@oxy.so/contracts 1.0.0

package/dist/types/identity.d.ts

@@ -0,0 +1,402 @@
+/**
+ * Self-sovereign identity API contracts.
+ *
+ * SINGLE SOURCE OF TRUTH for the wire shape of Oxy's AtProto/Bluesky-flavoured
+ * identity & portability layer: the W3C DID document the API derives on demand,
+ * the signed-record envelope clients sign with their cryptographic key (and the
+ * server verifies), the verified-domain badge, the auth-method ↔ DID
+ * verification-method mapping, and the signed data-export ("credible exit")
+ * bundle. The API validates its OUTPUT against these schemas; every consumer
+ * (the Commons vault app, `@oxy.so/core`'s identity mixin) validates its INPUT
+ * against the same definitions, so producer and consumers cannot drift.
+ *
+ * Design anchors (from the identity-layer plan):
+ *  - DID = `did:web:oxy.so:u:<userId>` — anchored on the stable account id, NOT
+ *    the keypair. The keypair is a *verification method* that maps 1:1 to the
+ *    existing `authMethods[]`. Custodial (password-only) users get a DID
+ *    controlled solely by Oxy (`OXY_DID`); creating a Commons key upgrades them
+ *    to self-sovereign (`controller = [userDid, OXY_DID]`); fully reversible.
+ *  - Verification methods use the secp256k1 `EcdsaSecp256k1VerificationKey2019`
+ *    type with `publicKeyHex` for now (a `Multikey`/`publicKeyMultibase` form may
+ *    be added later — see the plan's open risks).
+ *  - Signed records carry an envelope whose signing input is the canonical-JSON
+ *    of every field EXCEPT `publicKey` and `signature`; `alg` is
+ *    `ES256K-DER-SHA256` (secp256k1 over the SHA-256 of the canonical bytes,
+ *    DER-encoded signature) — the same scheme `SignatureService` uses.
+ *
+ * Explicit-`interface` exports (DidDocument, SignedRecordEnvelope, ExportBundle,
+ * VerifiedDomain, AuthMethodsResponse and their sub-parts) follow the same
+ * rationale as `UserNameResponse` in `./userResponse`: a `z.infer<>` of a nested
+ * object schema can degrade under a consumer's `moduleResolution: "node"`
+ * (node10) resolution, so the load-bearing response shapes are declared as
+ * literal interfaces and the runtime schemas are annotated `z.ZodType<Interface>`
+ * — the emitted `.d.ts` then states the field types verbatim and survives BOTH
+ * `node` and `bundler` resolution. Request schemas (no nested-object hazard) are
+ * inferred via `z.infer<>`.
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo. ESM-safe (no
+ * `require()`).
+ */
+import { z } from 'zod';
+/**
+ * A `EcdsaSecp256k1VerificationKey2019` verification method — the canonical Oxy
+ * key form. Mirrors the secp256k1 key entries the API derives from
+ * `User.publicKey` + each `authMethods[]` of type `identity`. `id` is a fragment
+ * reference within the DID document (e.g. `did:web:oxy.so:u:<id>#key-1`);
+ * `controller` is the controlling DID; `publicKeyHex` is the (uncompressed)
+ * secp256k1 public key in hex.
+ */
+export interface Secp256k1VerificationMethod {
+    id: string;
+    type: 'EcdsaSecp256k1VerificationKey2019';
+    controller: string;
+    publicKeyHex: string;
+}
+/**
+ * A `Multikey` verification method — the AtProto/Bluesky key form. The SAME
+ * secp256k1 key as an account's {@link Secp256k1VerificationMethod}, re-encoded
+ * the way atproto expects: `publicKeyMultibase` is the `did:key`-style multibase
+ * (`base58btc`, leading `z`) of the multicodec-prefixed (`0xe7 0x01`, secp256k1)
+ * COMPRESSED public key. This is the verification method a foreign Bluesky
+ * AppView reads when it routes to the user's bridge PDS; it is additive and only
+ * present for atproto-bridged self-sovereign accounts.
+ */
+export interface MultikeyVerificationMethod {
+    id: string;
+    type: 'Multikey';
+    controller: string;
+    publicKeyMultibase: string;
+}
+/**
+ * A single DID verification method — either the canonical Oxy secp256k1 form
+ * ({@link Secp256k1VerificationMethod}) or the atproto `Multikey` form
+ * ({@link MultikeyVerificationMethod}). Discriminated on `type`, so an
+ * `EcdsaSecp256k1VerificationKey2019` entry keeps its exact `publicKeyHex` shape
+ * (every document already served verifies byte-identically) and the `Multikey`
+ * entry carries `publicKeyMultibase`.
+ */
+export type VerificationMethod = Secp256k1VerificationMethod | MultikeyVerificationMethod;
+export declare const verificationMethodSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodLiteral<"EcdsaSecp256k1VerificationKey2019">;
+    controller: z.ZodString;
+    publicKeyHex: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "EcdsaSecp256k1VerificationKey2019";
+    id: string;
+    controller: string;
+    publicKeyHex: string;
+}, {
+    type: "EcdsaSecp256k1VerificationKey2019";
+    id: string;
+    controller: string;
+    publicKeyHex: string;
+}>, z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodLiteral<"Multikey">;
+    controller: z.ZodString;
+    publicKeyMultibase: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "Multikey";
+    id: string;
+    controller: string;
+    publicKeyMultibase: string;
+}, {
+    type: "Multikey";
+    id: string;
+    controller: string;
+    publicKeyMultibase: string;
+}>]>;
+/**
+ * A DID service entry (the `service[]` array). Oxy publishes its API root and
+ * profile endpoints here so a resolver can discover where to fetch the user's
+ * data. `serviceEndpoint` is a URL string.
+ */
+export interface DidService {
+    id: string;
+    type: string;
+    serviceEndpoint: string;
+}
+export declare const didServiceSchema: z.ZodType<DidService>;
+/**
+ * A W3C DID document derived on demand by the API (no stored document).
