@kaana.ai/contracts 8.13.0 → 8.14.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/internal/identity.d.ts +67 -0
- package/dist/internal/identity.js +42 -3
- package/dist/public/version.d.ts +1 -1
- package/dist/public/version.js +1 -1
- package/openapi.json +1 -1
- package/package.json +1 -1
|
@@ -15,6 +15,7 @@ export declare const kaanaIdentityRequestSchema: z.ZodObject<{
|
|
|
15
15
|
export declare const kaanaIdentityLaneSchema: z.ZodEnum<{
|
|
16
16
|
machine_credential: "machine_credential";
|
|
17
17
|
service_token: "service_token";
|
|
18
|
+
product_session: "product_session";
|
|
18
19
|
}>;
|
|
19
20
|
export declare const kaanaIdentityApplicationClassSchema: z.ZodEnum<{
|
|
20
21
|
system: "system";
|
|
@@ -35,6 +36,7 @@ export declare const kaanaIdentityPrincipalSchema: z.ZodDiscriminatedUnion<[z.Zo
|
|
|
35
36
|
lane: z.ZodEnum<{
|
|
36
37
|
machine_credential: "machine_credential";
|
|
37
38
|
service_token: "service_token";
|
|
39
|
+
product_session: "product_session";
|
|
38
40
|
}>;
|
|
39
41
|
applicationClass: z.ZodEnum<{
|
|
40
42
|
system: "system";
|
|
@@ -65,6 +67,7 @@ export declare const kaanaIdentityPrincipalSchema: z.ZodDiscriminatedUnion<[z.Zo
|
|
|
65
67
|
lane: z.ZodEnum<{
|
|
66
68
|
machine_credential: "machine_credential";
|
|
67
69
|
service_token: "service_token";
|
|
70
|
+
product_session: "product_session";
|
|
68
71
|
}>;
|
|
69
72
|
applicationClass: z.ZodEnum<{
|
|
70
73
|
system: "system";
|
|
@@ -73,6 +76,37 @@ export declare const kaanaIdentityPrincipalSchema: z.ZodDiscriminatedUnion<[z.Zo
|
|
|
73
76
|
internal: "internal";
|
|
74
77
|
}>;
|
|
75
78
|
applicationIsInternal: z.ZodBoolean;
|
|
79
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
80
|
+
authority: z.ZodLiteral<"session">;
|
|
81
|
+
lane: z.ZodEnum<{
|
|
82
|
+
machine_credential: "machine_credential";
|
|
83
|
+
service_token: "service_token";
|
|
84
|
+
product_session: "product_session";
|
|
85
|
+
}>;
|
|
86
|
+
applicationId: z.ZodString;
|
|
87
|
+
credentialId: z.ZodString;
|
|
88
|
+
environment: z.ZodEnum<{
|
|
89
|
+
development: "development";
|
|
90
|
+
staging: "staging";
|
|
91
|
+
production: "production";
|
|
92
|
+
}>;
|
|
93
|
+
applicationClass: z.ZodEnum<{
|
|
94
|
+
system: "system";
|
|
95
|
+
first_party: "first_party";
|
|
96
|
+
third_party: "third_party";
|
|
97
|
+
internal: "internal";
|
|
98
|
+
}>;
|
|
99
|
+
applicationIsInternal: z.ZodBoolean;
|
|
100
|
+
applicationOwnerAccountId: z.core.$ZodBranded<z.ZodString, "OxyAccountId", "out">;
|
|
101
|
+
verifiedRequester: z.ZodObject<{
|
|
102
|
+
subjectAccountId: z.core.$ZodBranded<z.ZodString, "OxyAccountId", "out">;
|
|
103
|
+
principalUserId: z.core.$ZodBranded<z.ZodString, "DelegatedUserId", "out">;
|
|
104
|
+
}, z.core.$strict>;
|
|
105
|
+
applicationBinding: z.ZodEnum<{
|
|
106
|
+
session: "session";
|
|
107
|
+
platform: "platform";
|
|
108
|
+
public_client_id: "public_client_id";
|
|
109
|
+
}>;
|
|
76
110
|
}, z.core.$strict>], "authority">;
|
|
77
111
|
export declare const kaanaIdentityAssertionSchema: z.ZodObject<{
|
|
78
112
|
schemaVersion: z.ZodLiteral<1>;
|
|
@@ -95,6 +129,7 @@ export declare const kaanaIdentityAssertionSchema: z.ZodObject<{
