@oxyhq/contracts 0.27.0 → 0.29.0

package/dist/types/inference/errors.d.ts

@@ -31,9 +31,20 @@ import { z } from 'zod';
  * `quota_exceeded`, `byok_credential_invalid`), routing/permission policy
  * (`policy_violation`, `commercial_permission_denied`, `no_route_available`),
  * and the platform or its upstreams (everything from `deployment_unavailable`).
+ *
+ * The platform group is NOT uniformly retryable, and that is the point of
+ * `provider_credential_invalid` sitting in it: an upstream that refuses the
+ * PLATFORM's own credential fails every identical retry until an operator
+ * rotates a key, so classifying it as `provider_error` would send every client
+ * into a retry loop against a request that cannot succeed.
+ *
+ * `provider_billing_refused` is in that group for the same reason and was found
+ * the same way — an upstream declining to bill OXY (Anthropic answers 402) has
+ * to be distinguishable from the customer's own balance running out, or the
+ * error tells them to go and top up an account that is not the one at fault.
  */
-export declare const INFERENCE_ERROR_CODES: readonly ["invalid_request", "authentication_failed", "permission_denied", "insufficient_scope", "model_not_found", "unsupported_modality", "context_length_exceeded", "request_too_large", "output_limit_exceeded", "idempotency_conflict", "insufficient_balance", "spending_limit_exceeded", "quota_exceeded", "byok_credential_invalid", "policy_violation", "commercial_permission_denied", "no_route_available", "upstream_content_filtered", "cancelled", "rate_limited", "deployment_unavailable", "provider_error", "provider_timeout", "provider_overloaded", "service_unavailable", "internal_error"];
-export declare const inferenceErrorCodeSchema: z.ZodEnum<["invalid_request", "authentication_failed", "permission_denied", "insufficient_scope", "model_not_found", "unsupported_modality", "context_length_exceeded", "request_too_large", "output_limit_exceeded", "idempotency_conflict", "insufficient_balance", "spending_limit_exceeded", "quota_exceeded", "byok_credential_invalid", "policy_violation", "commercial_permission_denied", "no_route_available", "upstream_content_filtered", "cancelled", "rate_limited", "deployment_unavailable", "provider_error", "provider_timeout", "provider_overloaded", "service_unavailable", "internal_error"]>;
+export declare const INFERENCE_ERROR_CODES: readonly ["invalid_request", "authentication_failed", "permission_denied", "insufficient_scope", "model_not_found", "unsupported_modality", "context_length_exceeded", "request_too_large", "output_limit_exceeded", "idempotency_conflict", "insufficient_balance", "spending_limit_exceeded", "quota_exceeded", "byok_credential_invalid", "policy_violation", "commercial_permission_denied", "no_route_available", "upstream_content_filtered", "cancelled", "rate_limited", "deployment_unavailable", "provider_error", "provider_timeout", "provider_overloaded", "provider_credential_invalid", "provider_billing_refused", "service_unavailable", "internal_error"];
+export declare const inferenceErrorCodeSchema: z.ZodEnum<["invalid_request", "authentication_failed", "permission_denied", "insufficient_scope", "model_not_found", "unsupported_modality", "context_length_exceeded", "request_too_large", "output_limit_exceeded", "idempotency_conflict", "insufficient_balance", "spending_limit_exceeded", "quota_exceeded", "byok_credential_invalid", "policy_violation", "commercial_permission_denied", "no_route_available", "upstream_content_filtered", "cancelled", "rate_limited", "deployment_unavailable", "provider_error", "provider_timeout", "provider_overloaded", "provider_credential_invalid", "provider_billing_refused", "service_unavailable", "internal_error"]>;
 /**
  * Codes for which an identical retried request cannot succeed.
  *
@@ -42,12 +53,50 @@ export declare const inferenceErrorCodeSchema: z.ZodEnum<["invalid_request", "au
  * names, while a quota is an account-level ceiling that only a human raises.
  * `cancelled` is here because the caller already withdrew the request; a client
  * that retries it is contradicting its own cancellation.
+ *
+ * `byok_credential_invalid` and `provider_credential_invalid` are the same
+ * failure seen from the two sides of the BYOK boundary — the customer's own
+ * upstream credential and the platform's — and they are two codes rather than
+ * one because only the first names an action the customer can take. Both are
+ * non-retryable for the same reason: a credential an upstream has refused keeps
+ * being refused until somebody replaces it.
