@lssm/lib.communication-spec 3.1.1

package/dist/contracts/ingestion.d.ts

@@ -0,0 +1,169 @@
+import { z } from 'zod';
+/** Built-in channels remain open to namespaced vertical/provider extensions. */
+export declare const CommunicationIngestionChannelSchema: z.ZodString;
+export declare const CommunicationDirectionSchema: z.ZodEnum<{
+    inbound: "inbound";
+    internal: "internal";
+    outbound: "outbound";
+}>;
+export declare const CommunicationRedactionStatusSchema: z.ZodEnum<{
+    applied: "applied";
+    not_required: "not_required";
+    partially_applied: "partially_applied";
+    pending: "pending";
+}>;
+/**
+ * Portable normalized ingestion record. Its thread, message, participant, and
+ * consent references point at the existing canonical CommunicationSpec models;
+ * ingestion does not introduce competing domain entities.
+ */
+export declare const NormalizedCommunicationIngestionRecordSchema: z.ZodObject<{
+    id: z.ZodString;
+    schemaVersion: z.ZodLiteral<"1.0.0">;
+    channel: z.ZodString;
+    direction: z.ZodEnum<{
+        inbound: "inbound";
+        internal: "internal";
+        outbound: "outbound";
+    }>;
+    threadRef: z.ZodString;
+    messageRef: z.ZodString;
+    participantRefs: z.ZodArray<z.ZodString>;
+    observedAt: z.ZodString;
+    bodyNormalized: z.ZodString;
+    consent: z.ZodObject<{
+        status: z.ZodEnum<{
+            expired: "expired";
+            granted: "granted";
+            not_recorded: "not_recorded";
+            withdrawn: "withdrawn";
+        }>;
+        subjectConsentRef: z.ZodOptional<z.ZodString>;
+        legalBasisRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    redaction: z.ZodObject<{
+        status: z.ZodEnum<{
+            applied: "applied";
+            not_required: "not_required";
+            partially_applied: "partially_applied";
+            pending: "pending";
+        }>;
+        redactedFields: z.ZodArray<z.ZodString>;
+        decisionRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    evidenceRefs: z.ZodArray<z.ZodString>;
+    source: z.ZodObject<{
+        adapterRef: z.ZodString;
+        externalRecordRef: z.ZodString;
+        networkAccessed: z.ZodLiteral<false>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/**
+ * Additive R001 bridge contract binding a normalized communication record to
+ * the canonical F002 tenant-governance envelope. The refinement prevents a
+ * record from being replayed under a governance subject other than itself.
+ */
+export declare const TenantBoundCommunicationIngestionSchema: z.ZodObject<{
+    ingestion: z.ZodObject<{
+        id: z.ZodString;
+        schemaVersion: z.ZodLiteral<"1.0.0">;
+        channel: z.ZodString;
+        direction: z.ZodEnum<{
+            inbound: "inbound";
+            internal: "internal";
+            outbound: "outbound";
+        }>;
+        threadRef: z.ZodString;
+        messageRef: z.ZodString;
+        participantRefs: z.ZodArray<z.ZodString>;
+        observedAt: z.ZodString;
+        bodyNormalized: z.ZodString;
+        consent: z.ZodObject<{
+            status: z.ZodEnum<{
+                expired: "expired";
+                granted: "granted";
+                not_recorded: "not_recorded";
+                withdrawn: "withdrawn";
+            }>;
+            subjectConsentRef: z.ZodOptional<z.ZodString>;
+            legalBasisRef: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        redaction: z.ZodObject<{
+            status: z.ZodEnum<{
+                applied: "applied";
+                not_required: "not_required";
+                partially_applied: "partially_applied";
+                pending: "pending";
+            }>;
+            redactedFields: z.ZodArray<z.ZodString>;
