@oxy.so/contracts 4.16.0 → 4.21.0

package/dist/types/agentKeys.d.ts

@@ -1,9 +1,7 @@
 /** Autonomous runtime proof. No private key crosses this contract. */
 import { z } from 'zod';
-export declare const AGENT_PROOF_AUDIENCE: "oxy-api/agent";
-export declare const AGENT_PROOF_TTL_MS = 60000;
-export declare const AGENT_PROOF_ACTIONS: readonly ["agent_signin", "agent_enroll", "agent_rotate", "agent_recover", "agent_governance"];
-export type AgentProofAction = (typeof AGENT_PROOF_ACTIONS)[number];
+export { AGENT_PROOF_AUDIENCE, AGENT_PROOF_TTL_MS, AGENT_PROOF_ACTIONS, ACCOUNT_AUTH_METHODS, } from './client/agentKeys';
+export type { AgentProofAction, AccountAuthMethod } from './client/agentKeys';
 export declare const agentProofClaimsSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     audience: z.ZodLiteral<"oxy-api/agent">;
@@ -16,8 +14,8 @@ export declare const agentProofClaimsSchema: z.ZodObject<{
     challenge: z.ZodString;
     expiresAt: z.ZodNumber;
 }, "strict", z.ZodTypeAny, {
-    expiresAt: number;
     accountId: string;
+    expiresAt: number;
     version: 1;
     audience: "oxy-api/agent";
     action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
@@ -27,8 +25,8 @@ export declare const agentProofClaimsSchema: z.ZodObject<{
     publicKey: string;
     payloadDigest: string;
 }, {
-    expiresAt: number;
     accountId: string;
+    expiresAt: number;
     version: 1;
     audience: "oxy-api/agent";
     action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
@@ -62,6 +60,7 @@ export declare const agentChallengeRequestSchema: z.ZodObject<{
 }, {
     publicKey: string;
 }>;
+export type AgentChallengeRequest = z.infer<typeof agentChallengeRequestSchema>;
 export declare const agentVerifyRequestSchema: z.ZodObject<{
     challenge: z.ZodString;
     signature: z.ZodString;
@@ -79,6 +78,7 @@ export declare const agentVerifyRequestSchema: z.ZodObject<{
     publicKey: string;
     timestamp: number;
 }>;
+export type AgentVerifyRequest = z.infer<typeof agentVerifyRequestSchema>;
 export declare const agentKeyOperationSchema: z.ZodDiscriminatedUnion<"operation", [z.ZodObject<{
     publicKey: z.ZodString;
     label: z.ZodString;
@@ -393,6 +393,7 @@ export declare const executeAgentKeyOperationSchema: z.ZodObject<{
         governorSignature?: string | undefined;
     };
 }>;
+export type ExecuteAgentKeyOperation = z.infer<typeof executeAgentKeyOperationSchema>;
 export declare const agentKeyOperationChallengeSchema: z.ZodObject<{
     claims: z.ZodObject<{
         version: z.ZodLiteral<1>;
@@ -406,8 +407,8 @@ export declare const agentKeyOperationChallengeSchema: z.ZodObject<{
         challenge: z.ZodString;
         expiresAt: z.ZodNumber;
     }, "strict", z.ZodTypeAny, {
-        expiresAt: number;
         accountId: string;
+        expiresAt: number;
         version: 1;
         audience: "oxy-api/agent";
         action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
@@ -417,8 +418,8 @@ export declare const agentKeyOperationChallengeSchema: z.ZodObject<{
         publicKey: string;
         payloadDigest: string;
     }, {
-        expiresAt: number;
         accountId: string;
+        expiresAt: number;
         version: 1;
         audience: "oxy-api/agent";
         action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
@@ -431,8 +432,8 @@ export declare const agentKeyOperationChallengeSchema: z.ZodObject<{
     governorPublicKey: z.ZodNullable<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     claims: {
-        expiresAt: number;
         accountId: string;
+        expiresAt: number;
         version: 1;
         audience: "oxy-api/agent";
         action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
@@ -445,8 +446,8 @@ export declare const agentKeyOperationChallengeSchema: z.ZodObject<{
     governorPublicKey: string | null;
 }, {
     claims: {
-        expiresAt: number;
         accountId: string;
+        expiresAt: number;
         version: 1;
