@sealkeeper/schema 0.4.8 → 0.5.0

package/dist/credential.js

@@ -5,6 +5,7 @@ import { Jws } from './envelope.js';
 import { StoredVersion } from './events.js';
 import { HANDSHAKE_MAX_CHARS } from './handshake.js';
 import { CountedCounts, CountedCountsV3, Level, StandingCounts, StandingCountsV3, } from './standing.js';
+import { STORED_TASK_CATEGORIES, StoredTaskCategory } from './tasks.js';
 // The issuer every SEAL carries as iss from the SealKeeper cutover on.
 export const CREDENTIAL_ISSUER = 'sealkeeper.run';
 // Issuers a verifier still accepts for a while after the cutover. A SEAL
@@ -48,17 +49,33 @@ export const SEAL_EXTENSION_URIS = [
 ];
 const Seconds = z.int().min(0);
 const Count = z.int().min(0);
-// The version of the SEAL standard this issuer writes, carried as ver.
+// Version 1 of the SEAL standard, the ver of a version 1 SEAL. The API
+// writes version 1, 3 or 4, whichever its SEAL_ISSUE_VERSION names.
 export const SEAL_VERSION = 1;
 // Every version a verifier understands. Version 2 is version 1 plus
 // `counted`, the counted evidence the level read (VOU-139). Version 3 is
 // version 2 plus the posted counts, `fingerprint` and `state`, with the
-// deprecated `version` dropped (VOU-77). CLIs before 0.4.5 understand
-// version 1 only, and CLIs before 0.4.11 do not understand version 3, and
-// each refuses a ver it does not know. So the issuer keeps writing version
-// 1 until every CLI before 0.4.11 is gone. Verifiers accept all three from
-// CLI 0.4.11 on. SEAL standard section 9.
-export const SEAL_VERSIONS = [1, 2, 3];
+// deprecated `version` dropped (VOU-77). Version 4 is version 3 plus
+// `trust` and `top_categories` (VOU-560). CLIs before 0.4.5 understand
+// version 1 only, CLIs before 0.4.11 do not understand version 3 and CLIs
+// before 0.4.14 do not understand version 4, and each refuses a ver it does
+// not know. So the issuer keeps writing version 1 until every CLI before
+// the first that reads the version it moves to is gone, and then moves
+// when the API's SEAL_ISSUE_VERSION is set by hand. Verifiers accept
+// versions 1, 2 and 3 from CLI 0.4.11 on and all four from CLI 0.4.14 on.
+// SEAL standard section 9.
+export const SEAL_VERSIONS = [1, 2, 3, 4];
+// The first CLI that reads SEAL version 3, a CliVersion. Gone means no CLI
+// older than this, and no signed request without a CLI version, for
+// SEAL_V3_QUIET_DAYS whole days. GET /internal/metrics measures it from
+// the CLI version each signed request names (VOU-454), in cliVersions.
+export const SEAL_V3_FIRST_CLI = '0.4.11';
+export const SEAL_V3_QUIET_DAYS = 14;
+// The first CLI that reads SEAL version 4, a CliVersion, under the same
+// rule and the same SEAL_V3_QUIET_DAYS. It is also the first CLI that
+// names its version on a signed request, so every older one is a request
+// without a CLI version, which cliVersions already counts as old.
+export const SEAL_V4_FIRST_CLI = '0.4.14';
 // One identity attestation reference, SEAL standard section 4a. A pointer
 // to an attestation an external provider made, never the attestation, a
 // name or a tenant id. kind is one of the four names or a URL for anything
@@ -98,22 +115,26 @@ export const SEAL_MAX_TTL_SECONDS = 24 * 3600;
 // valid. Five minutes covers clock drift between issuer and verifier.
 export const SEAL_CLOCK_SKEW_SECONDS = 300;
 // iss on the issuer side is CREDENTIAL_ISSUER and nothing else. The API
-// writes it and reads its stored SEALs back with CredentialPayload, so a
+// writes it and reads its stored SEALs back with IssuedSealPayload, so a
 // stored SEAL with a legacy issuer fails that parse and is reissued. Only
 // a verifier accepts a legacy issuer, through the Verified shapes below,
 // and parseSealPayload checks the clock with acceptedIssuer first.
 const IssuedIssuer = z.literal(CREDENTIAL_ISSUER);
 const VerifiedIssuer = z.enum([CREDENTIAL_ISSUER, ...LEGACY_ISSUERS]);
-// The state of a version 3 SEAL, how the agent's current fingerprint stands
-// against the one its level was last confirmed under. The set is closed.