+            decisionRef: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        evidenceRefs: z.ZodArray<z.ZodString>;
+        source: z.ZodObject<{
+            adapterRef: z.ZodString;
+            externalRecordRef: z.ZodString;
+            networkAccessed: z.ZodLiteral<false>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    governance: z.ZodObject<{
+        id: z.ZodString;
+        schemaVersion: z.ZodLiteral<"companyos.tenant-governance-envelope.v1">;
+        policyVersion: z.ZodString;
+        scope: z.ZodObject<{
+            tenantId: z.ZodString;
+            workspaceId: z.ZodString;
+        }, z.core.$strip>;
+        subjectRef: z.ZodObject<{
+            id: z.ZodString;
+            type: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        authority: z.ZodObject<{
+            derivation: z.ZodLiteral<"server_derived">;
+            actorPrincipalId: z.ZodString;
+            accountableOwnerPrincipalId: z.ZodString;
+            authorityEvaluationRefId: z.ZodString;
+            rbacDecisionRefId: z.ZodString;
+        }, z.core.$strip>;
+        dataGovernance: z.ZodObject<{
+            residencyRegion: z.ZodString;
+            residencyEvidenceRefIds: z.ZodArray<z.ZodString>;
+            providerResidencyVerified: z.ZodBoolean;
+            retentionPolicyRefId: z.ZodString;
+            retainUntil: z.ZodString;
+            legalBasis: z.ZodEnum<{
+                consent: "consent";
+                contract: "contract";
+                legal_obligation: "legal_obligation";
+                legitimate_interest: "legitimate_interest";
+            }>;
+            consentRefId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        idempotency: z.ZodObject<{
+            key: z.ZodString;
+            scope: z.ZodLiteral<"tenant_workspace_subject">;
+            tenantId: z.ZodString;
+            workspaceId: z.ZodString;
+            subjectRefId: z.ZodString;
+        }, z.core.$strip>;
+        evidenceReplayRefs: z.ZodObject<{
+            evidenceReceiptIds: z.ZodArray<z.ZodString>;
+            replayPacketIds: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>;
+        governanceState: z.ZodLiteral<"active">;
+        createdAt: z.ZodString;
+        metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>;
+}, z.core.$strict>;
+export type CommunicationIngestionChannel = z.infer<typeof CommunicationIngestionChannelSchema>;
+export type CommunicationDirection = z.infer<typeof CommunicationDirectionSchema>;
+export type CommunicationRedactionStatus = z.infer<typeof CommunicationRedactionStatusSchema>;
+export type NormalizedCommunicationIngestionRecord = z.infer<typeof NormalizedCommunicationIngestionRecordSchema>;
+export type TenantBoundCommunicationIngestion = z.infer<typeof TenantBoundCommunicationIngestionSchema>;
+/** Canonical models reused by the normalized ingestion envelope. */
+export declare const normalizedCommunicationIngestionModelRefs: {
+    readonly thread: 'CommunicationThread';
+    readonly message: 'CommunicationMessage';
+    readonly participant: 'CommunicationParticipant';
+    readonly consent: 'SubjectConsent';
+};

package/dist/contracts/ingestion.js

@@ -0,0 +1,2 @@
+// @bun