+ *
+ * - `controller` is `[userDid, OXY_DID]` for a self-sovereign account (it holds
+ *   at least one `identity` verification method) or `[OXY_DID]` for a custodial
+ *   (password-only) account.
+ * - `verificationMethod[]` is composed from the account's secp256k1 keys.
+ * - `authentication` / `assertionMethod` reference verification-method ids.
+ * - `alsoKnownAs[]` carries the account's other identifiers (`acct:` handle,
+ *   profile URL, any verified-domain URLs).
+ */
+export interface DidDocument {
+    '@context': string[];
+    id: string;
+    controller: string[];
+    verificationMethod: VerificationMethod[];
+    authentication: string[];
+    assertionMethod: string[];
+    alsoKnownAs: string[];
+    service: DidService[];
+}
+export declare const didDocumentSchema: z.ZodType<DidDocument>;
+/**
+ * A signed record envelope. `record` is the arbitrary payload; the signing
+ * input is the canonical-JSON of every envelope field EXCEPT `publicKey` and
+ * `signature`. `subject` and `issuer` are DIDs (the subject the record is about
+ * and the signer's DID — equal for self-issued records, `OXY_DID` for a
+ * custodial provenance attestation). `issuedAt` is epoch milliseconds.
+ *
+ * ## `type` — open by design
+ *
+ * `type` is an OPEN, non-empty string: it is the application-defined category of
+ * the record (e.g. Oxy's `identity`/`profile`/civic types, or `app.mention.*`'s
+ * `app_record`). The base envelope is app-agnostic, so it cannot enumerate every
+ * app's record categories — each app re-narrows `type` to its own closed set on
+ * the way INTO its own store (Oxy via {@link OxySignedRecordType}; an app via
+ * its own constant). Widening `type` from a closed enum to a string is
+ * canonical-bytes-safe: {@link signedRecordSigningInput} serializes `type` as the
+ * same JSON string either way, so every record already signed in production
+ * verifies byte-for-byte.
+ *
+ * ## Versioning
+ *
+ * - **v1** is the original shape (`{version, type, subject, issuer, record,
+ *   issuedAt}` + `publicKey/alg/signature`). It carries NONE of the v2 chain
+ *   fields and remains accepted unchanged — every `identity`/`profile` record
+ *   already in production verifies byte-identically.
+ * - **v2** adds a per-subject hash-chain (an append-only "personal blockchain"
+ *   of a single signer, no consensus/mining). The four chain fields are part of
+ *   the signed bytes (so the chain cannot be forged):
+ *     - `seq` — strictly-increasing sequence number per subject.
+ *     - `prev` — the `recordId` (content address) of the previous record in this
+ *       subject's chain, or `null` at genesis.
+ *     - `collection` + `rkey` — an AtProto-style record key (e.g.
+ *       `collection: 'app.oxy.identity'`, `rkey: 'self'`) used for
+ *       materialization and last-writer-wins reconciliation.
+ *
+ * The chain fields are OPTIONAL on the interface so v1 envelopes (which omit
+ * them) still type-check; the schema enforces "present iff version === 2".
+ */
+export interface SignedRecordEnvelope {
+    version: 1 | 2;
+    /** App-defined record category (open string); each store re-narrows it. */
+    type: string;
+    subject: string;
+    issuer: string;
+    record: Record<string, unknown>;
+    issuedAt: number;
+    /** v2 only: strictly-increasing sequence number for this subject's chain. */
+    seq?: number;
+    /** v2 only: `recordId` of the previous record in the chain, `null` at genesis. */
+    prev?: string | null;
+    /** v2 only: AtProto-style collection namespace (e.g. `app.oxy.identity`). */
+    collection?: string;
+    /** v2 only: AtProto-style record key within the collection (e.g. `self`). */
+    rkey?: string;
+    publicKey: string;
+    alg: 'ES256K-DER-SHA256';
+    signature: string;
+}
+export declare const signedRecordEnvelopeSchema: z.ZodType<SignedRecordEnvelope>;
+/**
+ * A proven domain ownership badge. `method` records how ownership was proven —
+ * a DNS-TXT record (`_oxy-identity.<domain>`) or a `/.well-known/oxy-domain`
+ * HTTP file. `verifiedAt` is a string on the wire (ISO timestamp) but accepts a
+ * `Date` so the API can validate its own pre-serialization model objects.
+ */
+export interface VerifiedDomain {
+    domain: string;
+    verifiedAt: string | Date;
+    method: 'dns-txt' | 'well-known';
+}
+export declare const verifiedDomainSchema: z.ZodType<VerifiedDomain>;
+/** Request body for `POST /identity/domains` — the domain to start verifying. */
+export declare const domainVerificationRequestSchema: z.ZodObject<{
+    domain: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    domain: string;
+}, {
+    domain: string;
+}>;
+export type DomainVerificationRequest = z.infer<typeof domainVerificationRequestSchema>;
+/**
+ * The instructions the API returns when a domain verification is requested. The
+ * caller may prove ownership EITHER by publishing the `dns` TXT record OR by
+ * serving the `wellKnown` file; either path then satisfies
+ * `POST /identity/domains/:domain/verify`.
+ */
+export declare const domainVerificationInstructionsSchema: z.ZodObject<{
+    domain: z.ZodString;
+    token: z.ZodString;
+    dns: z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        name: string;
+    }, {
+        value: string;
+        name: string;
+    }>;
+    wellKnown: z.ZodObject<{
+        url: z.ZodString;
+        body: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        url: string;
+        body: string;
+    }, {
+        url: string;
+        body: string;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    domain: string;
+    token: string;
+    dns: {
+        value: string;
+        name: string;
+    };
+    wellKnown: {
+        url: string;
+        body: string;
+    };
+}, {
+    domain: string;
+    token: string;
+    dns: {
+        value: string;
+        name: string;
+    };
+    wellKnown: {
+        url: string;
+        body: string;
+    };
+}>;
+export type DomainVerificationInstructions = z.infer<typeof domainVerificationInstructionsSchema>;
+/**
+ * One linked authentication method. Mirrors a `User.authMethods[]` entry.