+ *
+ * `quota_exceeded` and `provider_billing_refused` divide along the same line:
+ * both are money, but one is the CUSTOMER's ceiling and the other is Oxy's
+ * account with an upstream. Reporting the second as the first is retryability-
+ * correct and diagnostically wrong, which is the worst combination — it reads
+ * as actionable and the action does nothing.
  */
-export declare const NON_RETRYABLE_INFERENCE_ERROR_CODES: readonly ["invalid_request", "authentication_failed", "permission_denied", "insufficient_scope", "model_not_found", "unsupported_modality", "context_length_exceeded", "request_too_large", "output_limit_exceeded", "idempotency_conflict", "insufficient_balance", "spending_limit_exceeded", "quota_exceeded", "byok_credential_invalid", "policy_violation", "commercial_permission_denied", "no_route_available", "upstream_content_filtered", "cancelled"];
+export declare const NON_RETRYABLE_INFERENCE_ERROR_CODES: readonly ["invalid_request", "authentication_failed", "permission_denied", "insufficient_scope", "model_not_found", "unsupported_modality", "context_length_exceeded", "request_too_large", "output_limit_exceeded", "idempotency_conflict", "insufficient_balance", "spending_limit_exceeded", "quota_exceeded", "byok_credential_invalid", "policy_violation", "commercial_permission_denied", "no_route_available", "upstream_content_filtered", "cancelled", "provider_credential_invalid", "provider_billing_refused"];
 /**
- * Free text that is safe to hand a customer: bounded, and refused outright if a
- * credential marker appears in it. Applied to BOTH the Oxy message and the
+ * Free text that is safe to hand a customer: bounded, and refused if it still
+ * looks like it carries a credential. Applied to BOTH the Oxy message and the
  * upstream one — a leak is no less a leak for having been written by a provider.
+ *
+ * ## This is a last-resort REFUSAL, not protection
+ *
+ * A pattern over the OUTPUT cannot be the control that keeps a credential out of
+ * an error, and a producer that treats it as one has the hole #1027 reported.
+ * The only reliable control is redacting the KNOWN SECRET VALUE at the point
+ * where the producer still holds the bytes it sent — which is an adapter's job
+ * and is available to nobody else. This refinement exists to catch what that
+ * control missed, and nothing here is a licence to skip it.
+ *
+ * Two rules follow, and they are the whole reason this text is longer than the
+ * pattern it describes:
+ *
+ *  - **Never redact by replacing the span this pattern matched.** The span is
+ *    the MARKER; the secret is what follows it. OxyHQ/Relay#3 measured the
+ *    result: `{x-api-key: <key>}` is refused, `{x-[redacted] <key>}` was
+ *    accepted, and both carry the key. Redaction made the leak worse by
+ *    converting "this string is dangerous" into "this string is fine".
+ *  - **This package deliberately ships no redaction helper.** One keyed on these
+ *    patterns would rebuild the same defect one layer up, and one that took the
+ *    secret as an argument would only restate what the producer already has.
+ *
+ * What it still cannot see, stated so nobody relies on it: a credential with no
+ * marker, no issued-token prefix and no placeholder beside it is bytes that look
+ * like a request id, and refusing those means refusing request ids.