+import{CompanyOsTenantGovernanceEnvelopeSchema as i}from"@lssm/lib.companyos-spec/types/tenant-governance-envelope";import{z as n}from"zod";var o=n.string().min(1),a=n.enum(["inbound","outbound","internal"]),c=n.enum(["not_required","pending","applied","partially_applied"]),s=n.object({id:n.string().min(1),schemaVersion:n.literal("1.0.0"),channel:o,direction:a,threadRef:n.string().min(1),messageRef:n.string().min(1),participantRefs:n.array(n.string().min(1)).min(1),observedAt:n.string().datetime(),bodyNormalized:n.string().min(1),consent:n.object({status:n.enum(["not_recorded","granted","withdrawn","expired"]),subjectConsentRef:n.string().min(1).optional(),legalBasisRef:n.string().min(1).optional()}).strict(),redaction:n.object({status:c,redactedFields:n.array(n.string().min(1)),decisionRef:n.string().min(1).optional()}).strict(),evidenceRefs:n.array(n.string().min(1)).min(1),source:n.object({adapterRef:n.string().min(1),externalRecordRef:n.string().min(1),networkAccessed:n.literal(!1)}).strict()}).strict(),u=n.object({ingestion:s,governance:i}).strict().superRefine((e,t)=>{if(e.governance.subjectRef.id!==e.ingestion.id)t.addIssue({code:"custom",path:["governance","subjectRef","id"],message:"governance subject must reference the normalized ingestion"});if(e.governance.subjectRef.type!=="communication.ingestion")t.addIssue({code:"custom",path:["governance","subjectRef","type"],message:"governance subject type must be communication.ingestion"})}),d={thread:"CommunicationThread",message:"CommunicationMessage",participant:"CommunicationParticipant",consent:"SubjectConsent"};export{a as CommunicationDirectionSchema,o as CommunicationIngestionChannelSchema,c as CommunicationRedactionStatusSchema,s as NormalizedCommunicationIngestionRecordSchema,u as TenantBoundCommunicationIngestionSchema,d as normalizedCommunicationIngestionModelRefs};

package/dist/contracts/ingress-admission-policy.d.ts

@@ -0,0 +1,14 @@
+import type { CommunicationIngressAdmissionContextV1, CommunicationIngressAdmissionDecisionV1, CommunicationIngressReceiptV1 } from './ingress-admission.js';
+type Classification = Pick<CommunicationIngressAdmissionDecisionV1, 'status' | 'reason'>;
+/** Pure policy order: hard blocks, quarantine, mention-ignore, then admit. */
+export declare function classifyCommunicationIngressAdmissionV1(context: CommunicationIngressAdmissionContextV1): Classification;
+export declare function validateCommunicationIngressAdmissionBindingV1(input: {
+    receipt: CommunicationIngressReceiptV1;
+    context: CommunicationIngressAdmissionContextV1;
+    decision: CommunicationIngressAdmissionDecisionV1;
+}): string[];
+export declare function validateCommunicationIngressContextBindingV1(input: {
+    receipt: CommunicationIngressReceiptV1;
+    context: CommunicationIngressAdmissionContextV1;
+}): string[];
+export {};

package/dist/contracts/ingress-admission-policy.js

@@ -0,0 +1,2 @@
+// @bun
+import{z as s}from"zod";var h="1.0.0",R="1.0.0",I={id:"communication-os.agent-omnichannel.v1",title:"CommunicationOS agent omnichannel contracts",body:"Provider-neutral agent profiles and lifecycle links bind applications, runs, tasks, help requests, background results, routes, preferences, policies, and evidence through opaque references. They grant no provider access or effect authority.",kind:"reference",route:"/docs/communication-os/agent-omnichannel-v1",visibility:"public"},o=s.string().trim().min(1),d=s.string().datetime({offset:!0}),u=s.string().regex(/^sha256:[a-f0-9]{64}$/),l=s.object({ref:o,digest:u}).strict(),f=l.extend({revision:s.number().int().positive()}).strict(),g=s.object({tenantRef:o,workspaceRef:o.optional(),spaceRef:o.optional(),subjectRef:o}).strict(),A=s.object({schemaVersion:s.literal(h),profileRef:o,revision:s.number().int().positive(),agentRef:o,applicationRef:o,scope:g,routeBindings:s.array(f),connectionRefs:s.array(o),preferenceSet:f,policyRefs:s.array(o).min(1),evidenceRefs:s.array(o).min(1),createdAt:d,updatedAt:d,profileDigest:u}).strict().superRefine((e,i)=>{for(let t of["connectionRefs","policyRefs","evidenceRefs"])if(new Set(e[t]).size!==e[t].length)i.addIssue({code:s.ZodIssueCode.custom,path:[t],message:`${t} must be unique`});let n=e.routeBindings.map((t)=>t.ref);if(new Set(n).size!