@kaana.ai/contracts 6.1.1 → 7.0.0

package/dist/internal/catalogue.d.ts

@@ -226,35 +226,6 @@ export declare const inferenceProviderSchema: z.ZodObject<{
 export declare const modelDeploymentSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<2>;
     deploymentId: z.ZodString;
-    scopedExecution: z.ZodOptional<z.ZodObject<{
-        permitId: z.ZodString;
-        idempotencyKey: z.ZodString;
-        fixtureSha256: z.ZodString;
-        expiresAt: z.ZodString;
-        principal: z.ZodObject<{
-            accountId: z.ZodString;
-            applicationId: z.ZodString;
-            credentialId: z.ZodString;
-            environment: z.ZodEnum<{
-                development: "development";
-                staging: "staging";
-                production: "production";
-            }>;
-        }, z.core.$strict>;
-        policy: z.ZodObject<{
-            routingPolicyId: z.ZodString;
-            policyVersion: z.ZodNumber;
-        }, z.core.$strict>;
-        deploymentId: z.ZodString;
-        provider: z.ZodString;
-        keyId: z.ZodString;
-        modelReference: z.ZodString;
-        upstreamModelId: z.ZodString;
-        priceVersionId: z.ZodString;
-        providerRateCardVersionId: z.ZodString;
-        providerSourceVersion: z.ZodString;
-        maxCostUsd: z.core.$ZodBranded<z.ZodString, "ExactDecimal", "out">;
-    }, z.core.$strict>>;
     provider: z.ZodString;
     modelReference: z.ZodString;
     regions: z.ZodArray<z.ZodString>;

package/dist/internal/catalogue.js

@@ -9,7 +9,6 @@ import { cataloguePublisherSummarySchema, inferenceDataPolicySchema, modelCapabi
 import { inferenceDateSchema, inferenceHttpsUrlSchema, inferenceRegionSchema, inferenceTimestampSchema, modelIdSchema, modelReferenceSchema, modelRevisionLabelSchema, modelSlugSchema, publisherSlugSchema, RESERVED_ALIA_PUBLISHER, sha256DigestSchema, } from '../public/identifiers.js';
 import { priceSnapshotSchema } from '../public/money.js';
 import { deploymentIdSchema, inferenceProviderSlugSchema, routingProfileIdSchema, routingProfileSlugSchema, } from './identifiers.js';
-import { scopedExecutionAudienceSchema } from './scopedExecution.js';
 /**
  * Who a route may be served to. Availability to an official Oxy product never
  * implies permission to resell the same provider/model publicly, which is why
@@ -155,8 +154,6 @@ export const modelDeploymentSchema = z
     /** See `version.ts`: exchanged with the data plane on its own. */
     schemaVersion: z.literal(2),
     deploymentId: deploymentIdSchema,
-    /** Restrictive audience; never an eligibility approval. */
-    scopedExecution: scopedExecutionAudienceSchema.optional(),
     provider: inferenceProviderSlugSchema,
     /** Always revision-pinned: a deployment serves specific weights. */
     modelReference: modelReferenceSchema,