         audience: "oxy-api/agent";
         action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
@@ -458,6 +459,7 @@ export declare const agentKeyOperationChallengeSchema: z.ZodObject<{
     };
     governorPublicKey: string | null;
 }>;
+export type AgentKeyOperationChallenge = z.infer<typeof agentKeyOperationChallengeSchema>;
 export declare const agentKeyOperationResultSchema: z.ZodObject<{
     methodId: z.ZodNullable<z.ZodString>;
     revokedMethodIds: z.ZodArray<z.ZodString, "many">;
@@ -468,8 +470,7 @@ export declare const agentKeyOperationResultSchema: z.ZodObject<{
     methodId: string | null;
     revokedMethodIds: string[];
 }>;
-export declare const ACCOUNT_AUTH_METHODS: readonly ["identity", "agent_key"];
-export type AccountAuthMethod = (typeof ACCOUNT_AUTH_METHODS)[number];
+export type AgentKeyOperationResult = z.infer<typeof agentKeyOperationResultSchema>;
 /** Public credential inventory. Never includes a proof, bearer or private key. */
 export declare const agentKeyListResponseSchema: z.ZodObject<{
     keys: z.ZodArray<z.ZodObject<{
@@ -523,3 +524,4 @@ export declare const agentKeyListResponseSchema: z.ZodObject<{
         lastUsedAt: string | null;
     }[];
 }>;
+export type AgentKeyListResponse = z.infer<typeof agentKeyListResponseSchema>;

package/dist/types/applicationRoles.d.ts

@@ -0,0 +1,438 @@
+/**
+ * Application roles — the wire contract for permissions an APPLICATION declares
+ * about its own users, and for the grants that give them to Oxy users.
+ *
+ * Oxy decides who holds an app's operator powers (who may run Mercaria's
+ * payments desk, moderate GoWay, administer Homiio), so no app keeps an
+ * allow-list of Oxy user ids in its environment. The app declares a closed
+ * vocabulary of keys, its owners grant them to people, and the app's backend
+ * asks Oxy which of them the human behind a request holds
+ * (`GET /applications/:appId/roles/me`, read through `@oxy.so/core/server`).
+ *
+ * ## Why an application key can never collide with an Oxy permission
+ *
+ * Every permission Oxy itself checks (`app:update`, `apps:create`,
+ * `credentials:rotate`, every scope) is spelled with a COLON. An application key
+ * is dot-separated lowercase segments and cannot contain one, so the two
+ * vocabularies are disjoint by syntax, not by convention. They are also stored
+ * apart (scoped to one application id) and no Oxy gate ever reads an
+ * application key. A key means something only to the application that declared
+ * it.
+ *
+ * The pattern is exported as a SOURCE string because the API renders the same
+ * text into a Postgres CHECK; JavaScript's `RegExp` and Postgres' ARE agree on
+ * everything it uses (anchors, classes, a capturing group, a bounded repeat).
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo.
+ */
+import { z } from 'zod';
+/**
+ * Two to four dot-separated segments, each a lowercase letter followed by
+ * lowercase letters, digits or underscores: `payments.operate`,
+ * `catalog.review.publish`. At least two segments so a key always names an
+ * area and an action; never a colon (see the header).
+ */
+export declare const APPLICATION_PERMISSION_KEY_PATTERN_SOURCE = "^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*){1,3}$";
+export declare const APPLICATION_PERMISSION_KEY_PATTERN: RegExp;
+export declare const APPLICATION_PERMISSION_KEY_MAX_LENGTH = 64;
+export declare const APPLICATION_PERMISSION_DESCRIPTION_MAX_LENGTH = 280;
+/** How many live keys one application may declare. Operator powers are few. */
+export declare const APPLICATION_PERMISSIONS_MAX_DECLARED = 64;
+export declare const APPLICATION_ROLE_REASON_MAX_LENGTH = 500;
+export declare const APPLICATION_ROLE_GRANTS_PAGE_DEFAULT = 50;
+export declare const APPLICATION_ROLE_GRANTS_PAGE_MAX = 200;
+/**
+ * The `error` codes the application-roles routes answer beyond the generic
+ * ones (`BAD_REQUEST`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`). Renaming one
+ * is a breaking change.