  */
 export declare const safeErrorTextSchema: z.ZodEffects<z.ZodString, string, string>;
 /**
@@ -97,7 +146,7 @@ export declare const providerErrorPassthroughSchema: z.ZodObject<{
 export declare const inferenceErrorSchema: z.ZodEffects<z.ZodObject<{
     /** See `version.ts`: this shape appears alone on the wire, so it is versioned. */
     schemaVersion: z.ZodLiteral<1>;
-    code: z.ZodEnum<["invalid_request", "authentication_failed", "permission_denied", "insufficient_scope", "model_not_found", "unsupported_modality", "context_length_exceeded", "request_too_large", "output_limit_exceeded", "idempotency_conflict", "insufficient_balance", "spending_limit_exceeded", "quota_exceeded", "byok_credential_invalid", "policy_violation", "commercial_permission_denied", "no_route_available", "upstream_content_filtered", "cancelled", "rate_limited", "deployment_unavailable", "provider_error", "provider_timeout", "provider_overloaded", "service_unavailable", "internal_error"]>;
+    code: z.ZodEnum<["invalid_request", "authentication_failed", "permission_denied", "insufficient_scope", "model_not_found", "unsupported_modality", "context_length_exceeded", "request_too_large", "output_limit_exceeded", "idempotency_conflict", "insufficient_balance", "spending_limit_exceeded", "quota_exceeded", "byok_credential_invalid", "policy_violation", "commercial_permission_denied", "no_route_available", "upstream_content_filtered", "cancelled", "rate_limited", "deployment_unavailable", "provider_error", "provider_timeout", "provider_overloaded", "provider_credential_invalid", "provider_billing_refused", "service_unavailable", "internal_error"]>;
     message: z.ZodEffects<z.ZodString, string, string>;
     retryable: z.ZodBoolean;
     requestId: z.ZodString;
@@ -127,7 +176,7 @@ export declare const inferenceErrorSchema: z.ZodEffects<z.ZodObject<{
         status?: number | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
-    code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+    code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
     message: string;
     requestId: string;
     schemaVersion: 1;
@@ -142,7 +191,7 @@ export declare const inferenceErrorSchema: z.ZodEffects<z.ZodObject<{
         status?: number | undefined;
     } | undefined;
 }, {
-    code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+    code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
     message: string;
     requestId: string;
     schemaVersion: 1;
@@ -157,7 +206,7 @@ export declare const inferenceErrorSchema: z.ZodEffects<z.ZodObject<{
         status?: number | undefined;
     } | undefined;
 }>, {
-    code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+    code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
     message: string;
     requestId: string;
     schemaVersion: 1;
@@ -172,7 +221,7 @@ export declare const inferenceErrorSchema: z.ZodEffects<z.ZodObject<{
         status?: number | undefined;
     } | undefined;
 }, {
-    code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+    code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
     message: string;
     requestId: string;
     schemaVersion: 1;

package/dist/types/inference/identifiers.d.ts

@@ -51,9 +51,17 @@ export declare const oxyApplicationIdSchema: z.ZodString;
 /** An Oxy `ApplicationCredential._id` — the credential used for this request. */
 export declare const oxyCredentialIdSchema: z.ZodString;
 /**
- * A request id generated by the data plane. Correlates the Oxy edge, the data
- * plane, the financial ledger and the customer-visible receipt, so it appears on
- * every stream event and every ledger record.
+ * A request id allocated by the Oxy EDGE, at admission and BEFORE
+ * authentication, so that a request rejected for a bad credential is as
+ * traceable as one that was served (ADR 0007, and step 1 of ADR 0010's edge
+ * order). It is required on the inbound envelope, which is what makes the data
+ * plane a consumer of this id rather than its source: the data plane echoes it
+ * on every stream event, on the usage report and on anything it can be asked
+ * about later.
+ *
+ * Correlates the Oxy edge, the data plane, the financial ledger and the
+ * customer-visible receipt, so it appears on every stream event and every
+ * ledger record.
  */
 export declare const requestIdSchema: z.ZodString;
 /**

package/dist/types/inference/money.d.ts

@@ -78,6 +78,49 @@ export declare const moneySchema: z.ZodObject<{
 /**
  * The closed set of units inference is metered in.
  *
+ * **The units PARTITION a request: every unit counts material no other unit
+ * counts.** `cached_input_tokens` is not part of `input_tokens`, and
+ * `reasoning_tokens` is not part of `output_tokens` — they are siblings, not
+ * subsets. A request whose 10 000-token prompt was served 9 000 tokens from
+ * cache is reported as `input_tokens: 1000` beside `cached_input_tokens: 9000`,
+ * never as `input_tokens: 10000` beside it.
+ *
+ * That belongs to the definition rather than to a convention somewhere else,
+ * because settlement applies a price to EVERY reported unit and sums them
+ * (`inferenceLedger.service.ts`'s `computeCharge`). Under the partition rule
+ * that sum IS the request's cost, and a cached token can carry its own — lower
+ * — price. Under the nested reading the same sum charges the cached and
+ * reasoning tokens twice: once inside their parent and once on their own line.
+ * It fails silently, because every total still looks plausible and the receipt
+ * is still internally consistent, and on a reasoning model the reasoning tokens
+ * can dominate the completion, so the error is not marginal.
