@oxyhq/contracts 0.28.0 → 0.30.0

package/dist/esm/identity.js

@@ -204,6 +204,37 @@ export const exportAttestationSchema = z.object({
     signature: z.string(),
     signedAt: z.number(),
 });
+export const exportUsageReceiptSchema = z.object({
+    receiptId: z.string(),
+    requestId: z.string(),
+    settledAt: z.string(),
+    billedAmount: z.string(),
+    currency: z.string(),
+    outcome: z.string(),
+    resolvedModelReference: z.string(),
+    servingProvider: z.string(),
+    platformFeeOnly: z.boolean(),
+});
+export const exportLedgerEntrySchema = z.object({
+    entryId: z.string(),
+    kind: z.string(),
+    currency: z.string(),
+    createdAt: z.string(),
+});
+export const exportUsageReservationSchema = z.object({
+    reservationId: z.string(),
+    requestId: z.string(),
+    status: z.string(),
+    reservedAmount: z.string(),
+    currency: z.string(),
+    createdAt: z.string(),
+    expiresAt: z.string(),
+});
+export const exportFinancialSectionSchema = z.object({
+    receipts: z.array(exportUsageReceiptSchema),
+    ledgerEntries: z.array(exportLedgerEntrySchema),
+    reservations: z.array(exportUsageReservationSchema),
+});
 export const exportBundleSchema = z.object({
     '$schema': z.string(),
     exportedAt: z.string(),
@@ -218,6 +249,7 @@ export const exportBundleSchema = z.object({
         following: z.array(z.string()),
         followers: z.array(z.string()),
     }),
+    financial: exportFinancialSectionSchema,
     attestation: exportAttestationSchema.nullable(),
     proof: exportAttestationSchema.optional(),
 });

package/dist/esm/index.js

@@ -30,7 +30,7 @@ export {
 recommendationExcludeTypeSchema, recommendationBoostSchema, recommendationSignalWeightsSchema, recommendationRequestSchema, recommendationCountSchema, recommendationItemSchema, recommendationResponseSchema, appEndorsementInputSchema, appInterestInputSchema, appUserSignalIngestSchema, appAffinityEventTypeSchema, appAffinityEventSchema, appAffinityEventsIngestSchema, } from './recommendations.js';
 export { 
 // Schemas
-verificationMethodSchema, didServiceSchema, didDocumentSchema, signedRecordEnvelopeSchema, verifiedDomainSchema, domainVerificationRequestSchema, domainVerificationInstructionsSchema, authMethodEntrySchema, authMethodsResponseSchema, exportAttestationSchema, exportBundleSchema, } from './identity.js';
+verificationMethodSchema, didServiceSchema, didDocumentSchema, signedRecordEnvelopeSchema, verifiedDomainSchema, domainVerificationRequestSchema, domainVerificationInstructionsSchema, authMethodEntrySchema, authMethodsResponseSchema, exportAttestationSchema, exportUsageReceiptSchema, exportLedgerEntrySchema, exportUsageReservationSchema, exportFinancialSectionSchema, exportBundleSchema, } from './identity.js';
 export { 
 // Schemas
 oxySignedRecordTypeSchema, } from './oxyRecordTypes.js';
@@ -113,7 +113,7 @@ export {
 // are branded apart so a delegated end user can never become the payer.
 oxyAccountIdSchema, delegatedUserIdSchema, oxyApplicationIdSchema, oxyCredentialIdSchema, requestIdSchema, generationIdSchema, idempotencyKeySchema, inferenceEnvironmentSchema, 
 // Wire primitives
-inferenceTimestampSchema, inferenceDateSchema, inferenceHttpsUrlSchema, 
+inferenceTimestampSchema, inferenceDateSchema, inferenceHttpsUrlSchema, sha256DigestSchema, 
 // Catalogue references
 publisherSlugSchema, modelSlugSchema, modelIdSchema, modelRevisionLabelSchema, modelReferenceSchema, routingProfileSlugSchema, inferenceProviderSlugSchema, deploymentIdSchema, inferenceRegionSchema, RESERVED_ALIA_PUBLISHER, } from './inference/identifiers.js';
 export { 
@@ -134,7 +134,12 @@ inferenceModalitySchema, modelCapabilitiesSchema, modelLicenseSchema, modelProve
 export { 
 // Routing policy: every control, plus the refinement that rejects a policy
 // no route could ever satisfy.
