@oxy.so/contracts 4.22.0 → 4.24.0

package/dist/cjs/userResponse.js

@@ -246,6 +246,10 @@ exports.userResponseSchema = zod_1.z
      * so it is present on the current-user DTO (`GET /users/me`,
      * `GET /session/user/:sessionId`) and absent until the user sets it.
      */
+    userPreferences: zod_1.z
+        .object({ displayCurrency: zod_1.z.enum(['USD', 'EUR', 'FAIR']).optional() })
+        .catchall(zod_1.z.unknown())
+        .optional(),
     themePreference: exports.themePreferenceSchema.optional(),
     personalization: zod_1.z
         .object({
@@ -306,7 +310,10 @@ exports.userProfileUpdateSchema = zod_1.z
     languages: zod_1.z.array(zod_1.z.string()).optional(),
     accountExpiresAfterInactivityDays: zod_1.z.number().nullable().optional(),
     notificationPreferences: zod_1.z.record(zod_1.z.unknown()).optional(),
-    userPreferences: zod_1.z.record(zod_1.z.unknown()).optional(),
+    userPreferences: zod_1.z
+        .object({ displayCurrency: zod_1.z.enum(['USD', 'EUR', 'FAIR']).optional() })
+        .catchall(zod_1.z.unknown())
+        .optional(),
     privacySettings: zod_1.z.record(zod_1.z.unknown()).optional(),
     /**
      * Portable theme preference. Written through the same `PUT /users/me`

package/dist/esm/agency.js

@@ -169,6 +169,38 @@ export const agentRequesterCeilingSchema = agentRequesterCeilingWriteSchema
     updatedAt: z.string().datetime(),
 })
     .strict();
+/**
+ * Where an application's own agent opens (ADR 0044): `anywhere`, or only in
+ * sessions that belong to that application (`own_application`). An agent with
+ * no application row is available anywhere.
+ */
+export const APPLICATION_AGENT_AVAILABILITIES = ['anywhere', 'own_application'];
+export const applicationAgentAvailabilitySchema = z.enum(APPLICATION_AGENT_AVAILABILITIES);
+/** What Oxy staff write for one of an application's agents. */
+export const applicationAgentWriteSchema = z
+    .object({ availability: applicationAgentAvailabilitySchema })
+    .strict();
+/** One row of the application registry's agents: an agent is one application's. */
+export const applicationAgentSchema = applicationAgentWriteSchema
+    .extend({
+    applicationId: identifierSchema,
+    agentAccountId: identifierSchema,
+    createdByUserId: identifierSchema.nullable(),
+    createdAt: z.string().datetime(),
+    updatedAt: z.string().datetime(),
+})
+    .strict();
+/**
+ * `GET /capabilities/agent-availability/:agentAccountId`: the sessions an agent
+ * is reachable from. `anywhere: false` lists the applications whose sessions
+ * (the session validation answer's `applicationId`) may reach it.
+ */
+export const agentAvailabilitySchema = z.discriminatedUnion('anywhere', [
+    z.object({ anywhere: z.literal(true) }).strict(),
+    z
+        .object({ anywhere: z.literal(false), applicationIds: z.array(identifierSchema).min(1) })
+        .strict(),
+]);
 export const automationTriggerSchema = z.discriminatedUnion('type', [
     z.object({ type: z.literal('manual') }).strict(),
     z