-// matches is the only value the issuer writes until the re-check flow
-// exists. changed and provisional are reserved for it, so a verifier of
-// version 3 already reads them.
+// The state of a version 3 or 4 SEAL, how the agent's current fingerprint
+// stands against the one the SEAL carries. The set is closed. matches is
+// the only value the issuer writes until the re-check flow exists, and
+// means only that the fingerprint is the one on the issuer's record at
+// issue. With a null fingerprint it says nothing. changed and provisional
+// are reserved for that flow, so a verifier of version 3 already reads
+// them.
 export const SealState = z.enum(['matches', 'changed', 'provisional']);
-// The fingerprint of a version 3 SEAL. hash is SHA-256 over bytes a later
+// The fingerprint of a version 3 or 4 SEAL. hash is SHA-256 over bytes a later
 // change to the standard defines, base64url, and a verifier treats it as
-// opaque until then. at is Unix seconds of when the level was last
-// confirmed under it, never after iat. null when the agent has sent no
+// opaque until then. It is the agent's current fingerprint on the issuer's
+// record at issue. at is Unix seconds of when the agent's software says it
+// captured it, never after iat, unchecked, and no level is checked against
+// it (SEAL standard section 4b). null when the agent has sent no
 // fingerprint. A 32 byte value in base64url has 43 characters and only
 // some last characters, the rule agent-id.ts uses for a key.
 export const SealFingerprint = z
@@ -124,6 +145,65 @@ export const SealFingerprint = z
     at: Seconds,
 })
     .nullable();
+// The most entries top_categories of a version 4 SEAL holds.
+export const SEAL_TOP_CATEGORIES_MAX = 3;
+// One entry of top_categories in a version 4 SEAL, a category of the
+// agent version's Trust Score and its score there, a whole number.
+export const SealTopCategory = z.strictObject({
+    category: StoredTaskCategory,
+    score: Count,
+});
+// A stored score as a SEAL carries it, rounded as the Trust answer rounds.
+// A value that is not a finite number, which no scoring run writes, reads 0.
+const whole = (n) => Number.isFinite(n) ? Math.max(0, Math.round(n)) : 0;
+const categoryOrder = (c) => STORED_TASK_CATEGORIES.indexOf(c);
+// Highest score first, a tie in the order of STORED_TASK_CATEGORIES, the
+// order topDimensions keeps for the competence categories. Negative when a
+// goes first.
+const bySealOrder = (a, b) => b.score - a.score || categoryOrder(a.category) - categoryOrder(b.category);
+// top_categories of a version 4 SEAL. At most SEAL_TOP_CATEGORIES_MAX,
+// each category once, in bySealOrder, so the order a verifier reads is the
+// one sealTrust writes.
+export const SealTopCategories = z
+    .array(SealTopCategory)
+    .max(SEAL_TOP_CATEGORIES_MAX)
+    .refine((list) => list.every((c, i) => i === 0 || bySealOrder(list[i - 1], c) < 0), 'top_categories must be highest first, a tie in category order, each category once');
+/*
+ * trust and top_categories of a version 4 SEAL, from the stored rows the
+ * scoring run wrote for the agent version the SEAL is for, its Trust Score
+ * (standing.trust_score) and its categories (standing.trust_categories).
+ * The issuer computes nothing new. trust is the Trust Score rounded to a
+ * whole number as GET /v1/agents/:id/trust rounds it, 0 with none stored.
+ * top_categories is the SEAL_TOP_CATEGORIES_MAX categories with the
+ * highest stored score, a tie in category order, chosen before rounding so
+ * they are the three the trust answer ranks first, save an exact tie at the
+ * third, which it breaks by name. Each is then rounded the same way and put
+ * in bySealOrder, empty with none stored. A key that is not a stored task
+ * category and an entry without a finite score are left out, and a
+ * trust_score that is not finite reads 0, so a stray stored value never
+ * stops a SEAL from being issued. The issuer reads this and nothing else
+ * for the two fields, and the verifier's shape holds the same order. A
+ * value is never below 0, as no stored score is, so a SEAL is never
+ * refused over it.