+ * `verificationMethodId` is present for `identity` methods (a key), linking the
+ * auth method to its DID verification-method fragment. For `webauthn` methods
+ * `credentialId` identifies the specific passkey (one entry per registered
+ * credential) and `name` is its user-facing label; a passkey is NOT a DID
+ * verification method, so it carries no `verificationMethodId` (a passkey-only
+ * account stays custodial).
+ */
+export interface AuthMethodEntry {
+    type: 'identity' | 'webauthn';
+    linkedAt: string | Date;
+    verificationMethodId?: string;
+    credentialId?: string;
+    name?: string;
+}
+export declare const authMethodEntrySchema: z.ZodType<AuthMethodEntry>;
+/**
+ * Wire shape of `GET /auth/methods` — the account's DID plus every linked
+ * authentication method.
+ */
+export interface AuthMethodsResponse {
+    did: string;
+    methods: AuthMethodEntry[];
+}
+export declare const authMethodsResponseSchema: z.ZodType<AuthMethodsResponse>;
+/**
+ * A cryptographic attestation over the canonical-JSON of an export bundle.
+ * Reused for both the mandatory Oxy provenance `attestation` (signed with the
+ * Oxy custodial key) and the optional client `proof` (signed with the user's
+ * own key when they hold one). `signedAt` is epoch milliseconds.
+ */
+export interface ExportAttestation {
+    issuer: string;
+    publicKey: string;
+    alg: 'ES256K-DER-SHA256';
+    signature: string;
+    signedAt: number;
+}
+export declare const exportAttestationSchema: z.ZodType<ExportAttestation>;
+/**
+ * One settled charge, as the account it was charged to may take it away.
+ *
+ * Amounts are EXACT DECIMAL STRINGS, never numbers — the same rule the ledger
+ * itself follows. A JSON number cannot represent `0.000000700000` and a bill a
+ * customer re-adds must reproduce the figure Oxy charged.
+ */
+export interface ExportUsageReceipt {
+    receiptId: string;
+    requestId: string;
+    settledAt: string;
+    billedAmount: string;
+    currency: string;
+    outcome: string;
+    resolvedModelReference: string;
+    servingProvider: string;
+    /** True when the charge is Oxy's fee on a BYOK request, not the model cost. */
+    platformFeeOnly: boolean;
+}
+export declare const exportUsageReceiptSchema: z.ZodType<ExportUsageReceipt>;
+/** One entry in the account's own journal. */
+export interface ExportLedgerEntry {
+    entryId: string;
+    kind: string;
+    currency: string;
+    createdAt: string;
+}
+export declare const exportLedgerEntrySchema: z.ZodType<ExportLedgerEntry>;
+/** One hold: money that was neither spent nor returned at the time it was taken. */
+export interface ExportUsageReservation {
+    reservationId: string;
+    requestId: string;
+    status: string;
+    reservedAmount: string;
+    currency: string;
+    createdAt: string;
+    expiresAt: string;
+}
+export declare const exportUsageReservationSchema: z.ZodType<ExportUsageReservation>;
+/**
+ * What the account was charged, in the subject-access export (#972 section 12).
+ *
+ * Scoped to the CALLING user's own account and read-only. It exists because a
+ * person exercising a subject-access request previously learned nothing about
+ * what they had been charged unless they also happened to be an account
+ * administrator hitting the enterprise reporting route — the deletion side of
+ * that checkbox preserved financial records the export then never disclosed.
+ *
+ * Empty arrays are the normal answer, and mean the account has no ledger history
+ * rather than that anything was withheld.
+ */
+export interface ExportFinancialSection {
+    receipts: ExportUsageReceipt[];
+    ledgerEntries: ExportLedgerEntry[];
+    reservations: ExportUsageReservation[];
+}
+export declare const exportFinancialSectionSchema: z.ZodType<ExportFinancialSection>;
+/**
+ * The signed, open-format data-export bundle from `GET /users/me/export`. A
+ * portable snapshot of the account: its DID document, profile, verified
+ * domains, auth methods (no secrets), published signed records, per-app data,
+ * social graph, and what the account was charged.
+ *
+ * `attestation` is the Oxy custodial provenance signature. It is `null` only
+ * when the Oxy custodial signing key (`OXY_PRIVATE_KEY`) is unset (dev /
+ * pre-prod); in production it is always present. Carries an optional client
+ * `proof` when the user signed the bundle with their own key.
+ */
+export interface ExportBundle {
+    '$schema': string;
+    exportedAt: string;
+    did: string;
+    didDocument: DidDocument;
+    profile: Record<string, unknown>;
+    verifiedDomains: VerifiedDomain[];
+    authMethods: AuthMethodEntry[];
+    signedRecords: SignedRecordEnvelope[];
+    appData: Record<string, unknown>[];
+    social: {
+        following: string[];
+        followers: string[];
+    };
+    financial: ExportFinancialSection;
+    attestation: ExportAttestation | null;
+    proof?: ExportAttestation;
+}
+export declare const exportBundleSchema: z.ZodType<ExportBundle>;

package/dist/types/inboxPush.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Canonical contract for Inbox new-mail push notifications.
+ *
+ * The Android channel id and payload `type` are wire contracts: Android 8+
+ * drops a notification whose channel the app has not created, and the client
+ * only routes taps it recognises. Two hand-typed copies of either string fail as
+ * "the notification never arrived" or "tapping does nothing" — the hardest push
+ * symptoms to diagnose.
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo.
