@oxy.so/contracts 4.15.0 → 4.17.0

package/dist/esm/client/userResponse.js

@@ -0,0 +1,12 @@
+/**
+ * User-response checks, without Zod. Schemas: `../userResponse.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { exact, looseObject, optional, string } from './check.js';
+export const userNameCheck = exact()(looseObject({
+    first: optional(string()),
+    last: optional(string()),
+    full: optional(string()),
+    displayName: optional(string()),
+}));

package/dist/esm/client/username.js

@@ -0,0 +1,167 @@
+/**
+ * The username policy, without Zod. Schemas: `../username.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { maxLength, minLength, pattern, refine, string, trim } from './check.js';
+/** Shortest storable handle. `oxy` sets the floor. */
+export const USERNAME_MIN_LENGTH = 3;
+/** Longest storable handle, and the `maxLength` an input field should carry. */
+export const USERNAME_MAX_LENGTH = 30;
+/** The 400 / inline-validation copy for every path that rejects a handle. */
+export const USERNAME_INVALID_MESSAGE = 'Username must be 3-30 characters, use only letters, numbers, hyphens and underscores, ' +
+    'start and end with a letter or number, and never repeat a separator';
+/**
+ * Exact-match handles nobody may newly claim, regardless of account kind.
+ *
+ * This is NOT a namespace tightening like the bot suffix — it is a list of
+ * names withheld from `users_lower_username_key` before anybody asks for
+ * them. Compared against the same normalization the unique index applies
+ * (`lower(btrim(username))`), so `Admin`, ` ADMIN ` and `admin` are the one
+ * name this list means.
+ *
+ * `oxy`, `mention`, `homiio`, `clarity`, `faircoin`, `astro` and `mercaria`
+ * are deliberately NOT here: each already has an `organization`/`project`
+ * row, so the unique index already refuses a second one, and `oxy` is the
+ * name `USERNAME_MIN_LENGTH` is pinned against in
+ * `__tests__/username.test.ts` — listing it would make
+ * `usernameSchema.safeParse('oxy')` fail and falsify that comment. A brand
+ * with no account of its own yet (measured 2026-09-18: Alia, Allo, TNP,
+ * Kaana, Bloom) has no row to protect it, so it is listed until one exists.
+ */
+export const RESERVED_USERNAMES = new Set([
+    // Oxy product lines with no account row of their own yet.
+    'alia',
+    'allo',
+    'tnp',
+    'kaana',
+    'bloom',
+    // System / role words a signup impersonating staff or Oxy itself would reach for.
+    'admin',
+    'administrator',
+    'root',
+    'superadmin',
+    'super',
+    'superuser',
+    'support',
+    'staff',
+    'moderator',
+    'mod',
+    'security',
+    'system',
+    'official',
+    'help',
+    'noreply',
+    'anonymous',
+    'everyone',
+    'owner',
+]);
+/** The 400 / inline-validation copy for a handle on {@link RESERVED_USERNAMES}. */
+export const RESERVED_USERNAME_MESSAGE = 'This username is reserved and cannot be registered';
+/**
+ * {@link RESERVED_USERNAMES}, minus `alia`, checked against each `-`/`_`
+ * separated SEGMENT of a candidate rather than the whole string — so
+ * `official-oxy`, `super-admin` and `team-kaana` are refused the same as the
+ * bare words, without banning every word that merely CONTAINS one as a
+ * substring (`superman`, `modern`, `grassroot`, `homeowner` all stay legal:
+ * none of them separates the reserved word from the rest with `-` or `_`).
+ *
+ * `alia` is excluded because `alia-` is the live internal-cost-centre
+ * namespace: `alia-production-chat` is a minted account and
+ * `alia-research` / `alia-voice` / `alia-evaluations` are pinned as legal
+ * slugs in `__tests__/username.test.ts` and `internalCostCenterSpecs.test.ts`.
+ * Segment-matching `alia` would refuse all four. The bare word `alia` is
+ * still refused — {@link RESERVED_USERNAMES} above catches it exactly.
+ */
+export const RESERVED_USERNAME_SEGMENTS = new Set([...RESERVED_USERNAMES].filter((word) => word !== 'alia'));
+/** The 400 / inline-validation copy for a handle that is only digits. */
+export const NUMERIC_USERNAME_MESSAGE = 'Username cannot be only numbers';
+/**
+ * Alphanumeric runs joined by single separators, as a SOURCE string.
+ *
+ * A string rather than a literal because the OpenAPI docblocks that publish this
+ * rule (`POST /auth/register`, `PUT /users/:userId`) must quote it verbatim, and
+ * `usernamePolicySingleSource.test.ts` compares them against THIS constant. A
+ * published `pattern:` that drifts from the enforced rule is a lie told to every
+ * client that generates from the spec, and it is exactly the kind of copy nobody
+ * notices going stale.
+ *
