@hlos-ai/schemas 0.6.0 → 0.7.1

package/dist/index.js

@@ -1219,9 +1219,57 @@ var SignedRejectionReceiptV0Schema = z13.object({
   signature: Base64urlEd25519SigSchema
 }).strict();
 
-// src/srr-signing.ts
-var textEncoder = new TextEncoder();
-var DOMAIN_BYTES = textEncoder.encode(SRR_REJECTION_DOMAIN);
+// src/liability-waiver-terms-v0.ts
+import { z as z14 } from "zod";
+var LIABILITY_WAIVER_TERMS_TYPE_URI = "https://hlos.ai/schema/LiabilityWaiverTermsV0";
+var LIABILITY_WAIVER_TERMS_VERSION = 0;
+var LiabilityDispositionSchema = z14.enum([
+  "ABSORB",
+  "RELEASE",
+  "TRANSFER",
+  "DISPUTE"
+]);
+var LiabilityWaiverTermsPartiesSchema = z14.object({
+  offered_by: z14.string().min(1).optional(),
+  offered_to: z14.string().min(1).optional(),
+  beneficiary: z14.string().min(1).optional(),
+  burdened_party: z14.string().min(1).optional()
+}).strict();
+var LiabilityWaiverTermsScopeSchema = z14.object({
+  crossing_id: z14.string().min(1).optional(),
+  commitment_hash: Base64urlSha256Schema.optional(),
+  claim_scope: z14.string().min(1).optional()
+}).strict();
+var LiabilityWaiverTermsConditionsSchema = z14.object({
+  effective_if: z14.record(z14.unknown()).optional(),
+  expires_at: z14.string().datetime().optional(),
+  jurisdiction: z14.string().min(1).optional()
+}).strict();
+var LiabilityWaiverTermsHashInputSchema = z14.object({
+  parties: LiabilityWaiverTermsPartiesSchema,
+  liability_effect: LiabilityDispositionSchema,
+  scope: LiabilityWaiverTermsScopeSchema,
+  conditions: LiabilityWaiverTermsConditionsSchema.optional(),
+  canonical_terms: z14.record(z14.unknown()).optional()
+}).strict();
+var LiabilityWaiverTermsRefV0Schema = z14.object({
+  waiver_id: z14.string().min(1).optional(),
+  terms_hash: Base64urlSha256Schema,
+  type: z14.literal(LIABILITY_WAIVER_TERMS_TYPE_URI),
+  version: z14.literal(LIABILITY_WAIVER_TERMS_VERSION)
+}).strict();
+var LiabilityWaiverTermsV0Schema = z14.object({
+  "@type": z14.literal(LIABILITY_WAIVER_TERMS_TYPE_URI),
+  version: z14.literal(LIABILITY_WAIVER_TERMS_VERSION),
+  waiver_id: z14.string().min(1),
+  terms_hash: Base64urlSha256Schema,
+  parties: LiabilityWaiverTermsPartiesSchema,
+  liability_effect: LiabilityDispositionSchema,
+  scope: LiabilityWaiverTermsScopeSchema,
+  conditions: LiabilityWaiverTermsConditionsSchema.optional(),
+  human_readable_summary: z14.string().min(1).optional(),
+  canonical_terms: z14.record(z14.unknown()).optional()
+}).strict();
 var cachedSha256 = null;
 function loadSha256() {
   if (cachedSha256) return cachedSha256;
@@ -1237,24 +1285,104 @@ function loadSha256() {
       sha256 = _require("@noble/hashes/sha2").sha256;
     } catch {
       throw new Error(
-        "SRR signing requires @noble/hashes as a peer dependency. Install it: npm install @noble/hashes"
+        "Liability waiver hashing requires @noble/hashes as a peer dependency. Install it: npm install @noble/hashes"
       );
     }
   }
   cachedSha256 = sha256;
   return sha256;
 }
-function computeSrrSigningPayload(unsignedSrr) {
+function toLiabilityWaiverTermsHashInput(terms) {
+  return {
+    parties: terms.parties,
+    liability_effect: terms.liability_effect,
+    scope: terms.scope,
+    ...terms.conditions !== void 0 ? { conditions: terms.conditions } : {},
