@oxy.so/contracts 2.2.0 → 3.0.0

package/dist/esm/accountEmail.js

@@ -1,22 +1,26 @@
 /**
- * Recovery email contracts (ADR 0029 D3).
+ * Email codes and tickets (ADR 0030).
  *
- * A web account is a username, a passkey and a recovery email. The email is
- * proven by a 6-digit code sent to it, and the proof is a short-lived one-use
- * ticket the next step spends:
+ * A web account is a username and an email; a password and an authenticator
+ * app are optional and added later. The email is proven by a 6-digit code sent
+ * to it, and the proof is a short-lived one-use ticket the next step spends:
  *
- * - `signup`: the ticket lets `POST /webauthn/register/verify` create the
- *   account with that email;
- * - `recovery`: the person names their username or email, the code goes to the
- *   account's recovery email, and the ticket lets them register a new passkey
- *   for that account.
+ * - `signup`: the ticket lets `POST /auth/signup` create the account with that
+ *   email. `start` answers the same whether or not the address already has an
+ *   account, so it never tells anyone which emails have an Oxy account.
  *
- * `start` answers the same whether or not an account exists, so neither purpose
- * tells anyone which emails or usernames have an Oxy account. An account with a
- * Commons key has no recovery email: it recovers in Commons.
+ * Signing in by email (`signin`) and re-verifying before a sensitive change
+ * (`reauth`) use the same code, through their own routes (`signIn.ts`).
  */
 import { z } from 'zod';
-export const EMAIL_VERIFICATION_PURPOSES = ['signup', 'recovery'];
+/**
+ * - `signup`: above.
+ * - `signin`: the code (and link) of an email sign-in (`POST /auth/signin/email/start`).
+ * - `reauth`: a signed-in person proving it is them before a sensitive step
+ *   (`POST /users/me/reauth/email`): a password, an authenticator, deleting the
+ *   account, linking Commons.
+ */
+export const EMAIL_VERIFICATION_PURPOSES = ['signup', 'signin', 'reauth'];
 /** Digits in a code. */
 export const EMAIL_CODE_LENGTH = 6;
 /** How long a code can be confirmed. */
@@ -33,16 +37,9 @@ export const emailTicketSchema = z
     .trim()
     .regex(/^[A-Za-z0-9_-]{43}$/, 'ticket must be 32 bytes of base64url');
 /** `POST /auth/email/verify/start` */
-export const emailVerificationStartRequestSchema = z.discriminatedUnion('purpose', [
-    z.object({ purpose: z.literal('signup'), email: emailAddressSchema }).strict(),
-    z
-        .object({
-        purpose: z.literal('recovery'),
-        /** The account's username, or its recovery email. */
-        identifier: z.string().trim().min(1).max(254),
-    })
-        .strict(),
-]);
+export const emailVerificationStartRequestSchema = z
+    .object({ purpose: z.literal('signup'), email: emailAddressSchema })
+    .strict();
 export const emailVerificationStartResponseSchema = z.object({
     verificationId: z.string().min(1).max(64),
     expiresAt: z.number().int().positive(),
@@ -60,7 +57,6 @@ export const emailVerificationConfirmRequestSchema = z
 export const emailVerificationConfirmResponseSchema = z.object({
     ticket: emailTicketSchema,
     expiresAt: z.number().int().positive(),
-    username: z.string().nullable(),
 });
 /**
  * Stable error codes (`error.code` in the API error body). Clients map these
@@ -73,7 +69,7 @@ export const EMAIL_VERIFICATION_ERROR_CODES = {
     tooManyAttempts: 'EMAIL_CODE_TOO_MANY_ATTEMPTS',
     /** The ticket is unknown, expired, spent, or for another email or purpose. */
     ticketInvalid: 'EMAIL_TICKET_INVALID',
-    /** A sign-up without a confirmed recovery email. */
+    /** A sign-up without a confirmed email. */
     ticketRequired: 'EMAIL_TICKET_REQUIRED',
     /** This server cannot send mail. */
     unavailable: 'EMAIL_UNAVAILABLE',