+ * Deliberately NOT re-exported from the package barrel: it exists for the
+ * schema below and for that one gate. Anything validating a username uses
+ * {@link usernameSchema}, so there is no second way to ask the question.
+ *
+ * Written as an unambiguous alternation rather than a lookahead: every character
+ * belongs to exactly one branch, so matching is linear and there is no
+ * backtracking to bound. It also carries no `\p{…}` property escape, which
+ * mobile Hermes throws on at runtime — this module is reachable from every React
+ * Native consumer.
+ */
+export const USERNAME_PATTERN_SOURCE = '^[A-Za-z0-9]+(?:[-_][A-Za-z0-9]+)*$';
+export const USERNAME_PATTERN = new RegExp(USERNAME_PATTERN_SOURCE);
+/**
+ * Drop the characters the policy forbids, for an input field that filters
+ * keystrokes.
+ *
+ * This is a TYPING aid and nothing else — the result still has to pass
+ * {@link usernameSchema}, which is what decides. It does not lower-case (case is
+ * preserved, see the header) and it cannot repair a name: a value that is too
+ * short, edge-separated or doubly-separated comes back unchanged and fails
+ * validation with a message, which is the outcome the coercing rules this
+ * replaces used to hide.
+ */
+export function stripDisallowedUsernameCharacters(input) {
+    return input.replace(/[^A-Za-z0-9_-]/g, '');
+}
+/**
+ * The label a bot's handle ends in — the ONE exception the policy carries.
+ *
+ * Lower-case here because it is what a generator appends; the comparison that
+ * enforces it folds case, so `MyBot` satisfies it just as `mybot` does.
+ *
+ * Deliberately NOT re-exported from the package barrel, for the same reason
+ * {@link USERNAME_PATTERN_SOURCE} is not: it exists for the schema and the
+ * generator aid below. A consumer that wants to SAY the rule uses
+ * {@link BOT_USERNAME_INVALID_MESSAGE}, which already quotes it, and one that
+ * wants to APPLY it uses {@link applyBotUsernameSuffix} — so there is no second
+ * way to spell the check.
+ */
+export const BOT_USERNAME_SUFFIX = 'bot';
+/** The 400 / inline-validation copy for a bot handle that carries no label. */
+export const BOT_USERNAME_INVALID_MESSAGE = `A bot account's username must end in "${BOT_USERNAME_SUFFIX}"`;
+/**
+ * Label a proposed bot handle, so a generator PROPOSES something the server will
+ * accept.
+ *
+ * Alia builds an agent's handle from its display name; without this it would
+ * propose `garden-helper` for a bot and be 400ed on submit, which is the same
+ * "suggest, then refuse" defect the minimum length already caused once.
+ *
+ * It appends and never inserts: a separator is the caller's choice, so
+ * `garden-helper` becomes `garden-helperbot` while a caller who typed
+ * `garden-helper-` gets `garden-helper-bot`. It truncates to leave room rather
+ * than overflowing {@link USERNAME_MAX_LENGTH}.
+ *
+ * Like {@link stripDisallowedUsernameCharacters} it is an aid, not a decision: it
+ * cannot repair a handle the base policy refuses, and the result still has to
+ * pass {@link botUsernameSchema}.
+ */
+export function applyBotUsernameSuffix(candidate) {
+    const trimmed = candidate.trim();
+    if (trimmed.toLowerCase().endsWith(BOT_USERNAME_SUFFIX)) {
+        return trimmed;
+    }
+    return trimmed.slice(0, USERNAME_MAX_LENGTH - BOT_USERNAME_SUFFIX.length) + BOT_USERNAME_SUFFIX;
+}
+/* -------------------------------------------------------------------------- */
+/*  Checks                                                                    */
+/* -------------------------------------------------------------------------- */
+/** The username policy as a check — the twin of `usernameSchema`, same messages. */
+export const usernameCheck = refine(refine(refine(string(trim, minLength(USERNAME_MIN_LENGTH, USERNAME_INVALID_MESSAGE), maxLength(USERNAME_MAX_LENGTH, USERNAME_INVALID_MESSAGE), pattern(USERNAME_PATTERN, USERNAME_INVALID_MESSAGE)), (username) => !/^[0-9]+$/.test(username), NUMERIC_USERNAME_MESSAGE), (username) => !RESERVED_USERNAMES.has(username.toLowerCase()), RESERVED_USERNAME_MESSAGE), (username) => !username
+    .split(/[-_]/)
+    .some((segment) => RESERVED_USERNAME_SEGMENTS.has(segment.toLowerCase())), RESERVED_USERNAME_MESSAGE);
+/** A bot's username: the policy plus the `bot` suffix — the twin of `botUsernameSchema`. */
+export const botUsernameCheck = refine(usernameCheck, (username) => username.toLowerCase().endsWith(BOT_USERNAME_SUFFIX), BOT_USERNAME_INVALID_MESSAGE);
+/** The twin of `usernameSchemaForAccountKind`. */
+export function usernameCheckForAccountKind(kind) {
+    return kind === 'bot' ? botUsernameCheck : usernameCheck;
+}

