@oxy.so/contracts 4.16.0 → 4.17.0

package/dist/types/agentKeys.d.ts

@@ -1,9 +1,7 @@
 /** Autonomous runtime proof. No private key crosses this contract. */
 import { z } from 'zod';
-export declare const AGENT_PROOF_AUDIENCE: "oxy-api/agent";
-export declare const AGENT_PROOF_TTL_MS = 60000;
-export declare const AGENT_PROOF_ACTIONS: readonly ["agent_signin", "agent_enroll", "agent_rotate", "agent_recover", "agent_governance"];
-export type AgentProofAction = (typeof AGENT_PROOF_ACTIONS)[number];
+export { AGENT_PROOF_AUDIENCE, AGENT_PROOF_TTL_MS, AGENT_PROOF_ACTIONS, ACCOUNT_AUTH_METHODS, } from './client/agentKeys';
+export type { AgentProofAction, AccountAuthMethod } from './client/agentKeys';
 export declare const agentProofClaimsSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     audience: z.ZodLiteral<"oxy-api/agent">;
@@ -62,6 +60,7 @@ export declare const agentChallengeRequestSchema: z.ZodObject<{
 }, {
     publicKey: string;
 }>;
+export type AgentChallengeRequest = z.infer<typeof agentChallengeRequestSchema>;
 export declare const agentVerifyRequestSchema: z.ZodObject<{
     challenge: z.ZodString;
     signature: z.ZodString;
@@ -79,6 +78,7 @@ export declare const agentVerifyRequestSchema: z.ZodObject<{
     publicKey: string;
     timestamp: number;
 }>;
+export type AgentVerifyRequest = z.infer<typeof agentVerifyRequestSchema>;
 export declare const agentKeyOperationSchema: z.ZodDiscriminatedUnion<"operation", [z.ZodObject<{
     publicKey: z.ZodString;
     label: z.ZodString;
@@ -393,6 +393,7 @@ export declare const executeAgentKeyOperationSchema: z.ZodObject<{
         governorSignature?: string | undefined;
     };
 }>;
+export type ExecuteAgentKeyOperation = z.infer<typeof executeAgentKeyOperationSchema>;
 export declare const agentKeyOperationChallengeSchema: z.ZodObject<{
     claims: z.ZodObject<{
         version: z.ZodLiteral<1>;
@@ -458,6 +459,7 @@ export declare const agentKeyOperationChallengeSchema: z.ZodObject<{
     };
     governorPublicKey: string | null;
 }>;
+export type AgentKeyOperationChallenge = z.infer<typeof agentKeyOperationChallengeSchema>;
 export declare const agentKeyOperationResultSchema: z.ZodObject<{
     methodId: z.ZodNullable<z.ZodString>;
     revokedMethodIds: z.ZodArray<z.ZodString, "many">;
@@ -468,8 +470,7 @@ export declare const agentKeyOperationResultSchema: z.ZodObject<{
     methodId: string | null;
     revokedMethodIds: string[];
 }>;
-export declare const ACCOUNT_AUTH_METHODS: readonly ["identity", "agent_key"];
-export type AccountAuthMethod = (typeof ACCOUNT_AUTH_METHODS)[number];
+export type AgentKeyOperationResult = z.infer<typeof agentKeyOperationResultSchema>;
 /** Public credential inventory. Never includes a proof, bearer or private key. */
 export declare const agentKeyListResponseSchema: z.ZodObject<{
     keys: z.ZodArray<z.ZodObject<{
@@ -523,3 +524,4 @@ export declare const agentKeyListResponseSchema: z.ZodObject<{
         lastUsedAt: string | null;
     }[];
 }>;
+export type AgentKeyListResponse = z.infer<typeof agentKeyListResponseSchema>;

package/dist/types/client/accountEmail.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Account-email constants and response checks, without Zod. Schemas: `../accountEmail.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import type { EmailVerificationConfirmResponse, EmailVerificationStartResponse } from '../accountEmail';
+/**
+ * - `signup`: above.