==n.length)i.addIssue({code:s.ZodIssueCode.custom,path:["routeBindings"],message:"route bindings must be unique"})}),b=s.object({schemaVersion:s.literal(R),linkRef:o,profile:f,agentRef:o,applicationRef:o,scope:g,runRef:o.optional(),taskRef:o.optional(),helpRequestRef:o.optional(),approvalRequestRef:o.optional(),backgroundResultRef:o.optional(),canonicalConversation:l.optional(),session:f.optional(),correlationRef:o,evidenceRefs:s.array(o).min(1)}).strict().superRefine((e,i)=>{if(new Set(e.evidenceRefs).size!==e.evidenceRefs.length)i.addIssue({code:s.ZodIssueCode.custom,path:["evidenceRefs"],message:"evidenceRefs must be unique"});if(!e.runRef&&!e.taskRef&&!e.helpRequestRef&&!e.approvalRequestRef&&!e.backgroundResultRef)i.addIssue({code:s.ZodIssueCode.custom,path:["runRef"],message:"at least one run, task, help request, approval request, or background result ref is required"})});function c(e,i){return e.tenantRef===i.tenantRef&&e.workspaceRef===i.workspaceRef&&e.spaceRef===i.spaceRef&&e.subjectRef===i.subjectRef}function S(e){let i=[];for(let n of["agentRef","applicationRef"])if(e.profile[n]!==e.lifecycleLink[n])i.push(`Lifecycle ${n} does not match the agent profile`);if(e.lifecycleLink.profile.ref!==e.profile.profileRef||e.lifecycleLink.profile.revision!==e.profile.revision||e.lifecycleLink.profile.digest!==e.profile.profileDigest)i.push("Lifecycle profile binding does not match the agent profile");if(!c(e.profile.scope,e.lifecycleLink.scope))i.push("Lifecycle scope does not match the agent profile");return i}function x(e){let{intent:i,progress:n}=e,t=[];if(n.deliveryRef!==i.deliveryRef||n.intent.ref!==i.deliveryRef||n.intent.digest!==i.deliveryDigest)t.push("Progress delivery does not match the intent");if(!c(n.scope,i.scope))t.push("Progress scope does not match the intent");if(n.recipientRef!==i.recipientRefs[0])t.push("Progress recipient does not match the intent");let r=i.requestedRoutes.find((m)=>m.ref===n.route.ref);if(!r||r.revision!==n.route.revision||r.digest!==n.route.digest)t.push("Progress route was not requested by the intent");if(Date.parse(n.occurredAt)<Date.parse(i.createdAt)||Date.parse(n.occurredAt)>Date.parse(i.expiresAt))t.push("Progress occurred outside the intent validity window");return t}function C(e){if(e.connectionState!=="active")return a("connection_inactive");if(e.identityState==="revoked")return a("identity_revoked");if(e.consentState!=="valid")return a("consent_invalid");if(e.pairingState==="denied")return a("pairing_denied");if(e.membershipState==="not_member")return a("membership_denied");if(e.pairingState==="pending")return p("pairing_required");if(e.identityState!=="linked")return p("identity_unresolved");if(e.membershipState==="unknown")return p("membership_unresolved");if(e.conversationKind==="group"&&e.mentionPolicy==="required"&&!e.mentionDetected)return{status:"ignored",reason:"mention_required"};return{status:"admitted",reason:"eligible"}}function B(e){let{receipt:i,context:n,decision:t}=e,r=y({receipt:i,context:n});if(!c(i.scope,t.scope))r.push("Ingress decision scope does not match receipt");if(t.receipt.ref!==i.receiptRef||t.receipt.digest!==i.receiptDigest)r.push("Ingress decision receipt binding does not match");if(t.context.ref!==n.contextRef||t.context.digest!==n.contextDigest)r.push("Ingress decision context binding does not match");let m=C(n);if(t.status!==m.status||t.reason!==m.reason)r.push("Ingress decision does not match deterministic admission policy");return r}function y(e){let i=[];if(e.context.receipt.ref!==e.receipt.receiptRef||e.context.receipt.digest!==e.receipt.receiptDigest)i.push("Ingress context receipt binding does not match");if(!c(e.receipt.scope,e.context.scope))i.push("Ingress context scope does not match receipt");if(!v(e.receipt.connection,e.context.connection))i.push("Ingress context connection does not match receipt");if(Date.parse(e.context.evaluatedAt)<Date.parse(e.receipt.receivedAt))i.push("Ingress context predates durable receipt");return i}function v(e,i){return e.ref===i.ref&&e.revision===i.revision&&e.digest===i.digest}function a(e){return{status:"blocked",reason:e}}function p(e){return{status:"quarantined",reason:e}}export{C as classifyCommunicationIngressAdmissionV1,B as validateCommunicationIngressAdmissionBindingV1,y as validateCommunicationIngressContextBindingV1};