package/dist/esm/deviceSession.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+export { SESSION_ACCOUNTS_CHANGED_EVENT } from './client/deviceSession.js';
 export const sessionAccountSchema = z.object({
     accountId: z.string(),
     sessionId: z.string(),
@@ -58,21 +59,6 @@ export const deviceTokenMintResponseSchema = z.object({
     nextDeviceSecret: z.string(),
     state: deviceSessionStateSchema,
 });
-/* -------------------------------------------------------------------------- */
-/*  Instant cross-app session sync (token-free socket signal)                 */
-/* -------------------------------------------------------------------------- */
-/**
- * Name of the token-free Socket.IO event emitted to room `user:<userId>` on
- * every DeviceSession mutation that changes what is signed in for that user.
- *
- * This is a pure SIGNAL — it carries NO access token, NO deviceSecret and NO
- * account bodies. A client that receives it re-fetches its authenticated
- * session/account state (`GET /session/device/state`, `GET /accounts`). Unlike
- * `session_state` (scoped to `device:<deviceId>`, i.e. a single origin), this
- * reaches ALL of a user's connected sockets across their devices/origins so
- * every Oxy app reflects an add / switch / signout instantly.
- */
-export const SESSION_ACCOUNTS_CHANGED_EVENT = 'session_accounts_changed';
 /**
  * Why the signed-in set changed:
  *  - `login`   — a brand-new session was minted for the user (QR / cross-app authorize)

