@oxy.so/contracts 1.0.0

package/dist/cjs/deviceSession.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deviceBackgroundTokenResponseSchema = exports.deviceBackgroundTokenRequestSchema = exports.deviceBackgroundCredentialResponseSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = void 0;
+const zod_1 = require("zod");
+exports.sessionAccountSchema = zod_1.z.object({
+    accountId: zod_1.z.string(),
+    sessionId: zod_1.z.string(),
+    authuser: zod_1.z.number().int().nonnegative(),
+    operatedByUserId: zod_1.z.string().optional(),
+});
+exports.deviceSessionStateSchema = zod_1.z.object({
+    deviceId: zod_1.z.string(),
+    accounts: zod_1.z.array(exports.sessionAccountSchema),
+    activeAccountId: zod_1.z.string().nullable(),
+    revision: zod_1.z.number().int().nonnegative(),
+    updatedAt: zod_1.z.number(),
+});
+exports.activeTokenSchema = zod_1.z.object({
+    accessToken: zod_1.z.string(),
+    expiresAt: zod_1.z.string(),
+});
+exports.deviceSessionSyncSchema = zod_1.z.object({
+    state: exports.deviceSessionStateSchema,
+    activeToken: exports.activeTokenSchema.nullable(),
+});
+/* -------------------------------------------------------------------------- */
+/*  Device-secret token mint (phase 2c — zero-cookie transport)               */
+/* -------------------------------------------------------------------------- */
+/**
+ * Request body for `POST /session/device/token` — the client presents the
+ * `deviceId` it stored first-party plus the opaque `deviceSecret`. NO bearer:
+ * possession of the secret IS the proof of device ownership. The server matches
+ * `sha256(deviceSecret)` against the device's stored `secretHash` (constant-time)
+ * and mints a short access token for the device's active account.
+ *
+ * `accountId` pins the mint to ONE account of that device instead of whichever
+ * account is currently active. It exists for identity-bound clients (Commons),
+ * whose authenticated user is determined by a local cryptographic key and must
+ * never follow an account switch made by another app on the same device. The
+ * account must already be a member of the device session; the mint NEVER
+ * mutates `activeAccountId`, so pinning is read-only with respect to the device
+ * state every other app observes.
+ */
+exports.deviceTokenMintRequestSchema = zod_1.z.object({
+    deviceId: zod_1.z.string().min(1),
+    deviceSecret: zod_1.z.string().min(1),
+    accountId: zod_1.z.string().min(1).optional(),
+});
+/**
+ * Wire shape of a successful `POST /session/device/token`: the freshly-minted
+ * short access token for the active account, its expiry, the device secret the
+ * client must persist (`nextDeviceSecret` — on mint this echoes the presented
+ * secret unchanged so concurrent refreshes from multiple origins do not race),
+ * and the projected device-session state. Sign-in rotates the secret via
+ * `issueDeviceSecret`; mint does not.
+ */
+exports.deviceTokenMintResponseSchema = zod_1.z.object({
+    accessToken: zod_1.z.string(),
+    expiresAt: zod_1.z.string(),
+    nextDeviceSecret: zod_1.z.string(),
+    state: exports.deviceSessionStateSchema,
+});
+/* -------------------------------------------------------------------------- */
+/*  Instant cross-app session sync (token-free socket signal)                 */
+/* -------------------------------------------------------------------------- */
+/**
+ * Name of the token-free Socket.IO event emitted to room `user:<userId>` on
+ * every DeviceSession mutation that changes what is signed in for that user.
+ *
+ * This is a pure SIGNAL — it carries NO access token, NO deviceSecret and NO
+ * account bodies. A client that receives it re-fetches its authenticated
+ * session/account state (`GET /session/device/state`, `GET /accounts`). Unlike
+ * `session_state` (scoped to `device:<deviceId>`, i.e. a single origin), this
+ * reaches ALL of a user's connected sockets across their devices/origins so
+ * every Oxy app reflects an add / switch / signout instantly.
