@oxy.so/contracts 4.11.0-oxy-one.0 → 4.12.0

package/dist/esm/accountGraph.js

@@ -108,7 +108,7 @@ export function isOperatorSwitchTargetKind(kind) {
  * Narrow an unknown value to an {@link AccountKind}.
  *
  * The user-DTO serializers read from structurally-permissive `unknown` sources
- * (a Drizzle row, a Mongo document, an already-formatted object), so each one
+ * (a Drizzle row, a raw document, an already-formatted object), so each one
  * would otherwise hand-roll this check and they would drift on what counts.
  */
 export function isAccountKind(value) {
@@ -386,7 +386,8 @@ const accountNameSchema = z
  * accept categories would break that reasoning silently, so
  * `__tests__/accountGraph.test.ts` asserts the two lists agree.
  */
-export const createAccountRequestSchema = z.object({
+export const createAccountRequestSchema = z
+    .object({
     parentAccountId: z.string().trim().min(1).optional(),
     kind: childAccountKindSchema,
     /**
@@ -465,7 +466,8 @@ export const createAccountRequestSchema = z.object({
      * remedy must not either.
      */
     isPrivateAccount: z.boolean().optional(),
-}).superRefine((request, ctx) => {
+})
+    .superRefine((request, ctx) => {
     // The ONE place `kind` and `username` arrive in the same object, so it is the
     // only place a wire schema CAN apply the per-kind half of the policy: a bot's
     // handle must end in `bot`. Not a second rule — it asks

package/dist/esm/agency.js

@@ -2,17 +2,17 @@ import { z } from 'zod';
 import { catalogInvocationPathParameters, findOverlappingCatalogInvocations, } from './capabilityInvocation.js';
 const nonEmptyStringSchema = z.string().trim().min(1);
 const identifierSchema = z.string().trim().min(1).max(255);
-const limitKeySchema = z.string().regex(/^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)*$/, 'limit keys must be dot-separated input property names').max(255);
+const limitKeySchema = z
+    .string()
+    .regex(/^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)*$/, 'limit keys must be dot-separated input property names')
+    .max(255);
 const auditCodeSchema = z.string().regex(/^[A-Za-z0-9_.:-]{1,128}$/);
 const sha256HexSchema = z.string().regex(/^[a-f0-9]{64}$/);
-const invocationPathSchema = z.string().regex(/^\/(?!\/)[^\\?#]*$/, 'invocation paths must be absolute app-local paths without backslashes, query or fragment');
+const invocationPathSchema = z
+    .string()
+    .regex(/^\/(?!\/)[^\\?#]*$/, 'invocation paths must be absolute app-local paths without backslashes, query or fragment');
 /** Autonomy is ordered from least to most permissive. */
-export const AUTONOMY_LEVELS = [
-    'read_only',
-    'draft',
-    'execute_on_request',
-    'autonomous',
-];
+export const AUTONOMY_LEVELS = ['read_only', 'draft', 'execute_on_request', 'autonomous'];
 export const autonomyLevelSchema = z.enum(AUTONOMY_LEVELS);
 export const CAPABILITY_PACKAGES = [
     'read',
@@ -26,14 +26,18 @@ export const CAPABILITY_PACKAGES = [
 ];
 export const capabilityPackageSchema = z.enum(CAPABILITY_PACKAGES);
 export const actorRefSchema = z.discriminatedUnion('type', [
-    z.object({
+    z
+        .object({
         type: z.literal('alia'),
         ownerAccountId: identifierSchema,
-    }).strict(),
-    z.object({
+    })
+        .strict(),
+    z
+        .object({
         type: z.literal('agent'),
         accountId: identifierSchema,
-    }).strict(),
+    })
+        .strict(),
 ]);
 /** Present requester only; standing grants/automation retain actorRefSchema. */
 export const executionActorRefSchema = z.discriminatedUnion('type', [
@@ -41,63 +45,84 @@ export const executionActorRefSchema = z.discriminatedUnion('type', [
     z.object({ type: z.literal('requester'), accountId: identifierSchema }).strict(),
 ]);
