
+});
+/**
+ * Metered units for the request so far.
+ *
+ * Units only — no money. What a customer is charged is the ledger's answer,
+ * derived from these units and a price version at settlement; a cost quoted by
+ * the data plane would be a second, unauthoritative answer to the same
+ * question.
+ *
+ * ## This event is MEASUREMENT EVIDENCE, never a settleable record
+ *
+ * `normalizedUsageReportSchema` is the only shape a settlement is written from,
+ * and this event is deliberately NOT a subset of it that could be widened into
+ * one. It carries units and a source; a report additionally carries the
+ * attribution block, the outcome, the resolved route, the route-switch count and
+ * the two timestamps. Every one of those is knowable only by one END of the
+ * request rather than by the frame: the outcome only by the edge, which is the
+ * only party that knows whether the CLIENT cancelled, and the route record only
+ * by the data plane.
+ *
+ * So the event is not widened, and that is a decision rather than an omission.
+ * Adding the route record and the attribution block here would repeat both on
+ * EVERY usage frame of every stream, and each repetition is one more place two
+ * frames of one stream could disagree about which route served it — a second
+ * source of truth per frame, for fields no consumer of a progress signal reads.
+ *
+ * **What the edge may do with it, and what it may not.** The units are exact and
+ * may be settled; the record around them may not be inferred. When no terminal
+ * report arrives — the ordinary case for a client disconnect, since the report
+ * frame can no longer be delivered to a connection that is gone — the edge
+ * settles the units from the last such event and takes the OUTCOME from itself,
+ * never from the event. Its outcome is then `cancelled`, `partial` or `failed`;
+ * it is never `completed`, because nothing here can witness that the customer
+ * received the whole answer. Zero units marked `estimated` is the arm for no
+ * evidence at ALL, not for a disconnect that reported some.
+ */
+export const inferenceStreamUsageEventSchema = z.object({
+    /** See `version.ts`: each stream event is a whole message on the wire. */
+    schemaVersion: z.literal(2),
+    type: z.literal('usage'),
+    requestId: requestIdSchema,
+    sequence: z.number().int().nonnegative().safe(),
+    /** Exact deployment whose metering produced these partial units. */
+    deploymentId: deploymentIdSchema,
+    units: z.array(usageQuantitySchema).min(1),
+    usageSource: usageSourceSchema,
+});
+/**
+ * What kind of re-route happened.
+ *
+ * `deployment` is same-model failover: the same revision, served somewhere else.
+ * `model` is a substitution, and is expressible ONLY with
+ * `authorizedByPolicy: true` — the routing policy's `authorizedCrossModel` list
+ * is the only thing that can produce one, so "a concrete model was silently
+ * replaced" has no representation in this contract.
+ */
+export const inferenceRouteSwitchDetailSchema = z.discriminatedUnion('scope', [
+    z
+        .object({
+        scope: z.literal('deployment'),
+        modelReference: modelReferenceSchema,
+        toProvider: inferenceProviderSlugSchema,
+        toDeploymentId: deploymentIdSchema.optional(),
+    })
+        .strict(),
+    z
+        .object({
+        scope: z.literal('model'),
+        /**
+         * The UNPINNED model line the customer asked for (`<publisher>/<model>`,
+         * never `@revision`). A request that pinned a revision asked for exactly
+         * those weights and is served or refused, never substituted — so for such
+         * a request there is no value that satisfies this field, and the event
+         * cannot be constructed at all.
+         */
+        requestedModelId: modelIdSchema,
+        fromModelReference: modelReferenceSchema,
+        toModelReference: modelReferenceSchema,
+        toProvider: inferenceProviderSlugSchema,
+        /** Literal `true`: an unauthorized cross-model switch cannot be reported. */
+        authorizedByPolicy: z.literal(true),
+    })
+        .strict(),
+]);
+/** Why a route changed mid-request. */
+export const inferenceRouteSwitchReasonSchema = z.enum([
+    'deployment_unavailable',
+    'provider_error',
+    'provider_timeout',
+    'provider_overloaded',
+    'rate_limited',
+    'capacity',
+    'policy_preference',
+]);
+/**
+ * The customer-visible notice that an allowed route switch occurred.
+ *
+ * Emitted in-stream rather than only recorded on the receipt, because a
+ * customer comparing two answers needs to know that the second one came from
+ * somewhere else while they are reading it.
+ */
+export const inferenceStreamRouteSwitchEventSchema = z.object({
+    /** See `version.ts`: each stream event is a whole message on the wire. */
+    schemaVersion: z.literal(1),
+    type: z.literal('route_switch'),
+    requestId: requestIdSchema,
+    sequence: z.number().int().nonnegative().safe(),
+    reason: inferenceRouteSwitchReasonSchema,
+    detail: inferenceRouteSwitchDetailSchema,
+    occurredAt: inferenceTimestampSchema,
+});
+/**
+ * A terminal error. The stream ends here; no `done` follows, so a client that
+ * saw an error never also has to reconcile a success.
+ */
+export const inferenceStreamErrorEventSchema = z.object({
+    /** See `version.ts`: each stream event is a whole message on the wire. */
+    schemaVersion: z.literal(1),
+    type: z.literal('error'),
+    requestId: requestIdSchema,
+    sequence: z.number().int().nonnegative().safe(),
+    /** Carries its own `schemaVersion`: the same body is returned non-streaming. */
+    error: inferenceErrorSchema,
+});
+/**
+ * Why generation stopped.
+ *
+ * `refusal` and `content_filter` are separate members because they are separate
+ * events: the MODEL declining to answer is a property of the answer, while a
+ * filter is an upstream system removing one. The delta channels already carry
+ * that distinction (`channel: 'refusal'` beside the filter's own error code),
+ * so collapsing it here would have made the terminal event less specific than
+ * the stream that produced it.
+ */
+export const inferenceFinishReasonSchema = z.enum([
+    'stop',
+    'length',
+    'tool_calls',
+    'content_filter',
+    'refusal',
+    'cancelled',
+]);
+/**
+ * The successful terminal event.
+ *
+ * `receiptId` is present once settlement has produced one, giving a customer a
+ * direct handle on the exact amount charged rather than a telemetry estimate.
+ */
+export const inferenceStreamDoneEventSchema = z.object({
+    /** See `version.ts`: each stream event is a whole message on the wire. */
+    schemaVersion: z.literal(1),
+    type: z.literal('done'),
+    requestId: requestIdSchema,
+    sequence: z.number().int().nonnegative().safe(),
+    generationId: generationIdSchema.optional(),
+    finishReason: inferenceFinishReasonSchema,
+    receiptId: z.string().min(1).max(128).optional(),
+    completedAt: inferenceTimestampSchema,
+});
+/**
+ * Every event a normalized stream can carry.
+ *
+ * Discriminated on `type`, so a consumer that meets an unknown event fails at
+ * the parse instead of falling into a default branch that treats it as output.
+ */
+export const inferenceStreamEventSchema = z.discriminatedUnion('type', [
+    inferenceStreamStartEventSchema,
+    inferenceStreamDeltaEventSchema,
+    inferenceStreamToolCallEventSchema,
+    inferenceStreamUsageEventSchema,
+    inferenceStreamRouteSwitchEventSchema,
+    inferenceStreamErrorEventSchema,
+    inferenceStreamDoneEventSchema,
+]);