+ * - `signin`: the code (and link) of an email sign-in (`POST /auth/signin/email/start`).
+ * - `reauth`: a signed-in person proving it is them before a sensitive step
+ *   (`POST /users/me/reauth/email`): a password, an authenticator, deleting the
+ *   account, linking Commons.
+ */
+export declare const EMAIL_VERIFICATION_PURPOSES: readonly ["signup", "signin", "reauth"];
+export type EmailVerificationPurpose = (typeof EMAIL_VERIFICATION_PURPOSES)[number];
+/** Digits in a code. */
+export declare const EMAIL_CODE_LENGTH = 6;
+/** How long a code can be confirmed. */
+export declare const EMAIL_CODE_TTL_MS: number;
+/** Wrong codes before a verification is spent and a new code is needed. */
+export declare const EMAIL_CODE_MAX_ATTEMPTS = 5;
+/** How long a confirmed code's ticket can be spent. */
+export declare const EMAIL_TICKET_TTL_MS: number;
+/**
+ * Stable error codes (`error.code` in the API error body). Clients map these
+ * through their localization, never the English message.
+ */
+export declare const EMAIL_VERIFICATION_ERROR_CODES: {
+    /** The code is wrong, or its verification expired or was spent. */
+    readonly codeInvalid: "EMAIL_CODE_INVALID";
+    /** Too many wrong codes: request a new one. */
+    readonly tooManyAttempts: "EMAIL_CODE_TOO_MANY_ATTEMPTS";
+    /** The ticket is unknown, expired, spent, or for another email or purpose. */
+    readonly ticketInvalid: "EMAIL_TICKET_INVALID";
+    /** A sign-up without a confirmed email. */
+    readonly ticketRequired: "EMAIL_TICKET_REQUIRED";
+    /** This server cannot send mail. */
+    readonly unavailable: "EMAIL_UNAVAILABLE";
+};
+export type EmailVerificationErrorCode = (typeof EMAIL_VERIFICATION_ERROR_CODES)[keyof typeof EMAIL_VERIFICATION_ERROR_CODES];
+export declare const emailAddressCheck: import("./check").Check<string>;
+export declare const emailTicketCheck: import("./check").Check<string>;
+export declare const emailVerificationStartResponseCheck: import("./check").Check<EmailVerificationStartResponse>;
+export declare const emailVerificationConfirmResponseCheck: import("./check").Check<EmailVerificationConfirmResponse>;

package/dist/types/client/accountGraph.d.ts

@@ -0,0 +1,203 @@
+/**
+ * Account kinds and categories, without Zod. Schemas: `../accountGraph.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+/**
+ * Account-graph classification — the ONE authority for the kind vocabulary.
+ *
+ * `personal` is the only kind minted by signup and the only one that signs in
+ * as a device principal; every other kind is a child account created under a
+ * parent and reached through `account_members`. The API schema, the Drizzle
+ * table and the SDK all derive from this list rather than restating it, so a
+ * new kind is one edit here instead of four literals that can drift.
+ *
+ * The kind names what an account IS. It does not, on its own, answer who may
+ * switch into it, who may act as it, who the actor is, or anything commercial —
+ * each of those has its own predicate or contract, tabulated at the top of
+ * `accountSubject.ts`. In particular a `bot` is a COMPLETE account (issue
+ * #1520): it owns resources, holds roles, plans and a balance, receives funds
+ * and pays for itself under the same rules as a person, and is its own actor.
+ */
+export type AccountKind = 'personal' | 'organization' | 'project' | 'bot' | 'channel';
+/**
+ * The union is spelled out above and the array proves coverage BOTH ways
+ * (`satisfies` here, the `Gap` alias below) — the same shape this package's
+ * `ACCOUNT_CATEGORY_IDS` / `TRUST_TIERS` pairs use, and the one
+ * `db/schema/users.ts` mirrors to keep the `users_kind_check` CHECK honest.
