@oxy.so/contracts 1.5.0 → 2.1.0

package/dist/cjs/federationInstanceFetch.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * Wire contract for `POST /federation/instance-fetch/sign`: Oxy's INSTANCE
+ * actor signs one ActivityPub GET for a first-party service, so the service can
+ * read an instance running in authorized-fetch ("secure") mode without holding
+ * a key.
+ *
+ * The caller sends a URL, never a signing string: Oxy builds the string itself
+ * (`(request-target): get <path>`, `host`, `date`), the method is always GET
+ * and the key is always the instance actor's. The caller sends the returned
+ * headers, unchanged, on exactly that URL, within the few minutes remote
+ * servers accept a `Date` for. A redirect is a new URL and needs a new
+ * signature.
+ *
+ * Needs a service token whose application holds the privileged
+ * `federation:instance-fetch` scope.
+ *
+ * Platform-agnostic — zod only.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.instanceFetchSignResponseSchema = exports.instanceFetchSignRequestSchema = exports.INSTANCE_FETCH_MAX_URL_LENGTH = void 0;
+const zod_1 = require("zod");
+/** The longest URL Oxy will sign (the same cap as its own safe fetch). */
+exports.INSTANCE_FETCH_MAX_URL_LENGTH = 2048;
+exports.instanceFetchSignRequestSchema = zod_1.z
+    .object({
+    /** The absolute public `https://` URL the caller is about to GET. */
+    url: zod_1.z.string().trim().min(1).max(exports.INSTANCE_FETCH_MAX_URL_LENGTH),
+})
+    .strict();
+exports.instanceFetchSignResponseSchema = zod_1.z
+    .object({
+    /** The instance actor's key, e.g. `https://oxy.so/ap/users/instance#main-key`. */
+    keyId: zod_1.z.string().url(),
+    /** Send all three on the GET, as they are. */
+    headers: zod_1.z
+        .object({
+        Host: zod_1.z.string().min(1),
+        Date: zod_1.z.string().min(1),
+        Signature: zod_1.z.string().min(1),
+    })
+        .strict(),
+})
+    .strict();

package/dist/cjs/index.js

@@ -29,13 +29,13 @@ exports.OXY_USER_INVALIDATION_CHANNEL = exports.inboxEmailPushDataSchema = expor
 exports.vouchResultSchema = exports.personhoodStatusResultSchema = exports.personhoodBreakdownSchema = exports.personhoodVouchRecordSchema = exports.validationVoteResultSchema = exports.validationRequestSummarySchema = exports.validationOpenResultSchema = exports.validationOpenRequestSchema = exports.validationVerdictRecordSchema = exports.realLifeAttestationResultSchema = exports.realLifeAttestationRecordSchema = exports.signedPublicCardSchema = exports.publicCardSchema = exports.logPageResponseSchema = exports.chainHeadResponseSchema = exports.oxySignedRecordTypeSchema = exports.exportBundleSchema = exports.exportFinancialSectionSchema = exports.exportUsageReservationSchema = exports.exportLedgerEntrySchema = exports.exportUsageReceiptSchema = exports.exportAttestationSchema = exports.authMethodsResponseSchema = exports.authMethodEntrySchema = exports.domainVerificationInstructionsSchema = exports.resourceDomainOwnershipResponseSchema = exports.resourceDomainOwnershipRequestSchema = exports.domainVerificationRequestSchema = exports.verifiedDomainSchema = exports.signedRecordEnvelopeSchema = exports.didDocumentSchema = exports.didServiceSchema = exports.verificationMethodSchema = exports.appAffinityEventsIngestSchema = exports.appAffinityEventSchema = exports.appAffinityEventTypeSchema = exports.appUserSignalIngestSchema = exports.appInterestInputSchema = exports.appEndorsementInputSchema = exports.recommendationResponseSchema = exports.recommendationItemSchema = exports.recommendationCountSchema = exports.recommendationRequestSchema = exports.recommendationSignalWeightsSchema = exports.recommendationBoostSchema = exports.recommendationExcludeTypeSchema = exports.oxyUserInvalidationEventSchema = exports.isPublishedOxyUserChangeReason = exports.OXY_PUBLISHED_USER_CHANGE_REASONS = exports.OXY_USER_CHANGE_REASONS = void 0;
 exports.moderationSeveritySchema = exports.APPLICATION_MODERATION_STANDINGS = exports.IDENTITY_BINDING_STATUSES = exports.IDENTITY_BINDING_TYPES = exports.PERSONHOOD_STATUSES = exports.CONTRIBUTION_TIERS = exports.CONDUCT_STANDINGS = exports.CONDUCT_STRIKE_STATUSES = exports.MODERATION_EFFECT_SKIP_REASONS = exports.MODERATION_EFFECT_STATUSES = exports.MODERATION_EFFECT_TYPES = exports.MODERATION_DECISION_STATUSES = exports.MODERATION_ATTRIBUTIONS = exports.MODERATION_FINDING_SCOPES = exports.MODERATION_SEVERITIES = exports.isFullReputationBalance = exports.reverseReputationTransactionSchema = exports.upsertReputationRuleSchema = exports.resolveReputationDisputeSchema = exports.createReputationDisputeSchema = exports.awardReputationSchema = exports.reverseReputationTransactionResultSchema = exports.reputationInfluenceResultSchema = exports.reputationLeaderboardEntrySchema = exports.reputationLeaderboardUserSchema = exports.reputationRuleSchema = exports.reputationDisputeSchema = exports.reputationBalanceSchema = exports.reputationBalanceSummarySchema = exports.reputationReliabilitySchema = exports.reputationInfluenceSchema = exports.reputationBalanceBreakdownSchema = exports.reputationTransactionSchema = exports.reputationInfluenceContextSchema = exports.reputationDisputeStatusSchema = exports.reputationTargetEntityTypeSchema = exports.trustTierSchema = exports.reputationTransactionStatusSchema = exports.reputationCategorySchema = exports.REPUTATION_INFLUENCE_CONTEXTS = exports.REPUTATION_DISPUTE_STATUSES = exports.REPUTATION_TARGET_ENTITY_TYPES = exports.TRUST_TIERS = exports.REPUTATION_TRANSACTION_STATUSES = exports.REPUTATION_CATEGORIES = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = void 0;