|
|
|
95
129
|
lane: z.ZodEnum<{
|
|
96
130
|
machine_credential: "machine_credential";
|
|
97
131
|
service_token: "service_token";
|
|
132
|
+
product_session: "product_session";
|
|
98
133
|
}>;
|
|
99
134
|
applicationClass: z.ZodEnum<{
|
|
100
135
|
system: "system";
|
|
@@ -125,6 +160,7 @@ export declare const kaanaIdentityAssertionSchema: z.ZodObject<{
|
|
|
125
160
|
lane: z.ZodEnum<{
|
|
126
161
|
machine_credential: "machine_credential";
|
|
127
162
|
service_token: "service_token";
|
|
163
|
+
product_session: "product_session";
|
|
128
164
|
}>;
|
|
129
165
|
applicationClass: z.ZodEnum<{
|
|
130
166
|
system: "system";
|
|
@@ -133,6 +169,37 @@ export declare const kaanaIdentityAssertionSchema: z.ZodObject<{
|
|
|
133
169
|
internal: "internal";
|
|
134
170
|
}>;
|
|
135
171
|
applicationIsInternal: z.ZodBoolean;
|
|
172
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
173
|
+
authority: z.ZodLiteral<"session">;
|
|
174
|
+
lane: z.ZodEnum<{
|
|
175
|
+
machine_credential: "machine_credential";
|
|
176
|
+
service_token: "service_token";
|
|
177
|
+
product_session: "product_session";
|
|
178
|
+
}>;
|
|
179
|
+
applicationId: z.ZodString;
|
|
180
|
+
credentialId: z.ZodString;
|
|
181
|
+
environment: z.ZodEnum<{
|
|
182
|
+
development: "development";
|
|
183
|
+
staging: "staging";
|
|
184
|
+
production: "production";
|
|
185
|
+
}>;
|
|
186
|
+
applicationClass: z.ZodEnum<{
|
|
187
|
+
system: "system";
|
|
188
|
+
first_party: "first_party";
|
|
189
|
+
third_party: "third_party";
|
|
190
|
+
internal: "internal";
|
|
191
|
+
}>;
|
|
192
|
+
applicationIsInternal: z.ZodBoolean;
|
|
193
|
+
applicationOwnerAccountId: z.core.$ZodBranded<z.ZodString, "OxyAccountId", "out">;
|
|
194
|
+
verifiedRequester: z.ZodObject<{
|
|
195
|
+
subjectAccountId: z.core.$ZodBranded<z.ZodString, "OxyAccountId", "out">;
|
|
196
|
+
principalUserId: z.core.$ZodBranded<z.ZodString, "DelegatedUserId", "out">;
|
|
197
|
+
}, z.core.$strict>;
|
|
198
|
+
applicationBinding: z.ZodEnum<{
|
|
199
|
+
session: "session";
|
|
200
|
+
platform: "platform";
|
|
201
|
+
public_client_id: "public_client_id";
|
|
202
|
+
}>;
|
|
136
203
|
}, z.core.$strict>], "authority">;
|
|
137
204
|
userId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "DelegatedUserId", "out">>;
|
|
138
205
|
}, z.core.$strict>;
|
|
@@ -19,7 +19,11 @@ export const kaanaIdentityRequestSchema = z
|
|
|
19
19
|
onBehalfOfUserId: delegatedUserIdSchema.optional(),
|
|
20
20
|
})
|
|
21
21
|
.strict();
|
|
22
|
-
export const kaanaIdentityLaneSchema = z.enum([
|
|
22
|
+
export const kaanaIdentityLaneSchema = z.enum([
|
|
23
|
+
'machine_credential',
|
|
24
|
+
'service_token',
|
|
25
|
+
'product_session',
|
|
26
|
+
]);
|
|
23
27
|
export const kaanaIdentityApplicationClassSchema = z.enum([
|
|
24
28
|
'first_party',
|
|
25
29
|
'third_party',
|
|
@@ -31,7 +35,6 @@ const principalFields = {
|
|
|
31
35
|
applicationId: oxyApplicationIdSchema,
|
|
32
36
|
credentialId: oxyCredentialIdSchema,
|
|
33
37
|
environment: inferenceEnvironmentSchema,
|
|
34
|
-
// Product sessions require their own identity-only verifier before enrollment.