package/dist/esm/appAssertions.js

@@ -0,0 +1,191 @@
+/**
+ * App assertions (ADR 0045): how an Oxy app proves which app it is.
+ *
+ * ## The registry
+ *
+ * Each application may declare how it is recognised, written only by Oxy staff
+ * through the application administration lane
+ * (`PUT /applications/:appId/recognition`): its exact `https://` web origins,
+ * its Android package and signing certificates, and its iOS team and bundle.
+ * A platform it does not declare can never assert it.
+ *
+ * ## The exchange
+ *
+ * With the person's own bearer, the app asks `POST /apps/assertions` for an
+ * `OXY-APP+JWT` naming the application, and proves itself by platform: on the
+ * web the browser's `Origin`; on Android a Play Integrity token whose request
+ * hash is a challenge from `POST /apps/assertions/challenge`; on iOS an App
+ * Attest assertion over such a challenge, made with a key registered through
+ * `POST /apps/attest-keys`. The assertion lives five minutes and names the
+ * person (`sub`) and the session (`sid`) it was issued to.
+ *
+ * The Zod-free half (vocabularies, header name, response checks) is
+ * `./client/appAssertions.ts`.
+ */
+import { z } from 'zod';
+import { APP_ASSERTION_CHALLENGE_PURPOSES, APP_ASSERTION_ERROR_CODES, APP_ASSERTION_PLATFORMS, OXY_APP_ASSERTION_AUDIENCE, OXY_APP_ASSERTION_HEADER, OXY_APP_ASSERTION_TTL_SECONDS, OXY_APP_ASSERTION_TYPE, } from './client/appAssertions.js';
+export { APP_ASSERTION_CHALLENGE_PURPOSES, APP_ASSERTION_ERROR_CODES, APP_ASSERTION_PLATFORMS, OXY_APP_ASSERTION_AUDIENCE, OXY_APP_ASSERTION_HEADER, OXY_APP_ASSERTION_TTL_SECONDS, OXY_APP_ASSERTION_TYPE, };
+const applicationIdSchema = z.string().trim().min(1).max(255);
+const base64Url32Schema = z.string().regex(/^[A-Za-z0-9_-]{43}$/);
+const base64Schema = (max) => z
+    .string()
+    .min(4)
+    .max(max)
+    .regex(/^[A-Za-z0-9+/]+={0,2}$/);
+export const appAssertionPlatformSchema = z.enum(APP_ASSERTION_PLATFORMS);
+export const appAssertionErrorCodeSchema = z.enum(APP_ASSERTION_ERROR_CODES);
+// ---------------------------------------------------------------------------
+// Registry
+// ---------------------------------------------------------------------------
+/** True for an exact origin: `https:`, no path, query, fragment or credentials, in canonical form. */
+export function isExactHttpsOrigin(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' && url.origin === value;
+    }
+    catch {
+        return false;
+    }
+}
+/** An exact `https://` origin, in the form a browser sends in `Origin` (`https://mention.earth`). */
+export const applicationWebOriginSchema = z
+    .string()
+    .max(255)
+    .refine(isExactHttpsOrigin, 'Must be an exact https origin, as a browser sends it');
+/** A Java-style Android application id, at least two segments. */
+export const androidPackageNameSchema = z
+    .string()
+    .max(255)
+    .regex(/^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/, 'Must be an Android package name');
+/** A signing certificate's SHA-256, 64 lowercase hex characters (keytool's digest without colons). */
+export const signingCertSha256Schema = z
+    .string()
+    .regex(/^[0-9a-f]{64}$/, 'Must be 64 lowercase hex characters');
+/** An Apple Developer team id. */
+export const appleTeamIdSchema = z.string().regex(/^[A-Z0-9]{10}$/, 'Must be an Apple team id');
+/** An Apple bundle id. */
+export const appleBundleIdSchema = z
+    .string()
+    .max(255)
+    .regex(/^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/, 'Must be an Apple bundle id');
+const unique = (values) => new Set(values).size === values.length;
+export const applicationAndroidRecognitionSchema = z
+    .object({
+    packageName: androidPackageNameSchema,
+    signingCertSha256: z
+        .array(signingCertSha256Schema)
+        .min(1)
+        .max(10)
+        .refine(unique, 'Certificates must be unique'),
+})
+    .strict();
+export const applicationIosRecognitionSchema = z
+    .object({ teamId: appleTeamIdSchema, bundleId: appleBundleIdSchema })
+    .strict();
+/**