 /** Separate bearer lives only in the SDK option / authority request body. */
-export const foregroundExecutionAuthorizationInputSchema = z.object({
+export const foregroundExecutionAuthorizationInputSchema = z
+    .object({
     tool: z.enum(['recommendProfiles', 'readViewerGraph']),
-    expectedCatalog: z.object({
+    expectedCatalog: z
+        .object({
         registrationId: identifierSchema,
         version: identifierSchema,
         digest: sha256HexSchema,
-    }).strict(),
+    })
+        .strict(),
     runId: identifierSchema,
     stepId: identifierSchema.optional(),
     expiresAt: z.string().datetime(),
-}).strict();
-export const resourceRefSchema = z.object({
+})
+    .strict();
+export const resourceRefSchema = z
+    .object({
     appId: identifierSchema,
     effectiveAccountId: identifierSchema,
     resourceType: identifierSchema,
     resourceId: identifierSchema,
-}).strict();
-export const toolGrantOverrideSchema = z.object({
+})
+    .strict();
+export const toolGrantOverrideSchema = z
+    .object({
     tool: identifierSchema,
     decision: z.enum(['allow', 'deny']),
-}).strict();
-export const grantLimitSchema = z.object({
+})
+    .strict();
+export const grantLimitSchema = z
+    .object({
     tool: identifierSchema,
     key: limitKeySchema,
     // Persisted limits are deliberately closed scalar bounds. Strings and
     // arrays are tool arguments in disguise (recipient lists, prompts, search
     // queries) and ADR 0016 forbids persisting those in Oxy.
     value: z.union([z.number().finite(), z.boolean()]),
-}).strict();
-export const capabilityCatalogBindingSchema = z.object({
+})
+    .strict();
+export const capabilityCatalogBindingSchema = z
+    .object({
     registrationId: identifierSchema,
     version: identifierSchema,
     digest: sha256HexSchema,
-}).strict();
+})
+    .strict();
 export const executionAuthorizationRefSchema = z.discriminatedUnion('kind', [
-    z.object({
+    z
+        .object({
         kind: z.literal('direct_request'),
         id: identifierSchema,
-    }).strict(),
-    z.object({
+    })
+        .strict(),
+    z
+        .object({
         kind: z.literal('automation'),
         id: identifierSchema,
         automationId: identifierSchema,
-    }).strict(),
+    })
+        .strict(),
 ]);
-export const capabilityCoordinatorSchema = z.object({
+export const capabilityCoordinatorSchema = z
+    .object({
     applicationId: identifierSchema,
     credentialId: identifierSchema,
-}).strict();
+})
+    .strict();
 /** Opt-in catalogue pin; legacy issuance omits expectedCatalog and its claim. */
-export const capabilityTicketRequestSchema = z.object({
+export const capabilityTicketRequestSchema = z
+    .object({
     executionAuthorizationId: z.string().min(1),
     runId: z.string().min(1).optional(),
     stepId: z.string().min(1).optional(),
     expectedCatalog: capabilityCatalogBindingSchema.optional(),
-}).strict();
-export const delegationGrantSchema = z.object({
+})
+    .strict();
+export const delegationGrantSchema = z
+    .object({
     id: identifierSchema,
     ownerAccountId: identifierSchema,
     actor: actorRefSchema,
@@ -113,30 +138,38 @@ export const delegationGrantSchema = z.object({
     revokedAt: z.string().datetime().nullable().default(null),
     createdAt: z.string().datetime(),
     updatedAt: z.string().datetime(),
-}).strict();
+})
+    .strict();
 export const automationTriggerSchema = z.discriminatedUnion('type', [
     z.object({ type: z.literal('manual') }).strict(),
-    z.object({
+    z
+        .object({
         type: z.literal('event'),
         appId: identifierSchema,
         eventType: identifierSchema,
         resource: resourceRefSchema.optional(),
-    }).strict(),
-    z.object({
+    })
+        .strict(),
+    z
+        .object({