+ */
+export declare const APPLICATION_ROLE_ERROR_CODES: {
+    /** 403: a grant naming yourself on an application you do not own outright. */
+    readonly selfGrantForbidden: "SELF_GRANT_FORBIDDEN";
+    /** 422: the key is not a live declared permission of this application. */
+    readonly unknownPermission: "UNKNOWN_PERMISSION";
+    /** 422: the grantee is not a person (an organization, project, bot or channel). */
+    readonly granteeNotAPerson: "GRANTEE_NOT_A_PERSON";
+    /** 409: the grantee already holds the key; `details.grantId` names the live grant. */
+    readonly alreadyGranted: "ALREADY_GRANTED";
+    /** 409: the grant was already revoked. */
+    readonly alreadyRevoked: "ALREADY_REVOKED";
+    /** 403: the bearer's session belongs to a DIFFERENT application. */
+    readonly sessionApplicationMismatch: "SESSION_APPLICATION_MISMATCH";
+};
+export type ApplicationRoleErrorCode = (typeof APPLICATION_ROLE_ERROR_CODES)[keyof typeof APPLICATION_ROLE_ERROR_CODES];
+/** Whether `value` is a well-formed application permission key. */
+export declare function isApplicationPermissionKey(value: unknown): value is string;
+export declare const applicationPermissionKeySchema: z.ZodString;
+/** One key as the application's owners declare it. */
+export declare const applicationPermissionDeclarationSchema: z.ZodObject<{
+    key: z.ZodString;
+    description: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    description: string;
+    key: string;
+}, {
+    description: string;
+    key: string;
+}>;
+/**
+ * `PUT /applications/:appId/roles/permissions` — the WHOLE vocabulary.
+ *
+ * Declarative: a key present here and not live is added, a live key absent
+ * here is retired (and every grant of it revoked), a live key present here
+ * keeps its identity and takes the new description. Sending the same body twice
+ * changes nothing.
+ */
+export declare const declareApplicationPermissionsRequestSchema: z.ZodEffects<z.ZodObject<{
+    permissions: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        description: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        description: string;
+        key: string;
+    }, {
+        description: string;
+        key: string;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    permissions: {
+        description: string;
+        key: string;
+    }[];
+}, {
+    permissions: {
+        description: string;
+        key: string;
+    }[];
+}>, {
+    permissions: {
+        description: string;
+        key: string;
+    }[];
+}, {
+    permissions: {
+        description: string;
+        key: string;
+    }[];
+}>;
+/** A declared key. Retired keys are history: they confer nothing. */
+export declare const applicationPermissionSchema: z.ZodObject<{
+    key: z.ZodString;
+    description: z.ZodString;
+    declaredAt: z.ZodString;
+    declaredByUserId: z.ZodNullable<z.ZodString>;
+    retiredAt: z.ZodNullable<z.ZodString>;
+    retiredByUserId: z.ZodNullable<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    description: string;
+    key: string;
+    declaredAt: string;
+    declaredByUserId: string | null;
+    retiredAt: string | null;
+    retiredByUserId: string | null;
+}, {
+    description: string;
+    key: string;
+    declaredAt: string;
+    declaredByUserId: string | null;
+    retiredAt: string | null;
+    retiredByUserId: string | null;
+}>;
+export declare const applicationPermissionListSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        description: z.ZodString;
+        declaredAt: z.ZodString;
+        declaredByUserId: z.ZodNullable<z.ZodString>;
+        retiredAt: z.ZodNullable<z.ZodString>;
+        retiredByUserId: z.ZodNullable<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        description: string;
+        key: string;
+        declaredAt: string;
+        declaredByUserId: string | null;
+        retiredAt: string | null;
+        retiredByUserId: string | null;
+    }, {
+        description: string;
+        key: string;
+        declaredAt: string;
+        declaredByUserId: string | null;
+        retiredAt: string | null;