+ */
+import { z } from 'zod';
+/** Android notification channel id the new-mail push is sent on. */
+export declare const INBOX_EMAIL_PUSH_CHANNEL = "email";
+/** Runtime type discriminator of the new-mail push payload. */
+export declare const INBOX_EMAIL_PUSH_TYPE = "oxy_inbox_new_message";
+export declare const inboxEmailPushDataSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oxy_inbox_new_message">;
+    messageId: z.ZodString;
+    mailboxId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "oxy_inbox_new_message";
+    mailboxId: string;
+    messageId: string;
+}, {
+    type: "oxy_inbox_new_message";
+    mailboxId: string;
+    messageId: string;
+}>;
+export type InboxEmailPushData = z.infer<typeof inboxEmailPushDataSchema>;

package/dist/types/index.d.ts

@@ -0,0 +1,100 @@
+/**
+ * @oxy.so/contracts — single source of truth for API request/response contracts.
+ *
+ * Zod schemas plus their inferred types, shared by the backend (`@oxy.so/api`)
+ * and the client SDKs (`@oxy.so/core`, `@oxy.so/services`). The
+ * producer validates its output and every consumer validates its input against
+ * exactly the same definitions, so the wire shape cannot drift.
+ *
+ * Platform-agnostic — zod is the only runtime dependency. No react/react-native/
+ * expo, no `require()` in the ESM build.
+ */
+export { ACCOUNT_KINDS, accountKindSchema, CHILD_ACCOUNT_KINDS, childAccountKindSchema, isAccountKind, isDelegatedActAsEligibleKind, isOperatorSwitchTargetKind, ACCOUNT_CATEGORY_IDS, ACCOUNT_CATEGORY_KINDS, accountCategoriesSchema, accountCategoryIdSchema, isSelectableAccountCategoryId, kindAcceptsAccountCategories, MAX_ACCOUNT_CATEGORIES, newlyAddedRetiredCategories, RETIRED_ACCOUNT_CATEGORY_IDS, SELECTABLE_ACCOUNT_CATEGORY_IDS, createAccountRequestSchema, } from './accountGraph';
+export type { AccountKind, AccountCategoryId, AccountCategoryKind, ChildAccountKind, CreateAccountRequest, } from './accountGraph';
+export { usernameSchema, usernameSchemaForAccountKind, isValidUsername, stripDisallowedUsernameCharacters, applyBotUsernameSuffix, USERNAME_MIN_LENGTH, USERNAME_MAX_LENGTH, USERNAME_INVALID_MESSAGE, BOT_USERNAME_INVALID_MESSAGE, } from './username';
+export { userNameSchema, userRelationshipSchema, themePreferenceSchema, userResponseSchema, userProfileUpdateSchema, currentUserResponseSchema, deviceLinkedSessionSchema, deviceLinkedSessionsResponseSchema, resolveUserId, safeParseContract, } from './userResponse';
+export type { UserNameResponse, UserRelationship, ThemePreference, UserResponse, UserProfileUpdate, CurrentUserResponseContract, DeviceLinkedSessionResponse, DeviceLinkedSessionsResponseContract, } from './userResponse';
+export { applicationTypeSchema, publicApplicationSchema, sessionStatusSchema, } from './sessionStatus';
+export type { ApplicationTypeContract, PublicApplicationResponse, SessionStatusResponse, } from './sessionStatus';
+export { COMMONS_DENY_REASONS, commonsDenyReasonSchema, IDENTITY_APPROVAL_PUSH_CHANNEL, } from './commonsSignIn';
+export type { CommonsDenyReason } from './commonsSignIn';
+export { INBOX_EMAIL_PUSH_CHANNEL, INBOX_EMAIL_PUSH_TYPE, inboxEmailPushDataSchema, } from './inboxPush';
+export type { InboxEmailPushData } from './inboxPush';
+export { OXY_USER_INVALIDATION_CHANNEL, OXY_USER_CHANGE_REASONS, OXY_PUBLISHED_USER_CHANGE_REASONS, isPublishedOxyUserChangeReason, oxyUserInvalidationEventSchema, } from './userInvalidation';
+export type { OxyUserChangeReason, PublishedOxyUserChangeReason, OxyUserInvalidationEvent, } from './userInvalidation';
+export { recommendationExcludeTypeSchema, recommendationBoostSchema, recommendationSignalWeightsSchema, recommendationRequestSchema, recommendationCountSchema, recommendationItemSchema, recommendationResponseSchema, appEndorsementInputSchema, appInterestInputSchema, appUserSignalIngestSchema, appAffinityEventTypeSchema, appAffinityEventSchema, appAffinityEventsIngestSchema, } from './recommendations';
+export type { RecommendationExcludeType, RecommendationBoost, RecommendationSignalWeights, RecommendationRequest, RecommendationCount, RecommendationItem, RecommendationResponse, AppEndorsementInput, AppInterestInput, AppUserSignalIngest, AppAffinityEventType, AppAffinityEvent, AppAffinityEventsIngest, } from './recommendations';
+export { verificationMethodSchema, didServiceSchema, didDocumentSchema, signedRecordEnvelopeSchema, verifiedDomainSchema, domainVerificationRequestSchema, domainVerificationInstructionsSchema, authMethodEntrySchema, authMethodsResponseSchema, exportAttestationSchema, exportUsageReceiptSchema, exportLedgerEntrySchema, exportUsageReservationSchema, exportFinancialSectionSchema, exportBundleSchema, } from './identity';
+export type { VerificationMethod, Secp256k1VerificationMethod, MultikeyVerificationMethod, DidService, DidDocument, SignedRecordEnvelope, VerifiedDomain, DomainVerificationRequest, DomainVerificationInstructions, AuthMethodEntry, AuthMethodsResponse, ExportAttestation, ExportUsageReceipt, ExportLedgerEntry, ExportUsageReservation, ExportFinancialSection, ExportBundle, } from './identity';
+export { oxySignedRecordTypeSchema, } from './oxyRecordTypes';
+export type { OxySignedRecordType } from './oxyRecordTypes';