         type: z.literal('schedule'),
         cron: nonEmptyStringSchema,
         timezone: nonEmptyStringSchema,
-    }).strict(),
+    })
+        .strict(),
 ]);
 export const automationActorSelectionSchema = z.discriminatedUnion('mode', [
     z.object({ mode: z.literal('fixed'), actor: actorRefSchema }).strict(),
     z.object({ mode: z.literal('automatic') }).strict(),
 ]);
-export const automationDataFlowSchema = z.object({
+export const automationDataFlowSchema = z
+    .object({
     sources: z.array(resourceRefSchema),
     destinations: z.array(resourceRefSchema),
-}).strict();
-export const automationDefinitionSchema = z.object({
+})
+    .strict();
+export const automationDefinitionSchema = z
+    .object({
     id: identifierSchema,
     ownerAccountId: identifierSchema,
     objective: nonEmptyStringSchema,
@@ -150,8 +183,10 @@ export const automationDefinitionSchema = z.object({
     enabled: z.boolean(),
     createdAt: z.string().datetime(),
     updatedAt: z.string().datetime(),
-}).strict();
-export const capabilityTicketClaimsSchema = z.object({
+})
+    .strict();
+export const capabilityTicketClaimsSchema = z
+    .object({
     iss: nonEmptyStringSchema,
     aud: identifierSchema,
     sub: identifierSchema,
@@ -174,10 +209,10 @@ export const capabilityTicketClaimsSchema = z.object({
     capabilities: z.array(identifierSchema).min(1),
     limits: z.array(grantLimitSchema).default([]),
     autonomy: autonomyLevelSchema,
-}).strict().superRefine((claims, context) => {
-    const expectedSubject = claims.actor.type !== 'alia'
-        ? claims.actor.accountId
-        : `alia:${claims.actor.ownerAccountId}`;
+})
+    .strict()
+    .superRefine((claims, context) => {
+    const expectedSubject = claims.actor.type !== 'alia' ? claims.actor.accountId : `alia:${claims.actor.ownerAccountId}`;
     if (claims.sub !== expectedSubject) {
         context.addIssue({
             code: z.ZodIssueCode.custom,
@@ -192,13 +227,17 @@ export const capabilityTicketClaimsSchema = z.object({
             path: ['actor', 'ownerAccountId'],
         });
     }
-    if (claims.actor.type === 'requester' && (claims.actor.accountId !== claims.requesterAccountId
-        || claims.executionAuthorization.kind !== 'direct_request'
-        || claims.autonomy !== 'read_only'
-        || claims.grantId !== undefined
-        || claims.automationId !== undefined)) {
-        context.addIssue({ code: z.ZodIssueCode.custom, path: ['actor'],
-            message: 'requester actors require their exact principal and direct read-only authority without standing grants' });
+    if (claims.actor.type === 'requester' &&
+        (claims.actor.accountId !== claims.requesterAccountId ||
+            claims.executionAuthorization.kind !== 'direct_request' ||
+            claims.autonomy !== 'read_only' ||
+            claims.grantId !== undefined ||
+            claims.automationId !== undefined)) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['actor'],
+            message: 'requester actors require their exact principal and direct read-only authority without standing grants',
+        });
     }
     if (claims.exp <= claims.iat) {
         context.addIssue({
@@ -235,7 +274,8 @@ export const capabilityTicketClaimsSchema = z.object({
 });
 /** Structural projections only: an authenticated transport must produce these. */
 export const invocationPrincipalSchema = z.discriminatedUnion('kind', [
-    z.object({
+    z
+        .object({
         kind: z.literal('oauth'),
         subject: identifierSchema,
         clientId: identifierSchema,
@@ -243,25 +283,33 @@ export const invocationPrincipalSchema = z.discriminatedUnion('kind', [
         activeAccountId: identifierSchema,
         scopes: z.array(identifierSchema),
         resource: z.string().url(),
-    }).strict(),