+ */
+exports.SESSION_ACCOUNTS_CHANGED_EVENT = 'session_accounts_changed';
+/**
+ * Why the signed-in set changed:
+ *  - `login`   — a brand-new session was minted for the user (QR / cross-app authorize)
+ *  - `add`     — an account was registered onto a device set
+ *  - `switch`  — the active account on a device changed
+ *  - `signout` — one or all accounts were signed out of a device
+ *  - `revoke`  — a dead/revoked account was healed out of a device set
+ */
+exports.sessionAccountsChangedReasonSchema = zod_1.z.enum([
+    'login',
+    'add',
+    'switch',
+    'signout',
+    'revoke',
+]);
+/**
+ * Payload of {@link SESSION_ACCOUNTS_CHANGED_EVENT}. `revision` is the mutated
+ * DeviceSession revision for device-scoped reasons (`add`/`switch`/`signout`/
+ * `revoke`); for `login` (no device mutation at emit time) it is `0`. The
+ * payload is deliberately minimal and secret-free — the client refetches.
+ */
+exports.sessionAccountsChangedEventSchema = zod_1.z.object({
+    userId: zod_1.z.string(),
+    revision: zod_1.z.number().int().nonnegative(),
+    reason: exports.sessionAccountsChangedReasonSchema,
+});
+/* -------------------------------------------------------------------------- */
+/*  Background credential — native background code with no JS runtime         */
+/* -------------------------------------------------------------------------- */
+/**
+ * Response from `POST /session/device/background-credential` — provisioned by
+ * the SDK WHILE THE APP IS RUNNING (bearer required, `deviceId` and account
+ * derived server-side from it) and consumed afterwards only by native
+ * background code, which has no JS runtime to mint a token for itself.
+ *
+ * Deliberately a SEPARATE credential from the rotating `deviceSecret`: that one
+ * rotates on every mint, so background code presenting it would become a second
+ * writer of a value the JS runtime depends on, and background code killed
+ * mid-rotation would silently sign the user out on the next cold start. Against
+ * this credential background code is the sole writer, and it can never rotate
+ * anything JS reads.
+ *
+ * The raw `secret` is returned exactly once, at provision time — never stored
+ * retrievably, never logged, never re-read. A caller that loses it provisions
+ * a new one.
+ *
+ * `expiresAt` is an unvalidated string, like every other expiry in this file:
+ * no consumer on the JS path interprets it (native background code parses it
+ * itself), and a `.datetime()` here alone would leave one strict field beside
+ * two lax ones. If expiry is ever validated it goes on all three at once, with
+ * the API's serializers checked against it — the producer is the same server.
+ */
+exports.deviceBackgroundCredentialResponseSchema = zod_1.z.object({
+    deviceId: zod_1.z.string().min(1),
+    secret: zod_1.z.string().min(1),
+    accountId: zod_1.z.string().min(1),
+    expiresAt: zod_1.z.string(),
+});
+/**
+ * Request body for `POST /session/device/background-token` — presented by
+ * native background code with NO bearer and NO cookies: possession of the
+ * background `secret` IS the proof, as it is for the device-secret mint.
+ *
+ * Unlike that mint this one NEVER rotates the presented secret (hence no
+ * `next…` field to persist in the response), so background code interrupted
+ * anywhere between request and response leaves the credential intact and
+ * usable on its next run.
+ */
+exports.deviceBackgroundTokenRequestSchema = zod_1.z.object({
+    deviceId: zod_1.z.string().min(1),
+    secret: zod_1.z.string().min(1),
+});
+/**
+ * Wire shape of a successful `POST /session/device/background-token`: the short
+ * access token, its expiry, and the account the token belongs to — the last so
+ * a caller can key cached data per account and drop data belonging to a
+ * foreign one.
+ *
+ * Carries NO device state — no account list, no `activeAccountId`, no
+ * `revision`, unlike {@link deviceTokenMintResponseSchema} — deliberately, to
+ * cap what a compromised credential record yields.