+ * What Oxy staff write for an application: the whole declaration, replaced at
+ * once. `null` and `[]` declare nothing for that platform.
+ */
+export const applicationRecognitionWriteSchema = z
+    .object({
+    webOrigins: z
+        .array(applicationWebOriginSchema)
+        .max(20)
+        .refine(unique, 'Origins must be unique'),
+    android: applicationAndroidRecognitionSchema.nullable(),
+    ios: applicationIosRecognitionSchema.nullable(),
+})
+    .strict();
+/** An application's recognition as the registry holds it; `updatedAt` is `null` when none was written. */
+export const applicationRecognitionSchema = applicationRecognitionWriteSchema
+    .extend({
+    applicationId: applicationIdSchema,
+    updatedAt: z.string().datetime().nullable(),
+})
+    .strict();
+// ---------------------------------------------------------------------------
+// The exchange
+// ---------------------------------------------------------------------------
+/** `POST /apps/assertions/challenge`: a single-use challenge for a device proof. */
+export const appAssertionChallengeRequestSchema = z.discriminatedUnion('platform', [
+    z.object({ applicationId: applicationIdSchema, platform: z.literal('android') }).strict(),
+    z
+        .object({
+        applicationId: applicationIdSchema,
+        platform: z.literal('ios'),
+        purpose: z.enum(APP_ASSERTION_CHALLENGE_PURPOSES),
+    })
+        .strict(),
+]);
+/**
+ * The challenge, and `requestHash`: what the device signs or hands to Play
+ * Integrity, binding the challenge to this application, platform, purpose and
+ * session. `cloudProjectNumber` is the Google Cloud project Play Integrity
+ * tokens are requested for (Android only).
+ */
+export const appAssertionChallengeResponseSchema = z
+    .object({
+    challenge: base64Url32Schema,
+    requestHash: base64Url32Schema,
+    expiresAt: z.string().datetime(),
+    cloudProjectNumber: z
+        .string()
+        .regex(/^[0-9]{1,20}$/)
+        .optional(),
+})
+    .strict();
+/** An App Attest key id: the standard base64 of the SHA-256 of the key. */
+export const appAttestKeyIdSchema = z.string().regex(/^[A-Za-z0-9+/]{43}=$/);
+/** `POST /apps/attest-keys`: register an App Attest key, attested over a `attest_key` challenge. */
+export const appAttestKeyRequestSchema = z
+    .object({
+    applicationId: applicationIdSchema,
+    keyId: appAttestKeyIdSchema,
+    challenge: base64Url32Schema,
+    attestation: base64Schema(32768),
+})
+    .strict();
+export const appAttestKeyResponseSchema = z.object({ keyId: appAttestKeyIdSchema }).strict();
+/**
+ * `POST /apps/assertions`. The body names the application and the platform;
+ * the proof is the platform's: none on the web (the browser's `Origin` is), a
+ * Play Integrity token on Android, an App Attest assertion on iOS, each over a
+ * challenge minted for `assertion`.
+ */
+export const appAssertionRequestSchema = z.discriminatedUnion('platform', [
+    z.object({ applicationId: applicationIdSchema, platform: z.literal('web') }).strict(),
+    z
+        .object({
+        applicationId: applicationIdSchema,
+        platform: z.literal('android'),
+        proof: z
+            .object({
+            challenge: base64Url32Schema,
+            integrityToken: z.string().min(1).max(16384),
+        })
+            .strict(),
+    })
+        .strict(),
+    z
+        .object({
+        applicationId: applicationIdSchema,
+        platform: z.literal('ios'),
+        proof: z
+            .object({
+            challenge: base64Url32Schema,
+            keyId: appAttestKeyIdSchema,
+            assertion: base64Schema(4096),
+        })
+            .strict(),
+    })
+        .strict(),
+]);
+/** The assertion, and what it says. Send it as {@link OXY_APP_ASSERTION_HEADER}. */
+export const appAssertionResponseSchema = z
+    .object({
+    assertion: z.string().regex(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/),
+    applicationId: z.string().regex(/^\S{1,255}$/),
+    platform: appAssertionPlatformSchema,
+    expiresAt: z.string().datetime(),
+})
+    .strict();