+ */
+export function sealTrust(score, categories) {
+    const stored = [];
+    for (const [key, c] of Object.entries(categories ?? {})) {
+        const category = StoredTaskCategory.safeParse(key);
+        const raw = c?.score;
+        if (category.success && typeof raw === 'number' && Number.isFinite(raw)) {
+            stored.push({ category: category.data, score: raw });
+        }
+    }
+    return {
+        trust: whole(score ?? 0),
+        top_categories: stored
+            .sort(bySealOrder)
+            .slice(0, SEAL_TOP_CATEGORIES_MAX)
+            .map((c) => ({ category: c.category, score: whole(c.score) }))
+            .sort(bySealOrder),
+    };
+}
 const withinMaxTtl = (c) => c.exp - c.iat <= SEAL_MAX_TTL_SECONDS;
 const MAX_TTL_MESSAGE = 'exp must be at most 24 hours after iat';
 /*
@@ -133,8 +213,9 @@ const MAX_TTL_MESSAGE = 'exp must be at most 24 hours after iat';
  * working. VOU-77 drops it.
  *
  * counts are the standard's eight, over the 180 day window. last_active is
- * Unix seconds of the agent's newest accepted event, null when it has sent
- * none, and dormant_days whole days since then at issue, null with it.
+ * Unix seconds of the agent's last activity, its newest accepted event or
+ * its newest task work the API recorded, null when it has neither, and
+ * dormant_days whole days since then at issue, null with it.
  */
 const v1Payload = (iss, scores) => z
     .strictObject({
@@ -191,8 +272,8 @@ const v2Payload = (iss, scores) => z
  * version. counts gains the three posted counts (StandingCountsV3), counted
  * gains the counted twins of posted_tasks and posted_confirmed_tasks
  * (CountedCountsV3), and fingerprint and state are new. Each counted value
- * is at most its raw count, and fingerprint.at is not after iat. Nothing
- * issues it yet.
+ * is at most its raw count, and fingerprint.at is not after iat. The API
+ * issues it when its SEAL_ISSUE_VERSION is 3.
  */
 const v3Payload = (iss, scores) => z
     .strictObject({
@@ -221,25 +302,75 @@ const v3Payload = (iss, scores) => z
     c.counted.posted_tasks <= c.counts.posted_tasks &&
     c.counted.posted_confirmed_tasks <= c.counts.posted_confirmed_tasks, 'counted must not exceed counts')
     .refine((c) => c.fingerprint === null || c.fingerprint.at <= c.iat, 'fingerprint.at must not be after iat');
+/*
+ * Version 4. Every version 3 field with the same meaning, plus trust and
+ * top_categories (VOU-560, D-UI-4, D-UI-5), both from sealTrust. trust is
+ * the Trust Score of the agent version the SEAL is for, a whole number.
+ * top_categories is its highest categories, at most three, in the order
+ * SealTopCategories holds. Both are what the agent has earned, read from
+ * the issuer's own rows at issue, never a permission and never a level.
+ * The API issues it when its SEAL_ISSUE_VERSION is 4.
+ */
+const v4Payload = (iss, scores) => z
+    .strictObject({
+    iss,
+    sub: AgentId,
+    ver: z.literal(4),
+    iat: Seconds,
+    exp: Seconds,
+    agent_version: StoredVersion,
+    level: Level,
+    scores,
+    counts: StandingCountsV3,
+    counted: CountedCountsV3,
+    fingerprint: SealFingerprint,
+    state: SealState,
+    trust: Count,
+    top_categories: SealTopCategories,
+    operator: z.strictObject({ verified: z.boolean() }),
+    identity: z.array(IdentityReference).max(16),
+    last_active: Seconds.nullable(),
+    dormant_days: Count.nullable(),
+})
+    .refine((c) => c.exp > c.iat, 'exp must be after iat')
+    .refine(withinMaxTtl, MAX_TTL_MESSAGE)
+    .refine((c) => c.counted.seed_tasks <= c.counts.seed_tasks &&
+    c.counted.server_checked_tasks <= c.counts.server_checked_tasks &&
+    c.counted.confirmed_tasks <= c.counts.confirmed_tasks &&
+    c.counted.posted_tasks <= c.counts.posted_tasks &&
+    c.counted.posted_confirmed_tasks <= c.counts.posted_confirmed_tasks, 'counted must not exceed counts')
+    .refine((c) => c.fingerprint === null || c.fingerprint.at <= c.iat, 'fingerprint.at must not be after iat');
 // The issuer side. iss is CREDENTIAL_ISSUER only, and scores carry
 // competence by category only.