-    z.object({
+    })
+        .strict(),
+    z
+        .object({
         kind: z.literal('capability'),
         claims: capabilityTicketClaimsSchema.refine((claims) => claims.catalog !== undefined, {
             message: 'internal MCP requires a signed catalogue binding',
         }),
-    }).strict(),
+    })
+        .strict(),
 ]);
-export const policyDecisionSchema = z.object({
+export const policyDecisionSchema = z
+    .object({
     allowed: z.boolean(),
     reason: identifierSchema,
     effectiveAutonomy: autonomyLevelSchema.optional(),
     grantId: identifierSchema.optional(),
-}).strict();
-export const auditResultSchema = z.object({
+})
+    .strict();
+export const auditResultSchema = z
+    .object({
     status: z.enum(['planned', 'allowed', 'denied', 'succeeded', 'failed', 'rolled_back']),
     code: auditCodeSchema.optional(),
-}).strict();
-export const auditEventSchema = z.object({
+})
+    .strict();
+export const auditEventSchema = z
+    .object({
     eventId: identifierSchema,
     occurredAt: z.string().datetime(),
     requesterAccountId: identifierSchema,
@@ -274,20 +322,26 @@ export const auditEventSchema = z.object({
     capabilities: z.array(identifierSchema),
     policyDecision: policyDecisionSchema,
     result: auditResultSchema,
-    rollback: z.object({
+    rollback: z
+        .object({
         supported: z.boolean(),
         attempted: z.boolean(),
         succeeded: z.boolean().optional(),
-    }).strict(),
-    correlation: z.object({
+    })
+        .strict(),
+    correlation: z
+        .object({
         runId: identifierSchema,
         stepId: identifierSchema.optional(),
         automationId: identifierSchema.optional(),
         idempotencyKeyHash: sha256HexSchema.optional(),
         capabilityTicketId: identifierSchema.optional(),
-    }).strict(),
-}).strict();
-export const catalogToolSchema = z.object({
+    })
+        .strict(),
+})
+    .strict();
+export const catalogToolSchema = z
+    .object({
     name: identifierSchema,
     version: identifierSchema,
     description: nonEmptyStringSchema,
@@ -300,15 +354,23 @@ export const catalogToolSchema = z.object({
     idempotency: z.enum(['none', 'supported', 'required']),
     rollback: z.enum(['none', 'manual', 'supported']),
     exposure: z.array(z.enum(['internal', 'mcp'])).min(1),
-    limitKeys: z.array(z.object({
+    limitKeys: z
+        .array(z
+        .object({
         key: limitKeySchema,
         kind: z.enum(['maximum_number', 'exact_boolean']),
-    }).strict()).default([]),
-    invocation: z.object({
+    })
+        .strict())
+        .default([]),
+    invocation: z
+        .object({
         method: z.enum(['GET', 'POST', 'PATCH', 'PUT', 'DELETE']),
         path: invocationPathSchema,
-    }).strict(),
-}).strict().superRefine((tool, context) => {
+    })
+        .strict(),
+})
+    .strict()
+    .superRefine((tool, context) => {
     const requireUnique = (values, path) => {
         if (new Set(values).size !== values.length) {
             context.addIssue({
@@ -385,7 +447,8 @@ export const catalogToolSchema = z.object({
             path: ['capabilityPackage'],
         });
     }
-    if ((tool.effect === 'financial' || tool.effect === 'security') && tool.idempotency !== 'required') {
+    if ((tool.effect === 'financial' || tool.effect === 'security') &&
+        tool.idempotency !== 'required') {
         context.addIssue({
             code: z.ZodIssueCode.custom,
             message: 'Financial and security effects require idempotency keys',
@@ -404,16 +467,17 @@ export const catalogToolSchema = z.object({
     // not declare as a REQUIRED property can never be filled, and a GET input
     // that is not a scalar has no query-string form — both are refused here so
     // the builder never has to guess.