package/dist/contracts/ingress-admission.d.ts

@@ -0,0 +1,184 @@
+import { z } from 'zod';
+export declare const COMMUNICATION_INGRESS_RECEIPT_V1: 'communication.ingress-receipt.v1';
+export declare const COMMUNICATION_INGRESS_ADMISSION_CONTEXT_V1: 'communication.ingress-admission-context.v1';
+export declare const COMMUNICATION_INGRESS_ADMISSION_DECISION_V1: 'communication.ingress-admission-decision.v1';
+/** Durable metadata receipt; raw provider bytes and secrets remain adapter-private. */
+export declare const CommunicationIngressReceiptV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"communication.ingress-receipt.v1">;
+    receiptRef: z.ZodString;
+    receiptDigest: z.ZodString;
+    scope: z.ZodObject<{
+        tenantRef: z.ZodString;
+        workspaceRef: z.ZodOptional<z.ZodString>;
+        spaceRef: z.ZodOptional<z.ZodString>;
+        subjectRef: z.ZodString;
+    }, z.core.$strict>;
+    connection: z.ZodObject<{
+        ref: z.ZodString;
+        digest: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    network: z.ZodString;
+    providerDeliveryRef: z.ZodOptional<z.ZodString>;
+    payloadDigest: z.ZodString;
+    authenticationEvidence: z.ZodObject<{
+        ref: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>;
+    receivedAt: z.ZodString;
+    effectAuthority: z.ZodLiteral<"none">;
+}, z.core.$strict>;
+/** Exact deterministic inputs used after durable webhook acknowledgement. */
+export declare const CommunicationIngressAdmissionContextV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"communication.ingress-admission-context.v1">;
+    contextRef: z.ZodString;
+    contextDigest: z.ZodString;
+    receipt: z.ZodObject<{
+        ref: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>;
+    scope: z.ZodObject<{
+        tenantRef: z.ZodString;
+        workspaceRef: z.ZodOptional<z.ZodString>;
+        spaceRef: z.ZodOptional<z.ZodString>;
+        subjectRef: z.ZodString;
+    }, z.core.$strict>;
+    connection: z.ZodObject<{
+        ref: z.ZodString;
+        digest: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    connectionState: z.ZodEnum<{
+        active: "active";
+        revoked: "revoked";
+        unavailable: "unavailable";
+    }>;
+    conversationKind: z.ZodEnum<{
+        direct: "direct";
+        group: "group";
+    }>;
+    channelIdentity: z.ZodObject<{
+        ref: z.ZodString;
+        digest: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    identityState: z.ZodEnum<{
+        linked: "linked";
+        pending: "pending";
+        revoked: "revoked";
+        unknown: "unknown";
+    }>;
+    identityLink: z.ZodOptional<z.ZodObject<{
+        ref: z.ZodString;
+        digest: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>>;
+    resolvedPrincipalRef: z.ZodOptional<z.ZodString>;
+    pairingState: z.ZodEnum<{
+        confirmed: "confirmed";
+        denied: "denied";
+        not_required: "not_required";
+        pending: "pending";
+    }>;
+    pairing: z.ZodOptional<z.ZodObject<{
+        ref: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>>;
+    membershipState: z.ZodEnum<{
+        member: "member";
+        not_member: "not_member";