package/dist/esm/client/appAssertions.js

@@ -0,0 +1,77 @@
+/**
+ * App assertions (ADR 0045), without Zod. Schemas: `../appAssertions.ts`.
+ *
+ * An Oxy app proves which app it is by trading platform evidence (the browser's
+ * `Origin`, a Play Integrity verdict, an App Attest assertion) for a short-lived
+ * `OXY-APP+JWT` signed by Oxy. A service that needs to know the app reads it
+ * from {@link OXY_APP_ASSERTION_HEADER} and verifies it against Oxy's JWKS
+ * (`verifyAppAssertion` in `@oxy.so/core/server`).
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { datetime, exact, oneOf, optional, pattern, strictObject, string } from './check.js';
+/** How an app proves itself: the browser's origin, Play Integrity, or App Attest. */
+export const APP_ASSERTION_PLATFORMS = ['web', 'android', 'ios'];
+/**
+ * What a device challenge is spent on: an assertion, or (iOS only) registering
+ * an App Attest key. A challenge minted for one is refused for the other.
+ */
+export const APP_ASSERTION_CHALLENGE_PURPOSES = ['assertion', 'attest_key'];
+/** The JOSE `typ` of an app assertion. No other Oxy token carries it. */
+export const OXY_APP_ASSERTION_TYPE = 'OXY-APP+JWT';
+/** The `aud` of every app assertion. */
+export const OXY_APP_ASSERTION_AUDIENCE = 'oxy-apps';
+/** The request header an app (or an SDK acting for it) sends the assertion in. */
+export const OXY_APP_ASSERTION_HEADER = 'X-Oxy-App-Assertion';
+/** Oxy signs an app assertion for exactly this long. */
+export const OXY_APP_ASSERTION_TTL_SECONDS = 300;
+/**
+ * Why Oxy refused an app assertion, a challenge or an App Attest key. The API
+ * answers `{ error: <code>, message }`.
+ *
+ * - `application_unavailable`: no active application has that id.
+ * - `session_other_application`: the bearer's session belongs to another application.
+ * - `platform_not_registered`: the application declares no recognition for that platform.
+ * - `origin_not_registered`: the request's `Origin` is not one of the application's web origins.
+ * - `challenge_invalid`: the challenge is unknown, used, expired, or minted for something else.
+ * - `integrity_refused`: the Play Integrity verdict does not name this app, a registered
+ *   certificate, a Play-recognised install and this challenge.
+ * - `integrity_unconfigured` / `integrity_unavailable`: Oxy cannot ask Google (503).
+ * - `attest_key_unknown`: no App Attest key with that id is registered for the app; attest a new one.
+ * - `attest_key_exists`: that App Attest key is already registered.
+ * - `attestation_invalid`: the App Attest attestation does not verify.
+ * - `assertion_invalid`: the App Attest assertion does not verify, or its counter did not advance.
+ * - `signing_unavailable`: Oxy cannot sign (503).
+ */
+export const APP_ASSERTION_ERROR_CODES = [
+    'application_unavailable',
+    'session_other_application',
+    'platform_not_registered',
+    'origin_not_registered',
+    'challenge_invalid',
+    'integrity_refused',
+    'integrity_unconfigured',
+    'integrity_unavailable',
+    'attest_key_unknown',
+    'attest_key_exists',
+    'attestation_invalid',
+    'assertion_invalid',
+    'signing_unavailable',
+];
+/** 32 random bytes, base64url: a challenge, or the SHA-256 it is bound into. */
+const BASE64URL_32 = /^[A-Za-z0-9_-]{43}$/;
+/** An App Attest key id: the standard base64 of a SHA-256. */
+const APP_ATTEST_KEY_ID = /^[A-Za-z0-9+/]{43}=$/;
+export const appAssertionChallengeResponseCheck = exact()(strictObject({
+    challenge: string(pattern(BASE64URL_32)),
+    requestHash: string(pattern(BASE64URL_32)),
+    expiresAt: string(datetime),
+    cloudProjectNumber: optional(string(pattern(/^[0-9]{1,20}$/))),
+}));
+export const appAttestKeyResponseCheck = exact()(strictObject({ keyId: string(pattern(APP_ATTEST_KEY_ID)) }));
+export const appAssertionResponseCheck = exact()(strictObject({
+    assertion: string(pattern(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/)),
+    applicationId: string(pattern(/^\S{1,255}$/)),
+    platform: oneOf(APP_ASSERTION_PLATFORMS),
+    expiresAt: string(datetime),
+}));

