@oxyhq/contracts 0.30.0 → 0.32.0

package/dist/types/accountGraph.d.ts

@@ -207,8 +207,66 @@ export declare const createAccountRequestSchema: z.ZodObject<{
     bio: z.ZodOptional<z.ZodString>;
     avatar: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodString>;
+    /**
+     * A named color preset KEY (`"blue"`, `"mint"`, …), never a hex value.
+     *
+     * Here at CREATION for the reason `isPrivateAccount` is, in miniature: for a
+     * managed account the color is a visual identity, and an account that is
+     * discoverable without one and acquires it on a second request is a face that
+     * changes by itself. One statement, one row, born looking like what its owner
+     * chose.
+     *
+     * The VALUE is checked in the API rather than here. The vocabulary is
+     * `USER_COLOR_PRESETS`, which is declared next to the `users_color_check` CHECK
+     * that is rendered from it — pinning the list a second time in this package
+     * would be a second source of truth for what the database accepts, and the two
+     * would drift apart silently. What this shape does is keep an over-long or
+     * non-string value from reaching the service at all.
+     */
+    color: z.ZodOptional<z.ZodString>;
     /** Ordered, PRIMARY FIRST — see rule 2 above {@link ACCOUNT_CATEGORY_IDS}. */
     accountCategories: z.ZodOptional<z.ZodEffects<z.ZodArray<z.ZodEnum<["news", "politics", "business", "startup", "finance", "crypto", "marketplace", "retail", "real_estate", "agency", "landlord", "cooperative", "architecture", "technology", "software", "ai", "security", "automation", "science", "education", "books", "health", "fitness", "sports", "gaming", "music", "film", "podcast", "art", "photography", "comedy", "food", "travel", "fashion", "home_garden", "diy", "automotive", "animals", "family", "nonprofit", "government", "community", "activism", "environment", "religion", "other"]>, "many">, ("news" | "politics" | "business" | "startup" | "finance" | "crypto" | "marketplace" | "retail" | "real_estate" | "agency" | "landlord" | "cooperative" | "architecture" | "technology" | "software" | "ai" | "security" | "automation" | "science" | "education" | "books" | "health" | "fitness" | "sports" | "gaming" | "music" | "film" | "podcast" | "art" | "photography" | "comedy" | "food" | "travel" | "fashion" | "home_garden" | "diy" | "automotive" | "animals" | "family" | "nonprofit" | "government" | "community" | "activism" | "environment" | "religion" | "other")[], ("news" | "politics" | "business" | "startup" | "finance" | "crypto" | "marketplace" | "retail" | "real_estate" | "agency" | "landlord" | "cooperative" | "architecture" | "technology" | "software" | "ai" | "security" | "automation" | "science" | "education" | "books" | "health" | "fitness" | "sports" | "gaming" | "music" | "film" | "podcast" | "art" | "photography" | "comedy" | "food" | "travel" | "fashion" | "home_garden" | "diy" | "automotive" | "animals" | "family" | "nonprofit" | "government" | "community" | "activism" | "environment" | "religion" | "other")[]>>;
+    /**
+     * Create the account already opted OUT of discovery.
+     *
+     * ## Why this belongs at CREATION and not only on the privacy route
+     *
+     * Every account is born discoverable: the column defaults to `false` and
+     * nothing on the create path wrote it, so a new account appears in people
+     * search the instant it exists. For a human signing themselves up that is the
+     * right default and it is NOT changed here. For an account a program creates
+     * on someone's behalf — an agent, an unlaunched project, an organization for
+     * something not yet announced — it publishes the thing before its owner ever
+     * decided to.
+     *
+     * The alternative is a second call right after create, which is a window in
+     * which the account IS public, and a window whose closing depends on a second
+     * request succeeding. A field here has neither: one statement, one row, born
+     * in the state the caller asked for.
+     *
+     * ## It reuses the existing flag deliberately
+     *
+     * This is `privacy_is_private_account`, the same one `PUT /users/:id/privacy`
+     * toggles — not a new "published" column. A second visibility flag would be a
+     * second source of truth for one question, and the two would disagree.
+     *
+     * Inherited semantics, stated because reusing a flag means inheriting ALL of
+     * it: the account is kept out of people search, out of the follow-graph lists
+     * (`followers` / `following` / `mutuals`), out of `/similar` and out of the
+     * recommendation candidate pools, and its non-public, non-unlisted media
+     * becomes follower-gated. It does NOT hide the profile from someone who knows
+     * the handle, and it carries NO follow-approval flow — following is immediate
+     * and unilateral whatever this says, so nothing here creates a request queue
+     * nobody attends.
+     *
+     * ## Not conditioned on `kind`, on purpose
+     *
+     * The same reasoning as `accountCategories` above: this object does not
+     * refine on kind, and an unlaunched organization has exactly the problem an
+     * unpublished agent does. The discovery predicate never reads `kind`, so the
+     * remedy must not either.
+     */
+    isPrivateAccount: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     kind: "organization" | "project" | "bot" | "channel";
     username: string;
@@ -221,7 +279,9 @@ export declare const createAccountRequestSchema: z.ZodObject<{
     bio?: string | undefined;
     avatar?: string | undefined;
     description?: string | undefined;
+    color?: string | undefined;
     accountCategories?: ("news" | "politics" | "business" | "startup" | "finance" | "crypto" | "marketplace" | "retail" | "real_estate" | "agency" | "landlord" | "cooperative" | "architecture" | "technology" | "software" | "ai" | "security" | "automation" | "science" | "education" | "books" | "health" | "fitness" | "sports" | "gaming" | "music" | "film" | "podcast" | "art" | "photography" | "comedy" | "food" | "travel" | "fashion" | "home_garden" | "diy" | "automotive" | "animals" | "family" | "nonprofit" | "government" | "community" | "activism" | "environment" | "religion" | "other")[] | undefined;
+    isPrivateAccount?: boolean | undefined;
 }, {
     kind: "organization" | "project" | "bot" | "channel";
     username: string;
@@ -234,6 +294,8 @@ export declare const createAccountRequestSchema: z.ZodObject<{
     bio?: string | undefined;
     avatar?: string | undefined;
     description?: string | undefined;
+    color?: string | undefined;
     accountCategories?: ("news" | "politics" | "business" | "startup" | "finance" | "crypto" | "marketplace" | "retail" | "real_estate" | "agency" | "landlord" | "cooperative" | "architecture" | "technology" | "software" | "ai" | "security" | "automation" | "science" | "education" | "books" | "health" | "fitness" | "sports" | "gaming" | "music" | "film" | "podcast" | "art" | "photography" | "comedy" | "food" | "travel" | "fashion" | "home_garden" | "diy" | "automotive" | "animals" | "family" | "nonprofit" | "government" | "community" | "activism" | "environment" | "religion" | "other")[] | undefined;
+    isPrivateAccount?: boolean | undefined;
 }>;
 export type CreateAccountRequest = z.infer<typeof createAccountRequestSchema>;

