@kaana.ai/contracts 8.12.0 → 8.13.0

package/dist/internal/identity.d.ts

@@ -0,0 +1,141 @@
+/** Identity facts only. Kaana owns admission, routing and economic policy. */
+import { z } from 'zod';
+export declare const IDENTITY_SIGNATURE_DOMAIN = "oxy-kaana-identity:v1";
+export declare const IDENTITY_VALIDITY_WINDOW_MS = 60000;
+export declare const OXY_KAANA_IDENTITIES_ENDPOINT = "/internal/kaana/v1/identities";
+/** The exact bytes of this request, not inference content, are signed by hash. */
+export declare const kaanaIdentityRequestSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"identity">;
+    requestId: z.ZodString;
+    audience: z.ZodLiteral<"kaana.ai">;
+    credential: z.ZodString;
+    onBehalfOfUserId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "DelegatedUserId", "out">>;
+}, z.core.$strict>;
+export declare const kaanaIdentityLaneSchema: z.ZodEnum<{
+    machine_credential: "machine_credential";
+    service_token: "service_token";
+}>;
+export declare const kaanaIdentityApplicationClassSchema: z.ZodEnum<{
+    system: "system";
+    first_party: "first_party";
+    third_party: "third_party";
+    internal: "internal";
+}>;
+export declare const kaanaIdentityPrincipalSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    authority: z.ZodLiteral<"first_party">;
+    ownerAccountId: z.core.$ZodBranded<z.ZodString, "OxyAccountId", "out">;
+    applicationId: z.ZodString;
+    credentialId: z.ZodString;
+    environment: z.ZodEnum<{
+        development: "development";
+        staging: "staging";
+        production: "production";
+    }>;
+    lane: z.ZodEnum<{
+        machine_credential: "machine_credential";
+        service_token: "service_token";
+    }>;
+    applicationClass: z.ZodEnum<{
+        system: "system";
+        first_party: "first_party";
+        third_party: "third_party";
+        internal: "internal";
+    }>;
+    applicationIsInternal: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    authority: z.ZodLiteral<"external">;
+    scopes: z.ZodArray<z.ZodEnum<{
+        "inference:invoke": "inference:invoke";
+        "inference:models:read": "inference:models:read";
+        "inference:usage:read": "inference:usage:read";
+        "inference:routing:read": "inference:routing:read";
+        "inference:routing:write": "inference:routing:write";
+        "inference:providers:read": "inference:providers:read";
+        "inference:providers:write": "inference:providers:write";
+    }>>;
+    ownerAccountId: z.core.$ZodBranded<z.ZodString, "OxyAccountId", "out">;
+    applicationId: z.ZodString;
+    credentialId: z.ZodString;
+    environment: z.ZodEnum<{
+        development: "development";
+        staging: "staging";
+        production: "production";
+    }>;
+    lane: z.ZodEnum<{
+        machine_credential: "machine_credential";
+        service_token: "service_token";
+    }>;
+    applicationClass: z.ZodEnum<{
+        system: "system";
+        first_party: "first_party";
+        third_party: "third_party";
+        internal: "internal";
+    }>;
+    applicationIsInternal: z.ZodBoolean;
+}, z.core.$strict>], "authority">;
+export declare const kaanaIdentityAssertionSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"identity">;
+    requestId: z.ZodString;
+    audience: z.ZodLiteral<"kaana.ai">;
+    requestSha256: z.ZodString;
+    issuedAt: z.ZodString;
+    expiresAt: z.ZodString;
+    principal: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        authority: z.ZodLiteral<"first_party">;
+        ownerAccountId: z.core.$ZodBranded<z.ZodString, "OxyAccountId", "out">;
+        applicationId: z.ZodString;
+        credentialId: z.ZodString;
+        environment: z.ZodEnum<{
+            development: "development";
+            staging: "staging";
+            production: "production";
+        }>;
+        lane: z.ZodEnum<{
+            machine_credential: "machine_credential";
+            service_token: "service_token";
+        }>;
+        applicationClass: z.ZodEnum<{
+            system: "system";
+            first_party: "first_party";
+            third_party: "third_party";
+            internal: "internal";
+        }>;
+        applicationIsInternal: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        authority: z.ZodLiteral<"external">;
+        scopes: z.ZodArray<z.ZodEnum<{
+            "inference:invoke": "inference:invoke";
+            "inference:models:read": "inference:models:read";
+            "inference:usage:read": "inference:usage:read";
+            "inference:routing:read": "inference:routing:read";
+            "inference:routing:write": "inference:routing:write";
+            "inference:providers:read": "inference:providers:read";
+            "inference:providers:write": "inference:providers:write";
+        }>>;
+        ownerAccountId: z.core.$ZodBranded<z.ZodString, "OxyAccountId", "out">;
+        applicationId: z.ZodString;
+        credentialId: z.ZodString;
+        environment: z.ZodEnum<{
+            development: "development";
+            staging: "staging";
+            production: "production";
+        }>;
+        lane: z.ZodEnum<{
+            machine_credential: "machine_credential";
+            service_token: "service_token";
+        }>;
+        applicationClass: z.ZodEnum<{
+            system: "system";
+            first_party: "first_party";
+            third_party: "third_party";
+            internal: "internal";
+        }>;
+        applicationIsInternal: z.ZodBoolean;
+    }, z.core.$strict>], "authority">;
+    userId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "DelegatedUserId", "out">>;
+}, z.core.$strict>;
+export type KaanaIdentityRequest = z.infer<typeof kaanaIdentityRequestSchema>;
+export type KaanaIdentityPrincipal = z.infer<typeof kaanaIdentityPrincipalSchema>;
+export type KaanaIdentityAssertion = z.infer<typeof kaanaIdentityAssertionSchema>;