package/dist/esm/client/index.js

@@ -27,7 +27,7 @@ export { SESSION_ACCOUNTS_CHANGED_EVENT, activeTokenCheck, deviceBackgroundCrede
 export { IDENTITY_LINK_QR_PREFIX, IDENTITY_LINK_STATUSES, buildIdentityLinkQrPayload, identityLinkCreateResponseCheck, identityLinkStateCheck, parseIdentityLinkQrPayload, } from './identityLink.js';
 export { IDENTITY_ERROR_CODES, IDENTITY_PROOF_ACTIONS, IDENTITY_PROOF_ACTION_VALUES, IDENTITY_PROOF_AUDIENCE, IDENTITY_PROOF_CHALLENGE_TTL_MS, IDENTITY_PROOF_DOMAIN, IDENTITY_PROOF_VERSION, buildIdentityProofMessage, canonicalJson, } from './identityProof.js';
 export { ORGANIZATION_ALIAS_KINDS, ORGANIZATION_CLAIM_DECISIONS, ORGANIZATION_CLAIM_STATUSES, ORGANIZATION_ERROR_CODES, ORGANIZATION_NAME_MAX_LENGTH, ORGANIZATION_STATUSES, ORGANIZATION_TYPES, createOrganizationCheck, organizationBatchCheck, organizationCheck, organizationClaimCheck, organizationClaimDetailCheck, organizationClaimInputCheck, organizationClaimListCheck, organizationClaimReviewCheck, organizationCurationResultCheck, organizationExternalCheck, organizationExternalResolutionCheck, organizationImportBatchResultCheck, organizationListCheck, organizationNameCheck, updateOrganizationCheck, } from './organizations.js';
-export { cancelProductSubscriptionCheck, personalPlanCatalogueCheck, personalPlanCheckoutRequestCheck, personalPlanCheckoutResultCheck, productSubscriptionCancellationResultCheck, productSubscriptionsResponseCheck, subjectProductAccessCheck, subjectProductAccessQueryCheck, subscriptionCreditGrantsResponseCheck, } from './products.js';
+export { cancelProductSubscriptionCheck, personalPlanCatalogueCheck, personalPlanCheckoutRequestCheck, personalPlanCheckoutResultCheck, productPlanCatalogueCheck, productPlanCheckoutRequestCheck, productSubscriptionCancellationResultCheck, productSubscriptionRenewalRequestCheck, productSubscriptionsResponseCheck, subjectProductAccessCheck, subjectProductAccessQueryCheck, subscriptionCreditGrantsResponseCheck, } from './products.js';
 export { recommendationRequestCheck } from './recommendations.js';
 export { isFullReputationBalance } from './reputation.js';
 export { PURCHASE_APPROVAL_STATUSES, SAFETY_POLICY_VERSION, SUPERVISED_ACTIONS, SUPERVISION_CONSENT_VERSION, SUPERVISION_INVITATION_STATUSES, SUPERVISION_STATUSES, profileAccessDecisionCheck, profileAccessInputCheck, purchaseApprovalCheck, purchaseApprovalListCheck, purchaseReviewInputCheck, safetyOrganizationsInputCheck, safetyOrganizationsResponseCheck, safetyPeopleInputCheck, safetyPeopleResponseCheck, supervisionAcceptInputCheck, supervisionContactInputCheck, supervisionContactsResponseCheck, supervisionInvitationCheck, supervisionInviteInputCheck, supervisionReviewInputCheck, supervisionStateCheck, } from './safety.js';
@@ -36,3 +36,4 @@ export { EMAIL_ACCOUNTS_MAX, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_SIGNIN_LINK_TTL_M
 export { BOT_USERNAME_INVALID_MESSAGE, BOT_USERNAME_SUFFIX, NUMERIC_USERNAME_MESSAGE, RESERVED_USERNAMES, RESERVED_USERNAME_MESSAGE, USERNAME_INVALID_MESSAGE, USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, USERNAME_PATTERN_SOURCE, applyBotUsernameSuffix, botUsernameCheck, stripDisallowedUsernameCharacters, usernameCheck, usernameCheckForAccountKind, } from './username.js';
 export { userNameCheck } from './userResponse.js';
 export { CLAIMANT_RELATIONSHIPS, CLOSED_CONTENT_CLAIM_STATES, CONTENT_CLAIM_COUNTER_NOTICE_LIMITS, CONTENT_CLAIM_ERROR_CODES, CONTENT_CLAIM_KINDS, CONTENT_CLAIM_LIMITS, CONTENT_CLAIM_REFERENCE_PATTERN, CONTENT_CLAIM_STATES, COUNTER_NOTICE_STATEMENT_VERSION, COUNTER_NOTICE_STATEMENTS, ERASURE_REQUEST_DEADLINE_DAYS, OPEN_CONTENT_CLAIM_STATES, isErasureRequest, isRightsClaim, } from './contentClaims.js';
+export { APP_ASSERTION_CHALLENGE_PURPOSES, APP_ASSERTION_ERROR_CODES, APP_ASSERTION_PLATFORMS, OXY_APP_ASSERTION_AUDIENCE, OXY_APP_ASSERTION_HEADER, OXY_APP_ASSERTION_TTL_SECONDS, OXY_APP_ASSERTION_TYPE, appAssertionChallengeResponseCheck, appAssertionResponseCheck, appAttestKeyResponseCheck, } from './appAssertions.js';