package/dist/esm/identityLink.js

@@ -26,37 +26,14 @@
 import { z } from 'zod';
 import { identityProofSchema } from './identityProof.js';
 import { emailReauthProofSchema } from './signIn.js';
-export const IDENTITY_LINK_STATUSES = ['pending', 'signed', 'completed', 'cancelled'];
-/** The scheme and host Commons routes a link QR to. */
-export const IDENTITY_LINK_QR_PREFIX = 'oxycommons://link';
-const LINK_ID = /^[0-9a-f]{32}$/;
-const CHALLENGE = /^[0-9a-f]{64}$/;
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// it is re-exported here so the root entry is unchanged.
+import { IDENTITY_LINK_STATUSES, IDENTITY_LINK_QR_PREFIX, LINK_ID, CHALLENGE, } from './client/identityLink.js';
+export { IDENTITY_LINK_STATUSES, IDENTITY_LINK_QR_PREFIX, buildIdentityLinkQrPayload, parseIdentityLinkQrPayload, } from './client/identityLink.js';
 export const identityLinkIdSchema = z
     .string()
     .trim()
     .regex(LINK_ID, 'linkId must be 32 lowercase hex characters');
-/** The QR auth.oxy.so shows: the request's id and the challenge Commons signs. */
-export function buildIdentityLinkQrPayload(linkId, challenge) {
-    return `${IDENTITY_LINK_QR_PREFIX}?id=${linkId}&c=${challenge}`;
-}
-/** The request a scanned code names, or `null` for anything that is not a link QR. */
-export function parseIdentityLinkQrPayload(raw) {
-    const value = raw.trim();
-    if (!value.startsWith(`${IDENTITY_LINK_QR_PREFIX}?`))
-        return null;
-    // Parsed by hand: React Native's `URLSearchParams` does not implement `get`.
-    const params = new Map();
-    for (const pair of value.slice(IDENTITY_LINK_QR_PREFIX.length + 1).split('&')) {
-        const separator = pair.indexOf('=');
-        if (separator > 0)
-            params.set(pair.slice(0, separator), pair.slice(separator + 1));
-    }
-    const linkId = params.get('id') ?? '';
-    const challenge = params.get('c') ?? '';
-    if (!LINK_ID.test(linkId) || !CHALLENGE.test(challenge))
-        return null;
-    return { linkId, challenge };
-}
 export const identityLinkCreateResponseSchema = z.object({
     linkId: identityLinkIdSchema,
     challenge: z.string().regex(CHALLENGE),