+export { chainHeadResponseSchema, logPageResponseSchema, } from './protocol';
+export type { LexiconRecord, ChainHeadResponse, LogPageResponse } from './protocol';
+export { publicCardSchema, signedPublicCardSchema, realLifeAttestationRecordSchema, realLifeAttestationResultSchema, validationVerdictRecordSchema, validationOpenRequestSchema, validationOpenResultSchema, validationRequestSummarySchema, validationVoteResultSchema, personhoodVouchRecordSchema, personhoodBreakdownSchema, personhoodStatusResultSchema, vouchResultSchema, credentialRecordSchema, verifiableCredentialResponseSchema, credentialIssueResultSchema, credentialListResultSchema, credentialVerifyResultSchema, } from './civic';
+export type { CardTrustTier, PersonhoodStatus, PublicCard, SignedPublicCard, RealLifeAttestationRecord, RealLifeAttestationResult, ValidationVerdict, ValidationRequestStatus, ValidationVerdictRecord, ValidationOpenRequest, ValidationOpenResult, ValidationRequestSummary, ValidationVoteResult, PersonhoodVouchRecord, PersonhoodBreakdown, PersonhoodStatusResult, VouchResult, CredentialStatus, CredentialRecord, VerifiableCredentialResponse, CredentialIssueResult, CredentialListResult, CredentialVerifyResult, } from './civic';
+export { REPUTATION_CATEGORIES, REPUTATION_TRANSACTION_STATUSES, TRUST_TIERS, REPUTATION_TARGET_ENTITY_TYPES, REPUTATION_DISPUTE_STATUSES, REPUTATION_INFLUENCE_CONTEXTS, reputationCategorySchema, reputationTransactionStatusSchema, trustTierSchema, reputationTargetEntityTypeSchema, reputationDisputeStatusSchema, reputationInfluenceContextSchema, reputationTransactionSchema, reputationBalanceBreakdownSchema, reputationInfluenceSchema, reputationReliabilitySchema, reputationBalanceSummarySchema, reputationBalanceSchema, reputationDisputeSchema, reputationRuleSchema, reputationLeaderboardUserSchema, reputationLeaderboardEntrySchema, reputationInfluenceResultSchema, reverseReputationTransactionResultSchema, awardReputationSchema, createReputationDisputeSchema, resolveReputationDisputeSchema, upsertReputationRuleSchema, reverseReputationTransactionSchema, isFullReputationBalance, } from './reputation';
+export type { ReputationCategory, ReputationTransactionStatus, TrustTier, ReputationTargetEntityType, ReputationDisputeStatus, ReputationInfluenceContext, ReputationTransaction, ReputationBalanceBreakdown, ReputationInfluence, ReputationReliability, ReputationBalanceSummary, ReputationBalance, ReputationBalanceView, ReputationDispute, ReputationRule, ReputationLeaderboardUser, ReputationLeaderboardEntry, ReputationInfluenceResult, ReverseReputationTransactionResult, AwardReputationInput, CreateReputationDisputeInput, ResolveReputationDisputeInput, UpsertReputationRuleInput, UpsertReputationRuleRequest, ReverseReputationTransactionInput, } from './reputation';
+export { MODERATION_SEVERITIES, MODERATION_FINDING_SCOPES, MODERATION_ATTRIBUTIONS, MODERATION_DECISION_STATUSES, MODERATION_EFFECT_TYPES, MODERATION_EFFECT_STATUSES, MODERATION_EFFECT_SKIP_REASONS, CONDUCT_STRIKE_STATUSES, CONDUCT_STANDINGS, CONTRIBUTION_TIERS, PERSONHOOD_STATUSES, IDENTITY_BINDING_TYPES, IDENTITY_BINDING_STATUSES, APPLICATION_MODERATION_STANDINGS, moderationSeveritySchema, moderationFindingScopeSchema, moderationAttributionSchema, moderationDecisionStatusSchema, moderationEffectTypeSchema, moderationEffectStatusSchema, moderationEffectSkipReasonSchema, conductStrikeStatusSchema, conductStandingSchema, contributionTierSchema, personhoodStatusSchema, identityBindingTypeSchema, identityBindingStatusSchema, applicationModerationStandingSchema, moderationFindingSchema, moderationDecisionEventSubjectSchema, moderationPolicyVersionsSchema, moderationDecisionEventSchema, finalizeModerationDecisionSchema, reverseModerationEffectSchema, moderationEffectSchema, applyModerationDecisionResultSchema, reverseModerationEffectResultSchema, registerIdentityBindingSchema, identityBindingSchema, reputationPersonhoodSchema, reputationContributionSchema, reputationConductSchema, reputationReportingSchema, reputationReviewingSchema, reputationContextualInfluenceSchema, applicationModerationTrustSchema, } from './moderationReputation';
+export type { ModerationSeverity, ModerationFindingScope, ModerationAttribution, ModerationDecisionStatus, ModerationEffectType, ModerationEffectStatus, ModerationEffectSkipReason, ConductStrikeStatus, ConductStanding, ContributionTier, PersonhoodStatusValue, IdentityBindingType, IdentityBindingStatus, ApplicationModerationStanding, ModerationFinding, ModerationDecisionEventSubject, ModerationPolicyVersions, ModerationDecisionEvent, FinalizeModerationDecisionInput, ReverseModerationEffectInput, ModerationEffect, ApplyModerationDecisionResult, ReverseModerationEffectResult, RegisterIdentityBindingInput, IdentityBinding, ReputationPersonhood, ReputationContribution, ReputationConduct, ReputationReporting, ReputationReviewing, ReputationContextualInfluence, ApplicationModerationTrust, } from './moderationReputation';
+export { linkPreviewSchema, linkPreviewBatchRequestSchema, linkPreviewBatchResponseSchema, linkPreviewResponseSchema, } from './links';
+export type { LinkPreviewStatus, LinkPreview, LinkPreviewBatchRequest, LinkPreviewBatchResponse, } from './links';