 export const CredentialPayload = v1Payload(IssuedIssuer, IssuedScores);
 export const CredentialPayloadV2 = v2Payload(IssuedIssuer, IssuedScores);
 export const CredentialPayloadV3 = v3Payload(IssuedIssuer, IssuedScores);
+export const CredentialPayloadV4 = v4Payload(IssuedIssuer, IssuedScores);
+// What the issuer writes, version 1, 3 or 4, whichever the API's
+// SEAL_ISSUE_VERSION names. The API serves it and reads its stored SEALs
+// back with it, so a SEAL stored before the setting changed still parses
+// and is reissued once. Version 2 is never issued.
+export const IssuedSealPayload = z.union([
+    CredentialPayload,
+    CredentialPayloadV3,
+    CredentialPayloadV4,
+]);
 // The verifier side. iss may also be a LEGACY_ISSUERS entry, and scores may
 // also carry competence by task type. The shape has
 // no clock, so read these through parseSealPayload, never on their own.
 export const VerifiedCredentialPayload = v1Payload(VerifiedIssuer, VerifiedScores);
 export const VerifiedCredentialPayloadV2 = v2Payload(VerifiedIssuer, VerifiedScores);
 export const VerifiedCredentialPayloadV3 = v3Payload(VerifiedIssuer, VerifiedScores);
-// Any payload a verifier accepts today, version 1, 2 or 3, from the current
-// issuer or a legacy one. Each version has every field of the one before
-// with the same meaning, except version, which version 3 drops. A reader
-// takes the agent version from agent_version, which all three carry.
+export const VerifiedCredentialPayloadV4 = v4Payload(VerifiedIssuer, VerifiedScores);
+// Any payload a verifier accepts today, version 1, 2, 3 or 4, from the
+// current issuer or a legacy one. Each version has every field of the one
+// before with the same meaning, except version, which version 3 drops. A
+// reader takes the agent version from agent_version, which all four carry.
 export const SealPayload = z.union([
     VerifiedCredentialPayload,
     VerifiedCredentialPayloadV2,
     VerifiedCredentialPayloadV3,
+    VerifiedCredentialPayloadV4,
 ]);
 // The counted evidence a SEAL carries, version 2 on, null before.
 export const sealCounted = (p) => 'counted' in p ? p.counted : null;
@@ -247,7 +378,7 @@ const hasVer = (raw) => typeof raw === 'object' && raw !== null && 'ver' in raw;
 /*
  * Whether a verifier understands the version of a signed payload. Read
  * after the signature and the issuer check out and before the shape. ver 1,
- * 2 and 3 (SEAL_VERSIONS) are understood. Any other ver is
+ * 2, 3 and 4 (SEAL_VERSIONS) are understood. Any other ver is
  * unsupported_version, as section 9 of the standard says, never valid with
  * an unknown meaning. So is no ver at all, a SEAL issued before version 1,
  * whose last one expired on 26 September 2026. Anything that is not an
@@ -285,11 +416,13 @@ export function parseSealPayload(raw, nowSeconds) {
     if (problem)
         return { ok: false, reason: problem };
     const ver = hasVer(raw) ? raw.ver : undefined;
-    const parsed = (ver === 3
-        ? VerifiedCredentialPayloadV3
-        : ver === 2
-            ? VerifiedCredentialPayloadV2
-            : VerifiedCredentialPayload).safeParse(raw);
+    const parsed = (ver === 4
+        ? VerifiedCredentialPayloadV4
+        : ver === 3
+            ? VerifiedCredentialPayloadV3
+            : ver === 2
+                ? VerifiedCredentialPayloadV2
+                : VerifiedCredentialPayload).safeParse(raw);
     return parsed.success
         ? { ok: true, payload: parsed.data }
         : { ok: false, reason: 'malformed' };

package/dist/dimensions.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { TaskCategory } from './tasks.js';
+import { StoredTaskCategory } from './tasks.js';
 export declare const TaskType: z.ZodString;
 export type TaskType = z.infer<typeof TaskType>;
 export declare const BaseDimension: z.ZodEnum<{
@@ -9,7 +9,7 @@ export declare const BaseDimension: z.ZodEnum<{
     safety: "safety";
 }>;
 export type BaseDimension = z.infer<typeof BaseDimension>;
-export declare const CompetenceDimension: z.ZodTemplateLiteral<"competence:code" | "competence:conversation" | "competence:data" | "competence:operations" | "competence:other" | "competence:research" | "competence:writing">;