package/dist/esm/identityProof.js

@@ -16,94 +16,10 @@
  * primitive and passes the hex digest in).
  */
 import { z } from 'zod';
-export const IDENTITY_PROOF_VERSION = 2;
-export const IDENTITY_PROOF_DOMAIN = 'oxy-identity-proof';
-/** The audience every API-verified identity proof names. */
-export const IDENTITY_PROOF_AUDIENCE = 'oxy-api/identity';
-/** How long a proof challenge lives: one interactive ceremony. */
-export const IDENTITY_PROOF_CHALLENGE_TTL_MS = 5 * 60 * 1000;
-/**
- * Everything a root proof may authorize. A challenge is minted for exactly one
- * action and spent only by a proof for that action.
- */
-export const IDENTITY_PROOF_ACTIONS = {
-    /**
-     * Link Commons' root to an account that has none (`POST /auth/link`).
-     * The account becomes self-custodied and its email is deleted
-     * (ADR 0029 D3).
-     */
-    link: 'link_identity',
-};
-export const IDENTITY_PROOF_ACTION_VALUES = Object.values(IDENTITY_PROOF_ACTIONS);
-const HEX_DIGEST = /^[0-9a-f]{64}$/;
-const ROOT_KEY = /^04[0-9a-f]{128}$/;
-const CHALLENGE = /^[0-9a-f]{64}$/;
-/**
- * Canonical JSON: object keys sorted by UTF-16 code unit, no whitespace,
- * `undefined` members omitted, arrays in order. Numbers must be finite. This is
- * the ONLY serializer for anything digested into a proof.
- */
-export function canonicalJson(value) {
-    if (value === null)
-        return 'null';
-    switch (typeof value) {
-        case 'string':
-        case 'boolean':
-            return JSON.stringify(value);
-        case 'number':
-            if (!Number.isFinite(value))
-                throw new Error('canonicalJson: non-finite number');
-            return JSON.stringify(value);
-        case 'object': {
-            if (Array.isArray(value)) {
-                return `[${value.map((entry) => (entry === undefined ? 'null' : canonicalJson(entry))).join(',')}]`;
-            }
-            const record = value;
-            const keys = Object.keys(record)
-                .filter((key) => record[key] !== undefined)
-                .sort();
-            return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(',')}}`;
-        }
-        default:
-            throw new Error(`canonicalJson: unsupported ${typeof value}`);
-    }
-}
-/**
- * The exact bytes a root signs. Throws on a malformed claim rather than signing
- * (or verifying) something ambiguous.
- */
-export function buildIdentityProofMessage(claims) {
-    if (!IDENTITY_PROOF_ACTION_VALUES.includes(claims.action))
-        throw new Error('identity proof: unknown action');
-    if (!claims.subject || !claims.actor)
-        throw new Error('identity proof: subject and actor are required');
-    if (!ROOT_KEY.test(claims.rootPublicKey))
-        throw new Error('identity proof: rootPublicKey must be canonical');
-    if (claims.payloadDigest !== null && !HEX_DIGEST.test(claims.payloadDigest)) {
-        throw new Error('identity proof: payloadDigest must be a lowercase SHA-256 hex digest');
-    }
-    if (claims.expectedRevision !== null &&
-        (!Number.isSafeInteger(claims.expectedRevision) || claims.expectedRevision < 0)) {
-        throw new Error('identity proof: expectedRevision must be a non-negative integer');
-    }
-    if (!CHALLENGE.test(claims.challenge))
-        throw new Error('identity proof: challenge must be 64 lowercase hex characters');
-    if (!Number.isSafeInteger(claims.expiresAt) || claims.expiresAt <= 0)
-        throw new Error('identity proof: expiresAt must be unix milliseconds');
-    return canonicalJson({
-        v: IDENTITY_PROOF_VERSION,
-        domain: IDENTITY_PROOF_DOMAIN,
-        action: claims.action,
-        subject: claims.subject,
-        actor: claims.actor,
-        rootPublicKey: claims.rootPublicKey,
-        payloadDigest: claims.payloadDigest,
-        expectedRevision: claims.expectedRevision,
-        audience: claims.audience,
-        challenge: claims.challenge,
-        expiresAt: claims.expiresAt,
-    });
-}
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// it is re-exported here so the root entry is unchanged.
+import { IDENTITY_PROOF_VERSION, IDENTITY_PROOF_ACTION_VALUES, CHALLENGE, } from './client/identityProof.js';
+export { IDENTITY_PROOF_VERSION, IDENTITY_PROOF_DOMAIN, IDENTITY_PROOF_AUDIENCE, IDENTITY_PROOF_CHALLENGE_TTL_MS, IDENTITY_PROOF_ACTIONS, IDENTITY_PROOF_ACTION_VALUES, canonicalJson, buildIdentityProofMessage, IDENTITY_ERROR_CODES, } from './client/identityProof.js';
 /** The proof as it travels: the signature plus the two claims the verifier cannot derive. */
 export const identityProofSchema = z.object({
     v: z.literal(IDENTITY_PROOF_VERSION),
@@ -120,17 +36,6 @@ export const identityProofChallengeResponseSchema = z.object({
     expiresAt: z.number().int().positive(),
     audience: z.string().min(1),
 });
-/**
- * Stable error codes the root routes answer with (`error.code` in the API error
- * body). Clients map these through their localization, never the English message.
- */
-export const IDENTITY_ERROR_CODES = {
-    proofInvalid: 'IDENTITY_PROOF_INVALID',
-    rootAlreadyLinked: 'IDENTITY_ROOT_ALREADY_LINKED',
-    rootLinkedElsewhere: 'IDENTITY_ROOT_LINKED_ELSEWHERE',
-    freshFactorRequired: 'IDENTITY_FRESH_FACTOR_REQUIRED',
-    notPersonal: 'IDENTITY_NOT_PERSONAL_ACCOUNT',
-};
 export const identityRootStatusSchema = z.object({
     rootLinked: z.boolean(),
     recoveryEmail: z.string().nullable(),