-routingTargetSchema, routingPolicyScopeSchema, routingFallbackPolicySchema, routingPolicySchema, routingPolicyReferenceSchema, } from './inference/routingPolicy.js';
+routingTargetSchema, routingPolicyScopeSchema, routingFallbackPolicySchema, routingPolicySchema, routingPolicyReferenceSchema, 
+// What the data plane actually receives: the routes the policy authorized.
+authorizedRouteSchema, } from './inference/routingPolicy.js';
+export { 
+// The signed Alia model release manifest (ingestion contract; no endpoint).
+aliaReleaseArtifactSchema, aliaReleaseSignatureSchema, aliaModelReleaseManifestSchema, } from './inference/aliaModelRelease.js';
 export { 
 // The normalized Oxy→data-plane request envelope.
 inferenceContentSourceSchema, inferenceContentPartSchema, inferenceToolCallSchema, inferenceMessageRoleSchema, inferenceMessageSchema, inferenceInputSchema, samplingParametersSchema, toolDefinitionSchema, toolChoiceSchema, responseFormatSchema, clientRequestMetadataSchema, inferenceRequestSchema, } from './inference/request.js';

package/dist/esm/inference/aliaModelRelease.js

@@ -0,0 +1,247 @@
+/**
+ * The signed Alia model release manifest — the ingestion contract for a
+ * first-party model release.
+ *
+ * The catalogue already STORES everything such a manifest carries: the model
+ * card, the licence block, the provenance and base model, the evaluation table,
+ * the safety metadata, and an artifact digest with a `sha256:<64 hex>` CHECK.
+ * What did not exist was the manifest itself — a single document Alia SIGNS,
+ * asserting all of it at once — and that is the gap this shape closes. Nothing
+ * here re-declares a catalogue field; the manifest COMPOSES the published shapes
+ * so a manifest and the catalogue row it produces cannot describe a release
+ * differently.
+ *
+ * ## The manifest tightens the revision it carries
+ *
+ * `modelRevisionSchema` makes `modelCardUrl`, `artifactDigest`, `evaluations`
+ * and `safety` optional, because a third-party route legitimately has none of
+ * them — Oxy did not train those weights and cannot publish a card for them. A
+ * FIRST-PARTY release has no such excuse: the documentation trail is the reason
+ * a release manifest exists at all, and a model Alia ships without one is not a
+ * release, it is a deployment. So the refinement below requires all four,
+ * without changing the catalogue shape that a third-party entry still parses
+ * through.
+ *
+ * ## `.strict()` at the top level, and here that is forced rather than chosen
+ *
+ * The shapes exchanged with the data plane tolerate an unknown field, because
+ * refusing a producer one minor version ahead is a worse failure than ignoring
+ * its addition (`version.ts`). A SIGNED document inverts that: the signature is
+ * over the canonical bytes of the manifest, so a field silently stripped at this
+ * parse is a field missing from the bytes Oxy re-canonicalizes, and verification
+ * fails. A tolerant parse would therefore report "the signature is invalid" for
+ * what is really "this build does not understand this manifest" — the wrong
+ * diagnosis of the right problem. Strict says the true thing, and the cost is
+ * bounded: ingestion is a release-time operation an operator retries once Oxy
+ * takes the newer contract, not a served request that becomes unsettleable.
+ *
+ * ## What is deliberately NOT here
+ *
+ * **No HTTP write path.** The catalogue's emptiness is currently a safety
+ * property — `scripts/seed-inference-catalogue.ts` refuses to invent a licence
+ * or a retention flag because "a plausible invented value in a catalogue is
+ * worse than an absent one" — and a staff write path into it with nothing to
+ * ingest is an unexercised hazard. The schema lands; the endpoint waits for a
+ * real manifest to ingest.
+ *
+ * **No `payloadDigest` field.** The signature is over the canonical
+ * serialization of this manifest with `signatures` removed, and a verifier
+ * recomputes it. Storing the digest beside the document it digests would be a
+ * second source of truth for one fact, and a verifier that compared the
+ * signature against the DECLARED digest rather than the recomputed one would
+ * verify nothing at all.
+ *
+ * **No verification RESULT.** Whether a signature checked out is Oxy's finding
+ * about the document, not a claim the document makes about itself; a `verified`
+ * field inside a signed manifest is the signer asserting its own signature.