+ *
+ * Deriving the union from the array instead would cost nothing here and be paid
+ * by consumers: `kind` travels into `@oxy.so/services` on every device-directory
+ * context (`deviceContextSchema.kind` → `DeviceContext` → the switcher rows),
+ * and an indexed-access type is materially more expensive to check there than a
+ * literal union.
+ */
+export declare const ACCOUNT_KINDS: readonly ["personal", "organization", "project", "bot", "channel"];
+/** `never` while `ACCOUNT_KINDS` covers the union. */
+export type AccountKindGap = Exclude<AccountKind, (typeof ACCOUNT_KINDS)[number]>;
+/**
+ * Kinds that may be CREATED as children of another account. Exactly
+ * `ACCOUNT_KINDS` minus `personal`, which is always a tree root.
+ */
+export type ChildAccountKind = Exclude<AccountKind, 'personal'>;
+export declare const CHILD_ACCOUNT_KINDS: readonly ["organization", "project", "bot", "channel"];
+/** `never` while `CHILD_ACCOUNT_KINDS` covers the child union. */
+export type ChildAccountKindGap = Exclude<ChildAccountKind, (typeof CHILD_ACCOUNT_KINDS)[number]>;
+/**
+ * Whether an account of this kind may be the SUBJECT OF A DELEGATION — an
+ * application acting as it on some person's authority. `POST /internal/accounts/
+ * :id/service-switch` and the OAuth delegated subject both gate on this.
+ *
+ * It is NOT the question an account switcher asks. See
+ * {@link isOperatorSwitchTargetKind}, and the note below on why the difference
+ * is `bot`.
+ *
+ * Two kinds are refused, for opposite reasons:
+ *
+ *  - `personal` is a human login, so assuming it would be impersonation.
+ *  - `channel` is a CONTENT identity, not an operating one. A channel exists so
+ *    that posts can be authored BY it; it is never a seat anybody occupies. Its
+ *    operators act on it through their own membership, and an application
+ *    publishes to it with its own credential. Refusing act-as is what makes
+ *    "no login, ever" structural rather than incidental: no session can be
+ *    minted whose subject is a channel, so no bearer exists that could add an
+ *    auth method to one (every auth-method write resolves its target from the
+ *    authenticated subject, never from a parameter).
+ *
+ * Consumers must gate on this predicate rather than testing `kind === 'personal'`,
+ * which silently admits every kind added after it was written.
+ *
+ * Being act-as-eligible is NOT being without an identity of one's own. A bot is
+ * act-as-eligible AND its own actor (`accountKindActorNature` → `'agent'` in
+ * `accountSubject.ts`): an application acting as it on a person's authority
+ * records that person as the actor, and the bot acting with nobody operating it
+ * records the bot. Neither ever records the bot's owner in the bot's place.
+ */
+export declare function isDelegatedActAsEligibleKind(kind: AccountKind | null | undefined): boolean;
+/**
+ * Whether a PERSON may switch into an account of this kind — become it, in an
+ * account switcher, for the rest of their session.
+ *
+ * ## Why this is not the same question as {@link isDelegatedActAsEligibleKind}
+ *
+ * The two differ on exactly one kind, `bot`, and that difference is the whole
+ * reason both exist.
+ *
+ * **A bot is not something you become. It is somebody of its own.** It is an
+ * agent's identity, with its own resources, roles, plan and balance, and it is
+ * the actor of what it does unoperated. A person may still act AS it on their
+ * own authority — that is delegation, recorded with the person as actor, and it
+ * is what {@link isDelegatedActAsEligibleKind} admits it for. What a person
+ * never does is occupy its seat. This is a refusal of a SEAT, not a capability
+ * restriction: nothing a bot may do depends on this predicate.
+ *
+ * Handing a person the bot's seat instead inverts that. It puts a human inside
+ * the identity that exists to act without one, and it does so on the human's own
+ * device, next to their personal login — which is precisely what happened: a
+ * `bot` account held a live session on a person's device, offered to them by a
+ * switcher that had asked the delegation question by mistake.