package/dist/esm/deviceBoot.js

@@ -4,8 +4,8 @@
  * SINGLE SOURCE OF TRUTH for the first-party login result (the session arm). The
  * API validates its OUTPUT against this schema; every consumer (`@oxy.so/core`'s
  * auth mixin) validates its INPUT against the same definition, so producer and
- * consumers cannot drift. Sign-in is passkey (WebAuthn) or Commons handoff —
- * password and 2FA were removed, so the only outcome is a completed session.
+ * consumers cannot drift. This is the session arm every sign-in
+ * ends in (email code or link, password, authenticator, Commons handoff).
  *
  * The device transport is `deviceId` + `deviceSecret` + `POST /session/device/token`
  * (see `deviceSession.ts`). The legacy cookie/bootstrap/refresh-family lanes were

package/dist/esm/deviceSession.js

@@ -26,9 +26,10 @@ export const deviceSessionSyncSchema = z.object({
 /**
  * Request body for `POST /session/device/token` — the client presents the
  * `deviceId` it stored first-party plus the opaque `deviceSecret`. NO bearer:
- * possession of the secret IS the proof of device ownership. The server matches
- * `sha256(deviceSecret)` against the device's stored `secretHash` (constant-time)
- * and mints a short access token for the device's active account.
+ * possession of the secret IS the proof of device ownership. The server looks
+ * `sha256(deviceSecret)` up among the device's holder credentials (one per app
+ * or origin that joined the shared DeviceSession) and mints a short access
+ * token for the device's active account.
  *
  * `accountId` pins the mint to ONE account of that device instead of whichever
  * account is currently active. It exists for identity-bound clients (Commons),
@@ -48,8 +49,8 @@ export const deviceTokenMintRequestSchema = z.object({
  * short access token for the active account, its expiry, the device secret the
  * client must persist (`nextDeviceSecret` — on mint this echoes the presented
  * secret unchanged so concurrent refreshes from multiple origins do not race),
- * and the projected device-session state. Sign-in rotates the secret via
- * `issueDeviceSecret`; mint does not.
+ * and the projected device-session state. Nothing rotates: each sign-in issues
+ * a NEW holder credential and leaves the others valid.
  */
 export const deviceTokenMintResponseSchema = z.object({
     accessToken: z.string(),
@@ -107,12 +108,11 @@ export const sessionAccountsChangedEventSchema = z.object({
  * derived server-side from it) and consumed afterwards only by native
  * background code, which has no JS runtime to mint a token for itself.
  *
- * Deliberately a SEPARATE credential from the rotating `deviceSecret`: that one
- * rotates on every mint, so background code presenting it would become a second
- * writer of a value the JS runtime depends on, and background code killed
- * mid-rotation would silently sign the user out on the next cold start. Against
- * this credential background code is the sole writer, and it can never rotate
- * anything JS reads.
+ * Deliberately a SEPARATE credential from the holder `deviceSecret`: that one
+ * is device-wide and mints for whichever account is active, while this one is
+ * bound to ONE account and expires, so a widget worker never holds a
+ * credential that reaches every account on the device. Background code is its
+ * sole writer and never touches anything JS reads.
  *
  * The raw `secret` is returned exactly once, at provision time — never stored
  * retrievably, never logged, never re-read. A caller that loses it provisions
@@ -135,10 +135,10 @@ export const deviceBackgroundCredentialResponseSchema = z.object({