 exports.deviceActivateResponseSchema = exports.deviceActivateRequestSchema = exports.deviceDirectorySchema = exports.devicePrincipalSchema = exports.deviceAccountContextSchema = exports.deviceDirectoryProfileSchema = exports.deviceContextRelationshipSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceBackgroundTokenResponseSchema = exports.deviceBackgroundTokenRequestSchema = exports.deviceBackgroundCredentialResponseSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.applicationModerationTrustSchema = exports.reputationContextualInfluenceSchema = exports.reputationReviewingSchema = exports.reputationReportingSchema = exports.reputationConductSchema = exports.reputationContributionSchema = exports.reputationPersonhoodSchema = exports.identityBindingSchema = exports.registerIdentityBindingSchema = exports.reverseModerationEffectResultSchema = exports.applyModerationDecisionResultSchema = exports.moderationEffectSchema = exports.reverseModerationEffectSchema = exports.finalizeModerationDecisionSchema = exports.moderationDecisionEventSchema = exports.moderationPolicyVersionsSchema = exports.moderationDecisionEventSubjectSchema = exports.moderationFindingSchema = exports.applicationModerationStandingSchema = exports.identityBindingStatusSchema = exports.identityBindingTypeSchema = exports.personhoodStatusSchema = exports.contributionTierSchema = exports.conductStandingSchema = exports.conductStrikeStatusSchema = exports.moderationEffectSkipReasonSchema = exports.moderationEffectStatusSchema = exports.moderationEffectTypeSchema = exports.moderationDecisionStatusSchema = exports.moderationAttributionSchema = exports.moderationFindingScopeSchema = void 0;
-exports.IDENTITY_PROOF_ACTIONS = exports.IDENTITY_PROOF_CHALLENGE_TTL_MS = exports.IDENTITY_PROOF_AUDIENCE = exports.IDENTITY_PROOF_DOMAIN = exports.IDENTITY_PROOF_VERSION = exports.webIdentityEnvelopeEstablishSchema = exports.webauthnAssertionResponseSchema = exports.webIdentityEnvelopePutSchema = exports.webIdentityEnvelopeActionSchema = exports.webIdentityEnvelopeProofFieldsSchema = exports.webIdentityEnvelopeResponseSchema = exports.webIdentityHolderSchema = exports.webIdentityEnvelopeUploadSchema = exports.webIdentityEnvelopeSchema = exports.webIdentityWrapSchema = exports.webauthnRpIdSchema = exports.webauthnCredentialIdSchema = exports.webIdentityPublicKeySchema = exports.WEB_IDENTITY_SECRET_KINDS = exports.WEB_IDENTITY_ENVELOPE_VERSION = exports.backupStatusResponseSchema = exports.backupUploadRequestSchema = exports.encryptedBackupEnvelopeSchema = exports.backupLookupIdSchema = exports.rotateKeyCompleteResponseSchema = exports.rotateKeyCompleteRequestSchema = exports.rotateKeyChallengeResponseSchema = exports.loginResultSchema = exports.hubAuthorizeResultSchema = exports.hubAuthorizeRequestSchema = exports.hubActivateRequestSchema = exports.hubClaimRequestSchema = exports.hubSessionSchema = exports.browserHubRevokeResponseSchema = exports.browserHubErrorSchema = exports.browserHubResolveResponseSchema = exports.browserHubHandleResponseSchema = exports.browserHubHandleRequestSchema = exports.browserHubHandleSchema = exports.BROWSER_HUB_HANDLE_TTL_MS = exports.BROWSER_HUB_COOKIE_ATTRIBUTES = exports.BROWSER_HUB_COOKIE_NAME = exports.mcpOAuthConsentResponseSchema = exports.mcpOAuthClientInfoResponseSchema = exports.mcpOAuthConsentContextSchema = exports.mcpOAuthWriteActionSchema = exports.mcpOAuthClientApplicationSchema = exports.oauthAuthorizeCodeResponseSchema = exports.oauthConsentDecisionSchema = exports.deviceDirectorySyncSchema = void 0;
-exports.channelListResponseSchema = exports.channelSchema = exports.rollbackToEmbeddedEntrySchema = exports.createUpdateResponseSchema = exports.updateSchema = exports.createUpdateRequestSchema = exports.updateAssetRefSchema = exports.assetCompleteResponseSchema = exports.assetCompleteResultItemSchema = exports.assetCompleteRequestSchema = exports.assetInitResponseSchema = exports.assetUploadTicketSchema = exports.assetInitRequestSchema = exports.assetInitItemSchema = exports.rolloutPercentSchema = exports.runtimeVersionSchema = exports.channelNameSchema = exports.sha256HexSchema = exports.updateAssetStatusSchema = exports.updateStatusSchema = exports.updatePlatformSchema = exports.identityMoveStateSchema = exports.identityMoveReceiptRequestSchema = exports.identityMoveSealRequestSchema = exports.identityMoveJoinRequestSchema = exports.identityMoveCreateResponseSchema = exports.identityMoveCreateRequestSchema = exports.identityMoveEphemeralKeySchema = exports.identityMoveIdSchema = exports.buildMoveReceiptMessage = exports.buildMoveCiphertextDigestInput = exports.buildMoveSealPayload = exports.buildMoveSasInput = exports.buildMoveCommitmentInput = exports.identityMoveRevealRequestSchema = exports.IDENTITY_MOVE_QR_PREFIX = exports.IDENTITY_MOVE_STATUSES = exports.IDENTITY_MOVE_TTL_MS = exports.identityRecoveryCompleteRequestSchema = exports.identityRecoveryStartRequestSchema = exports.identityRecoveryChallengeResponseSchema = exports.IDENTITY_RECOVERY_TTL_MS = exports.identityRootStatusSchema = exports.identityProofChallengeResponseSchema = exports.identityProofChallengeRequestSchema = exports.identityProofSchema = exports.buildIdentityProofMessage = exports.canonicalJson = exports.IDENTITY_ERROR_CODES = exports.IDENTITY_PROOF_ACTION_VALUES = void 0;
-exports.inferenceScopeSchema = exports.INFERENCE_SCOPES = exports.unitPriceSchema = exports.usageQuantitySchema = exports.usageSourceSchema = exports.USAGE_SOURCES = exports.usageUnitSchema = exports.USAGE_UNITS = exports.moneySchema = exports.exactDecimalSchema = exports.INFERENCE_MONEY_SCALE = exports.currencyCodeSchema = exports.RESERVED_ALIA_PUBLISHER = exports.inferenceRegionSchema = exports.deploymentIdSchema = exports.inferenceProviderSlugSchema = exports.routingProfileSlugSchema = exports.routingProfileIdSchema = exports.modelReferenceSchema = exports.modelRevisionLabelSchema = exports.modelIdSchema = exports.modelSlugSchema = exports.publisherSlugSchema = exports.sha256DigestSchema = exports.inferenceHttpsUrlSchema = exports.inferenceDateSchema = exports.inferenceTimestampSchema = exports.inferenceEnvironmentSchema = exports.idempotencyKeySchema = exports.generationIdSchema = exports.requestIdSchema = exports.oxyCredentialIdSchema = exports.oxyApplicationIdSchema = exports.delegatedUserIdSchema = exports.oxyAccountIdSchema = exports.INFERENCE_CONTRACT_VERSION = exports.transparencyCheckpointListSchema = exports.transparencyInclusionProofSchema = exports.transparencyCheckpointSchema = exports.transparencyAnchorSchema = exports.transparencyCheckpointSignatureSchema = exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.updateRolloutPatchSchema = exports.promoteRequestSchema = exports.rollbackToEmbeddedRequestSchema = exports.rollbackRequestSchema = exports.updateListResponseSchema = void 0;
-exports.modelSystemicRiskTierSchema = exports.modelDistributionMethodSchema = exports.aliaModelReleaseManifestSchema = exports.aliaReleaseSignatureSchema = exports.aliaReleaseArtifactSchema = exports.authorizedRouteSchema = exports.routingPolicyReferenceSchema = exports.routingPolicySchema = exports.routingFallbackPolicySchema = exports.routingPolicyScopeSchema = exports.routingTargetSchema = exports.modelCatalogueEntrySchema = exports.catalogueServingProviderSummarySchema = exports.cataloguePublisherSummarySchema = exports.routingProfileSchema = exports.routingProfileCandidateSchema = exports.modelDeploymentSchema = exports.inferenceProviderSchema = exports.modelRevisionSchema = exports.catalogueModelSchema = exports.modelPublisherSchema = exports.modelSafetyMetadataSchema = exports.modelEvaluationResultSchema = exports.modelDeprecationSchema = exports.commercialPermissionSchema = exports.availabilityScopeSchema = exports.inferenceDataPolicySchema = exports.modelProvenanceSchema = exports.modelLicenseSchema = exports.modelCapabilitiesSchema = exports.reasoningEffortSchema = exports.inferenceModalitySchema = exports.priceSnapshotSchema = exports.priceVersionSchema = exports.priceVersionStatusSchema = exports.embeddingResponseSchema = exports.embeddingFailureSchema = exports.embeddingSuccessSchema = exports.embeddingUsageSchema = exports.embeddingVectorSchema = exports.inferenceErrorSchema = exports.providerErrorPassthroughSchema = exports.safeErrorTextSchema = exports.upstreamErrorCategorySchema = exports.inferenceErrorCodeSchema = exports.NON_RETRYABLE_INFERENCE_ERROR_CODES = exports.INFERENCE_ERROR_CODES = exports.inferenceAttributionSchema = exports.authenticatedPrincipalSchema = exports.billingPrincipalSchema = void 0;
-exports.kaanaCredentialIdentitySchema = exports.kaanaCredentialOperationActionSchema = exports.kaanaCredentialOperationIdSchema = exports.kaanaCredentialHandleSchema = exports.providerConnectionScopeSchema = exports.usageRefundSchema = exports.usageRefundReasonSchema = exports.usageRefundSubjectSchema = exports.usageReceiptSchema = exports.normalizedUsageReportSchema = exports.inferenceRequestOutcomeSchema = exports.usageReservationSchema = exports.usageReservationStatusSchema = exports.usageReservationRequestSchema = exports.inferenceStreamEventSchema = exports.inferenceStreamDoneEventSchema = exports.inferenceFinishReasonSchema = exports.inferenceStreamErrorEventSchema = exports.inferenceStreamRouteSwitchEventSchema = exports.inferenceRouteSwitchReasonSchema = exports.inferenceRouteSwitchDetailSchema = exports.inferenceStreamUsageEventSchema = exports.inferenceStreamToolCallEventSchema = exports.inferenceStreamAudioEventSchema = exports.MAX_INFERENCE_AUDIO_BYTES = exports.inferenceAudioMediaTypeSchema = exports.inferenceStreamDeltaEventSchema = exports.inferenceStreamStartEventSchema = exports.inferenceSpeechParametersSchema = exports.inferenceRequestSchema = exports.clientRequestMetadataSchema = exports.responseFormatSchema = exports.toolChoiceSchema = exports.toolDefinitionSchema = exports.inferenceReasoningSchema = exports.samplingParametersSchema = exports.inferenceInputSchema = exports.inferenceMessageSchema = exports.inferenceMessageRoleSchema = exports.inferenceToolCallSchema = exports.inferenceContentPartSchema = exports.inferenceContentSourceSchema = exports.modelDocumentationSchema = exports.modelReleaseIngestionResultSchema = exports.modelReleaseIngestionRequestSchema = exports.modelLineDeclarationSchema = exports.modelGpaiDocumentationSchema = exports.modelDownstreamDocumentationSchema = exports.SYSTEMIC_RISK_COMPUTE_THRESHOLD_FLOPS = exports.trainingComputeFlopsSchema = void 0;
-exports.planAllowanceSchema = exports.LIVE_PRODUCT_PLAN_STATUSES = exports.productPlanStatusSchema = exports.PRODUCT_PLAN_STATUSES = exports.reconciliationReportSchema = exports.reconciliationRunSchema = exports.reconciliationDiscrepancySchema = exports.reconciliationRunStatusSchema = exports.RECONCILIATION_RUN_STATUSES = exports.reconciliationDiscrepancyKindSchema = exports.RECONCILIATION_DISCREPANCY_KINDS = exports.autoRechargeAttemptSchema = exports.autoRechargeStatusSchema = exports.AUTO_RECHARGE_STATUSES = exports.externalPaymentSchema = exports.externalPaymentKindSchema = exports.EXTERNAL_PAYMENT_KINDS = exports.externalPaymentProviderSchema = exports.EXTERNAL_PAYMENT_PROVIDERS = exports.billingInvoiceSchema = exports.billingInvoiceStatusSchema = exports.BILLING_INVOICE_STATUSES = exports.accountBillingStateSchema = exports.billingProfileSchema = exports.autoRechargeSchema = exports.billingProfileStatusSchema = exports.BILLING_PROFILE_STATUSES = exports.billingModeSchema = exports.BILLING_MODES = exports.providerConnectionSchema = exports.providerConnectionStatusSchema = exports.providerConnectionValidationSchema = exports.providerCredentialCustodyStateSchema = exports.providerCredentialValidationDeploymentSchema = exports.providerCredentialValidationOperationSchema = exports.kaanaCredentialValidationOutcomeSchema = exports.kaanaCredentialValidationFailureCodeSchema = exports.kaanaCredentialValidationOutcomeStateSchema = exports.kaanaCredentialValidationTaskSchema = exports.kaanaCredentialOutcomeSchema = exports.kaanaCredentialConflictOutcomeSchema = exports.kaanaCredentialAppliedOutcomeSchema = exports.kaanaCredentialOutcomeRequestSchema = exports.kaanaCredentialRevokeOutcomeRequestSchema = exports.kaanaCredentialRotateOutcomeRequestSchema = exports.kaanaCredentialCreateOutcomeRequestSchema = exports.kaanaCredentialMutationSchema = exports.kaanaCredentialRevokeMutationSchema = exports.kaanaCredentialRotateMutationSchema = exports.kaanaCredentialCreateMutationSchema = void 0;
-exports.inboxInferenceStreamEventSchema = exports.inboxThreadSummaryResponseSchema = exports.inboxSmartRepliesResponseSchema = exports.inboxNaturalSearchResponseSchema = exports.inboxInferenceTextResponseSchema = exports.inboxMessageInferenceParamsSchema = exports.inboxNaturalSearchRequestSchema = exports.inboxDailyBriefRequestSchema = exports.inboxComposeRequestSchema = exports.emailAgentContextSchema = exports.emailContextMessageSchema = exports.emailContextMailboxSchema = exports.emailContextAddressSchema = exports.normalizedAppEventSchema = exports.catalogRegistrationSchema = exports.appCapabilityCatalogSchema = exports.catalogEventSchema = exports.catalogToolSchema = exports.auditEventSchema = exports.auditResultSchema = exports.policyDecisionSchema = exports.capabilityTicketClaimsSchema = exports.automationDefinitionSchema = exports.automationDataFlowSchema = exports.automationActorSelectionSchema = exports.automationTriggerSchema = exports.delegationGrantSchema = exports.capabilityCoordinatorSchema = exports.executionAuthorizationRefSchema = exports.capabilityCatalogBindingSchema = exports.grantLimitSchema = exports.toolGrantOverrideSchema = exports.resourceRefSchema = exports.actorRefSchema = exports.capabilityPackageSchema = exports.autonomyLevelSchema = exports.CAPABILITY_PACKAGES = exports.AUTONOMY_LEVELS = exports.productEntitlementSchema = exports.costCenterSpendSchema = exports.costCenterSchema = exports.costCenterStatusSchema = exports.COST_CENTER_STATUSES = exports.payAsYouGoEntitlementSchema = exports.productPlanSchema = void 0;