+ *
+ * ## The open owner decision this shape does not take
+ *
+ * **What signs, and what verifies, is not decided.** Oxy holds no Alia signing
+ * key, and whether to resolve `keyId` through the existing attestation machinery
+ * (`services/oxyVerificationResolver.ts`, the civic attestation code) or to
+ * introduce a dedicated Alia release key is a real choice with different
+ * custody, rotation and revocation consequences. So `keyId` is an OPAQUE
+ * identifier and this file names no registry that resolves it: either answer
+ * fits, and neither is presupposed. Until it is answered a manifest can be
+ * parsed and cannot be verified, which is the second reason no endpoint ships.
+ *
+ * Decided in: docs/adr/0008-catalogue-concept-separation.md,
+ * docs/adr/0017-authorized-routes-in-the-envelope.md, issue #972 §12.
+ */
+import { z } from 'zod';
+import { modelLicenseSchema, modelProvenanceSchema, modelRevisionSchema, } from './catalogue.js';
+import { inferenceTimestampSchema, RESERVED_ALIA_PUBLISHER, sha256DigestSchema, } from './identifiers.js';
+/**
+ * One artifact of a release, by path and digest.
+ *
+ * `sizeBytes` is required beside the digest so a verifier can refuse a stream
+ * that is the wrong length before reading it to the end, rather than only after.
+ */
+export const aliaReleaseArtifactSchema = z
+    .object({
+    /** Path within the release, e.g. `model-00001-of-00004.safetensors`. */
+    path: z.string().min(1).max(512),
+    digest: sha256DigestSchema,
+    sizeBytes: z.number().int().positive().safe(),
+    mediaType: z.string().min(1).max(255).optional(),
+})
+    .strict();
+/**
+ * One detached signature over the manifest.
+ *
+ * `algorithm` is a CLOSED enum with one member, and both halves of that are
+ * deliberate. Closed, because a verifier that trusts a document's own algorithm
+ * name accepts whatever that document nominates, `none` included. One member,
+ * because Ed25519 is the scheme ADR 0012 already chose for asymmetric
+ * verification on this platform, and naming a scheme nothing here can check
+ * would be advertising a capability that does not exist. A second member lands
+ * when a verifier for it does — which is a closed enum gaining a member, and
+ * therefore a MINOR contract-set change the handshake surfaces (`version.ts`).
+ *
+ * `keyId` is opaque on purpose: see the header. It identifies the public key
+ * without saying what resolves it.
+ *
+ * The signature covers the canonical serialization (RFC 8785 JCS) of the
+ * manifest with `signatures` removed. The canonicalization is NAMED rather than
+ * left implicit because a digest over "the manifest" is not verifiable by two
+ * implementations that serialize JSON differently; naming it is a mechanical
+ * necessity and is independent of the open question of which key signs.
+ */
+export const aliaReleaseSignatureSchema = z
+    .object({
+    algorithm: z.enum(['ed25519']),
+    canonicalization: z.enum(['jcs']),
+    /** Opaque identifier of the public key. Resolving it is undecided. */
+    keyId: z.string().min(1).max(256),
+    /**
+     * Unpadded base64url. Exactly 86 characters, which is a 64-byte Ed25519
+     * signature — the one algorithm above. A second algorithm moves this length
+     * into a refinement keyed on `algorithm`.
+     */
+    signature: z
+        .string()
+        .regex(/^[A-Za-z0-9_-]{86}$/, 'signature must be a 64-byte ed25519 signature in unpadded base64url'),
+    signedAt: inferenceTimestampSchema,
+})
+    .strict();
+/**
+ * A signed release of an `alia/*` model revision.
+ *
+ * `signatures` is a LIST rather than one signature, because "what signs" is
+ * undecided: a single field would presuppose one signer, while a list lets an
+ * Alia release key and an existing attestation co-sign the same document without
+ * either being retrofitted later.
+ */
+export const aliaModelReleaseManifestSchema = z
+    .object({
+    /** See `version.ts`: an ingestion payload is a whole message on the wire. */
+    schemaVersion: z.literal(1),
+    /** The release's own identity, so ingestion is idempotent on it. */
+    releaseId: z.string().min(1).max(128),
+    issuedAt: inferenceTimestampSchema,
+    /**
+     * The revision being released. Carries its OWN `schemaVersion`, like
+     * `billingProfileSchema` inside `accountBillingStateSchema`: the manifest's
+     * version governs the manifest and the revision's governs the revision,
+     * which is two versions of two things rather than two versions of one.