  * native background code with NO bearer and NO cookies: possession of the
  * background `secret` IS the proof, as it is for the device-secret mint.
  *
- * Unlike that mint this one NEVER rotates the presented secret (hence no
- * `next…` field to persist in the response), so background code interrupted
- * anywhere between request and response leaves the credential intact and
- * usable on its next run.
+ * Like that mint this one NEVER rotates the presented secret, and it carries
+ * no `next…` field at all, so background code interrupted anywhere between
+ * request and response leaves the credential intact and usable on its next
+ * run.
  */
 export const deviceBackgroundTokenRequestSchema = z.object({
     deviceId: z.string().min(1),
@@ -159,3 +159,60 @@ export const deviceBackgroundTokenResponseSchema = z.object({
     expiresAt: z.string(),
     accountId: z.string().min(1),
 });
+/* -------------------------------------------------------------------------- */
+/*  The browser bridge — joining the browser's DeviceSession (ADR 0029 D2)    */
+/* -------------------------------------------------------------------------- */
+/**
+ * Proof that the caller holds a device: the `deviceId` it stored first-party and
+ * one of that device's holder secrets. Sent with `POST /session/device/join-code`
+ * and, optionally, with a sign-in (`POST /auth/session/claim`, the email,
+ * password and second-factor sign-ins, `POST /auth/signup`), where
+ * a valid proof puts the new session on THAT device so every app holding it sees
+ * the account. An invalid proof on a sign-in is ignored, never an error.
+ */
+export const deviceProofSchema = z.object({
+    deviceId: z.string().min(1).max(128),
+    deviceSecret: z.string().min(1).max(256),
+});
+/**
+ * `POST /session/device/register` — auth.oxy.so only. No body. A new, empty
+ * DeviceSession with a server-chosen `deviceId` and ONE holder credential for
+ * auth.oxy.so. The raw secret is returned exactly once.
+ */
+export const deviceRegisterResponseSchema = z.object({
+    deviceId: z.string().min(1),
+    deviceSecret: z.string().min(1),
+});
+/** PKCE S256 challenge: base64url of a SHA-256 digest (43 characters). */
+const pkceS256ChallengeSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/);
+/**
+ * `POST /session/device/join-code` — auth.oxy.so only (the bridge window). Proves
+ * auth.oxy.so's device and asks for a one-use code an official app redeems to
+ * join it. The code is bound to the application (`clientId`), its exact
+ * registered `redirectUri` and the app's PKCE challenge, and lives about a
+ * minute.
+ */
+export const deviceJoinCodeRequestSchema = deviceProofSchema.extend({
+    clientId: z.string().min(1).max(256),
+    redirectUri: z.string().url().max(2048),
+    codeChallenge: pkceS256ChallengeSchema,
+    codeChallengeMethod: z.literal('S256'),
+});
+export const deviceJoinCodeResponseSchema = z.object({
+    code: z.string().min(1),
+    /** Seconds until the code expires. */
+    expiresIn: z.number().int().positive(),
+});
+/**
+ * `POST /session/device/join` — called by the app's own origin with the code the
+ * bridge window posted to it and the PKCE verifier only the app holds. Returns a
+ * NEW holder credential for the browser's device; the app then mints through the
+ * ordinary `POST /session/device/token`.
+ */
+export const deviceJoinRequestSchema = z.object({
+    code: z.string().min(1).max(256),
+    codeVerifier: z.string().min(43).max(128).regex(/^[A-Za-z0-9._~-]+$/),
+    clientId: z.string().min(1).max(256),
+    redirectUri: z.string().url().max(2048),
+});
+export const deviceJoinResponseSchema = deviceRegisterResponseSchema;

