@oxy.so/contracts 4.8.0 → 4.9.1

package/dist/types/agentKeys.d.ts

@@ -0,0 +1,525 @@
+/** Autonomous runtime proof. No private key crosses this contract. */
+import { z } from 'zod';
+export declare const AGENT_PROOF_AUDIENCE: "oxy-api/agent";
+export declare const AGENT_PROOF_TTL_MS = 60000;
+export declare const AGENT_PROOF_ACTIONS: readonly ["agent_signin", "agent_enroll", "agent_rotate", "agent_recover", "agent_governance"];
+export type AgentProofAction = (typeof AGENT_PROOF_ACTIONS)[number];
+export declare const agentProofClaimsSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    audience: z.ZodLiteral<"oxy-api/agent">;
+    action: z.ZodEnum<["agent_signin", "agent_enroll", "agent_rotate", "agent_recover", "agent_governance"]>;
+    accountId: z.ZodString;
+    actorId: z.ZodString;
+    authMethodId: z.ZodNullable<z.ZodString>;
+    publicKey: z.ZodString;
+    payloadDigest: z.ZodString;
+    challenge: z.ZodString;
+    expiresAt: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    expiresAt: number;
+    accountId: string;
+    version: 1;
+    audience: "oxy-api/agent";
+    action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
+    challenge: string;
+    actorId: string;
+    authMethodId: string | null;
+    publicKey: string;
+    payloadDigest: string;
+}, {
+    expiresAt: number;
+    accountId: string;
+    version: 1;
+    audience: "oxy-api/agent";
+    action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
+    challenge: string;
+    actorId: string;
+    authMethodId: string | null;
+    publicKey: string;
+    payloadDigest: string;
+}>;
+export type AgentProofClaims = z.infer<typeof agentProofClaimsSchema>;
+/** Different proof roles cannot substitute for one another on the same operation. */
+export declare function buildAgentProofMessage(claims: AgentProofClaims, timestamp: number, role?: 'credential' | 'governor'): string;
+export declare const agentSignatureSchema: z.ZodObject<{
+    challenge: z.ZodString;
+    signature: z.ZodString;
+    timestamp: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    signature: string;
+    challenge: string;
+    timestamp: number;
+}, {
+    signature: string;
+    challenge: string;
+    timestamp: number;
+}>;
+export type AgentSignature = z.infer<typeof agentSignatureSchema>;
+export declare const agentChallengeRequestSchema: z.ZodObject<{
+    publicKey: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    publicKey: string;
+}, {
+    publicKey: string;
+}>;
+export declare const agentVerifyRequestSchema: z.ZodObject<{
+    challenge: z.ZodString;
+    signature: z.ZodString;
+    timestamp: z.ZodNumber;
+} & {
+    publicKey: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    signature: string;
+    challenge: string;
+    publicKey: string;
+    timestamp: number;
+}, {
+    signature: string;
+    challenge: string;
+    publicKey: string;
+    timestamp: number;
+}>;
+export declare const agentKeyOperationSchema: z.ZodDiscriminatedUnion<"operation", [z.ZodObject<{
+    publicKey: z.ZodString;
+    label: z.ZodString;
+    operation: z.ZodLiteral<"enroll">;
+}, "strict", z.ZodTypeAny, {
+    publicKey: string;
+    operation: "enroll";
+    label: string;
+}, {
+    publicKey: string;
+    operation: "enroll";
+    label: string;
+}>, z.ZodObject<{
+    publicKey: z.ZodString;
+    label: z.ZodString;
+    operation: z.ZodLiteral<"recover">;
+}, "strict", z.ZodTypeAny, {
+    publicKey: string;
+    operation: "recover";
+    label: string;
+}, {
+    publicKey: string;
+    operation: "recover";
+    label: string;
+}>, z.ZodObject<{
+    retireCurrent: z.ZodOptional<z.ZodBoolean>;
+    publicKey: z.ZodString;
+    label: z.ZodString;
+    operation: z.ZodLiteral<"rotate">;
+}, "strict", z.ZodTypeAny, {
+    publicKey: string;
+    operation: "rotate";
+    label: string;
+    retireCurrent?: boolean | undefined;
+}, {
+    publicKey: string;
+    operation: "rotate";
+    label: string;
+    retireCurrent?: boolean | undefined;
+}>, z.ZodObject<{
+    operation: z.ZodLiteral<"revoke">;