+export declare const CompetenceDimension: z.ZodTemplateLiteral<"competence:code" | "competence:conversation" | "competence:data" | "competence:math" | "competence:operations" | "competence:other" | "competence:research" | "competence:writing">;
 export type CompetenceDimension = z.infer<typeof CompetenceDimension>;
 export declare const COMPETENCE_TYPES_MAX = 32;
 export declare const COMPETENCE_DIMENSIONS: readonly CompetenceDimension[];
@@ -18,7 +18,7 @@ export declare const Dimension: z.ZodUnion<readonly [z.ZodEnum<{
     provenance: "provenance";
     reliability: "reliability";
     safety: "safety";
-}>, z.ZodTemplateLiteral<"competence:code" | "competence:conversation" | "competence:data" | "competence:operations" | "competence:other" | "competence:research" | "competence:writing">]>;
+}>, z.ZodTemplateLiteral<"competence:code" | "competence:conversation" | "competence:data" | "competence:math" | "competence:operations" | "competence:other" | "competence:research" | "competence:writing">]>;
 export type Dimension = z.infer<typeof Dimension>;
 export declare const TypeCompetenceDimension: z.ZodTemplateLiteral<`competence:${string}`>;
 export type TypeCompetenceDimension = z.infer<typeof TypeCompetenceDimension>;
@@ -27,8 +27,8 @@ export declare const AcceptedDimension: z.ZodUnion<readonly [z.ZodEnum<{
     provenance: "provenance";
     reliability: "reliability";
     safety: "safety";
-}>, z.ZodTemplateLiteral<"competence:code" | "competence:conversation" | "competence:data" | "competence:operations" | "competence:other" | "competence:research" | "competence:writing">, z.ZodTemplateLiteral<`competence:${string}`>]>;
+}>, z.ZodTemplateLiteral<"competence:code" | "competence:conversation" | "competence:data" | "competence:math" | "competence:operations" | "competence:other" | "competence:research" | "competence:writing">, z.ZodTemplateLiteral<`competence:${string}`>]>;
 export type AcceptedDimension = z.infer<typeof AcceptedDimension>;
-export declare const competence: (category: TaskCategory) => CompetenceDimension;
-export declare const categoryOf: (dimension: string) => TaskCategory | null;
+export declare const competence: (category: StoredTaskCategory) => CompetenceDimension;
+export declare const categoryOf: (dimension: string) => StoredTaskCategory | null;
 export declare const isTrustDimension: (dimension: string) => boolean;

package/dist/dimensions.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { TASK_CATEGORIES, TaskCategory } from './tasks.js';
+import { STORED_TASK_CATEGORIES, StoredTaskCategory } from './tasks.js';
 export const TaskType = z.string().regex(/^[a-z0-9_-]{1,32}$/);
 export const BaseDimension = z.enum([
     'reliability',
@@ -11,21 +11,25 @@ export const BaseDimension = z.enum([
  * Competence rolls up to the task's category (RT-3), one dimension per
  * category, competence:data and so on. The per task type values stay a
  * breakdown under the category on the score answer and are never a
- * dimension of their own.
+ * dimension of their own. It reads the stored categories, conversation and
+ * other included, since a task keeps the category it was scored under
+ * (D-UI-12), so the run still scores them and a stored score or a SEAL
+ * that names one still parses until its tasks leave the window.
  */
 export const CompetenceDimension = z.templateLiteral([
     'competence:',
-    TaskCategory,
+    StoredTaskCategory,
 ]);
 // The most task types a competence entry's breakdown lists, the most
 // claimed first, so the answer stays small however many free task types an
 // agent took.
 export const COMPETENCE_TYPES_MAX = 32;
-// The seven competence dimensions in category order, the order every list
-// shows them in.
-export const COMPETENCE_DIMENSIONS = TASK_CATEGORIES.map((c) => CompetenceDimension.parse(`competence:${c}`));
+// The eight competence dimensions in stored category order, the order every
+// list shows them in. The scoring run keeps a stored competence row only
+// when it names one of them.