+export type { FollowTargetKind, FollowState, FollowEffectiveState, FollowApplicationMode, FollowTarget, FollowRecord, FollowStatus, FollowMutation, UnfollowMutation, FollowListPage, FollowOptions, } from './followGraph';
+export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, deviceTokenMintRequestSchema, deviceTokenMintResponseSchema, deviceBackgroundCredentialResponseSchema, deviceBackgroundTokenRequestSchema, deviceBackgroundTokenResponseSchema, SESSION_ACCOUNTS_CHANGED_EVENT, sessionAccountsChangedReasonSchema, sessionAccountsChangedEventSchema, } from './deviceSession';
+export type { SessionAccount, DeviceSessionState, ActiveToken, DeviceSessionSync, DeviceTokenMintRequest, DeviceTokenMintResponse, DeviceBackgroundCredentialResponse, DeviceBackgroundTokenRequest, DeviceBackgroundTokenResponse, SessionAccountsChangedReason, SessionAccountsChangedEvent, } from './deviceSession';
+export { deviceContextRelationshipSchema, deviceDirectoryProfileSchema, deviceAccountContextSchema, devicePrincipalSchema, deviceDirectorySchema, deviceActivateRequestSchema, deviceActivateResponseSchema, deviceDirectorySyncSchema, } from './deviceDirectory';
+export type { DeviceContextRelationship, DeviceDirectoryProfile, DeviceAccountContext, DevicePrincipal, DeviceDirectory, DeviceActivateRequest, DeviceActivateResponse, DeviceDirectorySync, } from './deviceDirectory';
+export { oauthConsentDecisionSchema, oauthAuthorizeCodeResponseSchema } from './oauth';
+export type { OauthConsentDecision, OauthAuthorizeCodeResponse } from './oauth';
+export { BROWSER_HUB_COOKIE_NAME, BROWSER_HUB_COOKIE_ATTRIBUTES, BROWSER_HUB_HANDLE_TTL_MS, browserHubHandleSchema, browserHubHandleRequestSchema, browserHubHandleResponseSchema, browserHubResolveResponseSchema, browserHubErrorSchema, browserHubRevokeResponseSchema, hubSessionSchema, hubClaimRequestSchema, hubActivateRequestSchema, hubAuthorizeRequestSchema, hubAuthorizeResultSchema, } from './browserHub';
+export type { BrowserHubHandleRequest, BrowserHubHandleResponse, BrowserHubResolveResponse, BrowserHubError, BrowserHubRevokeResponse, HubSession, HubClaimRequest, HubActivateRequest, HubAuthorizeRequest, HubAuthorizeResult, } from './browserHub';
+export { loginResultSchema, } from './deviceBoot';
+export type { LoginSessionResult, LoginResult, SecurityAlert, SecurityAlertAnomaly, } from './deviceBoot';
+export { rotateKeyChallengeResponseSchema, rotateKeyCompleteRequestSchema, rotateKeyCompleteResponseSchema, } from './keyRotation';
+export type { RotateKeyChallengeResponse, RotateKeyCompleteRequest, RotateKeyCompleteResponse, } from './keyRotation';
+export { backupLookupIdSchema, encryptedBackupEnvelopeSchema, backupUploadRequestSchema, backupStatusResponseSchema, } from './keyRecovery';
+export type { EncryptedBackupEnvelope, BackupUploadRequest, BackupStatusResponse, } from './keyRecovery';
+export { updatePlatformSchema, updateStatusSchema, updateAssetStatusSchema, sha256HexSchema, channelNameSchema, runtimeVersionSchema, rolloutPercentSchema, assetInitItemSchema, assetInitRequestSchema, assetUploadTicketSchema, assetInitResponseSchema, assetCompleteRequestSchema, assetCompleteResultItemSchema, assetCompleteResponseSchema, updateAssetRefSchema, createUpdateRequestSchema, updateSchema, createUpdateResponseSchema, rollbackToEmbeddedEntrySchema, channelSchema, channelListResponseSchema, updateListResponseSchema, rollbackRequestSchema, rollbackToEmbeddedRequestSchema, promoteRequestSchema, updateRolloutPatchSchema, } from './updates';
+export type { UpdatePlatform, UpdateStatus, UpdateAssetStatus, AssetInitItem, AssetInitRequest, AssetUploadTicket, AssetInitResponse, AssetCompleteRequest, AssetCompleteResultItem, AssetCompleteResponse, UpdateAssetRef, CreateUpdateRequest, Update, CreateUpdateResponse, RollbackToEmbeddedEntry, Channel, ChannelListResponse, UpdateListResponse, RollbackRequest, RollbackToEmbeddedRequest, PromoteRequest, UpdateRolloutPatch, } from './updates';
+export { webauthnRegisterOptionsRequestSchema, webauthnLoginOptionsRequestSchema, webauthnRegisterVerifyRequestSchema, webauthnLoginVerifyRequestSchema, } from './webauthn';
+export type { WebauthnRegisterOptionsRequest, WebauthnLoginOptionsRequest, WebauthnRegisterVerifyRequest, WebauthnLoginVerifyRequest, } from './webauthn';
+export { devicePairingStatusSchema, deviceTransferInitRequestSchema, deviceTransferInitResponseSchema, deviceTransferInfoResponseSchema, deviceTransferApproveRequestSchema, deviceTransferApproveResponseSchema, deviceTransferDenyResponseSchema, } from './devicePairing';
+export type { DevicePairingStatus, DeviceTransferInitRequest, DeviceTransferInitResponse, DeviceTransferInfoResponse, DeviceTransferApproveRequest, DeviceTransferApproveResponse, DeviceTransferDenyResponse, } from './devicePairing';
+export { transparencyCheckpointSignatureSchema, transparencyAnchorSchema, transparencyCheckpointSchema, transparencyInclusionProofSchema, transparencyCheckpointListSchema, } from './transparency';
+export type { TransparencyCheckpointSignature, TransparencyAnchor, TransparencyCheckpoint, TransparencyInclusionProof, TransparencyCheckpointList, } from './transparency';
+export { INFERENCE_CONTRACT_VERSION, } from './inference/version';