package/dist/types/index.d.ts

@@ -77,13 +77,15 @@ export { routingTargetSchema, routingPolicyScopeSchema, routingFallbackPolicySch
 export type { RoutingTarget, RoutingPolicyScope, RoutingFallbackPolicy, RoutingPolicy, RoutingPolicyReference, AuthorizedRoute, } from './inference/routingPolicy';
 export { aliaReleaseArtifactSchema, aliaReleaseSignatureSchema, aliaModelReleaseManifestSchema, } from './inference/aliaModelRelease';
 export type { AliaReleaseArtifact, AliaReleaseSignature, AliaModelReleaseManifest, } from './inference/aliaModelRelease';
+export { modelDistributionMethodSchema, modelSystemicRiskTierSchema, trainingComputeFlopsSchema, SYSTEMIC_RISK_COMPUTE_THRESHOLD_FLOPS, modelDownstreamDocumentationSchema, modelGpaiDocumentationSchema, modelLineDeclarationSchema, modelReleaseIngestionRequestSchema, modelReleaseIngestionResultSchema, modelDocumentationSchema, } from './inference/modelDocumentation';
+export type { ModelDistributionMethod, ModelSystemicRiskTier, ModelDownstreamDocumentation, ModelGpaiDocumentation, ModelLineDeclaration, ModelReleaseIngestionRequest, ModelReleaseIngestionResult, ModelDocumentation, } from './inference/modelDocumentation';
 export { inferenceContentSourceSchema, inferenceContentPartSchema, inferenceToolCallSchema, inferenceMessageRoleSchema, inferenceMessageSchema, inferenceInputSchema, samplingParametersSchema, toolDefinitionSchema, toolChoiceSchema, responseFormatSchema, clientRequestMetadataSchema, inferenceRequestSchema, } from './inference/request';
 export type { InferenceContentSource, InferenceContentPart, InferenceToolCall, InferenceMessageRole, InferenceMessage, InferenceInput, SamplingParameters, ToolDefinition, ToolChoice, ResponseFormat, ClientRequestMetadata, InferenceRequest, } from './inference/request';
 export { inferenceStreamStartEventSchema, inferenceStreamDeltaEventSchema, inferenceStreamToolCallEventSchema, inferenceStreamUsageEventSchema, inferenceRouteSwitchDetailSchema, inferenceRouteSwitchReasonSchema, inferenceStreamRouteSwitchEventSchema, inferenceStreamErrorEventSchema, inferenceFinishReasonSchema, inferenceStreamDoneEventSchema, inferenceStreamEventSchema, } from './inference/streamEvents';
 export type { InferenceStreamStartEvent, InferenceStreamDeltaEvent, InferenceStreamToolCallEvent, InferenceStreamUsageEvent, InferenceRouteSwitchDetail, InferenceRouteSwitchReason, InferenceStreamRouteSwitchEvent, InferenceStreamErrorEvent, InferenceFinishReason, InferenceStreamDoneEvent, InferenceStreamEvent, } from './inference/streamEvents';
 export { usageReservationRequestSchema, usageReservationStatusSchema, usageReservationSchema, inferenceRequestOutcomeSchema, normalizedUsageReportSchema, usageReceiptSchema, usageRefundSubjectSchema, usageRefundReasonSchema, usageRefundSchema, } from './inference/usage';
 export type { UsageReservationRequest, UsageReservationStatus, UsageReservation, InferenceRequestOutcome, NormalizedUsageReport, UsageReceipt, UsageRefundSubject, UsageRefundReason, UsageRefund, } from './inference/usage';
-export { providerConnectionScopeSchema, providerSecretReferenceSchema, providerConnectionValidationSchema, providerConnectionStatusSchema, providerConnectionSchema, } from './inference/providerConnection';
+export { PROVIDER_SECRET_REFERENCE_NAMESPACE, providerConnectionScopeSchema, providerSecretReferenceSchema, providerConnectionValidationSchema, providerConnectionStatusSchema, providerConnectionSchema, } from './inference/providerConnection';
 export type { ProviderConnectionScope, ProviderConnectionValidation, ProviderConnectionStatus, ProviderConnection, } from './inference/providerConnection';
 export { BILLING_MODES, billingModeSchema, BILLING_PROFILE_STATUSES, billingProfileStatusSchema, autoRechargeSchema, billingProfileSchema, accountBillingStateSchema, BILLING_INVOICE_STATUSES, billingInvoiceStatusSchema, billingInvoiceSchema, EXTERNAL_PAYMENT_PROVIDERS, externalPaymentProviderSchema, EXTERNAL_PAYMENT_KINDS, externalPaymentKindSchema, externalPaymentSchema, AUTO_RECHARGE_STATUSES, autoRechargeStatusSchema, autoRechargeAttemptSchema, RECONCILIATION_DISCREPANCY_KINDS, reconciliationDiscrepancyKindSchema, RECONCILIATION_RUN_STATUSES, reconciliationRunStatusSchema, reconciliationDiscrepancySchema, reconciliationRunSchema, reconciliationReportSchema, } from './inference/accountBilling';
 export type { BillingMode, BillingProfileStatus, AutoRecharge, BillingProfile, AccountBillingState, BillingInvoiceStatus, BillingInvoice, ExternalPaymentProvider, ExternalPaymentKind, ExternalPayment, AutoRechargeStatus, AutoRechargeAttempt, ReconciliationDiscrepancyKind, ReconciliationRunStatus, ReconciliationDiscrepancy, ReconciliationRun, ReconciliationReport, } from './inference/accountBilling';