package/dist/esm/index.js

@@ -100,7 +100,7 @@ export {
 EMAIL_VERIFICATION_PURPOSES, EMAIL_CODE_LENGTH, EMAIL_CODE_TTL_MS, EMAIL_CODE_MAX_ATTEMPTS, EMAIL_TICKET_TTL_MS, EMAIL_VERIFICATION_ERROR_CODES, emailAddressSchema, emailTicketSchema, emailVerificationStartRequestSchema, emailVerificationStartResponseSchema, emailVerificationConfirmRequestSchema, emailVerificationConfirmResponseSchema, } from './accountEmail.js';
 export { 
 // Email code/link, password and authenticator sign-in
-EMAIL_SIGNIN_LINK_TTL_MS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, PASSWORD_MIN_LENGTH, PASSWORD_MAX_LENGTH, TOTP_DIGITS, TOTP_PERIOD_SECONDS, TOTP_BACKUP_CODE_COUNT, SIGN_IN_ERROR_CODES, signInIdentifierSchema, passwordInputSchema, newPasswordSchema, secondFactorCodeSchema, emailSignInStartRequestSchema, emailSignInStartResponseSchema, emailSignInConfirmRequestSchema, emailSignInCodeSchema, normalizeEmailSignInCode, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, emailSignInCollectRequestSchema, emailSignInLinkRequestSchema, emailSignInLinkResponseSchema, emailSignInPendingSchema, passwordSignInRequestSchema, secondFactorSignInRequestSchema, secondFactorRequiredSchema, signUpRequestSchema, isSecondFactorRequired, reauthProofSchema, emailReauthProofSchema, REAUTH_ACTIONS, reauthEmailStartRequestSchema, passwordSetRequestSchema, signInMethodsSchema, totpEnrollResponseSchema, totpConfirmRequestSchema, totpReauthRequestSchema, totpBackupCodesResponseSchema, } from './signIn.js';
+EMAIL_SIGNIN_LINK_TTL_MS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, PASSWORD_MIN_LENGTH, PASSWORD_MAX_LENGTH, TOTP_DIGITS, TOTP_PERIOD_SECONDS, TOTP_BACKUP_CODE_COUNT, SIGN_IN_ERROR_CODES, signInIdentifierSchema, passwordInputSchema, newPasswordSchema, secondFactorCodeSchema, emailSignInStartRequestSchema, emailSignInStartResponseSchema, emailSignInConfirmRequestSchema, emailSignInCodeSchema, normalizeEmailSignInCode, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, emailSignInCollectRequestSchema, emailSignInLinkRequestSchema, emailSignInLinkResponseSchema, emailSignInPendingSchema, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_ACCOUNTS_MAX, emailSignInAccountOptionSchema, emailSignInChooseAccountSchema, emailSignInChooseRequestSchema, isEmailSignInChooseAccount, passwordSignInRequestSchema, secondFactorSignInRequestSchema, secondFactorRequiredSchema, signUpRequestSchema, isSecondFactorRequired, reauthProofSchema, emailReauthProofSchema, REAUTH_ACTIONS, reauthEmailStartRequestSchema, passwordSetRequestSchema, signInMethodsSchema, totpEnrollResponseSchema, totpConfirmRequestSchema, totpReauthRequestSchema, totpBackupCodesResponseSchema, } from './signIn.js';
 export { 
 // Linking Commons to an account without a key (ADR 0029 D3)
 IDENTITY_LINK_STATUSES, IDENTITY_LINK_QR_PREFIX, identityLinkIdSchema, buildIdentityLinkQrPayload, parseIdentityLinkQrPayload, identityLinkCreateResponseSchema, identityLinkStateSchema, identityLinkProofRequestSchema, identityLinkCompleteRequestSchema, } from './identityLink.js';
@@ -200,7 +200,7 @@ export { meteredGenerationSchema } from './inference/economics.js';
 export { canonicalCapabilityJson, inputSatisfiesCapabilityLimits, isLoopbackOrigin, } from './capabilityBindings.js';
 export * from './agentKeys.js';
 export { productSubscriptionSummarySchema, productSubscriptionsResponseSchema, subscriptionCreditGrantSchema, subscriptionCreditGrantsResponseSchema, cancelProductSubscriptionSchema, productSubscriptionCancellationResultSchema, } from './products/billing.js';
-export { personalPlanDisplayPriceSchema, personalPlanCatalogueSchema, productPlanCatalogueSchema, } from './products/plans.js';
+export { personalPlanDisplayPriceSchema, personalPlanCatalogueSchema, } from './products/plans.js';
 export * from './products/checkout.js';
 export * from './organizations.js';
 export * from './safety.js';