package/dist/esm/client/products.js

@@ -13,6 +13,15 @@ const oxyAccountId = branded(string(minLength(1), maxLength(64)));
 const actionKey = string(minLength(8), maxLength(160), pattern(/^[a-zA-Z0-9_-]+$/));
 const combination = oneOf(['maximum', 'sum', 'exclusive']);
 const origin = oneOf(['individual', 'bundle']);
+const purchase = oneOf(['unavailable', 'available']);
+const displayPrice = (interval) => strictObject({
+    currency: string(pattern(/^[A-Z]{3}$/)),
+    amountMinorUnits: version,
+    interval,
+    trial: literal('none'),
+    taxTreatment: literal('inclusive'),
+    merchantTotal: literal('final'),
+});
 const period = (message) => refine(strictObject({ start: string(datetime), end: string(datetime) }), (value) => Date.parse(value.end) > Date.parse(value.start), message);
 const productBenefit = discriminatedUnion('kind', {
     capability: strictObject({ kind: literal('capability'), productId: identifier, key: identifier }),
@@ -57,29 +66,41 @@ export const subjectProductAccessCheck = exact()(strictObject({
 export const personalPlanCatalogueCheck = exact()(refine(strictObject({
     schemaVersion: literal(1),
     state: oneOf(['unconfigured', 'configured']),
-    purchase: literal('unavailable'),
+    purchase,
     plans: array(strictObject({
         offerId: identifier,
         offerVersion: version,
         displayName,
         audience: literal('personal'),
         kind: literal('oxy_one'),
-        price: optional(strictObject({
-            currency: string(pattern(/^[A-Z]{3}$/)),
-            amountMinorUnits: version,
-            interval: literal('month'),
-            trial: literal('none'),
-            taxTreatment: literal('inclusive'),
-            merchantTotal: literal('final'),
-        })),
+        price: optional(displayPrice(literal('month'))),
         benefits: array(strictObject({ displayName, benefit: productBenefit })),
     })),
 }), (value) => (value.state === 'unconfigured') === (value.plans.length === 0), 'Catalogue state must match published plans'));
-export const personalPlanCheckoutRequestCheck = exact()(strictObject({
+export const productPlanCatalogueCheck = exact()(strictObject({
+    schemaVersion: literal(1),
+    productId: identifier,
+    purchase,
+    plans: array(strictObject({
+        productId: identifier,
+        offerId: identifier,
+        offerVersion: version,
+        displayName,
+        price: displayPrice(oneOf(['month', 'year'])),
+    })),
+}));
+const checkoutRequestShape = {
     expectedSubjectAccountId: oxyAccountId,
     offerId: identifier,
     offerVersion: version,
     idempotencyKey: actionKey,
+};
+export const personalPlanCheckoutRequestCheck = exact()(strictObject(checkoutRequestShape));
+export const productPlanCheckoutRequestCheck = exact()(strictObject({ ...checkoutRequestShape, productId: identifier }));
+export const productSubscriptionRenewalRequestCheck = exact()(strictObject({
+    expectedSubjectAccountId: oxyAccountId,
+    sourceId: identifier,
+    idempotencyKey: actionKey,
 }));
 export const personalPlanCheckoutResultCheck = exact()(discriminatedUnion('state', {
     unconfigured: strictObject({
@@ -111,6 +132,7 @@ export const productSubscriptionsResponseCheck = exact()(strictObject({
         period: billingPeriod,
         cancelAtPeriodEnd: boolean,
         canCancel: boolean,
+        canRenew: optional(boolean),
         offers: array(strictObject({
             segmentId: identifier,
             offerId: identifier,

package/dist/esm/index.js

@@ -180,7 +180,7 @@ PRODUCT_PLAN_STATUSES, productPlanStatusSchema, LIVE_PRODUCT_PLAN_STATUSES, plan
 export { 
 // Economic treatment (I09): derived by the server, never sent by a caller.
 INFERENCE_ECONOMIC_TREATMENTS, inferenceEconomicTreatmentSchema, PROVIDER_COST_SOURCES, providerCostSourceSchema, costCenterUsageSchema, } from './inference/economics.js';
-export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, executionActorRefSchema, foregroundExecutionAuthorizationInputSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, capabilityCatalogBindingSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, capabilityTicketRequestSchema, delegationGrantSchema, AGENT_REQUESTER_CEILING_AUTONOMY, agentRequesterCeilingWriteSchema, agentRequesterCeilingSchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, invocationPrincipalSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, catalogFeatureSchema, CATALOG_INTERNAL_TRANSPORTS, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency.js';
+export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, executionActorRefSchema, foregroundExecutionAuthorizationInputSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, capabilityCatalogBindingSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, capabilityTicketRequestSchema, delegationGrantSchema, AGENT_REQUESTER_CEILING_AUTONOMY, agentRequesterCeilingWriteSchema, agentRequesterCeilingSchema, APPLICATION_AGENT_AVAILABILITIES, applicationAgentAvailabilitySchema, applicationAgentWriteSchema, applicationAgentSchema, agentAvailabilitySchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, invocationPrincipalSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, catalogFeatureSchema, CATALOG_INTERNAL_TRANSPORTS, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency.js';
 export { catalogInvocationPathParameters, catalogInvocationsOverlap, catalogInvocationTemplatesEquivalent, findOverlappingCatalogInvocations, matchCatalogInvocation, resolveCatalogInvocation, } from './capabilityInvocation.js';
 export { emailContextAddressSchema, emailContextMailboxSchema, emailContextMessageSchema, emailAgentContextSchema, } from './emailAgentContext.js';
 export { inboxComposeRequestSchema, inboxDailyBriefRequestSchema, inboxDailyBriefResponseSchema, INBOX_DAILY_BRIEF_SECTIONS, inboxNaturalSearchRequestSchema, inboxMessageInferenceParamsSchema, inboxInferenceTextResponseSchema, inboxNaturalSearchResponseSchema, inboxSmartRepliesResponseSchema, inboxThreadSummaryResponseSchema, inboxInferenceStreamEventSchema, } from './inference/inbox.js';
@@ -201,10 +201,11 @@ export { meteredGenerationSchema } from './inference/economics.js';
 export { canonicalCapabilityJson, inputSatisfiesCapabilityLimits, isLoopbackOrigin, } from './capabilityBindings.js';
 export * from './agentKeys.js';
 export { productSubscriptionSummarySchema, productSubscriptionsResponseSchema, subscriptionCreditGrantSchema, subscriptionCreditGrantsResponseSchema, cancelProductSubscriptionSchema, productSubscriptionCancellationResultSchema, } from './products/billing.js';
-export { personalPlanDisplayPriceSchema, personalPlanCatalogueSchema, } from './products/plans.js';
+export { personalPlanDisplayPriceSchema, personalPlanCatalogueSchema, productPlanCatalogueSchema, } from './products/plans.js';
 export * from './products/checkout.js';
 export * from './organizations.js';
 export * from './safety.js';
 export { serviceTokenScopesSchema, serviceTokenOptionsSchema, } from './serviceToken.js';
 export * from './applicationRoles.js';
 export * from './contentClaims.js';
+export * from './appAssertions.js';