+ *
+ * `channel` is refused here as well, for the reason set out above, and
+ * `personal` because assuming somebody else's login is impersonation.
+ *
+ * ## This is the narrower predicate, deliberately
+ *
+ * Everything a person may become, a service may also act as; the reverse does
+ * not hold. A caller that is unsure which question it is asking wants THIS one:
+ * being wrong here withholds an affordance, while being wrong the other way
+ * hands out a seat.
+ */
+export declare function isOperatorSwitchTargetKind(kind: AccountKind | null | undefined): boolean;
+/**
+ * Narrow an unknown value to an {@link AccountKind}.
+ *
+ * The user-DTO serializers read from structurally-permissive `unknown` sources
+ * (a Drizzle row, a raw document, an already-formatted object), so each one
+ * would otherwise hand-roll this check and they would drift on what counts.
+ */
+export declare function isAccountKind(value: unknown): value is AccountKind;
+/**
+ * Every account category, by stable id.
+ *
+ * Grouped by comment for readability only; the storage, the wire and the picker
+ * all treat this as one flat list. `other` is the escape hatch for an account
+ * that fits nothing here.
+ *
+ * TO ADD ONE: append an id (lowercase ASCII, `snake_case`) here, publish
+ * `@oxy.so/contracts`, then ship a migration that widens
+ * `users_account_categories_check` — never edit an existing migration — and add
+ * an `accounts.accountCategory.<id>` label to each client's locales.
+ *
+ * TO WITHDRAW ONE: leave the id here and add it to
+ * {@link RETIRED_ACCOUNT_CATEGORY_IDS}. See rule 3 above.
+ */
+export declare const ACCOUNT_CATEGORY_IDS: readonly ["news", "politics", "business", "startup", "finance", "crypto", "marketplace", "retail", "real_estate", "agency", "landlord", "cooperative", "architecture", "technology", "software", "ai", "security", "automation", "science", "education", "books", "health", "fitness", "sports", "gaming", "music", "film", "podcast", "art", "photography", "comedy", "food", "travel", "fashion", "home_garden", "diy", "automotive", "animals", "family", "nonprofit", "government", "community", "activism", "environment", "religion", "other"];
+export type AccountCategoryId = (typeof ACCOUNT_CATEGORY_IDS)[number];
+/**
+ * Ids withdrawn from the picker. Empty today.
+ *
+ * A withdrawn id keeps working everywhere it is already stored: it validates,
+ * it survives a round-trip save, it still renders from its label key, and it
+ * stays PRIMARY if it was primary. Nothing rewrites a stored list — a read-time
+ * or migration-time demotion would silently replace a choice its owner made,
+ * which is precisely what stable ids exist to prevent. The owner drops it on
+ * their next edit; until then it is honoured.
+ *
+ * What withdrawal changes is only this: the id leaves
+ * {@link SELECTABLE_ACCOUNT_CATEGORY_IDS}, so no picker offers it, and
+ * {@link newlyAddedRetiredCategories} refuses to let a write ADD it to an
+ * account that did not already have it.
+ */
+export declare const RETIRED_ACCOUNT_CATEGORY_IDS: readonly AccountCategoryId[];
+/** Whether a category may still be OFFERED. A stored one is readable either way. */
+export declare function isSelectableAccountCategoryId(id: AccountCategoryId): boolean;
+/** The ids a picker may offer, in declaration order. */
+export declare const SELECTABLE_ACCOUNT_CATEGORY_IDS: readonly AccountCategoryId[];
+/**
+ * Which of `next` are withdrawn ids the account did not already carry — i.e.
+ * the ones a write must be refused for.
+ *
+ * `retired` is a parameter rather than a module read so the rule can be
+ * exercised against a non-empty set while the production one is empty; a test
+ * over `RETIRED_ACCOUNT_CATEGORY_IDS` alone would pass vacuously today and stay
+ * passing if the rule were deleted.
+ */
+export declare function newlyAddedRetiredCategories(next: readonly AccountCategoryId[], previous: readonly AccountCategoryId[], retired: readonly AccountCategoryId[]): AccountCategoryId[];
+/**
+ * How many categories one account may carry.