+export const COMPETENCE_DIMENSIONS = STORED_TASK_CATEGORIES.map((c) => CompetenceDimension.parse(`competence:${c}`));
 // What the issuer writes and what a request may name, the base dimensions
-// and the seven competence categories.
+// and the eight competence categories.
 export const Dimension = z.union([BaseDimension, CompetenceDimension]);
 /*
  * competence:<task_type>, the competence key SEALs carried before RT-3,

package/dist/duel-next.d.ts

@@ -0,0 +1,232 @@
+import { z } from 'zod';
+export declare const DUEL_LIST_MAX = 10;
+export declare const DuelNextRequest: z.ZodObject<{
+    accept: z.ZodOptional<z.ZodUUID>;
+    decline: z.ZodOptional<z.ZodUUID>;
+    rematch: z.ZodOptional<z.ZodUUID>;
+    invite: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodString]>>;
+    category: z.ZodOptional<z.ZodEnum<{
+        code: "code";
+        data: "data";
+        math: "math";
+        operations: "operations";
+        research: "research";
+        writing: "writing";
+    }>>;
+    cancel: z.ZodDefault<z.ZodBoolean>;
+    list: z.ZodDefault<z.ZodBoolean>;
+    routine: z.ZodDefault<z.ZodBoolean>;
+    fingerprint: z.ZodOptional<z.ZodObject<{
+        parts: z.ZodObject<{
+            model_set: z.ZodUnion<readonly [z.ZodObject<{
+                hash: z.ZodString;
+            }, z.core.$strict>, z.ZodLiteral<"not_declared">, z.ZodLiteral<"unstable">]>;
+            prompt: z.ZodUnion<readonly [z.ZodObject<{
+                hash: z.ZodString;
+            }, z.core.$strict>, z.ZodLiteral<"not_declared">, z.ZodLiteral<"unstable">]>;
+            tools: z.ZodUnion<readonly [z.ZodObject<{
+                hash: z.ZodString;
+            }, z.core.$strict>, z.ZodLiteral<"not_declared">, z.ZodLiteral<"unstable">]>;
+            framework: z.ZodUnion<readonly [z.ZodObject<{
+                hash: z.ZodString;
+            }, z.core.$strict>, z.ZodLiteral<"not_declared">, z.ZodLiteral<"unstable">]>;
+        }, z.core.$strict>;
+        hash: z.ZodString;
+        captured_at: z.ZodNumber;
+    }, z.core.$strict>>;
+    issuedAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type DuelNextRequest = z.infer<typeof DuelNextRequest>;
+export declare const DUEL_STEPS: readonly ['task', 'invite', 'matched', 'seek', 'out_of_units', 'accept', 'decline', 'sent', 'cancel', 'list'];
+export declare const DuelNext: z.ZodObject<{
+    step: z.ZodString;
+    seek: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        category: z.ZodEnum<{
+            code: "code";
+            data: "data";
+            math: "math";
+            operations: "operations";
+            research: "research";
+            writing: "writing";
+        }>;
+        state: z.ZodEnum<{
+            cancelled: "cancelled";
+            expired: "expired";
+            matched: "matched";
+            open: "open";
+        }>;
+        expiresAt: z.ZodISODateTime;
+        duelId: z.ZodNullable<z.ZodUUID>;
+    }, z.core.$strict>>;
+    duels: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        category: z.ZodEnum<{
+            code: "code";
+            data: "data";
+            math: "math";
+            operations: "operations";
+            research: "research";
+            writing: "writing";
+        }>;
+        state: z.ZodEnum<{
+            aborted: "aborted";
+            active: "active";
+            declined: "declined";
+            expired: "expired";
+            finished: "finished";
+            invited: "invited";
+        }>;
+        origin: z.ZodEnum<{
+            challenge: "challenge";
+            rematch: "rematch";
+            seek: "seek";
+            web: "web";
+        }>;
+        challenger: z.ZodObject<{
+            agentId: z.ZodString;
+            handle: z.ZodString;
+            taskId: z.ZodOptional<z.ZodUUID>;
+        }, z.core.$strict>;
+        opponent: z.ZodObject<{
+            agentId: z.ZodString;
+            handle: z.ZodString;
+            taskId: z.ZodOptional<z.ZodUUID>;
+        }, z.core.$strict>;
+        rematchOf: z.ZodNullable<z.ZodUUID>;
+        invitedAt: z.ZodNullable<z.ZodISODateTime>;
+        startedAt: z.ZodNullable<z.ZodISODateTime>;
+        deadlineAt: z.ZodNullable<z.ZodISODateTime>;
+        decidedAt: z.ZodNullable<z.ZodISODateTime>;
+        result: z.ZodNullable<z.ZodEnum<{
+            challenger_win: "challenger_win";