package/dist/internal/grant.d.ts

@@ -12,8 +12,10 @@
  * executes inside the grant; without a valid grant no provider is called.
  *
  * The grant carries the funding model as it is today, field for field: it
- * invents no policy. New in contract set 4.0.0; it replaces what the v1–v4
- * envelopes signed (`authorizedRoutes`, the scoped and Private Auto bindings).
+ * invents no policy. New in contract set 4.0.0; it replaces what the v1–v2
+ * envelopes signed (`authorizedRoutes`). Contract set 7.0.0 removes the exact
+ * route and the canonical input hash of the one-off source approvals: every
+ * operation, decisions included, is an ordinary grant of ordered steps.
  */
 import { z } from 'zod';
 /** The signature domain of a grant. Same Ed25519 keys as the envelope (`KAANA_EDGE_PUBLIC_KEYS`). */
@@ -134,7 +136,6 @@ export declare const inferenceAuthorizationRequestSchema: z.ZodObject<{
     idempotencyKey: z.ZodOptional<z.ZodString>;
     onBehalfOfUserId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "DelegatedUserId", "out">>;
     bodySha256: z.ZodString;
-    canonicalInputSha256: z.ZodOptional<z.ZodString>;
     client: z.ZodObject<{
         endpoint: z.ZodString;
         clientRequestId: z.ZodOptional<z.ZodString>;
@@ -214,7 +215,6 @@ export declare const authorizationRequestSchema: z.ZodDiscriminatedUnion<[z.ZodO
     idempotencyKey: z.ZodOptional<z.ZodString>;
     onBehalfOfUserId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "DelegatedUserId", "out">>;
     bodySha256: z.ZodString;
-    canonicalInputSha256: z.ZodOptional<z.ZodString>;
     client: z.ZodObject<{
         endpoint: z.ZodString;
         clientRequestId: z.ZodOptional<z.ZodString>;
@@ -353,24 +353,6 @@ export declare const grantStepSchema: z.ZodObject<{
         sameModelFailover: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strict>;
 }, z.core.$strict>;
-/**
- * The exact route of an operation with a source approval (scoped execution,
- * Private Auto, the Mention classifier): the deployment, provider, key and
- * price the approval fixed, and the input it was approved for.
- */
-export declare const grantExactRouteSchema: z.ZodObject<{
-    approval: z.ZodEnum<{
-        scoped_execution: "scoped_execution";
-        private_auto: "private_auto";
-        mention_classifier: "mention_classifier";
-    }>;
-    deploymentId: z.ZodString;
-    provider: z.ZodString;
-    keyId: z.ZodString;
-    modelReference: z.ZodString;
-    priceVersionId: z.ZodString;
-    inputSha256: z.ZodString;
-}, z.core.$strict>;
 /**
  * The signed grant: the body of a successful authorization for an inference
  * operation. Kaana verifies it and executes inside it; Oxy settles against it.
@@ -479,19 +461,6 @@ export declare const grantSchema: z.ZodObject<{
             sameModelFailover: z.ZodDefault<z.ZodBoolean>;
         }, z.core.$strict>;
     }, z.core.$strict>>;
-    exactRoute: z.ZodOptional<z.ZodObject<{
-        approval: z.ZodEnum<{
-            scoped_execution: "scoped_execution";
-            private_auto: "private_auto";
-            mention_classifier: "mention_classifier";
-        }>;
-        deploymentId: z.ZodString;
-        provider: z.ZodString;
-        keyId: z.ZodString;
-        modelReference: z.ZodString;
-        priceVersionId: z.ZodString;
-        inputSha256: z.ZodString;
-    }, z.core.$strict>>;
     customerProviderCredential: z.ZodOptional<z.ZodObject<{
         credentialHandle: z.ZodString;
         credentialRevision: z.ZodNumber;
@@ -693,7 +662,6 @@ export type GrantPrincipal = z.infer<typeof grantPrincipalSchema>;
 export type AdmittedModelLine = z.infer<typeof admittedModelLineSchema>;
 export type GrantStepLimits = z.infer<typeof grantStepLimitsSchema>;
 export type GrantStep = z.infer<typeof grantStepSchema>;
-export type GrantExactRoute = z.infer<typeof grantExactRouteSchema>;
 export type Grant = z.infer<typeof grantSchema>;
 export type CatalogueAccess = z.infer<typeof catalogueAccessSchema>;
 export type ReceiptAccess = z.infer<typeof receiptAccessSchema>;