+        unknown: "unknown";
+    }>;
+    membership: z.ZodOptional<z.ZodObject<{
+        ref: z.ZodString;
+        digest: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>>;
+    mentionPolicy: z.ZodEnum<{
+        not_required: "not_required";
+        required: "required";
+    }>;
+    mentionDetected: z.ZodBoolean;
+    consentState: z.ZodEnum<{
+        expired: "expired";
+        missing: "missing";
+        revoked: "revoked";
+        valid: "valid";
+    }>;
+    policyRefs: z.ZodArray<z.ZodString>;
+    evidenceRefs: z.ZodArray<z.ZodString>;
+    evaluatedAt: z.ZodString;
+}, z.core.$strict>;
+export declare const CommunicationIngressAdmissionReasonV1Schema: z.ZodEnum<{
+    connection_inactive: "connection_inactive";
+    consent_invalid: "consent_invalid";
+    eligible: "eligible";
+    identity_revoked: "identity_revoked";
+    identity_unresolved: "identity_unresolved";
+    membership_denied: "membership_denied";
+    membership_unresolved: "membership_unresolved";
+    mention_required: "mention_required";
+    pairing_denied: "pairing_denied";
+    pairing_required: "pairing_required";
+}>;
+export declare const CommunicationIngressAdmissionDecisionV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"communication.ingress-admission-decision.v1">;
+    decisionRef: z.ZodString;
+    decisionDigest: z.ZodString;
+    receipt: z.ZodObject<{
+        ref: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>;
+    context: z.ZodObject<{
+        ref: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>;
+    scope: z.ZodObject<{
+        tenantRef: z.ZodString;
+        workspaceRef: z.ZodOptional<z.ZodString>;
+        spaceRef: z.ZodOptional<z.ZodString>;
+        subjectRef: z.ZodString;
+    }, z.core.$strict>;
+    status: z.ZodEnum<{
+        admitted: "admitted";
+        blocked: "blocked";
+        ignored: "ignored";
+        quarantined: "quarantined";
+    }>;
+    reason: z.ZodEnum<{
+        connection_inactive: "connection_inactive";
+        consent_invalid: "consent_invalid";
+        eligible: "eligible";
+        identity_revoked: "identity_revoked";
+        identity_unresolved: "identity_unresolved";
+        membership_denied: "membership_denied";
+        membership_unresolved: "membership_unresolved";
+        mention_required: "mention_required";
+        pairing_denied: "pairing_denied";
+        pairing_required: "pairing_required";
+    }>;
+    canonicalConversation: z.ZodOptional<z.ZodObject<{
+        ref: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>>;
+    normalizedIngestionRef: z.ZodOptional<z.ZodString>;
+    quarantineRef: z.ZodOptional<z.ZodString>;
+    decidedAt: z.ZodString;
+    evidenceRefs: z.ZodArray<z.ZodString>;
+    effectAuthority: z.ZodLiteral<"none">;
+}, z.core.$strict>;
+export type CommunicationIngressReceiptV1 = z.infer<typeof CommunicationIngressReceiptV1Schema>;
+export type CommunicationIngressAdmissionContextV1 = z.infer<typeof CommunicationIngressAdmissionContextV1Schema>;
+export type CommunicationIngressAdmissionDecisionV1 = z.infer<typeof CommunicationIngressAdmissionDecisionV1Schema>;
+export declare function digestCommunicationIngressReceiptV1(receipt: Omit<CommunicationIngressReceiptV1, 'receiptDigest'>): Promise<`sha256:${string}`>;
+export declare function digestCommunicationIngressAdmissionContextV1(context: Omit<CommunicationIngressAdmissionContextV1, 'contextDigest'>): Promise<`sha256:${string}`>;
+export declare function digestCommunicationIngressAdmissionDecisionV1(decision: Omit<CommunicationIngressAdmissionDecisionV1, 'decisionDigest'>): Promise<`sha256:${string}`>;
+export declare function verifyCommunicationIngressArtifactDigestsV1(input: {
+    receipt: CommunicationIngressReceiptV1;