+    methodId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    operation: "revoke";
+    methodId: string;
+}, {
+    operation: "revoke";
+    methodId: string;
+}>]>;
+export type AgentKeyOperation = z.infer<typeof agentKeyOperationSchema>;
+export declare const agentKeyOperationProofSchema: z.ZodObject<{
+    challenge: z.ZodString;
+    timestamp: z.ZodNumber;
+    keySignature: z.ZodOptional<z.ZodString>;
+    governorSignature: z.ZodOptional<z.ZodString>;
+    reauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        password: z.ZodOptional<z.ZodString>;
+        emailCode: z.ZodOptional<z.ZodObject<{
+            verificationId: z.ZodString;
+            code: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            code: string;
+            verificationId: string;
+        }, {
+            code: string;
+            verificationId: string;
+        }>>;
+        totpCode: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }>, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    challenge: string;
+    timestamp: number;
+    reauth?: {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    } | undefined;
+    keySignature?: string | undefined;
+    governorSignature?: string | undefined;
+}, {
+    challenge: string;
+    timestamp: number;
+    reauth?: {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    } | undefined;
+    keySignature?: string | undefined;
+    governorSignature?: string | undefined;
+}>;
+export type AgentKeyOperationProof = z.infer<typeof agentKeyOperationProofSchema>;
+export declare const executeAgentKeyOperationSchema: z.ZodObject<{
+    operation: z.ZodDiscriminatedUnion<"operation", [z.ZodObject<{
+        publicKey: z.ZodString;
+        label: z.ZodString;
+        operation: z.ZodLiteral<"enroll">;
+    }, "strict", z.ZodTypeAny, {
+        publicKey: string;
+        operation: "enroll";
+        label: string;
+    }, {
+        publicKey: string;
+        operation: "enroll";
+        label: string;
+    }>, z.ZodObject<{
+        publicKey: z.ZodString;
+        label: z.ZodString;
+        operation: z.ZodLiteral<"recover">;
+    }, "strict", z.ZodTypeAny, {
+        publicKey: string;
+        operation: "recover";
+        label: string;
+    }, {
+        publicKey: string;
+        operation: "recover";
+        label: string;
+    }>, z.ZodObject<{
+        retireCurrent: z.ZodOptional<z.ZodBoolean>;
+        publicKey: z.ZodString;
+        label: z.ZodString;
+        operation: z.ZodLiteral<"rotate">;
+    }, "strict", z.ZodTypeAny, {
+        publicKey: string;
+        operation: "rotate";
+        label: string;
+        retireCurrent?: boolean | undefined;
+    }, {
+        publicKey: string;
+        operation: "rotate";
+        label: string;
+        retireCurrent?: boolean | undefined;
+    }>, z.ZodObject<{
+        operation: z.ZodLiteral<"revoke">;
+        methodId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        operation: "revoke";
+        methodId: string;
+    }, {
+        operation: "revoke";
+        methodId: string;
+    }>]>;
+    proof: z.ZodObject<{
+        challenge: z.ZodString;
+        timestamp: z.ZodNumber;
+        keySignature: z.ZodOptional<z.ZodString>;
+        governorSignature: z.ZodOptional<z.ZodString>;
+        reauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+            password: z.ZodOptional<z.ZodString>;
+            emailCode: z.ZodOptional<z.ZodObject<{
+                verificationId: z.ZodString;
+                code: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                code: string;
+                verificationId: string;
+            }, {
+                code: string;
+                verificationId: string;
+            }>>;
+            totpCode: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            password?: string | undefined;
+            emailCode?: {
+                code: string;
+                verificationId: string;
+            } | undefined;
+            totpCode?: string | undefined;
+        }, {
+            password?: string | undefined;
+            emailCode?: {