+exports.IDENTITY_MOVE_STATUSES = exports.IDENTITY_MOVE_TTL_MS = exports.identityRecoveryCompleteRequestSchema = exports.identityRecoveryStartRequestSchema = exports.identityRecoveryChallengeResponseSchema = exports.IDENTITY_RECOVERY_TTL_MS = exports.identityRootStatusSchema = exports.identityProofChallengeResponseSchema = exports.identityProofChallengeRequestSchema = exports.identityProofSchema = exports.buildIdentityProofMessage = exports.canonicalJson = exports.IDENTITY_ERROR_CODES = exports.IDENTITY_PROOF_ACTION_VALUES = exports.IDENTITY_PROOF_ACTIONS = exports.IDENTITY_PROOF_CHALLENGE_TTL_MS = exports.IDENTITY_PROOF_AUDIENCE = exports.IDENTITY_PROOF_DOMAIN = exports.IDENTITY_PROOF_VERSION = exports.webIdentityEnvelopeEstablishSchema = exports.webauthnAssertionResponseSchema = exports.webIdentityEnvelopePutSchema = exports.webIdentityEnvelopeActionSchema = exports.webIdentityEnvelopeProofFieldsSchema = exports.webIdentityEnvelopeResponseSchema = exports.webIdentityHolderSchema = exports.webIdentityEnvelopeUploadSchema = exports.webIdentityEnvelopeSchema = exports.webIdentityWrapSchema = exports.webauthnRpIdSchema = exports.webauthnCredentialIdSchema = exports.webIdentityPublicKeySchema = exports.WEB_IDENTITY_SECRET_KINDS = exports.WEB_IDENTITY_ENVELOPE_VERSION = exports.backupStatusResponseSchema = exports.backupUploadRequestSchema = exports.encryptedBackupEnvelopeSchema = exports.backupLookupIdSchema = exports.rotateKeyCompleteResponseSchema = exports.rotateKeyCompleteRequestSchema = exports.rotateKeyChallengeResponseSchema = exports.loginResultSchema = exports.mcpOAuthConsentResponseSchema = exports.mcpOAuthClientInfoResponseSchema = exports.mcpOAuthConsentContextSchema = exports.mcpOAuthWriteActionSchema = exports.mcpOAuthClientApplicationSchema = exports.oauthAuthorizeCodeResponseSchema = exports.oauthConsentDecisionSchema = exports.deviceDirectorySyncSchema = void 0;
+exports.transparencyCheckpointListSchema = exports.transparencyInclusionProofSchema = exports.transparencyCheckpointSchema = exports.transparencyAnchorSchema = exports.transparencyCheckpointSignatureSchema = exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.updateRolloutPatchSchema = exports.promoteRequestSchema = exports.rollbackToEmbeddedRequestSchema = exports.rollbackRequestSchema = exports.updateListResponseSchema = exports.channelListResponseSchema = exports.channelSchema = exports.rollbackToEmbeddedEntrySchema = exports.createUpdateResponseSchema = exports.updateSchema = exports.createUpdateRequestSchema = exports.updateAssetRefSchema = exports.assetCompleteResponseSchema = exports.assetCompleteResultItemSchema = exports.assetCompleteRequestSchema = exports.assetInitResponseSchema = exports.assetUploadTicketSchema = exports.assetInitRequestSchema = exports.assetInitItemSchema = exports.rolloutPercentSchema = exports.runtimeVersionSchema = exports.channelNameSchema = exports.sha256HexSchema = exports.updateAssetStatusSchema = exports.updateStatusSchema = exports.updatePlatformSchema = exports.identityMoveStateSchema = exports.identityMoveReceiptRequestSchema = exports.identityMoveSealRequestSchema = exports.identityMoveJoinRequestSchema = exports.identityMoveCreateResponseSchema = exports.identityMoveCreateRequestSchema = exports.identityMoveEphemeralKeySchema = exports.identityMoveIdSchema = exports.buildMoveReceiptMessage = exports.buildMoveCiphertextDigestInput = exports.buildMoveSealPayload = exports.buildMoveSasInput = exports.buildMoveCommitmentInput = exports.identityMoveRevealRequestSchema = exports.IDENTITY_MOVE_QR_PREFIX = void 0;
+exports.embeddingFailureSchema = exports.embeddingSuccessSchema = exports.embeddingUsageSchema = exports.embeddingVectorSchema = exports.inferenceErrorSchema = exports.providerErrorPassthroughSchema = exports.safeErrorTextSchema = exports.upstreamErrorCategorySchema = exports.inferenceErrorCodeSchema = exports.NON_RETRYABLE_INFERENCE_ERROR_CODES = exports.INFERENCE_ERROR_CODES = exports.inferenceAttributionSchema = exports.authenticatedPrincipalSchema = exports.billingPrincipalSchema = exports.inferenceScopeSchema = exports.INFERENCE_SCOPES = exports.unitPriceSchema = exports.usageQuantitySchema = exports.usageSourceSchema = exports.USAGE_SOURCES = exports.usageUnitSchema = exports.USAGE_UNITS = exports.moneySchema = exports.exactDecimalSchema = exports.INFERENCE_MONEY_SCALE = exports.currencyCodeSchema = exports.RESERVED_ALIA_PUBLISHER = exports.inferenceRegionSchema = exports.deploymentIdSchema = exports.inferenceProviderSlugSchema = exports.routingProfileSlugSchema = exports.routingProfileIdSchema = exports.modelReferenceSchema = exports.modelRevisionLabelSchema = exports.modelIdSchema = exports.modelSlugSchema = exports.publisherSlugSchema = exports.sha256DigestSchema = exports.inferenceHttpsUrlSchema = exports.inferenceDateSchema = exports.inferenceTimestampSchema = exports.inferenceEnvironmentSchema = exports.idempotencyKeySchema = exports.generationIdSchema = exports.requestIdSchema = exports.oxyCredentialIdSchema = exports.oxyApplicationIdSchema = exports.delegatedUserIdSchema = exports.oxyAccountIdSchema = exports.INFERENCE_CONTRACT_VERSION = void 0;