+        retiredByUserId: string | null;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    items: {
+        description: string;
+        key: string;
+        declaredAt: string;
+        declaredByUserId: string | null;
+        retiredAt: string | null;
+        retiredByUserId: string | null;
+    }[];
+}, {
+    items: {
+        description: string;
+        key: string;
+        declaredAt: string;
+        declaredByUserId: string | null;
+        retiredAt: string | null;
+        retiredByUserId: string | null;
+    }[];
+}>;
+export declare const declareApplicationPermissionsResponseSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        description: z.ZodString;
+        declaredAt: z.ZodString;
+        declaredByUserId: z.ZodNullable<z.ZodString>;
+        retiredAt: z.ZodNullable<z.ZodString>;
+        retiredByUserId: z.ZodNullable<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        description: string;
+        key: string;
+        declaredAt: string;
+        declaredByUserId: string | null;
+        retiredAt: string | null;
+        retiredByUserId: string | null;
+    }, {
+        description: string;
+        key: string;
+        declaredAt: string;
+        declaredByUserId: string | null;
+        retiredAt: string | null;
+        retiredByUserId: string | null;
+    }>, "many">;
+} & {
+    /** Keys that became live with this declaration. */
+    added: z.ZodArray<z.ZodString, "many">;
+    /** Keys this declaration retired. */
+    retired: z.ZodArray<z.ZodString, "many">;
+    /** Live keys whose description changed. */
+    described: z.ZodArray<z.ZodString, "many">;
+    /** Live grants revoked because their key was retired. */
+    revokedGrants: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    items: {
+        description: string;
+        key: string;
+        declaredAt: string;
+        declaredByUserId: string | null;
+        retiredAt: string | null;
+        retiredByUserId: string | null;
+    }[];
+    added: string[];
+    retired: string[];
+    described: string[];
+    revokedGrants: number;
+}, {
+    items: {
+        description: string;
+        key: string;
+        declaredAt: string;
+        declaredByUserId: string | null;
+        retiredAt: string | null;
+        retiredByUserId: string | null;
+    }[];
+    added: string[];
+    retired: string[];
+    described: string[];
+    revokedGrants: number;
+}>;
+/** One grant of one key to one Oxy user. Revocation is a stamp, never a delete. */
+export declare const applicationRoleGrantSchema: z.ZodObject<{
+    id: z.ZodString;
+    applicationId: z.ZodString;
+    permission: z.ZodString;
+    userId: z.ZodString;
+    /** The grantee's handle, for display. */
+    username: z.ZodNullable<z.ZodString>;
+    /** The HUMAN who granted it; null once that account was erased. */
+    grantedByUserId: z.ZodNullable<z.ZodString>;
+    grantedAt: z.ZodString;
+    grantReason: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+    revokedByUserId: z.ZodNullable<z.ZodString>;
+    revokeReason: z.ZodNullable<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    username: string | null;
+    id: string;
+    applicationId: string;
+    revokedAt: string | null;
+    userId: string;
+    permission: string;
+    grantedByUserId: string | null;
+    grantedAt: string;
+    grantReason: string | null;
+    revokedByUserId: string | null;
+    revokeReason: string | null;
+}, {
+    username: string | null;
+    id: string;
+    applicationId: string;
+    revokedAt: string | null;
+    userId: string;
+    permission: string;
+    grantedByUserId: string | null;
+    grantedAt: string;
+    grantReason: string | null;
+    revokedByUserId: string | null;
+    revokeReason: string | null;
+}>;
+export declare const applicationRoleGrantListSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        applicationId: z.ZodString;
+        permission: z.ZodString;
+        userId: z.ZodString;
+        /** The grantee's handle, for display. */
+        username: z.ZodNullable<z.ZodString>;
+        /** The HUMAN who granted it; null once that account was erased. */
+        grantedByUserId: z.ZodNullable<z.ZodString>;