package/dist/types/inference/aliaModelRelease.d.ts

@@ -35,14 +35,22 @@
  * bounded: ingestion is a release-time operation an operator retries once Oxy
  * takes the newer contract, not a served request that becomes unsettleable.
  *
- * ## What is deliberately NOT here
+ * ## The ingestion path, which this file used to say did not exist
+ *
+ * It does now: `POST /inference/admin/model-releases`, defined by
+ * `modelReleaseIngestionRequestSchema` in `modelDocumentation.ts`. This shape is
+ * unchanged — the request COMPOSES it, alongside two records that are Oxy's own
+ * rather than the signer's (the GPAI documentation and the capability sheet a
+ * manifest does not carry), precisely so the bytes a signature covers stay
+ * exactly the bytes described here.
  *
- * **No HTTP write path.** The catalogue's emptiness is currently a safety
- * property — `scripts/seed-inference-catalogue.ts` refuses to invent a licence
- * or a retention flag because "a plausible invented value in a catalogue is
- * worse than an absent one" — and a staff write path into it with nothing to
- * ingest is an unexercised hazard. The schema lands; the endpoint waits for a
- * real manifest to ingest.
+ * The earlier objection was that a staff write path into an empty catalogue is
+ * an unexercised hazard. What answers it is containment rather than emptiness: an
+ * ingested revision lands with `is_current = false` and no deployment, so nothing
+ * it creates is servable or listed, and a route still needs an approved
+ * contract/legal review before any customer can select it.
+ *
+ * ## What is deliberately NOT here
  *
  * **No `payloadDigest` field.** The signature is over the canonical
  * serialization of this manifest with `signatures` removed, and a verifier
@@ -64,7 +72,11 @@
  * custody, rotation and revocation consequences. So `keyId` is an OPAQUE
  * identifier and this file names no registry that resolves it: either answer
  * fits, and neither is presupposed. Until it is answered a manifest can be
- * parsed and cannot be verified, which is the second reason no endpoint ships.
+ * parsed and cannot be VERIFIED, so the ingestion path records no verification
+ * finding at all: it stores the signatures and the manifest as received, and the
+ * authority for the ingest is the staff member who performed it. A nullable
+ * `verified` column nothing ever writes would read, to whoever scanned the table
+ * later, as a check that ran.
  *
  * Decided in: docs/adr/0008-catalogue-concept-separation.md,
  * docs/adr/0017-authorized-routes-in-the-envelope.md, issue #972 §12.