+ */
+exports.deviceBackgroundTokenResponseSchema = zod_1.z.object({
+    accessToken: zod_1.z.string(),
+    expiresAt: zod_1.z.string(),
+    accountId: zod_1.z.string().min(1),
+});

package/dist/cjs/emailAgentContext.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emailAgentContextSchema = exports.emailContextMessageSchema = exports.emailContextMailboxSchema = exports.emailContextAddressSchema = void 0;
+const zod_1 = require("zod");
+exports.emailContextAddressSchema = zod_1.z.object({
+    name: zod_1.z.string().optional(),
+    address: zod_1.z.string().email(),
+}).strict();
+exports.emailContextMailboxSchema = zod_1.z.object({
+    mailboxId: zod_1.z.string().min(1),
+    name: zod_1.z.string(),
+    path: zod_1.z.string(),
+    totalMessages: zod_1.z.number().int().nonnegative(),
+    unseenMessages: zod_1.z.number().int().nonnegative(),
+}).strict();
+exports.emailContextMessageSchema = zod_1.z.object({
+    messageId: zod_1.z.string().min(1),
+    mailboxId: zod_1.z.string().min(1),
+    from: exports.emailContextAddressSchema,
+    subject: zod_1.z.string(),
+    receivedAt: zod_1.z.string().datetime(),
+    seen: zod_1.z.boolean(),
+    answered: zod_1.z.boolean(),
+}).strict();
+exports.emailAgentContextSchema = zod_1.z.object({
+    accountId: zod_1.z.string().min(1),
+    resourceMailboxId: zod_1.z.string().min(1).nullable(),
+    generatedAt: zod_1.z.string().datetime(),
+    mailboxes: zod_1.z.array(exports.emailContextMailboxSchema),
+    recentUnread: zod_1.z.array(exports.emailContextMessageSchema),
+    needsResponse: zod_1.z.array(exports.emailContextMessageSchema),
+}).strict();

package/dist/cjs/followGraph.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * The follow graph wire contract (`/v2/follows`).
+ *
+ * These types are the boundary between the API that owns the graph and every
+ * application that reads it. They live here — not in the API and not in the
+ * SDK — because both ends have to agree, and a shape defined on one side is a
+ * shape the other side re-declares slightly differently within a release or two.
+ *
+ * ## Why the state is three fields and not a boolean
+ *
+ * A user can follow something globally and turn it off in ONE application. That
+ * is a state the user themselves created, so the client has to be able to see
+ * it and say so — "following, but not shown here" is a sentence a boolean
+ * cannot express. `globalState`, `applicationMode` and `effectiveState` are
+ * therefore reported separately, and only the last one answers "does this
+ * appear in my feed right now".
+ *
+ * ## Why kinds are strings
+ *
+ * `FollowTargetKind` is a plain `string`, not a union. Applications register
+ * their own kinds at runtime (`mercaria.store`, `syra.artist`), so a union here
+ * would mean every new application in the ecosystem needs a release of this
+ * package before it can follow anything. The namespace rule is enforced by the
+ * database, which is the one place that can enforce it for applications this
+ * package has never heard of.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/identity.js

@@ -0,0 +1,258 @@
+"use strict";
+/**
+ * Self-sovereign identity API contracts.
+ *
+ * SINGLE SOURCE OF TRUTH for the wire shape of Oxy's AtProto/Bluesky-flavoured
+ * identity & portability layer: the W3C DID document the API derives on demand,
+ * the signed-record envelope clients sign with their cryptographic key (and the
+ * server verifies), the verified-domain badge, the auth-method ↔ DID
+ * verification-method mapping, and the signed data-export ("credible exit")
+ * bundle. The API validates its OUTPUT against these schemas; every consumer
+ * (the Commons vault app, `@oxy.so/core`'s identity mixin) validates its INPUT
+ * against the same definitions, so producer and consumers cannot drift.
+ *
+ * Design anchors (from the identity-layer plan):
+ *  - DID = `did:web:oxy.so:u:<userId>` — anchored on the stable account id, NOT
+ *    the keypair. The keypair is a *verification method* that maps 1:1 to the
+ *    existing `authMethods[]`. Custodial (password-only) users get a DID
+ *    controlled solely by Oxy (`OXY_DID`); creating a Commons key upgrades them
+ *    to self-sovereign (`controller = [userDid, OXY_DID]`); fully reversible.