|
|
35
38
|
lane: kaanaIdentityLaneSchema,
|
|
36
39
|
applicationClass: kaanaIdentityApplicationClassSchema,
|
|
37
40
|
applicationIsInternal: z.boolean(),
|
|
@@ -46,8 +49,36 @@ export const kaanaIdentityPrincipalSchema = z
|
|
|
46
49
|
scopes: z.array(inferenceScopeSchema),
|
|
47
50
|
})
|
|
48
51
|
.strict(),
|
|
52
|
+
z
|
|
53
|
+
.object({
|
|
54
|
+
authority: z.literal('session'),
|
|
55
|
+
lane: kaanaIdentityLaneSchema,
|
|
56
|
+
applicationId: oxyApplicationIdSchema,
|
|
57
|
+
credentialId: oxyCredentialIdSchema,
|
|
58
|
+
environment: inferenceEnvironmentSchema,
|
|
59
|
+
applicationClass: kaanaIdentityApplicationClassSchema,
|
|
60
|
+
applicationIsInternal: z.boolean(),
|
|
61
|
+
/** Application ownership is not a payer decision or a session privilege. */
|
|
62
|
+
applicationOwnerAccountId: oxyAccountIdSchema,
|
|
63
|
+
verifiedRequester: z
|
|
64
|
+
.object({
|
|
65
|
+
subjectAccountId: oxyAccountIdSchema,
|
|
66
|
+
principalUserId: delegatedUserIdSchema,
|
|
67
|
+
})
|
|
68
|
+
.strict(),
|
|
69
|
+
/** A public client id attributes an app; it does not authenticate that app. */
|
|
70
|
+
applicationBinding: z.enum(['session', 'platform', 'public_client_id']),
|
|
71
|
+
})
|
|
72
|
+
.strict(),
|
|
49
73
|
])
|
|
50
74
|
.superRefine((principal, ctx) => {
|
|
75
|
+
if ((principal.authority === 'session') !== (principal.lane === 'product_session')) {
|
|
76
|
+
ctx.addIssue({
|
|
77
|
+
code: 'custom',
|
|
78
|
+
path: ['lane'],
|
|
79
|
+
message: 'Session authority requires the product session lane exclusively',
|
|
80
|
+
});
|
|
81
|
+
}
|
|
51
82
|
if (principal.authority === 'first_party' && principal.lane !== 'service_token') {
|
|
52
83
|
ctx.addIssue({
|
|
53
84
|
code: 'custom',
|
|
@@ -66,11 +97,19 @@ export const kaanaIdentityAssertionSchema = z
|
|
|
66
97
|
issuedAt: inferenceTimestampSchema,
|
|
67
98
|
expiresAt: inferenceTimestampSchema,
|
|
68
99
|
principal: kaanaIdentityPrincipalSchema,
|
|
69
|
-
/** Attribution only
|
|
100
|
+
/** Attribution only for workloads/keys; verified subjectAccountId for sessions. */
|
|
70
101
|
userId: delegatedUserIdSchema.optional(),
|
|
71
102
|
})
|
|
72
103
|
.strict()
|
|
73
104
|
.superRefine((assertion, ctx) => {
|
|
105
|
+
if (assertion.principal.authority === 'session' &&
|
|
106
|
+
String(assertion.userId) !== String(assertion.principal.verifiedRequester.subjectAccountId)) {
|
|
107
|
+
ctx.addIssue({
|
|
108
|
+
code: 'custom',
|
|
109
|
+
path: ['userId'],
|
|
110
|
+
message: 'Session userId must be the verified subject account',
|
|
111
|
+
});
|
|
112
|
+
}
|
|
74
113
|
const duration = Date.parse(assertion.expiresAt) - Date.parse(assertion.issuedAt);
|
|
75
114
|
if (!(duration > 0 && duration <= IDENTITY_VALIDITY_WINDOW_MS)) {
|
|
76
115
|
ctx.addIssue({
|
package/dist/public/version.d.ts
CHANGED
|
@@ -100,7 +100,7 @@
|
|
|
100
100
|
* change to, say, the catalogue reject every in-flight inference request; the
|
|
101
101
|
* per-shape `schemaVersion` is what a message is validated against.
|
|
102
102
|
*/
|
|
103
|
-
export declare const INFERENCE_CONTRACT_VERSION = "8.
|
|
103
|
+
export declare const INFERENCE_CONTRACT_VERSION = "8.14.0";
|
|
104
104
|
/**
|
|
105
105
|
* Contract set 4.0.0 (Kaana ADR 0002) is the first published as
|
|
106
106
|
* `@kaana.ai/contracts`. MAJOR because the set changed hands and split in two:
|
package/dist/public/version.js
CHANGED
|
@@ -100,7 +100,7 @@
|
|
|
100
100
|
* change to, say, the catalogue reject every in-flight inference request; the
|
|
101
101
|
* per-shape `schemaVersion` is what a message is validated against.
|
|
102
102
|
*/
|
|
103
|
-
export const INFERENCE_CONTRACT_VERSION = '8.
|
|
103
|
+
export const INFERENCE_CONTRACT_VERSION = '8.14.0';
|
|
104
104
|
/**
|
|
105
105
|
* Contract set 4.0.0 (Kaana ADR 0002) is the first published as
|
|
106
106
|
* `@kaana.ai/contracts`. MAJOR because the set changed hands and split in two:
|
package/openapi.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"openapi": "3.1.0",
|
|
3
3
|
"info": {
|
|
4
4
|
"title": "Kaana API",
|
|
5
|
-
"version": "8.
|
|
5
|
+
"version": "8.14.0",
|
|
6
6
|
"description": "Kaana inference API. Generated from @kaana.ai/contracts; the Zod source is the authority. Accounts, applications, oxy_sk_ keys, limits and billing are managed in Oxy Console: https://console.oxy.so"
|
|
7
7
|
},
|
|
8
8
|
"servers": [
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@kaana.ai/contracts",
|
|
3
|
-
"version": "8.
|
|
3
|
+
"version": "8.14.0",
|
|
4
4
|
"description": "Kaana inference contract: the Zod schemas of the public API at https://kaana.ai/v1 and, under /internal, of the Oxy-Kaana grant, settlement and signed lane.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"sideEffects": false,
|