-    const declared = typeof tool.inputSchema.properties === 'object'
-        && tool.inputSchema.properties !== null
-        && !Array.isArray(tool.inputSchema.properties)
+    const declared = typeof tool.inputSchema.properties === 'object' &&
+        tool.inputSchema.properties !== null &&
+        !Array.isArray(tool.inputSchema.properties)
         ? tool.inputSchema.properties
         : {};
     const required = Array.isArray(tool.inputSchema.required) ? tool.inputSchema.required : [];
     const parameters = catalogInvocationPathParameters(tool.invocation.path);
     requireUnique(parameters, 'invocation.path parameters');
     for (const parameter of parameters) {
-        if (!Object.prototype.hasOwnProperty.call(declared, parameter) || !required.includes(parameter)) {
+        if (!Object.prototype.hasOwnProperty.call(declared, parameter) ||
+            !required.includes(parameter)) {
             context.addIssue({
                 code: z.ZodIssueCode.custom,
                 message: `Path parameter {${parameter}} must be a required input property`,
@@ -436,20 +500,26 @@ export const catalogToolSchema = z.object({
         }
     }
 });
-export const catalogEventSchema = z.object({
+export const catalogEventSchema = z
+    .object({
     type: identifierSchema,
     version: identifierSchema,
     description: nonEmptyStringSchema,
     dataSchema: z.record(z.unknown()),
     resourceTypes: z.array(identifierSchema).min(1),
-}).strict();
-export const appCapabilityCatalogSchema = z.object({
+})
+    .strict();
+export const appCapabilityCatalogSchema = z
+    .object({
     schemaVersion: z.literal('1'),
     appId: identifierSchema,
     version: identifierSchema,
     audience: identifierSchema,
     /** HTTPS origin that serves the catalog's internal invocation paths. */
-    internalBaseUrl: z.string().url().superRefine((value, context) => {
+    internalBaseUrl: z
+        .string()
+        .url()
+        .superRefine((value, context) => {
         const url = new URL(value);
         const localDevelopment = url.hostname === 'localhost' || url.hostname === '127.0.0.1';
         if (url.protocol !== 'https:' && !(localDevelopment && url.protocol === 'http:')) {
@@ -468,12 +538,16 @@ export const appCapabilityCatalogSchema = z.object({
     /** Account-scoped resource used for native Alia bindings without app-specific code. */
     accountResourceType: identifierSchema,
     /** Canonical protected-resource URI when this catalog is also exposed as an external MCP server. */
-    externalMcp: z.object({
-        resource: z.string().url().superRefine((value, context) => {
+    externalMcp: z
+        .object({
+        resource: z
+            .string()
+            .url()
+            .superRefine((value, context) => {
             const url = new URL(value);
-            const localDevelopment = url.hostname === 'localhost'
-                || url.hostname === '127.0.0.1'
-                || url.hostname === '[::1]';
+            const localDevelopment = url.hostname === 'localhost' ||
+                url.hostname === '127.0.0.1' ||
+                url.hostname === '[::1]';
             if (url.protocol !== 'https:' && !(localDevelopment && url.protocol === 'http:')) {
                 context.addIssue({
                     code: z.ZodIssueCode.custom,
@@ -487,10 +561,14 @@ export const appCapabilityCatalogSchema = z.object({
                 });
             }
         }),
-    }).strict().optional(),
+    })
+        .strict()
+        .optional(),
     tools: z.array(catalogToolSchema),
     events: z.array(catalogEventSchema),
-}).strict().superRefine((catalog, context) => {