+ *  - Verification methods use the secp256k1 `EcdsaSecp256k1VerificationKey2019`
+ *    type with `publicKeyHex` for now (a `Multikey`/`publicKeyMultibase` form may
+ *    be added later — see the plan's open risks).
+ *  - Signed records carry an envelope whose signing input is the canonical-JSON
+ *    of every field EXCEPT `publicKey` and `signature`; `alg` is
+ *    `ES256K-DER-SHA256` (secp256k1 over the SHA-256 of the canonical bytes,
+ *    DER-encoded signature) — the same scheme `SignatureService` uses.
+ *
+ * Explicit-`interface` exports (DidDocument, SignedRecordEnvelope, ExportBundle,
+ * VerifiedDomain, AuthMethodsResponse and their sub-parts) follow the same
+ * rationale as `UserNameResponse` in `./userResponse`: a `z.infer<>` of a nested
+ * object schema can degrade under a consumer's `moduleResolution: "node"`
+ * (node10) resolution, so the load-bearing response shapes are declared as
+ * literal interfaces and the runtime schemas are annotated `z.ZodType<Interface>`
+ * — the emitted `.d.ts` then states the field types verbatim and survives BOTH
+ * `node` and `bundler` resolution. Request schemas (no nested-object hazard) are
+ * inferred via `z.infer<>`.
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo. ESM-safe (no
+ * `require()`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportBundleSchema = exports.exportFinancialSectionSchema = exports.exportUsageReservationSchema = exports.exportLedgerEntrySchema = exports.exportUsageReceiptSchema = exports.exportAttestationSchema = exports.authMethodsResponseSchema = exports.authMethodEntrySchema = exports.domainVerificationInstructionsSchema = exports.domainVerificationRequestSchema = exports.verifiedDomainSchema = exports.signedRecordEnvelopeSchema = exports.didDocumentSchema = exports.didServiceSchema = exports.verificationMethodSchema = void 0;
+const zod_1 = require("zod");
+// The option schemas are left UN-annotated so they keep their concrete
+// `ZodObject` type — `z.discriminatedUnion` requires object options and an
+// explicit `z.ZodType<>` annotation would erase the shape it discriminates on.
+// `z.object` already infers each option's type exactly (id/type/controller +
+// the key field), so the union is structurally `VerificationMethod`.
+const secp256k1VerificationMethodSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    type: zod_1.z.literal('EcdsaSecp256k1VerificationKey2019'),
+    controller: zod_1.z.string(),
+    publicKeyHex: zod_1.z.string(),
+});
+const multikeyVerificationMethodSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    type: zod_1.z.literal('Multikey'),
+    controller: zod_1.z.string(),
+    publicKeyMultibase: zod_1.z.string(),
+});
+exports.verificationMethodSchema = zod_1.z.discriminatedUnion('type', [
+    secp256k1VerificationMethodSchema,
+    multikeyVerificationMethodSchema,
+]);
+exports.didServiceSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    type: zod_1.z.string(),
+    serviceEndpoint: zod_1.z.string(),
+});
+exports.didDocumentSchema = zod_1.z.object({
+    '@context': zod_1.z.array(zod_1.z.string()),
+    id: zod_1.z.string(),
+    controller: zod_1.z.array(zod_1.z.string()),
+    verificationMethod: zod_1.z.array(exports.verificationMethodSchema),
+    authentication: zod_1.z.array(zod_1.z.string()),
+    assertionMethod: zod_1.z.array(zod_1.z.string()),
+    alsoKnownAs: zod_1.z.array(zod_1.z.string()),
+    service: zod_1.z.array(exports.didServiceSchema),
+});
+exports.signedRecordEnvelopeSchema = zod_1.z
+    .object({
+    version: zod_1.z.union([zod_1.z.literal(1), zod_1.z.literal(2)]),
+    // Open, app-defined category (see the `type` doc above). The Oxy STORE
+    // re-narrows to `oxySignedRecordTypeSchema`; an app to its own constant.