+                code: string;
+                verificationId: string;
+            } | undefined;
+            totpCode?: string | undefined;
+        }>, {
+            password?: string | undefined;
+            emailCode?: {
+                code: string;
+                verificationId: string;
+            } | undefined;
+            totpCode?: string | undefined;
+        }, {
+            password?: string | undefined;
+            emailCode?: {
+                code: string;
+                verificationId: string;
+            } | undefined;
+            totpCode?: string | undefined;
+        }>>;
+    }, "strict", z.ZodTypeAny, {
+        challenge: string;
+        timestamp: number;
+        reauth?: {
+            password?: string | undefined;
+            emailCode?: {
+                code: string;
+                verificationId: string;
+            } | undefined;
+            totpCode?: string | undefined;
+        } | undefined;
+        keySignature?: string | undefined;
+        governorSignature?: string | undefined;
+    }, {
+        challenge: string;
+        timestamp: number;
+        reauth?: {
+            password?: string | undefined;
+            emailCode?: {
+                code: string;
+                verificationId: string;
+            } | undefined;
+            totpCode?: string | undefined;
+        } | undefined;
+        keySignature?: string | undefined;
+        governorSignature?: string | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    operation: {
+        publicKey: string;
+        operation: "enroll";
+        label: string;
+    } | {
+        publicKey: string;
+        operation: "recover";
+        label: string;
+    } | {
+        publicKey: string;
+        operation: "rotate";
+        label: string;
+        retireCurrent?: boolean | undefined;
+    } | {
+        operation: "revoke";
+        methodId: string;
+    };
+    proof: {
+        challenge: string;
+        timestamp: number;
+        reauth?: {
+            password?: string | undefined;
+            emailCode?: {
+                code: string;
+                verificationId: string;
+            } | undefined;
+            totpCode?: string | undefined;
+        } | undefined;
+        keySignature?: string | undefined;
+        governorSignature?: string | undefined;
+    };
+}, {
+    operation: {
+        publicKey: string;
+        operation: "enroll";
+        label: string;
+    } | {
+        publicKey: string;
+        operation: "recover";
+        label: string;
+    } | {
+        publicKey: string;
+        operation: "rotate";
+        label: string;
+        retireCurrent?: boolean | undefined;
+    } | {
+        operation: "revoke";
+        methodId: string;
+    };
+    proof: {
+        challenge: string;
+        timestamp: number;
+        reauth?: {
+            password?: string | undefined;
+            emailCode?: {
+                code: string;
+                verificationId: string;
+            } | undefined;
+            totpCode?: string | undefined;
+        } | undefined;
+        keySignature?: string | undefined;
+        governorSignature?: string | undefined;
+    };
+}>;
+export declare const agentKeyOperationChallengeSchema: z.ZodObject<{
+    claims: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        audience: z.ZodLiteral<"oxy-api/agent">;
+        action: z.ZodEnum<["agent_signin", "agent_enroll", "agent_rotate", "agent_recover", "agent_governance"]>;
+        accountId: z.ZodString;
+        actorId: z.ZodString;
+        authMethodId: z.ZodNullable<z.ZodString>;
+        publicKey: z.ZodString;
+        payloadDigest: z.ZodString;
+        challenge: z.ZodString;
+        expiresAt: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        expiresAt: number;
+        accountId: string;
+        version: 1;
+        audience: "oxy-api/agent";
+        action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
+        challenge: string;
+        actorId: string;
+        authMethodId: string | null;
+        publicKey: string;