package/dist/esm/identity.js

@@ -207,11 +207,9 @@ export const domainVerificationInstructionsSchema = z.object({
     }),
 });
 export const authMethodEntrySchema = z.object({
-    type: z.enum(['identity', 'webauthn']),
+    type: z.literal('identity'),
     linkedAt: z.union([z.string(), z.date()]),
     verificationMethodId: z.string().optional(),
-    credentialId: z.string().optional(),
-    name: z.string().optional(),
 });
 export const authMethodsResponseSchema = z.object({
     did: z.string(),

package/dist/esm/identityLink.js

@@ -1,28 +1,31 @@
 /**
- * Linking Commons to a passkey account (ADR 0029 D3) — the two-device relay.
+ * Linking Commons to an account without a key (ADR 0029 D3) — the two-device
+ * relay.
  *
- * A passkey account links a Commons root once, and becomes self-custodied: its
- * recovery email is deleted and its phrase in Commons is how it gets back in.
- * The authority is the same as `POST /auth/link` (ADR 0024 D8): a root proof
- * (`link_identity`) by the key Commons holds, and a fresh assertion by one of
- * the account's passkeys over the SAME one-use challenge. Only the transport is
- * new, because the two factors live on two devices:
+ * An account without a key links a Commons root once, and becomes
+ * self-custodied: its email is deleted and its phrase in Commons is how it gets
+ * back in. The authority is the same as `POST /auth/link` (ADR 0024 D8): a root
+ * proof (`link_identity`) by the key Commons holds over a one-use challenge,
+ * and the account's own confirmation — a code just sent to its email (plus its
+ * authenticator code when it has one). Only the transport is new, because the
+ * two factors live on two devices:
  *
- *   1. auth.oxy.so (signed in) opens a link request → `{ linkId, challenge }`,
- *      shown as a QR (`oxycommons://link?id=…&c=…`).
+ *   1. The signed-in account (the "Link Commons" panel of `@oxy.so/services`)
+ *      opens a link request → `{ linkId, challenge }`, shown as a QR
+ *      (`oxycommons://link?id=…&c=…`).
  *   2. Commons scans it, reads the request (the account's id and username),
  *      signs the root proof over the challenge and posts it with its key.
  *   3. Both screens show the same 6-digit code, derived from the link id and
  *      that key (`deriveIdentityLinkCode` in `@oxy.so/core`); the person checks
  *      they match, so a photographed QR cannot slip another key in.
- *   4. auth.oxy.so asserts the passkey over the challenge and completes: the
- *      account gains the root, loses the email, and Commons signs in with it.
+ *   4. The panel completes with the email code: the account gains the root,
+ *      loses the email, and Commons signs in with it.
  *
  * The server stores only the challenge's hash; the challenge travels in the QR.
  */
 import { z } from 'zod';
 import { identityProofSchema } from './identityProof.js';
-import { webauthnAssertionResponseSchema } from './webauthn.js';
+import { emailReauthProofSchema } from './signIn.js';
 export const IDENTITY_LINK_STATUSES = ['pending', 'signed', 'completed', 'cancelled'];
 /** The scheme and host Commons routes a link QR to. */
 export const IDENTITY_LINK_QR_PREFIX = 'oxycommons://link';
@@ -76,9 +79,9 @@ export const identityLinkProofRequestSchema = z
     proof: identityProofSchema,
 })
     .strict();
-/** `POST /identity/link/:linkId/options` — WebAuthn request options over the challenge. */
-export const identityLinkOptionsRequestSchema = z
-    .object({ challenge: z.string().trim().regex(CHALLENGE, 'challenge must be 64 lowercase hex characters') })
-    .strict();
-/** `POST /identity/link/:linkId/complete` — the passkey assertion over the challenge. */
-export const identityLinkCompleteRequestSchema = z.object({ assertion: webauthnAssertionResponseSchema }).strict();
+/**
+ * `POST /identity/link/:linkId/complete` — the account's own confirmation: a
+ * code just sent to its email for this link (`reauth`, plus its authenticator
+ * code when it has one).
+ */
+export const identityLinkCompleteRequestSchema = z.object({ reauth: emailReauthProofSchema }).strict();

package/dist/esm/identityProof.js

@@ -28,8 +28,8 @@ export const IDENTITY_PROOF_CHALLENGE_TTL_MS = 5 * 60 * 1000;
  */
 export const IDENTITY_PROOF_ACTIONS = {
     /**
-     * Link Commons' root to a passkey account that has none (`POST /auth/link`).
-     * The account becomes self-custodied and its recovery email is deleted
+     * Link Commons' root to an account that has none (`POST /auth/link`).
+     * The account becomes self-custodied and its email is deleted
      * (ADR 0029 D3).
      */
     link: 'link_identity',