+    type: zod_1.z.string().min(1),
+    subject: zod_1.z.string(),
+    issuer: zod_1.z.string(),
+    record: zod_1.z.record(zod_1.z.unknown()),
+    issuedAt: zod_1.z.number(),
+    seq: zod_1.z.number().int().nonnegative().optional(),
+    prev: zod_1.z.string().nullable().optional(),
+    collection: zod_1.z.string().min(1).optional(),
+    rkey: zod_1.z.string().min(1).optional(),
+    publicKey: zod_1.z.string(),
+    alg: zod_1.z.literal('ES256K-DER-SHA256'),
+    signature: zod_1.z.string(),
+})
+    .superRefine((env, ctx) => {
+    if (env.version === 2) {
+        // v2 REQUIRES the hash-chain fields. `prev` may be `null` at genesis,
+        // but the key must be present (it is part of the signed bytes), so we
+        // reject only when it is entirely absent.
+        if (typeof env.seq !== 'number') {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'v2 envelope requires `seq`',
+                path: ['seq'],
+            });
+        }
+        if (env.prev === undefined) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'v2 envelope requires `prev` (use `null` at genesis)',
+                path: ['prev'],
+            });
+        }
+        if (typeof env.collection !== 'string') {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'v2 envelope requires `collection`',
+                path: ['collection'],
+            });
+        }
+        if (typeof env.rkey !== 'string') {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'v2 envelope requires `rkey`',
+                path: ['rkey'],
+            });
+        }
+    }
+    else {
+        // v1 FORBIDS the v2 chain fields entirely, so a legacy envelope keeps
+        // its exact byte shape and cannot smuggle unsigned chain metadata.
+        if (env.seq !== undefined) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'v1 envelope must not carry `seq`',
+                path: ['seq'],
+            });
+        }
+        if (env.prev !== undefined) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'v1 envelope must not carry `prev`',
+                path: ['prev'],
+            });
+        }
+        if (env.collection !== undefined) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'v1 envelope must not carry `collection`',
+                path: ['collection'],
+            });
+        }
+        if (env.rkey !== undefined) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'v1 envelope must not carry `rkey`',
+                path: ['rkey'],
+            });
+        }
+    }
+});
+exports.verifiedDomainSchema = zod_1.z.object({
+    domain: zod_1.z.string(),
+    verifiedAt: zod_1.z.union([zod_1.z.string(), zod_1.z.date()]),
+    method: zod_1.z.enum(['dns-txt', 'well-known']),
+});
+/** Request body for `POST /identity/domains` — the domain to start verifying. */
+exports.domainVerificationRequestSchema = zod_1.z.object({
+    domain: zod_1.z.string().trim().min(1),
+});
+/**
+ * The instructions the API returns when a domain verification is requested. The
+ * caller may prove ownership EITHER by publishing the `dns` TXT record OR by
+ * serving the `wellKnown` file; either path then satisfies
+ * `POST /identity/domains/:domain/verify`.