+        payloadDigest: string;
+    }, {
+        expiresAt: number;
+        accountId: string;
+        version: 1;
+        audience: "oxy-api/agent";
+        action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
+        challenge: string;
+        actorId: string;
+        authMethodId: string | null;
+        publicKey: string;
+        payloadDigest: string;
+    }>;
+    governorPublicKey: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    claims: {
+        expiresAt: number;
+        accountId: string;
+        version: 1;
+        audience: "oxy-api/agent";
+        action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
+        challenge: string;
+        actorId: string;
+        authMethodId: string | null;
+        publicKey: string;
+        payloadDigest: string;
+    };
+    governorPublicKey: string | null;
+}, {
+    claims: {
+        expiresAt: number;
+        accountId: string;
+        version: 1;
+        audience: "oxy-api/agent";
+        action: "agent_signin" | "agent_enroll" | "agent_rotate" | "agent_recover" | "agent_governance";
+        challenge: string;
+        actorId: string;
+        authMethodId: string | null;
+        publicKey: string;
+        payloadDigest: string;
+    };
+    governorPublicKey: string | null;
+}>;
+export declare const agentKeyOperationResultSchema: z.ZodObject<{
+    methodId: z.ZodNullable<z.ZodString>;
+    revokedMethodIds: z.ZodArray<z.ZodString, "many">;
+}, "strict", z.ZodTypeAny, {
+    methodId: string | null;
+    revokedMethodIds: string[];
+}, {
+    methodId: string | null;
+    revokedMethodIds: string[];
+}>;
+export declare const ACCOUNT_AUTH_METHODS: readonly ["identity", "agent_key"];
+export type AccountAuthMethod = (typeof ACCOUNT_AUTH_METHODS)[number];
+/** Public credential inventory. Never includes a proof, bearer or private key. */
+export declare const agentKeyListResponseSchema: z.ZodObject<{
+    keys: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        publicKey: z.ZodString;
+        label: z.ZodString;
+        enrolledByUserId: z.ZodNullable<z.ZodString>;
+        enrollmentMethod: z.ZodEnum<["governor", "rotation", "recovery"]>;
+        linkedAt: z.ZodString;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        revokedAt: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        revokedAt: string | null;
+        publicKey: string;
+        label: string;
+        enrolledByUserId: string | null;
+        enrollmentMethod: "governor" | "rotation" | "recovery";
+        linkedAt: string;
+        lastUsedAt: string | null;
+    }, {
+        id: string;
+        revokedAt: string | null;
+        publicKey: string;
+        label: string;
+        enrolledByUserId: string | null;
+        enrollmentMethod: "governor" | "rotation" | "recovery";
+        linkedAt: string;
+        lastUsedAt: string | null;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    keys: {
+        id: string;
+        revokedAt: string | null;
+        publicKey: string;
+        label: string;
+        enrolledByUserId: string | null;
+        enrollmentMethod: "governor" | "rotation" | "recovery";
+        linkedAt: string;
+        lastUsedAt: string | null;
+    }[];
+}, {
+    keys: {
+        id: string;
+        revokedAt: string | null;
+        publicKey: string;
+        label: string;
+        enrolledByUserId: string | null;
+        enrollmentMethod: "governor" | "rotation" | "recovery";
+        linkedAt: string;
+        lastUsedAt: string | null;
+    }[];
+}>;

package/dist/types/capabilityBindings.d.ts

@@ -0,0 +1,6 @@
+import type { GrantLimit } from './agency';
+/** Registry-compatible JSON: sorted keys, omitted undefined object properties. */
+export declare function canonicalCapabilityJson(value: unknown): string;
+/** Enforces the signed per-action bounds before a domain handler runs. */
+export declare function inputSatisfiesCapabilityLimits(tool: string, input: Record<string, unknown>, limits: readonly GrantLimit[]): boolean;
+export declare function isLoopbackOrigin(origin: string): boolean;