package/dist/esm/index.js

@@ -47,13 +47,13 @@ export {
 // Closed value sets — shared by the API's mongoose enums, the API's request
 // validation, and the SDK's unions, so a new category/tier/status cannot be
 // added on one side only.
-REPUTATION_CATEGORIES, REPUTATION_TRANSACTION_STATUSES, TRUST_TIERS, REPUTATION_TARGET_ENTITY_TYPES, REPUTATION_DISPUTE_STATUSES, REPUTATION_INFLUENCE_CONTEXTS, 
+REPUTATION_CATEGORIES, REPUTATION_TRANSACTION_STATUSES, TRUST_TIERS, REPUTATION_TARGET_ENTITY_TYPES, REPUTATION_INFLUENCE_CONTEXTS, 
 // Schemas — closed value sets
-reputationCategorySchema, reputationTransactionStatusSchema, trustTierSchema, reputationTargetEntityTypeSchema, reputationDisputeStatusSchema, reputationInfluenceContextSchema, 
+reputationCategorySchema, reputationTransactionStatusSchema, trustTierSchema, reputationTargetEntityTypeSchema, reputationInfluenceContextSchema, 
 // Schemas — responses
-reputationTransactionSchema, reputationBalanceBreakdownSchema, reputationInfluenceSchema, reputationReliabilitySchema, reputationBalanceSummarySchema, reputationBalanceSchema, reputationDisputeSchema, reputationRuleSchema, reputationLeaderboardUserSchema, reputationLeaderboardEntrySchema, reputationInfluenceResultSchema, reverseReputationTransactionResultSchema, 
+reputationTransactionSchema, reputationBalanceBreakdownSchema, reputationInfluenceSchema, reputationReliabilitySchema, reputationBalanceSummarySchema, reputationBalanceSchema, reputationRuleSchema, reputationRulesResponseSchema, reputationLeaderboardUserSchema, reputationLeaderboardEntrySchema, reputationInfluenceResultSchema, 
 // Schemas — request bodies
-awardReputationSchema, createReputationDisputeSchema, resolveReputationDisputeSchema, upsertReputationRuleSchema, reverseReputationTransactionSchema, 
+awardReputationSchema, 
 // Narrows the two balance views apart at runtime.
 isFullReputationBalance, } from './reputation.js';
 export { 
@@ -67,7 +67,7 @@ moderationFindingSchema, moderationDecisionEventSubjectSchema, moderationPolicyV
 registerIdentityBindingSchema, identityBindingSchema, 
 // Schemas — the derived V2 axes
 reputationPersonhoodSchema, reputationContributionSchema, reputationConductSchema, reputationReportingSchema, reputationReviewingSchema, reputationContextualInfluenceSchema, applicationModerationTrustSchema, } from './moderationReputation.js';
-export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, deviceTokenMintRequestSchema, deviceTokenMintResponseSchema, deviceBackgroundCredentialResponseSchema, deviceBackgroundTokenRequestSchema, deviceBackgroundTokenResponseSchema, SESSION_ACCOUNTS_CHANGED_EVENT, sessionAccountsChangedReasonSchema, sessionAccountsChangedEventSchema, } from './deviceSession.js';
+export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, deviceTokenMintRequestSchema, deviceTokenMintResponseSchema, deviceBackgroundCredentialResponseSchema, deviceBackgroundTokenRequestSchema, deviceBackgroundTokenResponseSchema, deviceProofSchema, deviceRegisterResponseSchema, deviceJoinCodeRequestSchema, deviceJoinCodeResponseSchema, deviceJoinRequestSchema, deviceJoinResponseSchema, SESSION_ACCOUNTS_CHANGED_EVENT, sessionAccountsChangedReasonSchema, sessionAccountsChangedEventSchema, } from './deviceSession.js';
 export { deviceContextRelationshipSchema, deviceDirectoryProfileSchema, deviceAccountContextSchema, devicePrincipalSchema, deviceDirectorySchema, deviceActivateRequestSchema, deviceActivateResponseSchema, deviceDirectorySyncSchema, } from './deviceDirectory.js';