+exports.inferenceInputSchema = exports.inferenceMessageSchema = exports.inferenceMessageRoleSchema = exports.inferenceToolCallSchema = exports.inferenceContentPartSchema = exports.inferenceContentSourceSchema = exports.modelDocumentationSchema = exports.modelReleaseIngestionResultSchema = exports.modelReleaseIngestionRequestSchema = exports.modelLineDeclarationSchema = exports.modelGpaiDocumentationSchema = exports.modelDownstreamDocumentationSchema = exports.SYSTEMIC_RISK_COMPUTE_THRESHOLD_FLOPS = exports.trainingComputeFlopsSchema = exports.modelSystemicRiskTierSchema = exports.modelDistributionMethodSchema = exports.aliaModelReleaseManifestSchema = exports.aliaReleaseSignatureSchema = exports.aliaReleaseArtifactSchema = exports.authorizedRouteSchema = exports.routingPolicyReferenceSchema = exports.routingPolicySchema = exports.routingFallbackPolicySchema = exports.routingPolicyScopeSchema = exports.routingTargetSchema = exports.modelCatalogueEntrySchema = exports.catalogueServingProviderSummarySchema = exports.cataloguePublisherSummarySchema = exports.routingProfileSchema = exports.routingProfileCandidateSchema = exports.modelDeploymentSchema = exports.inferenceProviderSchema = exports.modelRevisionSchema = exports.catalogueModelSchema = exports.modelPublisherSchema = exports.modelSafetyMetadataSchema = exports.modelEvaluationResultSchema = exports.modelDeprecationSchema = exports.commercialPermissionSchema = exports.availabilityScopeSchema = exports.inferenceDataPolicySchema = exports.modelProvenanceSchema = exports.modelLicenseSchema = exports.modelCapabilitiesSchema = exports.reasoningEffortSchema = exports.inferenceModalitySchema = exports.priceSnapshotSchema = exports.priceVersionSchema = exports.priceVersionStatusSchema = exports.embeddingResponseSchema = void 0;
+exports.kaanaCredentialValidationFailureCodeSchema = exports.kaanaCredentialValidationOutcomeStateSchema = exports.kaanaCredentialValidationTaskSchema = exports.kaanaCredentialOutcomeSchema = exports.kaanaCredentialConflictOutcomeSchema = exports.kaanaCredentialAppliedOutcomeSchema = exports.kaanaCredentialOutcomeRequestSchema = exports.kaanaCredentialRevokeOutcomeRequestSchema = exports.kaanaCredentialRotateOutcomeRequestSchema = exports.kaanaCredentialCreateOutcomeRequestSchema = exports.kaanaCredentialMutationSchema = exports.kaanaCredentialRevokeMutationSchema = exports.kaanaCredentialRotateMutationSchema = exports.kaanaCredentialCreateMutationSchema = exports.kaanaCredentialIdentitySchema = exports.kaanaCredentialOperationActionSchema = exports.kaanaCredentialOperationIdSchema = exports.kaanaCredentialHandleSchema = exports.providerConnectionScopeSchema = exports.usageRefundSchema = exports.usageRefundReasonSchema = exports.usageRefundSubjectSchema = exports.usageReceiptSchema = exports.normalizedUsageReportSchema = exports.inferenceRequestOutcomeSchema = exports.usageReservationSchema = exports.usageReservationStatusSchema = exports.usageReservationRequestSchema = exports.inferenceStreamEventSchema = exports.inferenceStreamDoneEventSchema = exports.inferenceFinishReasonSchema = exports.inferenceStreamErrorEventSchema = exports.inferenceStreamRouteSwitchEventSchema = exports.inferenceRouteSwitchReasonSchema = exports.inferenceRouteSwitchDetailSchema = exports.inferenceStreamUsageEventSchema = exports.inferenceStreamToolCallEventSchema = exports.inferenceStreamAudioEventSchema = exports.MAX_INFERENCE_AUDIO_BYTES = exports.inferenceAudioMediaTypeSchema = exports.inferenceStreamDeltaEventSchema = exports.inferenceStreamStartEventSchema = exports.inferenceSpeechParametersSchema = exports.inferenceRequestSchema = exports.clientRequestMetadataSchema = exports.responseFormatSchema = exports.toolChoiceSchema = exports.toolDefinitionSchema = exports.inferenceReasoningSchema = exports.samplingParametersSchema = void 0;
+exports.toolGrantOverrideSchema = exports.resourceRefSchema = exports.actorRefSchema = exports.capabilityPackageSchema = exports.autonomyLevelSchema = exports.CAPABILITY_PACKAGES = exports.AUTONOMY_LEVELS = exports.productEntitlementSchema = exports.costCenterSpendSchema = exports.costCenterSchema = exports.costCenterStatusSchema = exports.COST_CENTER_STATUSES = exports.payAsYouGoEntitlementSchema = exports.productPlanSchema = exports.planAllowanceSchema = exports.LIVE_PRODUCT_PLAN_STATUSES = exports.productPlanStatusSchema = exports.PRODUCT_PLAN_STATUSES = exports.reconciliationReportSchema = exports.reconciliationRunSchema = exports.reconciliationDiscrepancySchema = exports.reconciliationRunStatusSchema = exports.RECONCILIATION_RUN_STATUSES = exports.reconciliationDiscrepancyKindSchema = exports.RECONCILIATION_DISCREPANCY_KINDS = exports.autoRechargeAttemptSchema = exports.autoRechargeStatusSchema = exports.AUTO_RECHARGE_STATUSES = exports.externalPaymentSchema = exports.externalPaymentKindSchema = exports.EXTERNAL_PAYMENT_KINDS = exports.externalPaymentProviderSchema = exports.EXTERNAL_PAYMENT_PROVIDERS = exports.billingInvoiceSchema = exports.billingInvoiceStatusSchema = exports.BILLING_INVOICE_STATUSES = exports.accountBillingStateSchema = exports.billingProfileSchema = exports.autoRechargeSchema = exports.billingProfileStatusSchema = exports.BILLING_PROFILE_STATUSES = exports.billingModeSchema = exports.BILLING_MODES = exports.providerConnectionSchema = exports.providerConnectionStatusSchema = exports.providerConnectionValidationSchema = exports.providerCredentialCustodyStateSchema = exports.providerCredentialValidationDeploymentSchema = exports.providerCredentialValidationOperationSchema = exports.kaanaCredentialValidationOutcomeSchema = void 0;