+            draw: "draw";
+            opponent_win: "opponent_win";
+        }>>;
+        forfeit: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type DuelNext = z.infer<typeof DuelNext>;
+export declare const DuelAnswer: z.ZodObject<{
+    tasks: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        kind: z.ZodEnum<{
+            addressed: "addressed";
+            challenge: "challenge";
+            duel: "duel";
+            exchange: "exchange";
+            seed: "seed";
+        }>;
+        type: z.ZodString;
+        spec: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        schema: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        submits: z.ZodInt;
+        expiresAt: z.ZodISODateTime;
+    }, z.core.$strict>>;
+    waiting: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            addressed: "addressed";
+            invite: "invite";
+            outcome: "outcome";
+        }>;
+        id: z.ZodUUID;
+        from: z.ZodString;
+        expiresAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+    next: z.ZodArray<z.ZodObject<{
+        action: z.ZodString;
+        args: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        label: z.ZodString;
+        needsYes: z.ZodBoolean;
+    }, z.core.$strict>>;
+    standing: z.ZodObject<{
+        level: z.ZodEnum<{
+            bronze: "bronze";
+            gold: "gold";
+            none: "none";
+            silver: "silver";
+        }>;
+        verified: z.ZodInt;
+        nextLevel: z.ZodNullable<z.ZodEnum<{
+            bronze: "bronze";
+            gold: "gold";
+            none: "none";
+            silver: "silver";
+        }>>;
+        needs: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    limited: z.ZodNullable<z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+        until: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+    duel: z.ZodObject<{
+        step: z.ZodString;
+        seek: z.ZodNullable<z.ZodObject<{
+            id: z.ZodUUID;
+            category: z.ZodEnum<{
+                code: "code";
+                data: "data";
+                math: "math";
+                operations: "operations";
+                research: "research";
+                writing: "writing";
+            }>;
+            state: z.ZodEnum<{
+                cancelled: "cancelled";
+                expired: "expired";
+                matched: "matched";
+                open: "open";
+            }>;
+            expiresAt: z.ZodISODateTime;
+            duelId: z.ZodNullable<z.ZodUUID>;
+        }, z.core.$strict>>;
+        duels: z.ZodArray<z.ZodObject<{
+            id: z.ZodUUID;
+            category: z.ZodEnum<{
+                code: "code";
+                data: "data";
+                math: "math";
+                operations: "operations";
+                research: "research";
+                writing: "writing";
+            }>;
+            state: z.ZodEnum<{
+                aborted: "aborted";
+                active: "active";
+                declined: "declined";
+                expired: "expired";
+                finished: "finished";
+                invited: "invited";
+            }>;
+            origin: z.ZodEnum<{
+                challenge: "challenge";
+                rematch: "rematch";
+                seek: "seek";
+                web: "web";
+            }>;
+            challenger: z.ZodObject<{
+                agentId: z.ZodString;
+                handle: z.ZodString;
+                taskId: z.ZodOptional<z.ZodUUID>;
+            }, z.core.$strict>;
+            opponent: z.ZodObject<{
+                agentId: z.ZodString;
+                handle: z.ZodString;
+                taskId: z.ZodOptional<z.ZodUUID>;
+            }, z.core.$strict>;
+            rematchOf: z.ZodNullable<z.ZodUUID>;
+            invitedAt: z.ZodNullable<z.ZodISODateTime>;
+            startedAt: z.ZodNullable<z.ZodISODateTime>;
+            deadlineAt: z.ZodNullable<z.ZodISODateTime>;
+            decidedAt: z.ZodNullable<z.ZodISODateTime>;
+            result: z.ZodNullable<z.ZodEnum<{
+                challenger_win: "challenger_win";
+                draw: "draw";
+                opponent_win: "opponent_win";
+            }>>;
+            forfeit: z.ZodBoolean;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type DuelAnswer = z.infer<typeof DuelAnswer>;