 export { oauthConsentDecisionSchema, oauthAuthorizeCodeResponseSchema, mcpOAuthClientApplicationSchema, mcpOAuthWriteActionSchema, mcpOAuthConsentContextSchema, mcpOAuthClientInfoResponseSchema, mcpOAuthConsentResponseSchema, } from './oauth.js';
 export { 
@@ -94,14 +94,14 @@ updateSchema, createUpdateResponseSchema, rollbackToEmbeddedEntrySchema, channel
 // Rollback / promote / rollout
 rollbackRequestSchema, rollbackToEmbeddedRequestSchema, promoteRequestSchema, updateRolloutPatchSchema, } from './updates.js';
 export { 
-// Schemas
-webauthnRegisterOptionsRequestSchema, webauthnLoginOptionsRequestSchema, webauthnRegisterVerifyRequestSchema, webauthnLoginVerifyRequestSchema, webauthnCredentialIdSchema, webauthnAssertionResponseSchema, } from './webauthn.js';
-export { 
-// Recovery email of a passkey account (ADR 0029 D3)
+// Email codes and tickets for sign-up and re-verification
 EMAIL_VERIFICATION_PURPOSES, EMAIL_CODE_LENGTH, EMAIL_CODE_TTL_MS, EMAIL_CODE_MAX_ATTEMPTS, EMAIL_TICKET_TTL_MS, EMAIL_VERIFICATION_ERROR_CODES, emailAddressSchema, emailTicketSchema, emailVerificationStartRequestSchema, emailVerificationStartResponseSchema, emailVerificationConfirmRequestSchema, emailVerificationConfirmResponseSchema, } from './accountEmail.js';
 export { 
-// Linking Commons to a passkey account (ADR 0029 D3)
-IDENTITY_LINK_STATUSES, IDENTITY_LINK_QR_PREFIX, identityLinkIdSchema, buildIdentityLinkQrPayload, parseIdentityLinkQrPayload, identityLinkCreateResponseSchema, identityLinkStateSchema, identityLinkProofRequestSchema, identityLinkOptionsRequestSchema, identityLinkCompleteRequestSchema, } from './identityLink.js';
+// Email code/link, password and authenticator sign-in
+EMAIL_SIGNIN_LINK_TTL_MS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, PASSWORD_MIN_LENGTH, PASSWORD_MAX_LENGTH, TOTP_DIGITS, TOTP_PERIOD_SECONDS, TOTP_BACKUP_CODE_COUNT, SIGN_IN_ERROR_CODES, signInIdentifierSchema, passwordInputSchema, newPasswordSchema, secondFactorCodeSchema, emailSignInStartRequestSchema, emailSignInStartResponseSchema, emailSignInConfirmRequestSchema, emailSignInCodeSchema, normalizeEmailSignInCode, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, emailSignInCollectRequestSchema, emailSignInLinkRequestSchema, emailSignInLinkResponseSchema, emailSignInPendingSchema, passwordSignInRequestSchema, secondFactorSignInRequestSchema, secondFactorRequiredSchema, signUpRequestSchema, isSecondFactorRequired, reauthProofSchema, emailReauthProofSchema, REAUTH_ACTIONS, reauthEmailStartRequestSchema, passwordSetRequestSchema, signInMethodsSchema, totpEnrollResponseSchema, totpConfirmRequestSchema, totpReauthRequestSchema, totpBackupCodesResponseSchema, } from './signIn.js';
+export { 
+// Linking Commons to an account without a key (ADR 0029 D3)
+IDENTITY_LINK_STATUSES, IDENTITY_LINK_QR_PREFIX, identityLinkIdSchema, buildIdentityLinkQrPayload, parseIdentityLinkQrPayload, identityLinkCreateResponseSchema, identityLinkStateSchema, identityLinkProofRequestSchema, identityLinkCompleteRequestSchema, } from './identityLink.js';
 export { 
 // Schemas — transparency log (checkpoints + inclusion proofs)
 transparencyCheckpointSignatureSchema, transparencyAnchorSchema, transparencyCheckpointSchema, transparencyInclusionProofSchema, transparencyCheckpointListSchema, } from './transparency.js';