+     */
+    revision: modelRevisionSchema,
+    /** On the MODEL rather than the revision in the catalogue, so carried here. */
+    provenance: modelProvenanceSchema,
+    license: modelLicenseSchema,
+    artifacts: z.array(aliaReleaseArtifactSchema).min(1),
+    signatures: z.array(aliaReleaseSignatureSchema).min(1),
+})
+    .strict()
+    .superRefine((manifest, ctx) => {
+    // The same rule `catalogueModelSchema` enforces on a model, applied to the
+    // carrier that creates one: `alia/*` names models Alia actually owns or
+    // derived, and a manifest is the document that would launder somebody else's
+    // weights into the namespace.
+    const publisher = manifest.revision.modelId.slice(0, manifest.revision.modelId.indexOf('/'));
+    if (publisher !== RESERVED_ALIA_PUBLISHER) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['revision', 'modelId'],
+            message: `an Alia release manifest releases a ${RESERVED_ALIA_PUBLISHER}/* model`,
+        });
+    }
+    if (manifest.provenance.releaseKind !== 'first_party_original' &&
+        manifest.provenance.releaseKind !== 'first_party_derived') {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['provenance', 'releaseKind'],
+            message: 'an Alia release manifest describes a first-party release',
+        });
+    }
+    // A derived model's base is the licence-attribution trail. Recording the
+    // derivation without naming what it derives from loses exactly the fact
+    // attribution needs.
+    if (manifest.provenance.releaseKind === 'first_party_derived' &&
+        manifest.provenance.baseModelId === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['provenance', 'baseModelId'],
+            message: 'a derived release names the model it derives from',
+        });
+    }
+    // The four fields a third-party catalogue entry may omit and a first-party
+    // release may not. See the header.
+    if (manifest.revision.modelCardUrl === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['revision', 'modelCardUrl'],
+            message: 'a first-party release publishes a model card',
+        });
+    }
+    if (manifest.revision.safety === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['revision', 'safety'],
+            message: 'a first-party release publishes its safety metadata',
+        });
+    }
+    if (manifest.revision.evaluations.length === 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['revision', 'evaluations'],
+            message: 'a first-party release publishes at least one evaluation result',
+        });
+    }
+    // The digest the catalogue will serve has to be one of the digests this
+    // manifest signed. Otherwise the signature covers a set of artifacts that
+    // does not include the weights anybody runs.
+    if (manifest.revision.artifactDigest === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['revision', 'artifactDigest'],
+            message: 'a first-party release names the digest of the artifact it serves',
+        });
+    }
+    else if (!manifest.artifacts.some((artifact) => artifact.digest === manifest.revision.artifactDigest)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['revision', 'artifactDigest'],
+            message: 'the served artifact digest must appear among the signed artifacts',
+        });
+    }
+    const paths = manifest.artifacts.map((artifact) => artifact.path);
+    if (new Set(paths).size !== paths.length) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['artifacts'],
+            message: 'each artifact path appears once in a release',
+        });
+    }
+    // Two signatures from one key are one signature written twice, and a
+    // duplicate would make a "two independent signers" check pass on one signer.
+    const keyIds = manifest.signatures.map((signature) => signature.keyId);
+    if (new Set(keyIds).size !== keyIds.length) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['signatures'],
+            message: 'each signing key signs a manifest once',
+        });
+    }
+});

package/dist/esm/inference/catalogue.js

@@ -27,7 +27,7 @@
  * Decided in: docs/adr/0008-catalogue-concept-separation.md.