+export { oxyAccountIdSchema, delegatedUserIdSchema, oxyApplicationIdSchema, oxyCredentialIdSchema, requestIdSchema, generationIdSchema, idempotencyKeySchema, inferenceEnvironmentSchema, inferenceTimestampSchema, inferenceDateSchema, inferenceHttpsUrlSchema, sha256DigestSchema, publisherSlugSchema, modelSlugSchema, modelIdSchema, modelRevisionLabelSchema, modelReferenceSchema, routingProfileIdSchema, routingProfileSlugSchema, inferenceProviderSlugSchema, deploymentIdSchema, inferenceRegionSchema, RESERVED_ALIA_PUBLISHER, } from './inference/identifiers';
+export type { OxyAccountId, DelegatedUserId, InferenceEnvironment, ModelReference, ModelId, } from './inference/identifiers';
+export { currencyCodeSchema, INFERENCE_MONEY_SCALE, exactDecimalSchema, moneySchema, USAGE_UNITS, usageUnitSchema, USAGE_SOURCES, usageSourceSchema, usageQuantitySchema, unitPriceSchema, } from './inference/money';
+export type { CurrencyCode, ExactDecimal, Money, UsageUnit, UsageSource, UsageQuantity, UnitPrice, } from './inference/money';
+export { INFERENCE_SCOPES, inferenceScopeSchema, billingPrincipalSchema, authenticatedPrincipalSchema, inferenceAttributionSchema, } from './inference/attribution';
+export type { InferenceScope, BillingPrincipal, AuthenticatedPrincipal, InferenceAttribution, } from './inference/attribution';
+export { INFERENCE_ERROR_CODES, NON_RETRYABLE_INFERENCE_ERROR_CODES, inferenceErrorCodeSchema, upstreamErrorCategorySchema, safeErrorTextSchema, providerErrorPassthroughSchema, inferenceErrorSchema, } from './inference/errors';
+export type { InferenceErrorCode, UpstreamErrorCategory, ProviderErrorPassthrough, InferenceError, } from './inference/errors';
+export { priceVersionStatusSchema, priceVersionSchema, priceSnapshotSchema, } from './inference/priceVersion';
+export type { PriceVersionStatus, PriceVersion, PriceSnapshot } from './inference/priceVersion';
+export { inferenceModalitySchema, modelCapabilitiesSchema, modelLicenseSchema, modelProvenanceSchema, inferenceDataPolicySchema, availabilityScopeSchema, commercialPermissionSchema, modelDeprecationSchema, modelEvaluationResultSchema, modelSafetyMetadataSchema, modelPublisherSchema, catalogueModelSchema, modelRevisionSchema, inferenceProviderSchema, modelDeploymentSchema, routingProfileCandidateSchema, routingProfileSchema, cataloguePublisherSummarySchema, catalogueServingProviderSummarySchema, modelCatalogueEntrySchema, } from './inference/catalogue';
+export type { InferenceModality, ModelCapabilities, ModelLicense, ModelProvenance, InferenceDataPolicy, AvailabilityScope, CommercialPermission, ModelDeprecation, ModelEvaluationResult, ModelSafetyMetadata, ModelPublisher, CatalogueModel, ModelRevision, InferenceProvider, ModelDeployment, RoutingProfileCandidate, RoutingProfile, CataloguePublisherSummary, CatalogueServingProviderSummary, ModelCatalogueEntry, } from './inference/catalogue';
+export { routingTargetSchema, routingPolicyScopeSchema, routingFallbackPolicySchema, routingPolicySchema, routingPolicyReferenceSchema, authorizedRouteSchema, } from './inference/routingPolicy';
+export type { RoutingTarget, RoutingPolicyScope, RoutingFallbackPolicy, RoutingPolicy, RoutingPolicyReference, AuthorizedRoute, } from './inference/routingPolicy';
+export { aliaReleaseArtifactSchema, aliaReleaseSignatureSchema, aliaModelReleaseManifestSchema, } from './inference/aliaModelRelease';
+export type { AliaReleaseArtifact, AliaReleaseSignature, AliaModelReleaseManifest, } from './inference/aliaModelRelease';
+export { modelDistributionMethodSchema, modelSystemicRiskTierSchema, trainingComputeFlopsSchema, SYSTEMIC_RISK_COMPUTE_THRESHOLD_FLOPS, modelDownstreamDocumentationSchema, modelGpaiDocumentationSchema, modelLineDeclarationSchema, modelReleaseIngestionRequestSchema, modelReleaseIngestionResultSchema, modelDocumentationSchema, } from './inference/modelDocumentation';
+export type { ModelDistributionMethod, ModelSystemicRiskTier, ModelDownstreamDocumentation, ModelGpaiDocumentation, ModelLineDeclaration, ModelReleaseIngestionRequest, ModelReleaseIngestionResult, ModelDocumentation, } from './inference/modelDocumentation';
+export { inferenceContentSourceSchema, inferenceContentPartSchema, inferenceToolCallSchema, inferenceMessageRoleSchema, inferenceMessageSchema, inferenceInputSchema, samplingParametersSchema, toolDefinitionSchema, toolChoiceSchema, responseFormatSchema, clientRequestMetadataSchema, inferenceRequestSchema, } from './inference/request';
+export type { InferenceContentSource, InferenceContentPart, InferenceToolCall, InferenceMessageRole, InferenceMessage, InferenceInput, SamplingParameters, ToolDefinition, ToolChoice, ResponseFormat, ClientRequestMetadata, InferenceRequest, } from './inference/request';
+export { inferenceStreamStartEventSchema, inferenceStreamDeltaEventSchema, inferenceStreamToolCallEventSchema, inferenceStreamUsageEventSchema, inferenceRouteSwitchDetailSchema, inferenceRouteSwitchReasonSchema, inferenceStreamRouteSwitchEventSchema, inferenceStreamErrorEventSchema, inferenceFinishReasonSchema, inferenceStreamDoneEventSchema, inferenceStreamEventSchema, } from './inference/streamEvents';