+ *
+ * **Every OpenAI-compatible provider reports the other way round**:
+ * `prompt_tokens` INCLUDES `prompt_tokens_details.cached_tokens`, and
+ * `completion_tokens` INCLUDES `completion_tokens_details.reasoning_tokens`.
+ * Normalising is the data plane's job and it is subtraction:
+ *
+ * ```text
+ * input_tokens  = prompt_tokens     - prompt_tokens_details.cached_tokens
+ * output_tokens = completion_tokens - completion_tokens_details.reasoning_tokens
+ * ```
+ *
+ * No refinement in this package can enforce it, and saying so is part of the
+ * rule: a nested report and a disjoint one are the same four non-negative
+ * integers, so no predicate over a single report can tell them apart. The two
+ * structural guards that DO exist — refining `cached <= input` and
+ * `reasoning <= output`, or deriving the parents instead of reporting them —
+ * both encode the nested reading, which is the one this rule rejects. What IS
+ * enforceable is the arithmetic that depends on the rule, and that is where the
+ * enforcement lives — `inferenceLedger.service.test.ts` prices a report in
+ * which cached and reasoning tokens are both non-zero and asserts the exact
+ * total, which the nested reading cannot produce.
+ *
+ * Where the public surface has to speak a nested dialect, the sum is put back
+ * at the boundary rather than the internal reading being bent to it
+ * (`routes/inferenceEdge.ts` renders `prompt_tokens` as
+ * `input_tokens + cached_input_tokens`).
+ *
  * Time is carried in integer MILLISECONDS rather than seconds so that no unit
  * quantity is ever fractional: a 12.5-second transcription is `12500`, exactly,
  * and the "units are integers" rule holds for every modality instead of holding

package/dist/types/inference/streamEvents.d.ts

@@ -345,7 +345,7 @@ export declare const inferenceStreamErrorEventSchema: z.ZodObject<{
     /** Carries its own `schemaVersion`: the same body is returned non-streaming. */
     error: z.ZodEffects<z.ZodObject<{
         schemaVersion: z.ZodLiteral<1>;
-        code: z.ZodEnum<["invalid_request", "authentication_failed", "permission_denied", "insufficient_scope", "model_not_found", "unsupported_modality", "context_length_exceeded", "request_too_large", "output_limit_exceeded", "idempotency_conflict", "insufficient_balance", "spending_limit_exceeded", "quota_exceeded", "byok_credential_invalid", "policy_violation", "commercial_permission_denied", "no_route_available", "upstream_content_filtered", "cancelled", "rate_limited", "deployment_unavailable", "provider_error", "provider_timeout", "provider_overloaded", "service_unavailable", "internal_error"]>;
+        code: z.ZodEnum<["invalid_request", "authentication_failed", "permission_denied", "insufficient_scope", "model_not_found", "unsupported_modality", "context_length_exceeded", "request_too_large", "output_limit_exceeded", "idempotency_conflict", "insufficient_balance", "spending_limit_exceeded", "quota_exceeded", "byok_credential_invalid", "policy_violation", "commercial_permission_denied", "no_route_available", "upstream_content_filtered", "cancelled", "rate_limited", "deployment_unavailable", "provider_error", "provider_timeout", "provider_overloaded", "provider_credential_invalid", "provider_billing_refused", "service_unavailable", "internal_error"]>;
         message: z.ZodEffects<z.ZodString, string, string>;
         retryable: z.ZodBoolean;
         requestId: z.ZodString;
@@ -369,7 +369,7 @@ export declare const inferenceStreamErrorEventSchema: z.ZodObject<{
             status?: number | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
-        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
         message: string;
         requestId: string;
         schemaVersion: 1;
@@ -384,7 +384,7 @@ export declare const inferenceStreamErrorEventSchema: z.ZodObject<{
             status?: number | undefined;
         } | undefined;
     }, {
-        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
         message: string;
         requestId: string;
         schemaVersion: 1;
@@ -399,7 +399,7 @@ export declare const inferenceStreamErrorEventSchema: z.ZodObject<{
             status?: number | undefined;
         } | undefined;
     }>, {
-        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
         message: string;
         requestId: string;
         schemaVersion: 1;
@@ -414,7 +414,7 @@ export declare const inferenceStreamErrorEventSchema: z.ZodObject<{
             status?: number | undefined;
         } | undefined;
     }, {
-        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
         message: string;
         requestId: string;
         schemaVersion: 1;
@@ -435,7 +435,7 @@ export declare const inferenceStreamErrorEventSchema: z.ZodObject<{
     schemaVersion: 1;
     sequence: number;
     error: {
-        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
         message: string;
         requestId: string;
         schemaVersion: 1;
@@ -456,7 +456,7 @@ export declare const inferenceStreamErrorEventSchema: z.ZodObject<{
     schemaVersion: 1;
     sequence: number;
     error: {
-        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
         message: string;
         requestId: string;
         schemaVersion: 1;
@@ -472,8 +472,17 @@ export declare const inferenceStreamErrorEventSchema: z.ZodObject<{
         } | undefined;
     };
 }>;
-/** Why generation stopped. */
-export declare const inferenceFinishReasonSchema: z.ZodEnum<["stop", "length", "tool_calls", "content_filter", "cancelled"]>;
+/**
+ * Why generation stopped.