package/dist/esm/inference/money.js

@@ -144,6 +144,15 @@ export const moneySchema = z
  * estimated from the audio, and a provider billed by the audio it carries (or
  * by tokens) never reports it.
  *
+ * **`input_transcription_milliseconds` is a second model's reading** (added in
+ * contract set 3.9.0, mirroring `@kaana.ai/contracts` 4.1.0): milliseconds of a
+ * realtime session's input audio that the deployment's own TRANSCRIPTION model
+ * transcribed, when the provider bills that model apart from the session model
+ * (OpenAI bills input transcription at the ASR model's price). The session
+ * model's `audio_input_tokens` and this unit are two charges for two models,
+ * each read once, so the partition rule holds. A provider whose session price
+ * already includes the transcription (xAI's Voice Agent) never reports it.
+ *
  * No refinement in this package can enforce it, and saying so is part of the
  * rule: a nested report and a disjoint one are the same four non-negative
  * integers, so no predicate over a single report can tell them apart. The two
@@ -181,6 +190,7 @@ export const USAGE_UNITS = [
     'cached_audio_input_tokens',
     'audio_output_tokens',
     'session_milliseconds',
+    'input_transcription_milliseconds',
 ];
 export const usageUnitSchema = z.enum(USAGE_UNITS);
 /**

package/dist/esm/inference/version.js

@@ -99,4 +99,4 @@
  * change to, say, the catalogue reject every in-flight inference request; the
  * per-shape `schemaVersion` is what a message is validated against.
  */
-export const INFERENCE_CONTRACT_VERSION = '3.8.0';
+export const INFERENCE_CONTRACT_VERSION = '3.9.0';

package/dist/esm/organizations.js

@@ -1,22 +1,8 @@
 import { z } from 'zod';
-/** Real-world identity classification, independent of account topics and permissions. */
-export const ORGANIZATION_TYPES = [
-    'business',
-    'nonprofit',
-    'public_body',
-    'community',
-    'other',
-];
-export const ORGANIZATION_STATUSES = ['active', 'inactive', 'merged', 'suppressed'];
-export const ORGANIZATION_CLAIM_STATUSES = ['unclaimed', 'claimed'];
-export const ORGANIZATION_ALIAS_KINDS = [
-    'name_variant',
-    'former_name',
-    'localized_name',
-    'marketing_name',
-    'misspelling',
-];
-export const ORGANIZATION_CLAIM_DECISIONS = ['pending', 'approved', 'rejected'];
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// it is re-exported here so the root entry is unchanged.
+import { ORGANIZATION_TYPES, ORGANIZATION_STATUSES, ORGANIZATION_CLAIM_STATUSES, ORGANIZATION_ALIAS_KINDS, ORGANIZATION_CLAIM_DECISIONS, ORGANIZATION_NAME_MAX_LENGTH, ORGANIZATION_ERROR_CODES, } from './client/organizations.js';
+export { ORGANIZATION_TYPES, ORGANIZATION_STATUSES, ORGANIZATION_CLAIM_STATUSES, ORGANIZATION_ALIAS_KINDS, ORGANIZATION_CLAIM_DECISIONS, ORGANIZATION_NAME_MAX_LENGTH, ORGANIZATION_ERROR_CODES, } from './client/organizations.js';
 const id = z.string().min(1).max(128);
 const optionalText = (max) => z.string().trim().min(1).max(max).nullable().optional();
 export const organizationAliasSchema = z
@@ -26,7 +12,6 @@ export const organizationAliasSchema = z
     language: z.string().min(2).max(35).optional(),
 })
     .strict();
-export const ORGANIZATION_NAME_MAX_LENGTH = 300;
 export const organizationNameSchema = z
     .string()
     .trim()
@@ -168,18 +153,6 @@ export const organizationMergeSchema = z
     evidenceReference: z.string().trim().min(1).max(1000),
 })
     .strict();
-export const ORGANIZATION_ERROR_CODES = [
-    'bad_request',
-    'unauthorized',
-    'forbidden',
-    'not_found',
-    'unknown_route',
-    'conflict',
-    'validation_failed',
-    'rate_limited',
-    'internal_error',
-    'service_unavailable',
-];
 export const organizationErrorSchema = z
     .object({
     error: z

package/dist/esm/products/billing.js

@@ -24,7 +24,6 @@ export const productSubscriptionSummarySchema = z
     period,
     cancelAtPeriodEnd: z.boolean(),
     canCancel: z.boolean(),
-    canRenew: z.boolean().optional(),
     offers: z.array(z
         .object({
         segmentId: id,