package/dist/internal/identity.js

@@ -0,0 +1,82 @@
+/** Identity facts only. Kaana owns admission, routing and economic policy. */
+import { z } from 'zod';
+import { maxUtf16Length, minUtf16Length } from '../stringBounds.js';
+import { delegatedUserIdSchema, inferenceEnvironmentSchema, inferenceTimestampSchema, oxyApplicationIdSchema, oxyCredentialIdSchema, requestIdSchema, } from '../public/identifiers.js';
+import { inferenceScopeSchema } from './attribution.js';
+import { oxyAccountIdSchema } from './identifiers.js';
+export const IDENTITY_SIGNATURE_DOMAIN = 'oxy-kaana-identity:v1';
+export const IDENTITY_VALIDITY_WINDOW_MS = 60_000;
+export const OXY_KAANA_IDENTITIES_ENDPOINT = '/internal/kaana/v1/identities';
+/** The exact bytes of this request, not inference content, are signed by hash. */
+export const kaanaIdentityRequestSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    kind: z.literal('identity'),
+    requestId: requestIdSchema,
+    audience: z.literal('kaana.ai'),
+    credential: z.string().check(minUtf16Length(1)).check(maxUtf16Length(8192)),
+    /** Attribution only. Never proof of the person's identity or data authority. */
+    onBehalfOfUserId: delegatedUserIdSchema.optional(),
+})
+    .strict();
+export const kaanaIdentityLaneSchema = z.enum(['machine_credential', 'service_token']);
+export const kaanaIdentityApplicationClassSchema = z.enum([
+    'first_party',
+    'third_party',
+    'internal',
+    'system',
+]);
+const principalFields = {
+    ownerAccountId: oxyAccountIdSchema,
+    applicationId: oxyApplicationIdSchema,
+    credentialId: oxyCredentialIdSchema,
+    environment: inferenceEnvironmentSchema,
+    // Product sessions require their own identity-only verifier before enrollment.
+    lane: kaanaIdentityLaneSchema,
+    applicationClass: kaanaIdentityApplicationClassSchema,
+    applicationIsInternal: z.boolean(),
+};
+export const kaanaIdentityPrincipalSchema = z
+    .discriminatedUnion('authority', [
+    z.object({ ...principalFields, authority: z.literal('first_party') }).strict(),
+    z
+        .object({
+        ...principalFields,
+        authority: z.literal('external'),
+        scopes: z.array(inferenceScopeSchema),
+    })
+        .strict(),
+])
+    .superRefine((principal, ctx) => {
+    if (principal.authority === 'first_party' && principal.lane !== 'service_token') {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['lane'],
+            message: 'First-party authority requires a workload service token',
+        });
+    }
+});
+export const kaanaIdentityAssertionSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    kind: z.literal('identity'),
+    requestId: requestIdSchema,
+    audience: z.literal('kaana.ai'),
+    requestSha256: z.string().regex(/^[0-9a-f]{64}$/),
+    issuedAt: inferenceTimestampSchema,
+    expiresAt: inferenceTimestampSchema,
+    principal: kaanaIdentityPrincipalSchema,
+    /** Attribution only, with the same meaning as onBehalfOfUserId. */
+    userId: delegatedUserIdSchema.optional(),
+})
+    .strict()
+    .superRefine((assertion, ctx) => {
+    const duration = Date.parse(assertion.expiresAt) - Date.parse(assertion.issuedAt);
+    if (!(duration > 0 && duration <= IDENTITY_VALIDITY_WINDOW_MS)) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['expiresAt'],
+            message: 'Identity assertions are valid for at most 60 seconds',
+        });
+    }
+});