+ *
+ * `refusal` and `content_filter` are separate members because they are separate
+ * events: the MODEL declining to answer is a property of the answer, while a
+ * filter is an upstream system removing one. The delta channels already carry
+ * that distinction (`channel: 'refusal'` beside the filter's own error code),
+ * so collapsing it here would have made the terminal event less specific than
+ * the stream that produced it.
+ */
+export declare const inferenceFinishReasonSchema: z.ZodEnum<["stop", "length", "tool_calls", "content_filter", "refusal", "cancelled"]>;
 /**
  * The successful terminal event.
  *
@@ -487,7 +496,7 @@ export declare const inferenceStreamDoneEventSchema: z.ZodObject<{
     requestId: z.ZodString;
     sequence: z.ZodNumber;
     generationId: z.ZodOptional<z.ZodString>;
-    finishReason: z.ZodEnum<["stop", "length", "tool_calls", "content_filter", "cancelled"]>;
+    finishReason: z.ZodEnum<["stop", "length", "tool_calls", "content_filter", "refusal", "cancelled"]>;
     receiptId: z.ZodOptional<z.ZodString>;
     completedAt: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -495,7 +504,7 @@ export declare const inferenceStreamDoneEventSchema: z.ZodObject<{
     requestId: string;
     schemaVersion: 1;
     sequence: number;
-    finishReason: "length" | "cancelled" | "content_filter" | "stop" | "tool_calls";
+    finishReason: "length" | "cancelled" | "content_filter" | "refusal" | "stop" | "tool_calls";
     completedAt: string;
     generationId?: string | undefined;
     receiptId?: string | undefined;
@@ -504,7 +513,7 @@ export declare const inferenceStreamDoneEventSchema: z.ZodObject<{
     requestId: string;
     schemaVersion: 1;
     sequence: number;
-    finishReason: "length" | "cancelled" | "content_filter" | "stop" | "tool_calls";
+    finishReason: "length" | "cancelled" | "content_filter" | "refusal" | "stop" | "tool_calls";
     completedAt: string;
     generationId?: string | undefined;
     receiptId?: string | undefined;
@@ -738,7 +747,7 @@ export declare const inferenceStreamEventSchema: z.ZodDiscriminatedUnion<"type",
     /** Carries its own `schemaVersion`: the same body is returned non-streaming. */
     error: z.ZodEffects<z.ZodObject<{
         schemaVersion: z.ZodLiteral<1>;
-        code: z.ZodEnum<["invalid_request", "authentication_failed", "permission_denied", "insufficient_scope", "model_not_found", "unsupported_modality", "context_length_exceeded", "request_too_large", "output_limit_exceeded", "idempotency_conflict", "insufficient_balance", "spending_limit_exceeded", "quota_exceeded", "byok_credential_invalid", "policy_violation", "commercial_permission_denied", "no_route_available", "upstream_content_filtered", "cancelled", "rate_limited", "deployment_unavailable", "provider_error", "provider_timeout", "provider_overloaded", "service_unavailable", "internal_error"]>;
+        code: z.ZodEnum<["invalid_request", "authentication_failed", "permission_denied", "insufficient_scope", "model_not_found", "unsupported_modality", "context_length_exceeded", "request_too_large", "output_limit_exceeded", "idempotency_conflict", "insufficient_balance", "spending_limit_exceeded", "quota_exceeded", "byok_credential_invalid", "policy_violation", "commercial_permission_denied", "no_route_available", "upstream_content_filtered", "cancelled", "rate_limited", "deployment_unavailable", "provider_error", "provider_timeout", "provider_overloaded", "provider_credential_invalid", "provider_billing_refused", "service_unavailable", "internal_error"]>;
         message: z.ZodEffects<z.ZodString, string, string>;
         retryable: z.ZodBoolean;
         requestId: z.ZodString;
@@ -762,7 +771,7 @@ export declare const inferenceStreamEventSchema: z.ZodDiscriminatedUnion<"type",
             status?: number | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
-        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
         message: string;
         requestId: string;
         schemaVersion: 1;