+export type { InferenceStreamStartEvent, InferenceStreamDeltaEvent, InferenceStreamToolCallEvent, InferenceStreamUsageEvent, InferenceRouteSwitchDetail, InferenceRouteSwitchReason, InferenceStreamRouteSwitchEvent, InferenceStreamErrorEvent, InferenceFinishReason, InferenceStreamDoneEvent, InferenceStreamEvent, } from './inference/streamEvents';
+export { usageReservationRequestSchema, usageReservationStatusSchema, usageReservationSchema, inferenceRequestOutcomeSchema, normalizedUsageReportSchema, usageReceiptSchema, usageRefundSubjectSchema, usageRefundReasonSchema, usageRefundSchema, } from './inference/usage';
+export type { UsageReservationRequest, UsageReservationStatus, UsageReservation, InferenceRequestOutcome, NormalizedUsageReport, UsageReceipt, UsageRefundSubject, UsageRefundReason, UsageRefund, } from './inference/usage';
+export { providerConnectionScopeSchema, kaanaCredentialHandleSchema, kaanaCredentialOperationIdSchema, kaanaCredentialOperationActionSchema, kaanaCredentialIdentitySchema, kaanaCredentialCreateMutationSchema, kaanaCredentialRotateMutationSchema, kaanaCredentialRevokeMutationSchema, kaanaCredentialMutationSchema, kaanaCredentialCreateOutcomeRequestSchema, kaanaCredentialRotateOutcomeRequestSchema, kaanaCredentialRevokeOutcomeRequestSchema, kaanaCredentialOutcomeRequestSchema, kaanaCredentialAppliedOutcomeSchema, kaanaCredentialConflictOutcomeSchema, kaanaCredentialOutcomeSchema, kaanaCredentialValidationTaskSchema, kaanaCredentialValidationOutcomeStateSchema, kaanaCredentialValidationFailureCodeSchema, kaanaCredentialValidationOutcomeSchema, providerCredentialValidationOperationSchema, providerCredentialValidationDeploymentSchema, providerCredentialCustodyStateSchema, providerConnectionValidationSchema, providerConnectionStatusSchema, providerConnectionSchema, } from './inference/providerConnection';
+export type { ProviderConnectionScope, KaanaCredentialOperationAction, KaanaCredentialIdentity, KaanaCredentialMutation, KaanaCredentialOutcomeRequest, KaanaCredentialOutcome, KaanaCredentialValidationTask, KaanaCredentialValidationOutcome, ProviderCredentialValidationOperation, ProviderCredentialValidationDeployment, ProviderConnectionValidation, ProviderConnectionStatus, ProviderCredentialCustodyState, ProviderConnection, } from './inference/providerConnection';
+export { BILLING_MODES, billingModeSchema, BILLING_PROFILE_STATUSES, billingProfileStatusSchema, autoRechargeSchema, billingProfileSchema, accountBillingStateSchema, BILLING_INVOICE_STATUSES, billingInvoiceStatusSchema, billingInvoiceSchema, EXTERNAL_PAYMENT_PROVIDERS, externalPaymentProviderSchema, EXTERNAL_PAYMENT_KINDS, externalPaymentKindSchema, externalPaymentSchema, AUTO_RECHARGE_STATUSES, autoRechargeStatusSchema, autoRechargeAttemptSchema, RECONCILIATION_DISCREPANCY_KINDS, reconciliationDiscrepancyKindSchema, RECONCILIATION_RUN_STATUSES, reconciliationRunStatusSchema, reconciliationDiscrepancySchema, reconciliationRunSchema, reconciliationReportSchema, } from './inference/accountBilling';
+export type { BillingMode, BillingProfileStatus, AutoRecharge, BillingProfile, AccountBillingState, BillingInvoiceStatus, BillingInvoice, ExternalPaymentProvider, ExternalPaymentKind, ExternalPayment, AutoRechargeStatus, AutoRechargeAttempt, ReconciliationDiscrepancyKind, ReconciliationRunStatus, ReconciliationDiscrepancy, ReconciliationRun, ReconciliationReport, } from './inference/accountBilling';
+export { PRODUCT_PLAN_STATUSES, productPlanStatusSchema, LIVE_PRODUCT_PLAN_STATUSES, planAllowanceSchema, productPlanSchema, payAsYouGoEntitlementSchema, COST_CENTER_STATUSES, costCenterStatusSchema, costCenterSchema, costCenterSpendSchema, productEntitlementSchema, } from './inference/entitlement';
+export type { ProductPlanStatus, PlanAllowance, ProductPlan, PayAsYouGoEntitlement, CostCenterStatus, CostCenter, CostCenterSpend, ProductEntitlement, } from './inference/entitlement';
+export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, delegationGrantSchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency';
+export type { AutonomyLevel, CapabilityPackage, ActorRef, ResourceRef, ToolGrantOverride, GrantLimit, ExecutionAuthorizationRef, CapabilityCoordinator, DelegationGrant, AutomationTrigger, AutomationActorSelection, AutomationDefinition, CapabilityTicketClaims, PolicyDecision, AuditEvent, CatalogTool, CatalogEvent, AppCapabilityCatalog, CatalogRegistration, NormalizedAppEvent, } from './agency';
+export { emailContextAddressSchema, emailContextMailboxSchema, emailContextMessageSchema, emailAgentContextSchema, } from './emailAgentContext';
+export type { EmailContextAddress, EmailContextMailbox, EmailContextMessage, EmailAgentContext, } from './emailAgentContext';
+export { inboxComposeRequestSchema, inboxDailyBriefRequestSchema, inboxNaturalSearchRequestSchema, inboxMessageInferenceParamsSchema, inboxInferenceTextResponseSchema, inboxNaturalSearchResponseSchema, inboxSmartRepliesResponseSchema, inboxThreadSummaryResponseSchema, inboxInferenceStreamEventSchema, } from './inference/inbox';
+export type { InboxComposeRequest, InboxDailyBriefRequest, InboxInferenceTextResponse, InboxNaturalSearchResponse, InboxSmartRepliesResponse, InboxThreadSummaryResponse, InboxInferenceStreamEvent, } from './inference/inbox';