+ *
+ * Four, not "as many as you like". Three reasons, in the order they bind:
+ *
+ *  - The primary has to MEAN something. At ten categories the first element
+ *    reads as a sort artifact rather than a choice, and rule 2 above is the
+ *    entire mechanism by which a primary exists.
+ *  - The profile RENDERS them as a row of chips; four labels of this length is
+ *    what fits a phone-width profile header before the row wraps or truncates.
+ *  - Four is enough to place a genuinely compound account without a tag cloud:
+ *    a housing cooperative that is also a non-profit serving a local community
+ *    spends `cooperative`, `nonprofit`, `community`, `real_estate` — and is the
+ *    most compound real example in the ecosystem.
+ *
+ * One constant, read by the wire schema, the database CHECK and the picker, so
+ * changing it is one edit plus a migration.
+ */
+export declare const MAX_ACCOUNT_CATEGORIES = 4;
+/**
+ * Kinds that may carry categories: every kind EXCEPT `personal`.
+ *
+ * A person has interests, not a sector — and their interests are not a
+ * classification anybody else gets to read off their profile. Spelled out
+ * positively, like {@link isDelegatedActAsEligibleKind} and for the same reason: a `kind
+ * !== 'personal'` test silently admits every kind invented after it was
+ * written, whereas this list forces whoever adds one to decide.
+ */
+export declare const ACCOUNT_CATEGORY_KINDS: readonly ["organization", "project", "bot", "channel"];
+export type AccountCategoryKind = (typeof ACCOUNT_CATEGORY_KINDS)[number];
+/**
+ * Whether an account of this kind may carry categories.
+ *
+ * The API refuses the write and the `users_account_categories_kind_check`
+ * constraint makes it unrepresentable; both derive from
+ * {@link ACCOUNT_CATEGORY_KINDS}, so they cannot disagree.
+ */
+export declare function kindAcceptsAccountCategories(kind: AccountKind | null | undefined): boolean;

package/dist/types/client/agentKeys.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Agent-key constants and checks, without Zod. Schemas: `../agentKeys.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+export declare const AGENT_PROOF_AUDIENCE: "oxy-api/agent";
+export declare const AGENT_PROOF_TTL_MS = 60000;
+export declare const AGENT_PROOF_ACTIONS: readonly ["agent_signin", "agent_enroll", "agent_rotate", "agent_recover", "agent_governance"];
+export type AgentProofAction = (typeof AGENT_PROOF_ACTIONS)[number];
+export declare const ACCOUNT_AUTH_METHODS: readonly ["identity", "agent_key"];
+export type AccountAuthMethod = (typeof ACCOUNT_AUTH_METHODS)[number];
+export declare const agentProofClaimsCheck: import("./check").Check<{
+    expiresAt: number;
+    accountId: string;
+    version: 1;
+    audience: "oxy-api/agent";
+    action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
+    challenge: string;
+    actorId: string;
+    authMethodId: string | null;
+    publicKey: string;
+    payloadDigest: string;
+}>;
+export declare const agentChallengeRequestCheck: import("./check").Check<{
+    publicKey: string;
+}>;
+export declare const agentVerifyRequestCheck: import("./check").Check<{
+    signature: string;
+    challenge: string;
+    publicKey: string;
+    timestamp: number;
+}>;
+export declare const agentKeyOperationCheck: import("./check").Check<{
+    publicKey: string;
+    operation: "enroll";
+    label: string;
+} | {
+    publicKey: string;
+    operation: "recover";
+    label: string;
+} | {
+    publicKey: string;
+    operation: "rotate";
+    label: string;
+    retireCurrent?: boolean | undefined;
+} | {
+    operation: "revoke";
+    methodId: string;
+}>;
+export declare const executeAgentKeyOperationCheck: import("./check").Check<{
+    operation: {
+        publicKey: string;
+        operation: "enroll";
+        label: string;
+    } | {