+exports.inboxInferenceStreamEventSchema = exports.inboxThreadSummaryResponseSchema = exports.inboxSmartRepliesResponseSchema = exports.inboxNaturalSearchResponseSchema = exports.inboxInferenceTextResponseSchema = exports.inboxMessageInferenceParamsSchema = exports.inboxNaturalSearchRequestSchema = exports.inboxDailyBriefRequestSchema = exports.inboxComposeRequestSchema = exports.emailAgentContextSchema = exports.emailContextMessageSchema = exports.emailContextMailboxSchema = exports.emailContextAddressSchema = exports.normalizedAppEventSchema = exports.catalogRegistrationSchema = exports.appCapabilityCatalogSchema = exports.catalogEventSchema = exports.catalogToolSchema = exports.auditEventSchema = exports.auditResultSchema = exports.policyDecisionSchema = exports.capabilityTicketClaimsSchema = exports.automationDefinitionSchema = exports.automationDataFlowSchema = exports.automationActorSelectionSchema = exports.automationTriggerSchema = exports.delegationGrantSchema = exports.capabilityCoordinatorSchema = exports.executionAuthorizationRefSchema = exports.capabilityCatalogBindingSchema = exports.grantLimitSchema = void 0;
 var accountGraph_1 = require("./accountGraph");
 Object.defineProperty(exports, "ACCOUNT_KINDS", { enumerable: true, get: function () { return accountGraph_1.ACCOUNT_KINDS; } });
 Object.defineProperty(exports, "accountKindSchema", { enumerable: true, get: function () { return accountGraph_1.accountKindSchema; } });
@@ -285,21 +285,6 @@ Object.defineProperty(exports, "mcpOAuthWriteActionSchema", { enumerable: true,
 Object.defineProperty(exports, "mcpOAuthConsentContextSchema", { enumerable: true, get: function () { return oauth_1.mcpOAuthConsentContextSchema; } });
 Object.defineProperty(exports, "mcpOAuthClientInfoResponseSchema", { enumerable: true, get: function () { return oauth_1.mcpOAuthClientInfoResponseSchema; } });
 Object.defineProperty(exports, "mcpOAuthConsentResponseSchema", { enumerable: true, get: function () { return oauth_1.mcpOAuthConsentResponseSchema; } });
-var browserHub_1 = require("./browserHub");
-Object.defineProperty(exports, "BROWSER_HUB_COOKIE_NAME", { enumerable: true, get: function () { return browserHub_1.BROWSER_HUB_COOKIE_NAME; } });
-Object.defineProperty(exports, "BROWSER_HUB_COOKIE_ATTRIBUTES", { enumerable: true, get: function () { return browserHub_1.BROWSER_HUB_COOKIE_ATTRIBUTES; } });
-Object.defineProperty(exports, "BROWSER_HUB_HANDLE_TTL_MS", { enumerable: true, get: function () { return browserHub_1.BROWSER_HUB_HANDLE_TTL_MS; } });
-Object.defineProperty(exports, "browserHubHandleSchema", { enumerable: true, get: function () { return browserHub_1.browserHubHandleSchema; } });
-Object.defineProperty(exports, "browserHubHandleRequestSchema", { enumerable: true, get: function () { return browserHub_1.browserHubHandleRequestSchema; } });
-Object.defineProperty(exports, "browserHubHandleResponseSchema", { enumerable: true, get: function () { return browserHub_1.browserHubHandleResponseSchema; } });
-Object.defineProperty(exports, "browserHubResolveResponseSchema", { enumerable: true, get: function () { return browserHub_1.browserHubResolveResponseSchema; } });
-Object.defineProperty(exports, "browserHubErrorSchema", { enumerable: true, get: function () { return browserHub_1.browserHubErrorSchema; } });
-Object.defineProperty(exports, "browserHubRevokeResponseSchema", { enumerable: true, get: function () { return browserHub_1.browserHubRevokeResponseSchema; } });
-Object.defineProperty(exports, "hubSessionSchema", { enumerable: true, get: function () { return browserHub_1.hubSessionSchema; } });
-Object.defineProperty(exports, "hubClaimRequestSchema", { enumerable: true, get: function () { return browserHub_1.hubClaimRequestSchema; } });
-Object.defineProperty(exports, "hubActivateRequestSchema", { enumerable: true, get: function () { return browserHub_1.hubActivateRequestSchema; } });
-Object.defineProperty(exports, "hubAuthorizeRequestSchema", { enumerable: true, get: function () { return browserHub_1.hubAuthorizeRequestSchema; } });
-Object.defineProperty(exports, "hubAuthorizeResultSchema", { enumerable: true, get: function () { return browserHub_1.hubAuthorizeResultSchema; } });
 var deviceBoot_1 = require("./deviceBoot");
 // Schemas
 Object.defineProperty(exports, "loginResultSchema", { enumerable: true, get: function () { return deviceBoot_1.loginResultSchema; } });
@@ -698,4 +683,5 @@ Object.defineProperty(exports, "inboxThreadSummaryResponseSchema", { enumerable:
 Object.defineProperty(exports, "inboxInferenceStreamEventSchema", { enumerable: true, get: function () { return inbox_1.inboxInferenceStreamEventSchema; } });
 __exportStar(require("./externalIdentity"), exports);
 __exportStar(require("./linkedAccounts"), exports);
+__exportStar(require("./federationInstanceFetch"), exports);
 __exportStar(require("./notifications"), exports);

package/dist/cjs/linkedAccounts.js