+})
+    .strict()
+    .superRefine((catalog, context) => {
     const names = new Set();
     for (const [index, tool] of catalog.tools.entries()) {
         if (names.has(tool.name)) {
@@ -509,8 +587,8 @@ export const appCapabilityCatalogSchema = z.object({
     for (const [left, right] of findOverlappingCatalogInvocations(catalog.tools)) {
         context.addIssue({
             code: z.ZodIssueCode.custom,
-            message: `Tools ${left.name} and ${right.name} have overlapping invocations `
-                + `(${left.invocation.method} ${left.invocation.path} / ${right.invocation.method} ${right.invocation.path})`,
+            message: `Tools ${left.name} and ${right.name} have overlapping invocations ` +
+                `(${left.invocation.method} ${left.invocation.path} / ${right.invocation.method} ${right.invocation.path})`,
             path: ['tools'],
         });
     }
@@ -526,13 +604,16 @@ export const appCapabilityCatalogSchema = z.object({
         eventTypes.add(event.type);
     }
 });
-export const catalogRegistrationSchema = z.object({
+export const catalogRegistrationSchema = z
+    .object({
     catalog: appCapabilityCatalogSchema,
     digest: z.string().regex(/^[a-f0-9]{64}$/),
     signature: nonEmptyStringSchema,
     deployedAt: z.string().datetime(),
-}).strict();
-export const normalizedAppEventSchema = z.object({
+})
+    .strict();
+export const normalizedAppEventSchema = z
+    .object({
     eventId: identifierSchema,
     appId: identifierSchema,
     accountId: identifierSchema,
@@ -540,4 +621,5 @@ export const normalizedAppEventSchema = z.object({
     type: identifierSchema,
     occurredAt: z.string().datetime(),
     data: z.record(z.unknown()),
-}).strict();
+})
+    .strict();

package/dist/esm/agentKeys.js

@@ -4,8 +4,15 @@ import { reauthProofSchema } from './signIn.js';
 import { canonicalJson } from './identityProof.js';
 export const AGENT_PROOF_AUDIENCE = 'oxy-api/agent';
 export const AGENT_PROOF_TTL_MS = 60000;
-export const AGENT_PROOF_ACTIONS = ['agent_signin', 'agent_enroll', 'agent_rotate', 'agent_recover', 'agent_governance'];
-export const agentProofClaimsSchema = z.object({
+export const AGENT_PROOF_ACTIONS = [
+    'agent_signin',
+    'agent_enroll',
+    'agent_rotate',
+    'agent_recover',
+    'agent_governance',
+];
+export const agentProofClaimsSchema = z
+    .object({
     version: z.literal(1),
     audience: z.literal(AGENT_PROOF_AUDIENCE),
     action: z.enum(AGENT_PROOF_ACTIONS),
@@ -16,48 +23,95 @@ export const agentProofClaimsSchema = z.object({
     payloadDigest: z.string().regex(/^[0-9a-f]{64}$/),
     challenge: z.string().regex(/^[0-9a-f]{64}$/),
     expiresAt: z.number().int().positive(),
-}).strict();
+})
+    .strict();
 /** Different proof roles cannot substitute for one another on the same operation. */
 export function buildAgentProofMessage(claims, timestamp, role = 'credential') {
-    return canonicalJson({ domain: 'oxy-agent-proof', ...agentProofClaimsSchema.parse(claims), timestamp, role });
+    return canonicalJson({
+        domain: 'oxy-agent-proof',
+        ...agentProofClaimsSchema.parse(claims),
+        timestamp,
+        role,
+    });
 }
-export const agentSignatureSchema = z.object({
+export const agentSignatureSchema = z
+    .object({
     challenge: z.string().regex(/^[0-9a-f]{64}$/),
-    signature: z.string().regex(/^[0-9a-f]+$/i).max(160),
+    signature: z
+        .string()
+        .regex(/^[0-9a-f]+$/i)
+        .max(160),
     timestamp: z.number().int().positive(),
-}).strict();
-export const agentChallengeRequestSchema = z.object({ publicKey: z.string().trim().min(1).max(130) }).strict();