package/dist/esm/products/billing.js

@@ -24,6 +24,7 @@ export const productSubscriptionSummarySchema = z
     period,
     cancelAtPeriodEnd: z.boolean(),
     canCancel: z.boolean(),
+    canRenew: z.boolean().optional(),
     offers: z.array(z
         .object({
         segmentId: id,

package/dist/esm/products/checkout.js

@@ -30,3 +30,16 @@ export const personalPlanCheckoutResultSchema = z.discriminatedUnion('state', [
     z.object({ state: z.literal('closed'), intentId: z.string().min(1).max(160) }).strict(),
     z.object({ state: z.literal('fulfilled'), intentId: z.string().min(1).max(160) }).strict(),
 ]);
+/** Explicit individual product offer; still owned and paid through Oxy. */
+export const productPlanCheckoutRequestSchema = personalPlanCheckoutRequestSchema
+    .extend({
+    productId: z.string().min(1).max(160),
+})
+    .strict();
+export const productSubscriptionRenewalRequestSchema = z
+    .object({
+    expectedSubjectAccountId: oxyAccountIdSchema,
+    sourceId: z.string().min(1).max(160),
+    idempotencyKey: personalPlanCheckoutRequestSchema.shape.idempotencyKey,
+})
+    .strict();

package/dist/esm/products/plans.js

@@ -16,7 +16,7 @@ export const personalPlanCatalogueSchema = z
     .object({
     schemaVersion: z.literal(1),
     state: z.enum(['unconfigured', 'configured']),
-    purchase: z.literal('unavailable'),
+    purchase: z.enum(['unavailable', 'available']),
     plans: z.array(z
         .object({
         offerId: z.string().min(1).max(160),
@@ -33,3 +33,19 @@ export const personalPlanCatalogueSchema = z
 })
     .strict()
     .refine((value) => (value.state === 'unconfigured') === (value.plans.length === 0), 'Catalogue state must match published plans');
+export const productPlanCatalogueSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    productId: z.string().min(1).max(160),
+    purchase: z.enum(['unavailable', 'available']),
+    plans: z.array(z
+        .object({
+        productId: z.string().min(1).max(160),
+        offerId: z.string().min(1).max(160),
+        offerVersion: z.number().int().positive().safe(),
+        displayName: z.string().min(1).max(100),
+        price: personalPlanDisplayPriceSchema.extend({ interval: z.enum(['month', 'year']) }),
+    })
+        .strict()),
+})
+    .strict();