+        grantedAt: z.ZodString;
+        grantReason: z.ZodNullable<z.ZodString>;
+        revokedAt: z.ZodNullable<z.ZodString>;
+        revokedByUserId: z.ZodNullable<z.ZodString>;
+        revokeReason: z.ZodNullable<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        username: string | null;
+        id: string;
+        applicationId: string;
+        revokedAt: string | null;
+        userId: string;
+        permission: string;
+        grantedByUserId: string | null;
+        grantedAt: string;
+        grantReason: string | null;
+        revokedByUserId: string | null;
+        revokeReason: string | null;
+    }, {
+        username: string | null;
+        id: string;
+        applicationId: string;
+        revokedAt: string | null;
+        userId: string;
+        permission: string;
+        grantedByUserId: string | null;
+        grantedAt: string;
+        grantReason: string | null;
+        revokedByUserId: string | null;
+        revokeReason: string | null;
+    }>, "many">;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    items: {
+        username: string | null;
+        id: string;
+        applicationId: string;
+        revokedAt: string | null;
+        userId: string;
+        permission: string;
+        grantedByUserId: string | null;
+        grantedAt: string;
+        grantReason: string | null;
+        revokedByUserId: string | null;
+        revokeReason: string | null;
+    }[];
+    nextCursor: string | null;
+}, {
+    items: {
+        username: string | null;
+        id: string;
+        applicationId: string;
+        revokedAt: string | null;
+        userId: string;
+        permission: string;
+        grantedByUserId: string | null;
+        grantedAt: string;
+        grantReason: string | null;
+        revokedByUserId: string | null;
+        revokeReason: string | null;
+    }[];
+    nextCursor: string | null;
+}>;
+/** `POST /applications/:appId/roles/grants` — name the grantee by id OR handle. */
+export declare const createApplicationRoleGrantRequestSchema: z.ZodEffects<z.ZodObject<{
+    userId: z.ZodOptional<z.ZodString>;
+    username: z.ZodOptional<z.ZodString>;
+    permission: z.ZodString;
+    reason: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+}, "strict", z.ZodTypeAny, {
+    permission: string;
+    username?: string | undefined;
+    reason?: string | undefined;
+    userId?: string | undefined;
+}, {
+    permission: string;
+    username?: string | undefined;
+    reason?: string | undefined;
+    userId?: string | undefined;
+}>, {
+    permission: string;
+    username?: string | undefined;
+    reason?: string | undefined;
+    userId?: string | undefined;
+}, {
+    permission: string;
+    username?: string | undefined;
+    reason?: string | undefined;
+    userId?: string | undefined;
+}>;
+/** `POST /applications/:appId/roles/grants/:grantId/revoke`. */
+export declare const revokeApplicationRoleGrantRequestSchema: z.ZodObject<{
+    reason: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+}, "strict", z.ZodTypeAny, {
+    reason?: string | undefined;
+}, {
+    reason?: string | undefined;
+}>;
+/** `GET /applications/:appId/roles/grants` query. */
+export declare const listApplicationRoleGrantsQuerySchema: z.ZodObject<{
+    permission: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodString>;
+    includeRevoked: z.ZodOptional<z.ZodEffects<z.ZodEnum<["true", "false"]>, boolean, "true" | "false">>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    limit?: number | undefined;
+    cursor?: string | undefined;
+    userId?: string | undefined;
+    permission?: string | undefined;
+    includeRevoked?: boolean | undefined;
+}, {
+    limit?: number | undefined;
+    cursor?: string | undefined;
+    userId?: string | undefined;
+    permission?: string | undefined;
+    includeRevoked?: "true" | "false" | undefined;
+}>;
+/**
+ * `GET /applications/:appId/roles/me` — the keys the HUMAN behind the bearer
+ * holds for this application, in no particular order. `userId` is that human
+ * (the operator), which is NOT the account the session speaks as when a person
+ * is acting as an organization.