-export const agentVerifyRequestSchema = agentSignatureSchema.extend({ publicKey: z.string().trim().min(1).max(130) }).strict();
-const newKey = { publicKey: z.string().trim().min(1).max(130), label: z.string().trim().min(1).max(120) };
+})
+    .strict();
+export const agentChallengeRequestSchema = z
+    .object({ publicKey: z.string().trim().min(1).max(130) })
+    .strict();
+export const agentVerifyRequestSchema = agentSignatureSchema
+    .extend({ publicKey: z.string().trim().min(1).max(130) })
+    .strict();
+const newKey = {
+    publicKey: z.string().trim().min(1).max(130),
+    label: z.string().trim().min(1).max(120),
+};
 export const agentKeyOperationSchema = z.discriminatedUnion('operation', [
     z.object({ operation: z.literal('enroll'), ...newKey }).strict(),
     z.object({ operation: z.literal('recover'), ...newKey }).strict(),
-    z.object({ operation: z.literal('rotate'), ...newKey, retireCurrent: z.boolean().optional() }).strict(),
+    z
+        .object({ operation: z.literal('rotate'), ...newKey, retireCurrent: z.boolean().optional() })
+        .strict(),
     z.object({ operation: z.literal('revoke'), methodId: z.string().min(1) }).strict(),
 ]);
-export const agentKeyOperationProofSchema = z.object({
+export const agentKeyOperationProofSchema = z
+    .object({
     challenge: z.string().regex(/^[0-9a-f]{64}$/),
     timestamp: z.number().int().positive(),
-    keySignature: z.string().regex(/^[0-9a-f]+$/i).max(160).optional(),
-    governorSignature: z.string().regex(/^[0-9a-f]+$/i).max(160).optional(),
+    keySignature: z
+        .string()
+        .regex(/^[0-9a-f]+$/i)
+        .max(160)
+        .optional(),
+    governorSignature: z
+        .string()
+        .regex(/^[0-9a-f]+$/i)
+        .max(160)
+        .optional(),
     reauth: reauthProofSchema.optional(),
-}).strict();
-export const executeAgentKeyOperationSchema = z.object({
+})
+    .strict();
+export const executeAgentKeyOperationSchema = z
+    .object({
     operation: agentKeyOperationSchema,
     proof: agentKeyOperationProofSchema,
-}).strict();
-export const agentKeyOperationChallengeSchema = z.object({
+})
+    .strict();
+export const agentKeyOperationChallengeSchema = z
+    .object({
     claims: agentProofClaimsSchema,
     governorPublicKey: z.string().nullable(),
-}).strict();
-export const agentKeyOperationResultSchema = z.object({
+})
+    .strict();
+export const agentKeyOperationResultSchema = z
+    .object({
     methodId: z.string().nullable(),
     revokedMethodIds: z.array(z.string()),
-}).strict();
+})
+    .strict();
 export const ACCOUNT_AUTH_METHODS = ['identity', 'agent_key'];
 /** Public credential inventory. Never includes a proof, bearer or private key. */
-export const agentKeyListResponseSchema = z.object({ keys: z.array(z.object({
-        id: z.string(), publicKey: z.string(), label: z.string(),
-        enrolledByUserId: z.string().nullable(), enrollmentMethod: z.enum(['governor', 'rotation', 'recovery']),
-        linkedAt: z.string().datetime(), lastUsedAt: z.string().datetime().nullable(), revokedAt: z.string().datetime().nullable(),
-    }).strict()) }).strict();
+export const agentKeyListResponseSchema = z
+    .object({
+    keys: z.array(z
+        .object({
+        id: z.string(),
+        publicKey: z.string(),
+        label: z.string(),
+        enrolledByUserId: z.string().nullable(),
+        enrollmentMethod: z.enum(['governor', 'rotation', 'recovery']),
+        linkedAt: z.string().datetime(),
+        lastUsedAt: z.string().datetime().nullable(),
+        revokedAt: z.string().datetime().nullable(),
+    })
+        .strict()),
+})
+    .strict();