@@ -777,7 +786,7 @@ export declare const inferenceStreamEventSchema: z.ZodDiscriminatedUnion<"type",
             status?: number | undefined;
         } | undefined;
     }, {
-        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
         message: string;
         requestId: string;
         schemaVersion: 1;
@@ -792,7 +801,7 @@ export declare const inferenceStreamEventSchema: z.ZodDiscriminatedUnion<"type",
             status?: number | undefined;
         } | undefined;
     }>, {
-        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
         message: string;
         requestId: string;
         schemaVersion: 1;
@@ -807,7 +816,7 @@ export declare const inferenceStreamEventSchema: z.ZodDiscriminatedUnion<"type",
             status?: number | undefined;
         } | undefined;
     }, {
-        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
         message: string;
         requestId: string;
         schemaVersion: 1;
@@ -828,7 +837,7 @@ export declare const inferenceStreamEventSchema: z.ZodDiscriminatedUnion<"type",
     schemaVersion: 1;
     sequence: number;
     error: {
-        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
         message: string;
         requestId: string;
         schemaVersion: 1;
@@ -849,7 +858,7 @@ export declare const inferenceStreamEventSchema: z.ZodDiscriminatedUnion<"type",
     schemaVersion: 1;
     sequence: number;
     error: {
-        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "service_unavailable" | "internal_error";
+        code: "invalid_request" | "authentication_failed" | "permission_denied" | "insufficient_scope" | "model_not_found" | "unsupported_modality" | "context_length_exceeded" | "request_too_large" | "output_limit_exceeded" | "idempotency_conflict" | "insufficient_balance" | "spending_limit_exceeded" | "quota_exceeded" | "byok_credential_invalid" | "policy_violation" | "commercial_permission_denied" | "no_route_available" | "upstream_content_filtered" | "cancelled" | "rate_limited" | "deployment_unavailable" | "provider_error" | "provider_timeout" | "provider_overloaded" | "provider_credential_invalid" | "provider_billing_refused" | "service_unavailable" | "internal_error";
         message: string;
         requestId: string;
         schemaVersion: 1;
@@ -871,7 +880,7 @@ export declare const inferenceStreamEventSchema: z.ZodDiscriminatedUnion<"type",
     requestId: z.ZodString;
     sequence: z.ZodNumber;
     generationId: z.ZodOptional<z.ZodString>;
-    finishReason: z.ZodEnum<["stop", "length", "tool_calls", "content_filter", "cancelled"]>;
+    finishReason: z.ZodEnum<["stop", "length", "tool_calls", "content_filter", "refusal", "cancelled"]>;
     receiptId: z.ZodOptional<z.ZodString>;
     completedAt: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -879,7 +888,7 @@ export declare const inferenceStreamEventSchema: z.ZodDiscriminatedUnion<"type",
     requestId: string;
     schemaVersion: 1;
     sequence: number;
-    finishReason: "length" | "cancelled" | "content_filter" | "stop" | "tool_calls";
+    finishReason: "length" | "cancelled" | "content_filter" | "refusal" | "stop" | "tool_calls";
     completedAt: string;
     generationId?: string | undefined;
     receiptId?: string | undefined;
@@ -888,7 +897,7 @@ export declare const inferenceStreamEventSchema: z.ZodDiscriminatedUnion<"type",
     requestId: string;
     schemaVersion: 1;
     sequence: number;
-    finishReason: "length" | "cancelled" | "content_filter" | "stop" | "tool_calls";
+    finishReason: "length" | "cancelled" | "content_filter" | "refusal" | "stop" | "tool_calls";
     completedAt: string;
     generationId?: string | undefined;
     receiptId?: string | undefined;

package/dist/types/inference/usage.d.ts

@@ -370,6 +370,12 @@ export declare const inferenceRequestOutcomeSchema: z.ZodEnum<["completed", "par
  * `usageSource` is load-bearing when a provider returns no usage at all: the
  * report still arrives, marked `estimated`, so settlement can apply the
  * estimation policy knowingly instead of treating a reconstruction as fact.