  */
 import { z } from 'zod';
-import { deploymentIdSchema, inferenceDateSchema, inferenceHttpsUrlSchema, inferenceProviderSlugSchema, inferenceRegionSchema, inferenceTimestampSchema, modelIdSchema, modelReferenceSchema, modelRevisionLabelSchema, modelSlugSchema, publisherSlugSchema, RESERVED_ALIA_PUBLISHER, routingProfileSlugSchema, } from './identifiers.js';
+import { deploymentIdSchema, inferenceDateSchema, inferenceHttpsUrlSchema, inferenceProviderSlugSchema, inferenceRegionSchema, inferenceTimestampSchema, modelIdSchema, modelReferenceSchema, modelRevisionLabelSchema, modelSlugSchema, publisherSlugSchema, RESERVED_ALIA_PUBLISHER, routingProfileSlugSchema, sha256DigestSchema, } from './identifiers.js';
 import { priceSnapshotSchema } from './priceVersion.js';
 /* -------------------------------------------------------------------------- */
 /*  Shared catalogue vocabulary                                               */
@@ -279,10 +279,7 @@ export const modelRevisionSchema = z
     releasedAt: inferenceTimestampSchema,
     retiredAt: inferenceTimestampSchema.optional(),
     /** Digest of the served artifact, where Oxy hosts the weights itself. */
-    artifactDigest: z
-        .string()
-        .regex(/^sha256:[a-f0-9]{64}$/, 'artifact digest must be sha256:<64 lowercase hex>')
-        .optional(),
+    artifactDigest: sha256DigestSchema.optional(),
     modelCardUrl: inferenceHttpsUrlSchema.optional(),
     evaluations: z.array(modelEvaluationResultSchema).default([]),
     safety: modelSafetyMetadataSchema.optional(),

package/dist/esm/inference/errors.js

@@ -38,6 +38,11 @@ import { inferenceProviderSlugSchema, requestIdSchema } from './identifiers.js';
  * PLATFORM's own credential fails every identical retry until an operator
  * rotates a key, so classifying it as `provider_error` would send every client
  * into a retry loop against a request that cannot succeed.
+ *
+ * `provider_billing_refused` is in that group for the same reason and was found
+ * the same way — an upstream declining to bill OXY (Anthropic answers 402) has
+ * to be distinguishable from the customer's own balance running out, or the
+ * error tells them to go and top up an account that is not the one at fault.
  */
 export const INFERENCE_ERROR_CODES = [
     'invalid_request',
@@ -65,6 +70,7 @@ export const INFERENCE_ERROR_CODES = [
     'provider_timeout',
     'provider_overloaded',
     'provider_credential_invalid',
+    'provider_billing_refused',
     'service_unavailable',
     'internal_error',
 ];
@@ -84,6 +90,12 @@ export const inferenceErrorCodeSchema = z.enum(INFERENCE_ERROR_CODES);
  * one because only the first names an action the customer can take. Both are
  * non-retryable for the same reason: a credential an upstream has refused keeps
  * being refused until somebody replaces it.
+ *
+ * `quota_exceeded` and `provider_billing_refused` divide along the same line:
+ * both are money, but one is the CUSTOMER's ceiling and the other is Oxy's
+ * account with an upstream. Reporting the second as the first is retryability-
+ * correct and diagnostically wrong, which is the worst combination — it reads
+ * as actionable and the action does nothing.
  */
 export const NON_RETRYABLE_INFERENCE_ERROR_CODES = [
     'invalid_request',
@@ -106,27 +118,114 @@ export const NON_RETRYABLE_INFERENCE_ERROR_CODES = [
     'upstream_content_filtered',
     'cancelled',
     'provider_credential_invalid',
+    'provider_billing_refused',
 ];
 const NON_RETRYABLE_CODE_SET = new Set(NON_RETRYABLE_INFERENCE_ERROR_CODES);
+/* -------------------------------------------------------------------------- */
+/*  Credential-shaped text                                                     */
+/* -------------------------------------------------------------------------- */
+/**
+ * A run of characters long enough and opaque enough to BE a credential.
+ *
+ * The alphabet every bearer token, API key and base64/base64url secret is
+ * written in. The LENGTH floors below are what keep this from being an entropy
+ * heuristic: nothing here fires on a short word, so `authorization: none` and
+ * `api_key=***` read as what they are.
+ */
+const OPAQUE_ALPHABET = '[A-Za-z0-9][A-Za-z0-9._~+/=-]';
 /**
- * Text that looks like it carries a credential.
+ * Words a producer substitutes FOR a credential.
  *
- * A deliberately narrow set of literal markers — the shapes upstream providers
- * actually echo — rather than an entropy heuristic, which would reject
- * legitimate error text (a request id, a base64 image fragment) and teach
- * producers to strip messages until they pass.
+ * Excluded at the value position so a message whose secret has already been
+ * replaced is accepted. That acceptance is deliberate and is half the fix for
+ * issue #1027: the previous pattern refused `Authorization: [redacted]` — a
+ * correctly redacted string — which is precisely what pushed a producer into
+ * redacting the MARKER instead, and a marker-redacted string carries the secret
+ * and passes.