package/dist/esm/userResponse.js

@@ -241,6 +241,10 @@ export const userResponseSchema = z
      * so it is present on the current-user DTO (`GET /users/me`,
      * `GET /session/user/:sessionId`) and absent until the user sets it.
      */
+    userPreferences: z
+        .object({ displayCurrency: z.enum(['USD', 'EUR', 'FAIR']).optional() })
+        .catchall(z.unknown())
+        .optional(),
     themePreference: themePreferenceSchema.optional(),
     personalization: z
         .object({
@@ -301,7 +305,10 @@ export const userProfileUpdateSchema = z
     languages: z.array(z.string()).optional(),
     accountExpiresAfterInactivityDays: z.number().nullable().optional(),
     notificationPreferences: z.record(z.unknown()).optional(),
-    userPreferences: z.record(z.unknown()).optional(),
+    userPreferences: z
+        .object({ displayCurrency: z.enum(['USD', 'EUR', 'FAIR']).optional() })
+        .catchall(z.unknown())
+        .optional(),
     privacySettings: z.record(z.unknown()).optional(),
     /**
      * Portable theme preference. Written through the same `PUT /users/me`

package/dist/types/agency.d.ts

@@ -533,6 +533,66 @@ export declare const agentRequesterCeilingSchema: z.ZodObject<{
         key: string;
     }[] | undefined;
 }>;
+/**
+ * Where an application's own agent opens (ADR 0044): `anywhere`, or only in
+ * sessions that belong to that application (`own_application`). An agent with
+ * no application row is available anywhere.
+ */
+export declare const APPLICATION_AGENT_AVAILABILITIES: readonly ["anywhere", "own_application"];
+export declare const applicationAgentAvailabilitySchema: z.ZodEnum<["anywhere", "own_application"]>;
+/** What Oxy staff write for one of an application's agents. */
+export declare const applicationAgentWriteSchema: z.ZodObject<{
+    availability: z.ZodEnum<["anywhere", "own_application"]>;
+}, "strict", z.ZodTypeAny, {
+    availability: "anywhere" | "own_application";
+}, {
+    availability: "anywhere" | "own_application";
+}>;
+/** One row of the application registry's agents: an agent is one application's. */
+export declare const applicationAgentSchema: z.ZodObject<{
+    availability: z.ZodEnum<["anywhere", "own_application"]>;
+} & {
+    applicationId: z.ZodString;
+    agentAccountId: z.ZodString;
+    createdByUserId: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    createdAt: string;
+    updatedAt: string;
+    applicationId: string;
+    agentAccountId: string;
+    availability: "anywhere" | "own_application";
+    createdByUserId: string | null;
+}, {
+    createdAt: string;
+    updatedAt: string;
+    applicationId: string;
+    agentAccountId: string;
+    availability: "anywhere" | "own_application";
+    createdByUserId: string | null;
+}>;
+/**
+ * `GET /capabilities/agent-availability/:agentAccountId`: the sessions an agent
+ * is reachable from. `anywhere: false` lists the applications whose sessions
+ * (the session validation answer's `applicationId`) may reach it.
+ */
+export declare const agentAvailabilitySchema: z.ZodDiscriminatedUnion<"anywhere", [z.ZodObject<{
+    anywhere: z.ZodLiteral<true>;
+}, "strict", z.ZodTypeAny, {
+    anywhere: true;
+}, {
+    anywhere: true;
+}>, z.ZodObject<{
+    anywhere: z.ZodLiteral<false>;
+    applicationIds: z.ZodArray<z.ZodString, "many">;
+}, "strict", z.ZodTypeAny, {
+    anywhere: false;
+    applicationIds: string[];
+}, {
+    anywhere: false;
+    applicationIds: string[];
+}>]>;
 export declare const automationTriggerSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     type: z.ZodLiteral<"manual">;
 }, "strict", z.ZodTypeAny, {
@@ -3286,5 +3346,9 @@ export type CatalogInternalTransport = (typeof CATALOG_INTERNAL_TRANSPORTS)[numb
 export type AgentRequesterCeilingWrite = z.infer<typeof agentRequesterCeilingWriteSchema>;
 export type AgentRequesterCeiling = z.infer<typeof agentRequesterCeilingSchema>;
 export type AgentRequesterCeilingAutonomy = (typeof AGENT_REQUESTER_CEILING_AUTONOMY)[number];
+export type ApplicationAgentAvailability = (typeof APPLICATION_AGENT_AVAILABILITIES)[number];
+export type ApplicationAgentWrite = z.infer<typeof applicationAgentWriteSchema>;
+export type ApplicationAgent = z.infer<typeof applicationAgentSchema>;
+export type AgentAvailability = z.infer<typeof agentAvailabilitySchema>;
 export type CatalogRegistration = z.infer<typeof catalogRegistrationSchema>;
 export type NormalizedAppEvent = z.infer<typeof normalizedAppEventSchema>;