+        publicKey: string;
+        operation: "recover";
+        label: string;
+    } | {
+        publicKey: string;
+        operation: "rotate";
+        label: string;
+        retireCurrent?: boolean | undefined;
+    } | {
+        operation: "revoke";
+        methodId: string;
+    };
+    proof: {
+        challenge: string;
+        timestamp: number;
+        reauth?: {
+            password?: string | undefined;
+            emailCode?: {
+                code: string;
+                verificationId: string;
+            } | undefined;
+            totpCode?: string | undefined;
+        } | undefined;
+        keySignature?: string | undefined;
+        governorSignature?: string | undefined;
+    };
+}>;
+export declare const agentKeyOperationChallengeCheck: import("./check").Check<{
+    claims: {
+        expiresAt: number;
+        accountId: string;
+        version: 1;
+        audience: "oxy-api/agent";
+        action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
+        challenge: string;
+        actorId: string;
+        authMethodId: string | null;
+        publicKey: string;
+        payloadDigest: string;
+    };
+    governorPublicKey: string | null;
+}>;
+export declare const agentKeyOperationResultCheck: import("./check").Check<{
+    methodId: string | null;
+    revokedMethodIds: string[];
+}>;
+export declare const agentKeyListResponseCheck: import("./check").Check<{
+    keys: {
+        id: string;
+        revokedAt: string | null;
+        publicKey: string;
+        label: string;
+        enrolledByUserId: string | null;
+        enrollmentMethod: "governor" | "rotation" | "recovery";
+        linkedAt: string;
+        lastUsedAt: string | null;
+    }[];
+}>;

package/dist/types/client/check.d.ts

@@ -0,0 +1,184 @@
+/**
+ * Structural checks for contract values, without Zod.
+ *
+ * The Zod schemas in this package are the contract, and the API parses with
+ * them. A client only needs to know that a response has the shape its type
+ * promises, and Zod's object schemas pull Zod's whole runtime into every app
+ * that bundles the SDK (~120 KB before compression, evaluated at startup). The
+ * checks here give the client the same answers in plain TypeScript.
+ *
+ * Every check mirrors one Zod 3 schema in this package, and
+ * `__tests__/clientChecks.parity.test.ts` runs both over the same inputs and
+ * requires the same verdict, the same output and the same failing path. The
+ * rules follow Zod 3 exactly:
+ *
+ *   string(...rules)      a string; `trim`/`toLowerCase` rewrite it, the other
+ *                         rules test it, in the order given
+ *   number(...rules)      a number that is not NaN (Infinity passes, as in Zod)
+ *   literal(v) / oneOf    `===` one value / one of a fixed set of strings
+ *   optional(c)           `undefined` (or an absent key) passes; `null` does not
+ *   nullable(c)           `null` passes and is kept
+ *   withDefault(c, v)     `undefined` becomes `v`, which is then checked
+ *   array(c, ...rules)    the size rules first, then every element in order
+ *   object(shape)         unknown keys are DROPPED (Zod's default "strip")
+ *   strictObject(shape)   unknown keys FAIL (`.strict()`)
+ *   looseObject(shape)    unknown keys are KEPT (`.passthrough()`)
+ *   refine(c, test)       a further condition, run once `c` passes
+ *   union / discriminatedUnion   as Zod 3 reports them
+ *
+ * A failure carries the first issue Zod would report and whether Zod would have
+ * stopped there (`fatal`: the type was wrong) or kept checking (`fatal: false`:
+ * only a rule failed). Only `union` reads the difference, because Zod reports a
+ * union through its first "rule failed" option.
+ *
+ * This module, and everything under `src/client/`, must never import `zod`
+ * (`__tests__/clientEntryGraph.test.ts` walks the graph).