  */
-const CREDENTIAL_LIKE_TEXT = /(?:bearer\s+[a-z0-9._~+/=-]{8,}|authorization\s*[:=]|api[_-]?key\s*[:=]|\bsk-[a-z0-9_-]{8,}|\bsk_(?:live|test)_[a-z0-9]{8,})/i;
+const PLACEHOLDER_WORDS = 'redacted|removed|hidden|masked|scrubbed|elided|omitted|filtered|sanitized|sanitised|none|null|undefined|empty';
+/** A value position whose contents are a placeholder rather than a secret. */
+const NOT_A_PLACEHOLDER = `(?!(?:${PLACEHOLDER_WORDS})\\b)`;
 /**
- * Free text that is safe to hand a customer: bounded, and refused outright if a
- * credential marker appears in it. Applied to BOTH the Oxy message and the
+ * Header and parameter names that carry a credential, as any provider spells
+ * them.
+ *
+ * The prefix group is the whole point of the rewrite: `authorization` and
+ * `api_key` were matched literally, so `x-api-key`, `anthropic-api-key`,
+ * `x-goog-api-key` and `proxy-authorization` — the spellings an upstream
+ * actually echoes — went unrecognised.
+ */
+const CREDENTIAL_NAME = '(?:[a-z0-9]{1,20}[-_]){0,3}(?:api[-_]?(?:key|token|secret)|authorization|auth[-_]?(?:token|key)?|access[-_]?token|id[-_]?token|refresh[-_]?token|bearer[-_]?token|secret[-_]?key|private[-_]?key|client[-_]?secret|session[-_]?(?:id|key|token)|passwords?|passwd|cookie|credentials?|tokens?|secrets?)';
+/** An auth scheme sitting between the marker and the value. */
+const AUTH_SCHEME = '(?:(?:bearer|basic|token|apikey|digest)\\s+)?';
+/**
+ * The four ways a credential is recognisable in free text.
+ *
+ * Each is checked independently, so removing one signal does not clear the
+ * string — which is the failure #1027 reported. All four are load-bearing:
+ * `inference.errors.test.ts` has a case that only one of them catches, and
+ * deleting any one entry turns a test red.
+ */
+const CREDENTIAL_PATTERNS = [
+    // 1. A credential-bearing name ASSIGNED a value that is long enough to be a
+    //    credential. The value is anchored to the separator so a placeholder at
+    //    that position ends the match rather than being skipped over.
+    new RegExp(`(?:^|[^a-z0-9])${CREDENTIAL_NAME}["']?\\s*[:=]\\s*["']?${AUTH_SCHEME}${NOT_A_PLACEHOLDER}${OPAQUE_ALPHABET}{7,}`, 'i'),
+    // 2. A bearer token with no marker in front of it, which is how an upstream
+    //    quotes the header value alone.
+    new RegExp(`\\bbearer\\s+${NOT_A_PLACEHOLDER}${OPAQUE_ALPHABET}{7,}`, 'i'),
+    // 3. Token grammars that ARE credentials wherever they appear, marker or not.
+    //    This is the layer that survives a producer stripping the marker, and it
+    //    is a closed list of issued shapes rather than an entropy score, so a
+    //    request id or a base64 image fragment is unaffected.
+    //
+    //    Case-SENSITIVE on purpose: `AKIA`, `AIza` and `gh[pousr]_` are issued in
+    //    exactly that case, and matching them case-insensitively would start
+    //    firing on ordinary words.
+    /\b(?:sk-[A-Za-z0-9_-]{8,}|[sprk]k_(?:live|test)_[A-Za-z0-9]{8,}|AKIA[0-9A-Z]{12,}|ASIA[0-9A-Z]{12,}|AIza[0-9A-Za-z_-]{20,}|gh[pousr]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|xox[abeprs]-[A-Za-z0-9-]{10,}|glpat-[A-Za-z0-9_-]{16,}|npm_[A-Za-z0-9]{20,}|eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,})/,
+    // 4. A redaction placeholder standing NEXT TO a surviving opaque value — the
+    //    exact residue of the span redaction in #1027 (`{x-[redacted] <key>}`).
+    //    A correct redaction puts the placeholder WHERE the value was, so the two
+    //    never appear side by side; a marker-span redaction leaves them adjacent.
+    //    Both signals are required, which is what keeps an ordinary redacted
+    //    message from being refused.