package/dist/esm/reputation.js

@@ -3,9 +3,8 @@
  *
  * SINGLE SOURCE OF TRUTH for the reputation ledger's wire shapes: the closed
  * value sets (`REPUTATION_CATEGORIES`, `TRUST_TIERS`, …), the response entities
- * (`ReputationTransaction`, the two balance views, `ReputationDispute`,
- * `ReputationRule`, the leaderboard entry) and the request bodies the write
- * endpoints accept. The API validates its OUTPUT against these schemas and its
+ * (`ReputationTransaction`, the two balance views, `ReputationRule`, the
+ * leaderboard entry) and the award body. The API validates its OUTPUT against these schemas and its
  * INPUT with the same request schemas the SDK's input types are derived from;
  * `@oxy.so/core`'s reputation mixin imports every type from here rather than
  * declaring its own.
@@ -71,15 +70,13 @@ export const reputationCategorySchema = z.enum(REPUTATION_CATEGORIES);
  * Transaction lifecycle status.
  *
  * - `active`   — counts toward the balance.
- * - `disputed` — under dispute; still counts until the dispute resolves.
- * - `reversed` — superseded by a compensating reversal transaction; excluded.
- * - `voided`   — administratively excluded with no compensating entry.
+ * - `reversed` — superseded by a compensating reversal transaction (written
+ *                only by policy-driven code, never by a person); the pair nets
+ *                to zero.
  */
 export const REPUTATION_TRANSACTION_STATUSES = [
     'active',
-    'disputed',
     'reversed',
-    'voided',
 ];
 export const reputationTransactionStatusSchema = z.enum(REPUTATION_TRANSACTION_STATUSES);
 /**
@@ -104,15 +101,6 @@ export const REPUTATION_TARGET_ENTITY_TYPES = [
     'other',
 ];
 export const reputationTargetEntityTypeSchema = z.enum(REPUTATION_TARGET_ENTITY_TYPES);
-/** Dispute lifecycle status. */
-export const REPUTATION_DISPUTE_STATUSES = [
-    'open',
-    'accepted',
-    'rejected',
-    'needs_review',
-];
-export const reputationDisputeStatusSchema = z.enum(REPUTATION_DISPUTE_STATUSES);
-/** Influence context selecting which capped weight axis to read. */
 export const REPUTATION_INFLUENCE_CONTEXTS = [
     'default',
     'report',
@@ -217,26 +205,16 @@ const FULL_BALANCE_FIELDS = [
 export function isFullReputationBalance(balance) {
     return FULL_BALANCE_FIELDS.every((field) => field in balance);
 }
-export const reputationDisputeSchema = z.object({
-    id: z.string(),
-    transactionId: z.string(),
-    userId: z.string(),
-    reason: z.string(),
-    status: reputationDisputeStatusSchema,
-    evidence: z.array(z.string()).optional(),
-    resolvedAt: z.string().optional(),
-    resolvedByUserId: z.string().optional(),
-    createdAt: z.string(),
-    updatedAt: z.string(),
-});
 export const reputationRuleSchema = z.object({
-    id: z.string(),
     actionType: z.string(),
     points: z.number(),
     category: reputationCategorySchema,
     description: z.string(),
     cooldownInMinutes: z.number(),
-    isEnabled: z.boolean(),
+});
+export const reputationRulesResponseSchema = z.object({
+    version: z.number().int(),
+    rules: z.array(reputationRuleSchema),
 });
 export const reputationLeaderboardUserSchema = z.object({
     id: z.string(),
@@ -256,10 +234,6 @@ export const reputationInfluenceResultSchema = z.object({
     weight: z.number(),
     influence: reputationInfluenceSchema,
 });
-export const reverseReputationTransactionResultSchema = z.object({
-    original: reputationTransactionSchema,
-    reversal: reputationTransactionSchema,
-});
 export const awardReputationSchema = z.object({
     userId: z.string().trim().min(1),
     actionType: z.string().trim().min(1),
@@ -272,22 +246,3 @@ export const awardReputationSchema = z.object({
     reason: z.string().trim().max(500).optional(),
     metadata: z.record(z.unknown()).optional(),
 });
-export const createReputationDisputeSchema = z.object({
-    transactionId: z.string().trim().min(1),
-    reason: z.string().trim().min(1).max(1000),
-    evidence: z.array(z.string().trim().min(1)).max(20).optional(),
-});
-export const resolveReputationDisputeSchema = z.object({
-    status: z.enum(['accepted', 'rejected']),
-});
-export const upsertReputationRuleSchema = z.object({
-    actionType: z.string().trim().min(1),
-    points: z.number(),
-    category: reputationCategorySchema,
-    description: z.string().trim().min(1).max(500),
-    cooldownInMinutes: z.number().int().min(0).default(0),
-    isEnabled: z.boolean().default(true),
-});
-export const reverseReputationTransactionSchema = z.object({
-    reason: z.string().trim().max(500).optional(),
-});