+    context: CommunicationIngressAdmissionContextV1;
+    decision: CommunicationIngressAdmissionDecisionV1;
+}): Promise<boolean>;
+export declare function verifyCommunicationIngressReceiptV1(receipt: CommunicationIngressReceiptV1): Promise<boolean>;
+export declare function verifyCommunicationIngressAdmissionContextV1(context: CommunicationIngressAdmissionContextV1): Promise<boolean>;
+export declare function verifyCommunicationIngressAdmissionDecisionV1(decision: CommunicationIngressAdmissionDecisionV1): Promise<boolean>;
+export { classifyCommunicationIngressAdmissionV1, validateCommunicationIngressAdmissionBindingV1, validateCommunicationIngressContextBindingV1, } from './ingress-admission-policy.js';

package/dist/contracts/ingress-admission.js

@@ -0,0 +1,2 @@
+// @bun
+import{z as o}from"zod";import{z as r}from"zod";var S="1.0.0",x="1.0.0",j={id:"communication-os.agent-omnichannel.v1",title:"CommunicationOS agent omnichannel contracts",body:"Provider-neutral agent profiles and lifecycle links bind applications, runs, tasks, help requests, background results, routes, preferences, policies, and evidence through opaque references. They grant no provider access or effect authority.",kind:"reference",route:"/docs/communication-os/agent-omnichannel-v1",visibility:"public"},s=r.string().trim().min(1),V=r.string().datetime({offset:!0}),d=r.string().regex(/^sha256:[a-f0-9]{64}$/),p=r.object({ref:s,digest:d}).strict(),m=p.extend({revision:r.number().int().positive()}).strict(),g=r.object({tenantRef:s,workspaceRef:s.optional(),spaceRef:s.optional(),subjectRef:s}).strict(),M=r.object({schemaVersion:r.literal(S),profileRef:s,revision:r.number().int().positive(),agentRef:s,applicationRef:s,scope:g,routeBindings:r.array(m),connectionRefs:r.array(s),preferenceSet:m,policyRefs:r.array(s).min(1),evidenceRefs:r.array(s).min(1),createdAt:V,updatedAt:V,profileDigest:d}).strict().superRefine((e,i)=>{for(let t of["connectionRefs","policyRefs","evidenceRefs"])if(new Set(e[t]).size!==e[t].length)i.addIssue({code:r.ZodIssueCode.custom,path:[t],message:`${t} must be unique`});let n=e.routeBindings.map((t)=>t.ref);if(new Set(n).size!==n.length)i.addIssue({code:r.ZodIssueCode.custom,path:["routeBindings"],message:"route bindings must be unique"})}),T=r.object({schemaVersion:r.literal(x),linkRef:s,profile:m,agentRef:s,applicationRef:s,scope:g,runRef:s.optional(),taskRef:s.optional(),helpRequestRef:s.optional(),approvalRequestRef:s.optional(),backgroundResultRef:s.optional(),canonicalConversation:p.optional(),session:m.optional(),correlationRef:s,evidenceRefs:r.array(s).min(1)}).strict().superRefine((e,i)=>{if(new Set(e.evidenceRefs).size!==e.evidenceRefs.length)i.addIssue({code:r.ZodIssueCode.custom,path:["evidenceRefs"],message:"evidenceRefs must be unique"});if(!e.runRef&&!e.taskRef&&!e.helpRequestRef&&!e.approvalRequestRef&&!e.backgroundResultRef)i.addIssue({code:r.ZodIssueCode.custom,path:["runRef"],message:"at least one run, task, help request, approval request, or background result ref is required"})});function l(e,i){return e.tenantRef===i.tenantRef&&e.workspaceRef===i.workspaceRef&&e.spaceRef===i.spaceRef&&e.subjectRef===i.subjectRef}function U(e){let i=[];for(let n of["agentRef","applicationRef"])if(e.profile[n]!==e.lifecycleLink[n])i.push(`Lifecycle ${n} does not match the agent profile`);if(e.lifecycleLink.profile.ref!==e.profile.profileRef||e.lifecycleLink.profile.revision!==e.profile.revision||e.lifecycleLink.profile.digest!==e.profile.profileDigest)i.push("Lifecycle profile binding does not match the agent profile");if(!l(e.profile.scope,e.lifecycleLink.scope))i.push("Lifecycle scope does not match the agent profile");return i}function Z(e){let{intent:i,progress:n}=e,t=[];if(n.deliveryRef!==i.deliveryRef||n.intent.ref!