+ *
+ * `units` is a PARTITION of what the request consumed, not a set of totals with
+ * details hanging off them — see `USAGE_UNITS` in `money.ts`. Reporting a provider's
+ * nested `prompt_tokens`/`completion_tokens` verbatim charges the cached and
+ * reasoning tokens twice, so subtracting the children out is part of what
+ * "normalized" means in this shape's name.
  */
 export declare const normalizedUsageReportSchema: z.ZodEffects<z.ZodObject<{
     /** See `version.ts`: emitted by the data plane as a whole message. */

package/dist/types/inference/version.d.ts

@@ -34,6 +34,34 @@
  * field is additive and does not bump it, because a consumer on the previous
  * version parses the message correctly and simply does not read the new field.
  *
+ * ## Which shapes reject an unknown field
+ *
+ * That last rule is why the shapes EXCHANGED WITH THE DATA PLANE are not
+ * `.strict()` at their top level — the request envelope, the four usage records,
+ * the stream events, the error body, the catalogue descriptors, the price
+ * version. The split is a decision rather than an omission: `.strict()` and
+ * "adding an optional field is additive" cannot both hold on one shape, because
+ * a producer one minor version ahead would have its whole message REFUSED
+ * rather than its new field ignored. For a usage report that means a request
+ * already served upstream can never be settled and Oxy absorbs its cost, which
+ * is a worse failure than the one strictness would have caught.
+ *
+ * Their LEAVES are strict, and that is where the protection lives: a stripped
+ * field is the worse outcome exactly where it would be a leak or a second
+ * source of truth, because it disappears at this parse and survives in the
+ * producer, which is where somebody eventually reads it. So
+ * `clientRequestMetadataSchema` (no IP, ever), `moneySchema` (no convenience
+ * float beside the exact decimal), `providerErrorPassthroughSchema` (no
+ * upstream request or headers beside the message), `usageQuantitySchema` and
+ * `unitPriceSchema` all refuse an unknown field, while the envelope carrying
+ * them tolerates an additive one.
+ *
+ * A shape Oxy does NOT exchange with the data plane is strict at its top level
+ * too, since nothing there can run ahead of this package:
+ * `providerConnectionSchema`, where an unknown field is how a BYOK credential
+ * escapes, and the billing and entitlement records, where one is a second
+ * number beside an exact amount.
+ *
  * Decided in: docs/adr/0006-oxy-relay-boundary.md, docs/adr/0010-public-api-compatibility.md.
  */
 /**
@@ -43,12 +71,19 @@
  *
  * MAJOR is bumped when any individual shape's `schemaVersion` increments (at
  * least one message is now read differently by the two sides); MINOR when a
- * shape or an optional field is added; PATCH for documentation-only changes
- * that leave every parsed byte identical.
+ * shape or an optional field is added, when a CLOSED ENUM gains a member, or
+ * when a refinement changes which bytes parse; PATCH for documentation-only
+ * changes that leave every parsed byte identical.
+ *
+ * The last two are MINOR rather than PATCH because both produce the same
+ * failure: a producer on the newer set emits something the older set refuses,
+ * with no `schemaVersion` difference to explain it. A new enum member and a
+ * loosened refinement are exactly what the handshake exists to surface — a
+ * skew the per-message version cannot express.
  *
  * This constant is deliberately NOT embedded in the request envelope. Pinning a
  * request to the version of the whole set would make an unrelated additive
  * change to, say, the catalogue reject every in-flight inference request; the
  * per-shape `schemaVersion` is what a message is validated against.
  */
-export declare const INFERENCE_CONTRACT_VERSION = "1.0.0";
+export declare const INFERENCE_CONTRACT_VERSION = "1.1.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/contracts",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "description": "OxyHQ API contracts — single source of truth for request/response Zod schemas and inferred types, shared by the backend and the client SDKs",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",