package/dist/internal.d.ts

@@ -19,6 +19,7 @@ export * from './internal/embeddings.js';
 export * from './internal/errors.js';
 export * from './internal/grant.js';
 export * from './internal/identifiers.js';
+export * from './internal/identity.js';
 export * from './internal/realtime.js';
 export * from './internal/request.js';
 export * from './internal/routing.js';

package/dist/internal.js

@@ -19,6 +19,7 @@ export * from './internal/embeddings.js';
 export * from './internal/errors.js';
 export * from './internal/grant.js';
 export * from './internal/identifiers.js';
+export * from './internal/identity.js';
 export * from './internal/realtime.js';
 export * from './internal/request.js';
 export * from './internal/routing.js';

package/dist/public/version.d.ts

@@ -100,7 +100,7 @@
  * change to, say, the catalogue reject every in-flight inference request; the
  * per-shape `schemaVersion` is what a message is validated against.
  */
-export declare const INFERENCE_CONTRACT_VERSION = "8.12.0";
+export declare const INFERENCE_CONTRACT_VERSION = "8.13.0";
 /**
  * Contract set 4.0.0 (Kaana ADR 0002) is the first published as
  * `@kaana.ai/contracts`. MAJOR because the set changed hands and split in two:
@@ -249,6 +249,12 @@ export declare const INFERENCE_CONTRACT_VERSION = "8.12.0";
  * `images_generations` API format, image modality and text input. Nothing in
  * 8.11.0 changes and the public request and response shapes are unchanged.
  */
+/**
+ * Contract set 8.13.0 adds identity-only Oxy assertions under /internal, with a
+ * distinct signature domain and bounded request binding. Existing grants and
+ * public inference shapes are unchanged; publishing does not activate native
+ * economic authorization or enroll any customer.
+ */
 /** The public API's one origin and version. */
 export declare const KAANA_API_BASE_URL = "https://kaana.ai/v1";
 /** The response header that carries the request id. */

package/dist/public/version.js

@@ -100,7 +100,7 @@
  * change to, say, the catalogue reject every in-flight inference request; the
  * per-shape `schemaVersion` is what a message is validated against.
  */
-export const INFERENCE_CONTRACT_VERSION = '8.12.0';
+export const INFERENCE_CONTRACT_VERSION = '8.13.0';
 /**
  * Contract set 4.0.0 (Kaana ADR 0002) is the first published as
  * `@kaana.ai/contracts`. MAJOR because the set changed hands and split in two:
@@ -249,6 +249,12 @@ export const INFERENCE_CONTRACT_VERSION = '8.12.0';
  * `images_generations` API format, image modality and text input. Nothing in
  * 8.11.0 changes and the public request and response shapes are unchanged.
  */
+/**
+ * Contract set 8.13.0 adds identity-only Oxy assertions under /internal, with a
+ * distinct signature domain and bounded request binding. Existing grants and
+ * public inference shapes are unchanged; publishing does not activate native
+ * economic authorization or enroll any customer.
+ */
 /** The public API's one origin and version. */
 export const KAANA_API_BASE_URL = 'https://kaana.ai/v1';
 /** The response header that carries the request id. */

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Kaana API",
-    "version": "8.12.0",
+    "version": "8.13.0",
     "description": "Kaana inference API. Generated from @kaana.ai/contracts; the Zod source is the authority. Accounts, applications, oxy_sk_ keys, limits and billing are managed in Oxy Console: https://console.oxy.so"
   },
   "servers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaana.ai/contracts",
-  "version": "8.12.0",
+  "version": "8.13.0",
   "description": "Kaana inference contract: the Zod schemas of the public API at https://kaana.ai/v1 and, under /internal, of the Oxy-Kaana grant, settlement and signed lane.",
   "type": "module",
   "sideEffects": false,