+    new RegExp(`(?:[[<({]\\s*(?:${PLACEHOLDER_WORDS})[^\\])}>]{0,16}[\\])}>]|\\*{3,})[^A-Za-z0-9]{0,4}${OPAQUE_ALPHABET}{11,}`, 'i'),
+];
+/**
+ * Free text that is safe to hand a customer: bounded, and refused if it still
+ * looks like it carries a credential. Applied to BOTH the Oxy message and the
  * upstream one — a leak is no less a leak for having been written by a provider.
+ *
+ * ## This is a last-resort REFUSAL, not protection
+ *
+ * A pattern over the OUTPUT cannot be the control that keeps a credential out of
+ * an error, and a producer that treats it as one has the hole #1027 reported.
+ * The only reliable control is redacting the KNOWN SECRET VALUE at the point
+ * where the producer still holds the bytes it sent — which is an adapter's job
+ * and is available to nobody else. This refinement exists to catch what that
+ * control missed, and nothing here is a licence to skip it.
+ *
+ * Two rules follow, and they are the whole reason this text is longer than the
+ * pattern it describes:
+ *
+ *  - **Never redact by replacing the span this pattern matched.** The span is
+ *    the MARKER; the secret is what follows it. OxyHQ/Relay#3 measured the
+ *    result: `{x-api-key: <key>}` is refused, `{x-[redacted] <key>}` was
+ *    accepted, and both carry the key. Redaction made the leak worse by
+ *    converting "this string is dangerous" into "this string is fine".
+ *  - **This package deliberately ships no redaction helper.** One keyed on these
+ *    patterns would rebuild the same defect one layer up, and one that took the
+ *    secret as an argument would only restate what the producer already has.
+ *
+ * What it still cannot see, stated so nobody relies on it: a credential with no
+ * marker, no issued-token prefix and no placeholder beside it is bytes that look
+ * like a request id, and refusing those means refusing request ids.
  */
 export const safeErrorTextSchema = z
     .string()
     .min(1)
     .max(2000)
-    .refine((value) => !CREDENTIAL_LIKE_TEXT.test(value), 'error text must not contain credential-shaped material');
+    .refine((value) => !CREDENTIAL_PATTERNS.some((pattern) => pattern.test(value)), 'error text must not contain credential-shaped material');
 /**
  * A coarse classification of an upstream failure (ADR 0010's `upstreamCategory`).
  *

package/dist/esm/inference/identifiers.js

@@ -59,8 +59,16 @@ export const oxyCredentialIdSchema = z.string().min(1).max(64);
  * traceable as one that was served (ADR 0007, and step 1 of ADR 0010's edge
  * order). It is required on the inbound envelope, which is what makes the data
  * plane a consumer of this id rather than its source: the data plane echoes it
- * on every stream event, on the usage report and on anything it can be asked
- * about later.
+ * on every stream event, on the usage report, in its response header and on
+ * anything it can be asked about later. It never mints one for a request it
+ * received.
+ *
+ * The one case that is NOT an exception to that: an envelope the data plane
+ * cannot read or authenticate carries no id to echo, so its rejection is
+ * labelled with an id of the data plane's own — visibly local, and never
+ * correlated with an Oxy request, because there is no Oxy request it belongs to.
+ * Saying so is what stops "consumer, not source" from being read as forbidding
+ * the only id such a rejection could have.
  *
  * Correlates the Oxy edge, the data plane, the financial ledger and the
  * customer-visible receipt, so it appears on every stream event and every
@@ -106,6 +114,18 @@ export const inferenceHttpsUrlSchema = z
     .string()
     .max(2048)
     .regex(/^https:\/\/[^\s]+$/, 'must be an absolute https URL');
+/**
+ * A content digest, `sha256:<64 lowercase hex>`.
+ *
+ * ONE spelling, because a digest is compared for equality and nothing else: an
+ * uppercase or unprefixed variant of the same hash is a different string, so two
+ * records describing the same bytes would not match. Lowercase hex with the
+ * algorithm prefix is what the `inference_model_revisions` CHECK stores and what
+ * every artifact registry emits.
+ */
+export const sha256DigestSchema = z
+    .string()
+    .regex(/^sha256:[a-f0-9]{64}$/, 'digest must be sha256:<64 lowercase hex>');
 /* -------------------------------------------------------------------------- */
 /*  Catalogue references                                                      */
 /* -------------------------------------------------------------------------- */