@@ -11,7 +11,7 @@
  * Platform-agnostic — zod only, no react/react-native/expo.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LINKED_ACCOUNT_CALLBACK_ERRORS = exports.serviceLinkedAccountListResponseSchema = exports.serviceLinkedAccountSchema = exports.linkedAccountListResponseSchema = exports.completeLinkedAccountResponseSchema = exports.linkedAccountSchema = exports.completeLinkedAccountRequestSchema = exports.startLinkedAccountResponseSchema = exports.startLinkedAccountRequestSchema = exports.linkedAccountNetworkSchema = exports.LINKED_ACCOUNT_NETWORKS = void 0;
+exports.linkedAccountStartErrorDetailsSchema = exports.linkedAccountStartErrorReasonSchema = exports.LINKED_ACCOUNT_START_ERROR_REASONS = exports.LINKED_ACCOUNT_CALLBACK_ERRORS = exports.serviceLinkedAccountListResponseSchema = exports.serviceLinkedAccountSchema = exports.linkedAccountListResponseSchema = exports.completeLinkedAccountResponseSchema = exports.linkedAccountSchema = exports.completeLinkedAccountRequestSchema = exports.startLinkedAccountResponseSchema = exports.startLinkedAccountRequestSchema = exports.linkedAccountNetworkSchema = exports.LINKED_ACCOUNT_NETWORKS = void 0;
 const zod_1 = require("zod");
 exports.LINKED_ACCOUNT_NETWORKS = ['activitypub', 'atproto'];
 exports.linkedAccountNetworkSchema = zod_1.z.enum(exports.LINKED_ACCOUNT_NETWORKS);
@@ -91,3 +91,36 @@ exports.LINKED_ACCOUNT_CALLBACK_ERRORS = [
     'verification_failed',
     'provider_unavailable',
 ];
+/**
+ * Why `POST /linked-accounts/:network/start` refused, as `details.reason` on
+ * its 400 (`{ error: 'BAD_REQUEST', message, details: { reason } }`). The
+ * message is for logs; show the user a text chosen from the reason.
+ *
+ * - `instance_invalid`: the ActivityPub `instance` is not a server name.
+ * - `instance_unreachable`: the server does not resolve to a public address, or
+ *   could not be connected to.
+ * - `handle_unresolvable`: the atproto handle or DID does not resolve to an
+ *   account. The only reason that means "check what you typed".
+ * - `provider_rejected`: the other network answered and refused Oxy's
+ *   request — for atproto an authorization-server error such as
+ *   `invalid_client_metadata`; for a Mastodon-API server a refused app
+ *   registration (often: not a Mastodon-compatible server). Nothing the user
+ *   typed is wrong.
+ * - `provider_unavailable`: the other network could not be asked right now
+ *   (its OAuth metadata did not load, a 5xx, a timeout). Try again later.
+ *
+ * A refusal with no `details.reason` (a bad `returnTo`, a missing field) is a
+ * client bug, not something to show.
+ */
+exports.LINKED_ACCOUNT_START_ERROR_REASONS = [
+    'instance_invalid',
+    'instance_unreachable',
+    'handle_unresolvable',
+    'provider_rejected',
+    'provider_unavailable',
+];
+exports.linkedAccountStartErrorReasonSchema = zod_1.z.enum(exports.LINKED_ACCOUNT_START_ERROR_REASONS);
+/** The `details` of a start refusal. */
+exports.linkedAccountStartErrorDetailsSchema = zod_1.z
+    .object({ reason: exports.linkedAccountStartErrorReasonSchema })
+    .strict();

package/dist/cjs/notifications.js

@@ -12,7 +12,7 @@
  * Platform-agnostic — zod only, no react/react-native/expo.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createOxyNotificationRequestSchema = exports.OXY_NOTIFICATION_URL_MAX = exports.OXY_SYSTEM_NOTIFICATION_MESSAGE_MAX = exports.OXY_SYSTEM_NOTIFICATION_TITLE_MAX = exports.OXY_NOTIFICATION_ENTITY_TYPES = exports.OXY_NOTIFICATION_TYPES = void 0;
+exports.oxySystemNotificationPushDataSchema = exports.OXY_SYSTEM_NOTIFICATION_PUSH_TYPE = exports.OXY_ACCOUNT_PUSH_CHANNEL = exports.createOxyNotificationRequestSchema = exports.OXY_NOTIFICATION_URL_MAX = exports.OXY_SYSTEM_NOTIFICATION_MESSAGE_MAX = exports.OXY_SYSTEM_NOTIFICATION_TITLE_MAX = exports.OXY_NOTIFICATION_ENTITY_TYPES = exports.OXY_NOTIFICATION_TYPES = void 0;
 const zod_1 = require("zod");
 exports.OXY_NOTIFICATION_TYPES = [
     'like',
@@ -79,3 +79,22 @@ exports.createOxyNotificationRequestSchema = zod_1.z
         }
     }
 });
+/**
+ * Android notification channel a `system` notification is pushed on — a wire
+ * contract, because Android 8+ silently drops a push whose channel the app has
+ * not created. Created by the vault (Commons) before it registers its token.
+ */
+exports.OXY_ACCOUNT_PUSH_CHANNEL = 'account';
+/** Runtime type discriminator of the push that announces a `system` notification. */
+exports.OXY_SYSTEM_NOTIFICATION_PUSH_TYPE = 'oxy_system_notification';
+/**
+ * The ONLY data a `system` notification's push carries: its id. The title and
+ * message ride as the push's own title and body; the deep link does NOT travel,
+ * because a push payload is untrusted at the receiver. On a tap the vault
+ * re-reads the notification from Oxy by id (scoped to the signed-in recipient)
+ * and opens the `url` stored there.
+ */
+exports.oxySystemNotificationPushDataSchema = zod_1.z.object({
+    type: zod_1.z.literal(exports.OXY_SYSTEM_NOTIFICATION_PUSH_TYPE),
+    notificationId: zod_1.z.string().min(1).max(64),
+});