+ */
+/** Where in the value a check failed. */
+export type CheckPath = (string | number)[];
+/** Zod 3's issue codes, for the ones these checks can report. */
+export type CheckIssueCode = 'invalid_type' | 'invalid_literal' | 'invalid_enum_value' | 'invalid_string' | 'too_small' | 'too_big' | 'unrecognized_keys' | 'invalid_union' | 'invalid_union_discriminator' | 'custom';
+/**
+ * The first problem found, in the order Zod reports its issues, with Zod's
+ * code and message. `expected`/`received` name TYPES (`'number'`, `'string'`)
+ * on an `invalid_type`, never values, so they are safe to log.
+ */
+export interface CheckIssue {
+    path: CheckPath;
+    code: CheckIssueCode;
+    message: string;
+    expected?: string;
+    received?: string;
+}
+/** An issue before it knows where it happened. */
+type Problem = Omit<CheckIssue, 'path'>;
+export type CheckResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    issue: CheckIssue;
+    fatal: boolean;
+};
+/** Checks one value at `path`. */
+export type Check<T> = (input: unknown, path: CheckPath) => CheckResult<T>;
+/** The value type a check produces. */
+export type CheckOutput<C> = C extends Check<infer T> ? T : never;
+/** One step of a string check: rewrite the value, or test it. */
+export type StringRule = {
+    rewrite: (value: string) => string;
+} | {
+    test: (value: string) => boolean;
+    code: CheckIssueCode;
+    message: string;
+};
+export declare const trim: StringRule;
+export declare const toLowerCase: StringRule;
+export declare function minLength(min: number, message?: string): StringRule;
+export declare function maxLength(max: number, message?: string): StringRule;
+export declare function pattern(regex: RegExp, message?: string): StringRule;
+export declare function startsWith(prefix: string): StringRule;
+export declare const email: StringRule;
+/** Zod 3's `.url()`: anything `new URL()` accepts. */
+export declare const url: StringRule;
+export declare const datetime: StringRule;
+export declare function string(...rules: StringRule[]): Check<string>;
+/** A test on a number; `undefined` when it passes, else Zod's issue. */
+export type NumberRule = (value: number) => Problem | undefined;
+/** Zod's `.int()` — reported, as Zod does, as an `invalid_type` that does not stop the parse. */
+export declare const int: NumberRule;
+export declare function atLeast(min: number): NumberRule;
+export declare function atMost(max: number): NumberRule;
+/** Zod's `.positive()`. */
+export declare const positive: NumberRule;
+/** Zod's `.nonnegative()` (and `.min(0)`). */
+export declare const nonnegative: NumberRule;
+/** Zod's `.safe()`: both bounds, low first. */
+export declare const safe: NumberRule;
+export declare function number(...rules: NumberRule[]): Check<number>;
+export declare const boolean: Check<boolean>;
+export declare function literal<const T extends string | number | boolean>(expected: T): Check<T>;
+/** One of a fixed set of strings — Zod's `z.enum`. */
+export declare function oneOf<const T extends readonly [string, ...string[]]>(values: T): Check<T[number]>;
+export declare function optional<T>(inner: Check<T>): Check<T | undefined>;
+export declare function nullable<T>(inner: Check<T>): Check<T | null>;
+export declare function withDefault<T>(inner: Check<T>, fallback: T): Check<T>;
+/** A further condition on a value `inner` accepted. */
+export declare function refine<T>(inner: Check<T>, test: (value: T) => boolean, message: string): Check<T>;
+/**
+ * Zod's `.superRefine()` for the one-issue case: `test` returns the first
+ * problem (its path relative to the value) or `undefined`.