+    ...terms.canonical_terms !== void 0 ? { canonical_terms: terms.canonical_terms } : {}
+  };
+}
+function computeLiabilityWaiverTermsHash(input) {
   const sha256 = loadSha256();
+  const canonical = jcsCanonicalize(input);
+  const digest = sha256(new TextEncoder().encode(canonical));
+  return bytesToBase64url(digest);
+}
+
+// src/srr-v1.ts
+import { z as z15 } from "zod";
+var SRR_V1_TYPE_URI = "https://hlos.ai/schema/SignedRejectionReceiptV1";
+var SRR_V1_VERSION = 1;
+var SRR_V1_REJECTION_DOMAIN = "kernel:u:rejection:v1";
+var SRR_V1_SIGNATURE_ALGORITHM = SRR_SIGNATURE_ALGORITHM;
+var SignedRejectionReceiptV1Schema = z15.object({
+  "@type": z15.literal(SRR_V1_TYPE_URI),
+  version: z15.literal(SRR_V1_VERSION),
+  receipt_id: z15.string().regex(
+    /^srr_[0-9A-HJKMNP-TV-Z]{26}$/i,
+    "receipt_id must be srr_ + 26-char ULID"
+  ),
+  crossing_id: z15.string().min(1),
+  reason_code: z15.string().regex(REASON_CODE_PATTERN, "reason_code must be UPPER_SNAKE_CASE, 3-64 chars"),
+  reason_message: z15.string().min(1),
+  details: z15.record(z15.unknown()).optional(),
+  commitment_hash: Base64urlSha256Schema.optional(),
+  issuer_id: z15.string().min(1),
+  rejected_at: z15.string().datetime(),
+  issuer_public_key_ref: z15.string().min(1),
+  signature_algorithm: z15.literal(SRR_V1_SIGNATURE_ALGORITHM),
+  liability_disposition: LiabilityDispositionSchema,
+  waiver_terms_ref: LiabilityWaiverTermsRefV0Schema.optional(),
+  signature: Base64urlEd25519SigSchema
+}).strict().superRefine((value, ctx) => {
+  if ((value.liability_disposition === "RELEASE" || value.liability_disposition === "TRANSFER") && value.waiver_terms_ref === void 0) {
+    ctx.addIssue({
+      code: z15.ZodIssueCode.custom,
+      path: ["waiver_terms_ref"],
+      message: "waiver_terms_ref is required for RELEASE and TRANSFER"
+    });
+  }
+});
+
+// src/srr-signing.ts
+var textEncoder = new TextEncoder();
+var DOMAIN_BYTES_V0 = textEncoder.encode(SRR_REJECTION_DOMAIN);
+var DOMAIN_BYTES_V1 = textEncoder.encode(SRR_V1_REJECTION_DOMAIN);
+var cachedSha2562 = null;
+function loadSha2562() {
+  if (cachedSha2562) return cachedSha2562;
+  const moduleApi = typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : __require("module");
+  const createRequire = moduleApi.createRequire;
+  const requireBase = typeof __filename === "string" ? __filename : `${process.cwd()}/package.json`;
+  const _require = createRequire(requireBase);
+  let sha256;
+  try {
+    sha256 = _require("@noble/hashes/sha2.js").sha256;
+  } catch {
+    try {
+      sha256 = _require("@noble/hashes/sha2").sha256;
+    } catch {
+      throw new Error(
+        "SRR signing requires @noble/hashes as a peer dependency. Install it: npm install @noble/hashes"
+      );
+    }
+  }
+  cachedSha2562 = sha256;
+  return sha256;
+}
+function computeSrrSigningPayload(unsignedSrr) {
+  const sha256 = loadSha2562();
   const canonical = jcsCanonicalize(unsignedSrr);
   const digest = sha256(textEncoder.encode(canonical));
-  const payload = new Uint8Array(DOMAIN_BYTES.length + digest.length);
-  payload.set(DOMAIN_BYTES, 0);
-  payload.set(digest, DOMAIN_BYTES.length);
+  const domainBytes = unsignedSrr["@type"] === SRR_V1_TYPE_URI ? DOMAIN_BYTES_V1 : unsignedSrr["@type"] === SRR_TYPE_URI ? DOMAIN_BYTES_V0 : (() => {