+ */
+exports.domainVerificationInstructionsSchema = zod_1.z.object({
+    domain: zod_1.z.string(),
+    token: zod_1.z.string(),
+    dns: zod_1.z.object({
+        name: zod_1.z.string(),
+        value: zod_1.z.string(),
+    }),
+    wellKnown: zod_1.z.object({
+        url: zod_1.z.string(),
+        body: zod_1.z.string(),
+    }),
+});
+exports.authMethodEntrySchema = zod_1.z.object({
+    type: zod_1.z.enum(['identity', 'webauthn']),
+    linkedAt: zod_1.z.union([zod_1.z.string(), zod_1.z.date()]),
+    verificationMethodId: zod_1.z.string().optional(),
+    credentialId: zod_1.z.string().optional(),
+    name: zod_1.z.string().optional(),
+});
+exports.authMethodsResponseSchema = zod_1.z.object({
+    did: zod_1.z.string(),
+    methods: zod_1.z.array(exports.authMethodEntrySchema),
+});
+exports.exportAttestationSchema = zod_1.z.object({
+    issuer: zod_1.z.string(),
+    publicKey: zod_1.z.string(),
+    alg: zod_1.z.literal('ES256K-DER-SHA256'),
+    signature: zod_1.z.string(),
+    signedAt: zod_1.z.number(),
+});
+exports.exportUsageReceiptSchema = zod_1.z.object({
+    receiptId: zod_1.z.string(),
+    requestId: zod_1.z.string(),
+    settledAt: zod_1.z.string(),
+    billedAmount: zod_1.z.string(),
+    currency: zod_1.z.string(),
+    outcome: zod_1.z.string(),
+    resolvedModelReference: zod_1.z.string(),
+    servingProvider: zod_1.z.string(),
+    platformFeeOnly: zod_1.z.boolean(),
+});
+exports.exportLedgerEntrySchema = zod_1.z.object({
+    entryId: zod_1.z.string(),
+    kind: zod_1.z.string(),
+    currency: zod_1.z.string(),
+    createdAt: zod_1.z.string(),
+});
+exports.exportUsageReservationSchema = zod_1.z.object({
+    reservationId: zod_1.z.string(),
+    requestId: zod_1.z.string(),
+    status: zod_1.z.string(),
+    reservedAmount: zod_1.z.string(),
+    currency: zod_1.z.string(),
+    createdAt: zod_1.z.string(),
+    expiresAt: zod_1.z.string(),
+});
+exports.exportFinancialSectionSchema = zod_1.z.object({
+    receipts: zod_1.z.array(exports.exportUsageReceiptSchema),
+    ledgerEntries: zod_1.z.array(exports.exportLedgerEntrySchema),
+    reservations: zod_1.z.array(exports.exportUsageReservationSchema),
+});
+exports.exportBundleSchema = zod_1.z.object({
+    '$schema': zod_1.z.string(),
+    exportedAt: zod_1.z.string(),
+    did: zod_1.z.string(),
+    didDocument: exports.didDocumentSchema,
+    profile: zod_1.z.record(zod_1.z.unknown()),
+    verifiedDomains: zod_1.z.array(exports.verifiedDomainSchema),
+    authMethods: zod_1.z.array(exports.authMethodEntrySchema),
+    signedRecords: zod_1.z.array(exports.signedRecordEnvelopeSchema),
+    appData: zod_1.z.array(zod_1.z.record(zod_1.z.unknown())),
+    social: zod_1.z.object({
+        following: zod_1.z.array(zod_1.z.string()),
+        followers: zod_1.z.array(zod_1.z.string()),
+    }),
+    financial: exports.exportFinancialSectionSchema,
+    attestation: exports.exportAttestationSchema.nullable(),
+    proof: exports.exportAttestationSchema.optional(),
+});

package/dist/cjs/inboxPush.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * Canonical contract for Inbox new-mail push notifications.
+ *
+ * The Android channel id and payload `type` are wire contracts: Android 8+
+ * drops a notification whose channel the app has not created, and the client
+ * only routes taps it recognises. Two hand-typed copies of either string fail as
+ * "the notification never arrived" or "tapping does nothing" — the hardest push
+ * symptoms to diagnose.
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inboxEmailPushDataSchema = exports.INBOX_EMAIL_PUSH_TYPE = exports.INBOX_EMAIL_PUSH_CHANNEL = void 0;
+const zod_1 = require("zod");
+/** Android notification channel id the new-mail push is sent on. */
+exports.INBOX_EMAIL_PUSH_CHANNEL = 'email';
+/** Runtime type discriminator of the new-mail push payload. */
+exports.INBOX_EMAIL_PUSH_TYPE = 'oxy_inbox_new_message';
+exports.inboxEmailPushDataSchema = zod_1.z.object({
+    type: zod_1.z.literal(exports.INBOX_EMAIL_PUSH_TYPE),
+    messageId: zod_1.z.string().min(1),
+    mailboxId: zod_1.z.string().min(1),
+});