+ */
+export declare function refineAt<T>(inner: Check<T>, test: (value: T) => {
+    path: CheckPath;
+    message: string;
+} | undefined): Check<T>;
+/** Narrows a checked value to a branded contract type (Zod's `.brand()`). */
+export declare function branded<T extends B, B>(inner: Check<B>): Check<T>;
+export interface ArrayRule {
+    test: (length: number) => boolean;
+    code: CheckIssueCode;
+    message: string;
+}
+export declare function minItems(min: number): ArrayRule;
+export declare function maxItems(max: number): ArrayRule;
+/** Zod's `.length(n)`: `too_big` or `too_small`, by which side it missed. */
+export declare function exactItems(count: number): ArrayRule[];
+export declare function array<T>(inner: Check<T>, ...rules: (ArrayRule | ArrayRule[])[]): Check<T[]>;
+/** One check per key. */
+export type Shape = Record<string, Check<unknown>>;
+type Flatten<T> = {
+    [K in keyof T]: T[K];
+};
+type OptionalKeys<S extends Shape> = {
+    [K in keyof S]: undefined extends CheckOutput<S[K]> ? K : never;
+}[keyof S];
+type RequiredKeys<S extends Shape> = Exclude<keyof S, OptionalKeys<S>>;
+/** What Zod 3 infers for `z.object(shape)`: keys that admit `undefined` become optional. */
+export type ShapeOutput<S extends Shape> = Flatten<{
+    [K in RequiredKeys<S>]: CheckOutput<S[K]>;
+} & {
+    [K in OptionalKeys<S>]?: CheckOutput<S[K]>;
+}>;
+/** Unknown keys are dropped — Zod's `z.object(shape)`. */
+export declare function object<S extends Shape>(shape: S): Check<ShapeOutput<S>>;
+/** Unknown keys fail — Zod's `z.object(shape).strict()`. */
+export declare function strictObject<S extends Shape>(shape: S): Check<ShapeOutput<S>>;
+/** Unknown keys are kept as sent — Zod's `z.object(shape).passthrough()`. */
+export declare function looseObject<S extends Shape>(shape: S): Check<Flatten<ShapeOutput<S> & {
+    [key: string]: unknown;
+}>>;
+/** Any object, every value kept — Zod's `z.record(z.unknown())`. */
+export declare const unknownRecord: Check<Record<string, unknown>>;
+/** The first option that passes; else Zod 3's report (the first option that only failed a rule). */
+export declare function union<const C extends readonly Check<unknown>[]>(...options: C): Check<CheckOutput<C[number]>>;
+/** Zod 3's `z.discriminatedUnion(key, options)`, with the options keyed by their tag. */
+export declare function discriminatedUnion<K extends string, M extends Record<string, Check<unknown>>>(key: K, options: M): Check<CheckOutput<M[keyof M]>>;
+/** `a.b[0].c` — for messages. */
+export declare function formatCheckPath(path: CheckPath): string;
+/**
+ * A value did not have the shape its contract requires. Thrown where a Zod
+ * schema's `.parse()` used to throw a `ZodError`; `issues` keeps that error's
+ * issue shape (`code`, `path`, `message`), holding the first issue Zod reports.
+ */
+export declare class ContractCheckError extends Error {
+    readonly issues: CheckIssue[];
+    constructor(issue: CheckIssue, context?: string);
+}
+/** The checked value, or `null` — the twin of `safeParseContract`. */
+export declare function checkContract<T>(check: Check<T>, input: unknown): T | null;
+/** The checked value; throws {@link ContractCheckError} — the twin of a schema's `.parse()`. */
+export declare function parseContract<T>(check: Check<T>, input: unknown, context?: string): T;
+/** `true` when `A` and `B` are the same type (not merely assignable either way). */
+export type Equal<A, B> = (<X>() => X extends A ? 1 : 2) extends <X>() => X extends B ? 1 : 2 ? true : false;
+/**
+ * `exact<DeviceSessionState>()(check)` compiles only when `check` produces
+ * exactly `DeviceSessionState` — every key, every optional mark, every literal
+ * — so a contract type that changes without its check is a type error here.
+ */
+export declare function exact<T>(): <C extends Check<unknown>>(check: C & (Equal<CheckOutput<C>, T> extends true ? unknown : {
+    mismatch: "the check does not produce the contract type";
+    check: CheckOutput<C>;
+    contract: T;
+})) => Check<T>;
+export {};

package/dist/types/client/deviceBoot.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The first-party login result check, without Zod. Schemas: `../deviceBoot.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+export declare const loginResultCheck: import("./check").Check<import("..").LoginSessionResult>;