+ */
+export declare const applicationRolesMeSchema: z.ZodObject<{
+    applicationId: z.ZodString;
+    userId: z.ZodString;
+    permissions: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    permissions: string[];
+    applicationId: string;
+    userId: string;
+}, {
+    permissions: string[];
+    applicationId: string;
+    userId: string;
+}>;
+export type ApplicationPermissionDeclaration = z.infer<typeof applicationPermissionDeclarationSchema>;
+export type DeclareApplicationPermissionsRequest = z.infer<typeof declareApplicationPermissionsRequestSchema>;
+export type ApplicationPermissionDefinition = z.infer<typeof applicationPermissionSchema>;
+export type ApplicationPermissionList = z.infer<typeof applicationPermissionListSchema>;
+export type DeclareApplicationPermissionsResponse = z.infer<typeof declareApplicationPermissionsResponseSchema>;
+export type ApplicationRoleGrant = z.infer<typeof applicationRoleGrantSchema>;
+export type ApplicationRoleGrantList = z.infer<typeof applicationRoleGrantListSchema>;
+export type CreateApplicationRoleGrantRequest = z.infer<typeof createApplicationRoleGrantRequestSchema>;
+export type RevokeApplicationRoleGrantRequest = z.infer<typeof revokeApplicationRoleGrantRequestSchema>;
+export type ListApplicationRoleGrantsQuery = z.infer<typeof listApplicationRoleGrantsQuerySchema>;
+export type ApplicationRolesMe = z.infer<typeof applicationRolesMeSchema>;

package/dist/types/client/accountEmail.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Account-email constants and response checks, without Zod. Schemas: `../accountEmail.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import type { EmailVerificationConfirmResponse, EmailVerificationStartResponse } from '../accountEmail';
+/**
+ * - `signup`: above.
+ * - `signin`: the code (and link) of an email sign-in (`POST /auth/signin/email/start`).
+ * - `reauth`: a signed-in person proving it is them before a sensitive step
+ *   (`POST /users/me/reauth/email`): a password, an authenticator, deleting the
+ *   account, linking Commons.
+ */
+export declare const EMAIL_VERIFICATION_PURPOSES: readonly ["signup", "signin", "reauth"];
+export type EmailVerificationPurpose = (typeof EMAIL_VERIFICATION_PURPOSES)[number];
+/** Digits in a code. */
+export declare const EMAIL_CODE_LENGTH = 6;
+/** How long a code can be confirmed. */
+export declare const EMAIL_CODE_TTL_MS: number;
+/** Wrong codes before a verification is spent and a new code is needed. */
+export declare const EMAIL_CODE_MAX_ATTEMPTS = 5;
+/** How long a confirmed code's ticket can be spent. */
+export declare const EMAIL_TICKET_TTL_MS: number;
+/**
+ * Stable error codes (`error.code` in the API error body). Clients map these
+ * through their localization, never the English message.
+ */
+export declare const EMAIL_VERIFICATION_ERROR_CODES: {
+    /** The code is wrong, or its verification expired or was spent. */
+    readonly codeInvalid: "EMAIL_CODE_INVALID";
+    /** Too many wrong codes: request a new one. */
+    readonly tooManyAttempts: "EMAIL_CODE_TOO_MANY_ATTEMPTS";
+    /** The ticket is unknown, expired, spent, or for another email or purpose. */
+    readonly ticketInvalid: "EMAIL_TICKET_INVALID";
+    /** A sign-up without a confirmed email. */
+    readonly ticketRequired: "EMAIL_TICKET_REQUIRED";
+    /** This server cannot send mail. */
+    readonly unavailable: "EMAIL_UNAVAILABLE";
+};
+export type EmailVerificationErrorCode = (typeof EMAIL_VERIFICATION_ERROR_CODES)[keyof typeof EMAIL_VERIFICATION_ERROR_CODES];
+export declare const emailAddressCheck: import("./check").Check<string>;
+export declare const emailTicketCheck: import("./check").Check<string>;
+export declare const emailVerificationStartResponseCheck: import("./check").Check<EmailVerificationStartResponse>;
+export declare const emailVerificationConfirmResponseCheck: import("./check").Check<EmailVerificationConfirmResponse>;