package/dist/esm/products/checkout.js

@@ -30,16 +30,3 @@ export const personalPlanCheckoutResultSchema = z.discriminatedUnion('state', [
     z.object({ state: z.literal('closed'), intentId: z.string().min(1).max(160) }).strict(),
     z.object({ state: z.literal('fulfilled'), intentId: z.string().min(1).max(160) }).strict(),
 ]);
-/** Explicit individual product offer; still owned and paid through Oxy. */
-export const productPlanCheckoutRequestSchema = personalPlanCheckoutRequestSchema
-    .extend({
-    productId: z.string().min(1).max(160),
-})
-    .strict();
-export const productSubscriptionRenewalRequestSchema = z
-    .object({
-    expectedSubjectAccountId: oxyAccountIdSchema,
-    sourceId: z.string().min(1).max(160),
-    idempotencyKey: personalPlanCheckoutRequestSchema.shape.idempotencyKey,
-})
-    .strict();

package/dist/esm/products/plans.js

@@ -16,7 +16,7 @@ export const personalPlanCatalogueSchema = z
     .object({
     schemaVersion: z.literal(1),
     state: z.enum(['unconfigured', 'configured']),
-    purchase: z.enum(['unavailable', 'available']),
+    purchase: z.literal('unavailable'),
     plans: z.array(z
         .object({
         offerId: z.string().min(1).max(160),
@@ -33,19 +33,3 @@ export const personalPlanCatalogueSchema = z
 })
     .strict()
     .refine((value) => (value.state === 'unconfigured') === (value.plans.length === 0), 'Catalogue state must match published plans');
-export const productPlanCatalogueSchema = z
-    .object({
-    schemaVersion: z.literal(1),
-    productId: z.string().min(1).max(160),
-    purchase: z.enum(['unavailable', 'available']),
-    plans: z.array(z
-        .object({
-        productId: z.string().min(1).max(160),
-        offerId: z.string().min(1).max(160),
-        offerVersion: z.number().int().positive().safe(),
-        displayName: z.string().min(1).max(100),
-        price: personalPlanDisplayPriceSchema.extend({ interval: z.enum(['month', 'year']) }),
-    })
-        .strict()),
-})
-    .strict();

package/dist/esm/reputation.js

@@ -41,6 +41,7 @@
 import { z } from 'zod';
 import { userNameSchema } from './userResponse.js';
 import { reputationConductSchema, reputationContextualInfluenceSchema, reputationContributionSchema, reputationPersonhoodSchema, reputationReportingSchema, reputationReviewingSchema, } from './moderationReputation.js';
+export { isFullReputationBalance } from './client/reputation.js';
 /* -------------------------------------------------------------------------- */
 /*  Closed value sets                                                         */
 /* -------------------------------------------------------------------------- */
@@ -170,38 +171,6 @@ export const reputationBalanceSchema = z.object({
     reviewing: reputationReviewingSchema.optional(),
     contextualInfluence: reputationContextualInfluenceSchema.optional(),
 });
-/**
- * The fields the full {@link ReputationBalance} carries beyond the public
- * {@link ReputationBalanceSummary} that the API sends ALL-OR-NOTHING. The
- * runtime discriminant between the two views.
- *
- * The V2 blocks (`conduct`, `contribution`, …) are deliberately NOT listed:
- * they are optional on the wire, so requiring them here would make a balance
- * from a server that predates them fail to narrow, hiding the whole private
- * view. Read a V2 block by checking that block.
- */
-const FULL_BALANCE_FIELDS = [
-    'positive',
-    'negative',
-    'breakdown',
-    'influence',
-    'reliability',
-    'recalculatedAt',
-    'updatedAt',
-];
-/**
- * Whether a balance came back as the SUBJECT view, and so carries the
- * breakdown / influence / reliability blocks.
- *
- * Checks every extra field rather than one representative: the point of the
- * guard is that the caller then dereferences those blocks, so a partial payload
- * must not narrow.
- *
- * @param balance - A balance from `getReputationBalance`.
- */
-export function isFullReputationBalance(balance) {
-    return FULL_BALANCE_FIELDS.every((field) => field in balance);
-}
 export const reputationRuleSchema = z.object({
     actionType: z.string(),
     points: z.number(),