package/dist/internal/grant.js

@@ -12,19 +12,21 @@
  * executes inside the grant; without a valid grant no provider is called.
  *
  * The grant carries the funding model as it is today, field for field: it
- * invents no policy. New in contract set 4.0.0; it replaces what the v1–v4
- * envelopes signed (`authorizedRoutes`, the scoped and Private Auto bindings).
+ * invents no policy. New in contract set 4.0.0; it replaces what the v1–v2
+ * envelopes signed (`authorizedRoutes`). Contract set 7.0.0 removes the exact
+ * route and the canonical input hash of the one-off source approvals: every
+ * operation, decisions included, is an ordinary grant of ordered steps.
  */
 import { z } from 'zod';
 import { powerLevelSchema, realtimeSessionKindSchema } from '../public/catalogue.js';
 import { generationRecordSchema } from '../public/generations.js';
-import { delegatedUserIdSchema, generationIdSchema, idempotencyKeySchema, inferenceEnvironmentSchema, inferenceRegionSchema, inferenceTimestampSchema, modelIdSchema, modelReferenceSchema, modelRevisionLabelSchema, oxyApplicationIdSchema, oxyCredentialIdSchema, requestIdSchema, } from '../public/identifiers.js';
+import { delegatedUserIdSchema, generationIdSchema, idempotencyKeySchema, inferenceEnvironmentSchema, inferenceRegionSchema, inferenceTimestampSchema, modelIdSchema, modelRevisionLabelSchema, oxyApplicationIdSchema, oxyCredentialIdSchema, requestIdSchema, } from '../public/identifiers.js';
 import { requestLabelsSchema } from '../public/messages.js';
 import { moneySchema } from '../public/money.js';
 import { routingPolicyReferenceSchema } from '../public/policy.js';
 import { inferenceScopeSchema } from './attribution.js';
 import { inferenceEconomicTreatmentSchema } from './economics.js';
-import { deploymentIdSchema, inferenceFundingTierSchema, inferenceProviderSlugSchema, oxyAccountIdSchema, } from './identifiers.js';
+import { inferenceFundingTierSchema, inferenceProviderSlugSchema, oxyAccountIdSchema, } from './identifiers.js';
 import { authorizedRouteSchema } from './routing.js';
 /* -------------------------------------------------------------------------- */
 /*  Signing                                                                    */
@@ -132,12 +134,6 @@ export const inferenceAuthorizationRequestSchema = z
     onBehalfOfUserId: delegatedUserIdSchema.optional(),
     /** SHA-256 of the normalized request body; the grant is bound to it. */
     bodySha256: sha256HexSchema,
-    /**
-     * For an operation under a source approval (scoped execution, Private Auto,
-     * the Jev classifier): `canonicalInputSha256(input)`, which Oxy compares
-     * with the hash the approval fixed.
-     */
-    canonicalInputSha256: sha256HexSchema.optional(),
     client: z
         .object({
         /** The public path, e.g. `/v1/responses`. */
@@ -299,34 +295,6 @@ export const grantStepSchema = z
         });
     }
 });
-/**
- * The exact route of an operation with a source approval (scoped execution,
- * Private Auto, the Mention classifier): the deployment, provider, key and
- * price the approval fixed, and the input it was approved for.
- */
-export const grantExactRouteSchema = z
-    .object({
-    approval: z.enum(['scoped_execution', 'private_auto', 'mention_classifier']),
-    deploymentId: deploymentIdSchema,
-    provider: inferenceProviderSlugSchema,
-    /** The provider key the approval fixed (opaque Kaana key identity). */
-    keyId: z.string().min(1).max(256),
-    /** Always revision-pinned. */
-    modelReference: modelReferenceSchema,
-    priceVersionId: z.string().min(1).max(128),
-    /** `canonicalInputSha256` of the approved input. */
-    inputSha256: sha256HexSchema,
-})
-    .strict()
-    .superRefine((route, ctx) => {
-    if (!route.modelReference.includes('@')) {
-        ctx.addIssue({
-            code: 'custom',
-            path: ['modelReference'],
-            message: 'an exact route pins an immutable revision',
-        });
-    }
-});
 /** The BYOK binding, exactly as an authorized route carries it today. */
 const customerProviderCredentialBinding = authorizedRouteSchema.options[0].shape.customerProviderCredential;
 /**
@@ -360,7 +328,7 @@ export const grantSchema = z
         reservationId: z.string().min(1).max(128),
         /** The most the hold covers. Shown, never spent by Kaana. */
         ceiling: moneySchema,
-        /** `promotional-only` for a scoped permit. */
+        /** `promotional-only`: the hold draws on promotional credit alone. */
         fundingRestriction: z.literal('promotional-only').optional(),
     })
         .strict()
@@ -371,7 +339,6 @@ export const grantSchema = z
         .strict()
         .optional(),
     steps: z.array(grantStepSchema).min(1).max(8),
-    exactRoute: grantExactRouteSchema.optional(),
     /** BYOK: the customer's own provider key. Excludes `maxFundingTier`. */
     customerProviderCredential: customerProviderCredentialBinding,
     idempotencyKey: idempotencyKeySchema.optional(),
@@ -403,22 +370,6 @@ export const grantSchema = z
             issue(['steps', index, 'limits', 'maxFundingTier'], 'a funding ceiling bounds platform keys; a customer credential is billed to the customer');
         }
     }
-    if (grant.exactRoute !== undefined) {
-        const [step] = grant.steps;
-        const route = grant.exactRoute;
-        const [line, revision] = route.modelReference.split('@');
-        if (grant.steps.length !== 1 ||
-            step.target.kind !== 'model' ||
-            step.target.modelLine !== line ||
-            step.target.revision !== revision ||
-            byok) {
-            issue(['exactRoute'], 'an exact route is one platform route for the one pinned model the grant serves');
-        }
-        if (step !== undefined &&
-            !step.limits.admittedModelLines.some((admitted) => admitted.modelLine === line && admitted.priceVersionId === route.priceVersionId)) {
-            issue(['exactRoute', 'priceVersionId'], 'the exact route settles at its admitted price');
-        }
-    }
 });
 /**
  * The answer to a catalogue authorization: what the credential may see.