+    throw new Error("Unsupported SRR type for signing payload construction");
+  })();
+  const payload = new Uint8Array(domainBytes.length + digest.length);
+  payload.set(domainBytes, 0);
+  payload.set(digest, domainBytes.length);
   return payload;
 }
 function computeSrrDigest(signedSrr) {
-  const sha256 = loadSha256();
+  const sha256 = loadSha2562();
   const canonical = jcsCanonicalize(signedSrr);
   return bytesToBase64url(sha256(textEncoder.encode(canonical)));
 }
@@ -1310,23 +1438,28 @@ async function verifySignedRejectionReceipt(params) {
   if (!srr || typeof srr !== "object") {
     return { valid: false, reason: "SCHEMA_VIOLATION" };
   }
-  if (srr.signature_algorithm !== SRR_SIGNATURE_ALGORITHM) {
+  if (typeof srr.signature_algorithm === "string" && srr.signature_algorithm !== SRR_SIGNATURE_ALGORITHM) {
     return { valid: false, reason: "UNSUPPORTED_ALGORITHM" };
   }
-  const parseResult = SignedRejectionReceiptV0Schema.safeParse(srr);
+  const wireType = srr["@type"];
+  if (wireType !== SRR_V1_TYPE_URI && wireType !== SRR_TYPE_URI) {
+    return { valid: false, reason: "SCHEMA_VIOLATION" };
+  }
+  const parseResult = wireType === SRR_V1_TYPE_URI ? SignedRejectionReceiptV1Schema.safeParse(srr) : SignedRejectionReceiptV0Schema.safeParse(srr);
   if (!parseResult.success) {
     return { valid: false, reason: "SCHEMA_VIOLATION" };
   }
+  const parsedSrr = parseResult.data;
   let signingPayload;
   try {
-    const { signature, ...unsignedFields } = srr;
+    const { signature, ...unsignedFields } = parsedSrr;
     signingPayload = computeSrrSigningPayload(unsignedFields);
   } catch {
     return { valid: false, reason: "PAYLOAD_CONSTRUCTION_ERROR" };
   }
   let signatureBytes;
   try {
-    signatureBytes = base64urlToBytes(srr.signature);
+    signatureBytes = base64urlToBytes(parsedSrr.signature);
   } catch {
     return { valid: false, reason: "INVALID_SIGNATURE" };
   }
@@ -1382,7 +1515,16 @@ export {
   KernelErrorCodeSchema2 as KernelErrorCodeSchema,
   KernelErrorSchema,
   KernelOkSchema,
+  LIABILITY_WAIVER_TERMS_TYPE_URI,
+  LIABILITY_WAIVER_TERMS_VERSION,
   LiabilityAttestationContentSchema,
+  LiabilityDispositionSchema,
+  LiabilityWaiverTermsConditionsSchema,
+  LiabilityWaiverTermsHashInputSchema,
+  LiabilityWaiverTermsPartiesSchema,
+  LiabilityWaiverTermsRefV0Schema,
+  LiabilityWaiverTermsScopeSchema,
+  LiabilityWaiverTermsV0Schema,
   LogInclusionProofSchema,
   NA_ID_PREFIX,
   NotarizeResponseSchema,
@@ -1409,6 +1551,10 @@ export {
   SRR_REJECTION_DOMAIN,
   SRR_SIGNATURE_ALGORITHM,
   SRR_TYPE_URI,
+  SRR_V1_REJECTION_DOMAIN,
+  SRR_V1_SIGNATURE_ALGORITHM,
+  SRR_V1_TYPE_URI,
+  SRR_V1_VERSION,
   SRR_VERSION,
   SURFACES,
   SettlementAnchorContentSchema,
@@ -1419,6 +1565,7 @@ export {
   SignedReceiptV0LooseSchema,
   SignedReceiptV0Schema,
   SignedRejectionReceiptV0Schema,
+  SignedRejectionReceiptV1Schema,
   StackConnectionSchema,
   StackProviderSchema,
   StackSchema,
@@ -1436,6 +1583,7 @@ export {
   base64urlToBytes,
   bytesToBase64url,
   computeContentHash,
+  computeLiabilityWaiverTermsHash,
   computeReceiptHash,
   computeSrrDigest,
   computeSrrSigningPayload,
@@ -1459,6 +1607,7 @@ export {
   kernelError,
   kernelOk,
   success,
+  toLiabilityWaiverTermsHashInput,
   validateTimeWindow,
   verifyAAR,
   verifyDetachedEd25519,