==i.deliveryRef||n.intent.digest!==i.deliveryDigest)t.push("Progress delivery does not match the intent");if(!l(n.scope,i.scope))t.push("Progress scope does not match the intent");if(n.recipientRef!==i.recipientRefs[0])t.push("Progress recipient does not match the intent");let c=i.requestedRoutes.find((f)=>f.ref===n.route.ref);if(!c||c.revision!==n.route.revision||c.digest!==n.route.digest)t.push("Progress route was not requested by the intent");if(Date.parse(n.occurredAt)<Date.parse(i.createdAt)||Date.parse(n.occurredAt)>Date.parse(i.expiresAt))t.push("Progress occurred outside the intent validity window");return t}async function y(e){let i=new TextEncoder().encode(h(e)),n=new Uint8Array(i.byteLength);n.set(i);let t=await crypto.subtle.digest("SHA-256",n.buffer),c=Array.from(new Uint8Array(t),(f)=>f.toString(16).padStart(2,"0")).join("");return d.parse(`sha256:${c}`)}function h(e){if(Array.isArray(e))return`[${e.map(h).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).sort(([i],[n])=>i.localeCompare(n)).map(([i,n])=>`${JSON.stringify(i)}:${h(n)}`).join(",")}}`;return JSON.stringify(e)}function v(e){if(e.connectionState!=="active")return C("connection_inactive");if(e.identityState==="revoked")return C("identity_revoked");if(e.consentState!=="valid")return C("consent_invalid");if(e.pairingState==="denied")return C("pairing_denied");if(e.membershipState==="not_member")return C("membership_denied");if(e.pairingState==="pending")return R("pairing_required");if(e.identityState!=="linked")return R("identity_unresolved");if(e.membershipState==="unknown")return R("membership_unresolved");if(e.conversationKind==="group"&&e.mentionPolicy==="required"&&!e.mentionDetected)return{status:"ignored",reason:"mention_required"};return{status:"admitted",reason:"eligible"}}function b(e){let{receipt:i,context:n,decision:t}=e,c=A({receipt:i,context:n});if(!l(i.scope,t.scope))c.push("Ingress decision scope does not match receipt");if(t.receipt.ref!==i.receiptRef||t.receipt.digest!==i.receiptDigest)c.push("Ingress decision receipt binding does not match");if(t.context.ref!==n.contextRef||t.context.digest!==n.contextDigest)c.push("Ingress decision context binding does not match");let f=v(n);if(t.status!==f.status||t.reason!==f.reason)c.push("Ingress decision does not match deterministic admission policy");return c}function A(e){let i=[];if(e.context.receipt.ref!==e.receipt.receiptRef||e.context.receipt.digest!==e.receipt.receiptDigest)i.push("Ingress context receipt binding does not match");if(!l(e.receipt.scope,e.context.scope))i.push("Ingress context scope does not match receipt");if(!D(e.receipt.connection,e.context.connection))i.push("Ingress context connection does not match receipt");if(Date.parse(e.context.evaluatedAt)<Date.parse(e.receipt.receivedAt))i.push("Ingress context predates durable receipt");return i}function D(e,i){return e.ref===i.ref&&e.revision===i.revision&&e.digest===i.digest}function C(e){return{status:"blocked",reason:e}}function R(e){return{status:"quarantined",reason:e}}var k="communication.ingress-receipt.v1",_="communication.ingress-admission-context.v1",q="communication.ingress-admission-decision.v1",a=o.string().trim().min(1),I=o.string().datetime({offset:!0}),W=o.object({schemaVersion:o.literal(k),receiptRef:a,receiptDigest:d,scope:g,connection:m,network:a,providerDeliveryRef:a.optional(),payloadDigest:d,authenticationEvidence:p,receivedAt:I,effectAuthority:o.literal("none")}).strict(),ee=o.object({schemaVersion:o.literal(_),contextRef:a,contextDigest:d,receipt:p,scope:g,connection:m,connectionState:o.enum(["active","revoked","unavailable"]),conversationKind:o.enum(["direct","group"]),channelIdentity:m,identityState:o.enum(["linked","pending","unknown","revoked"]),identityLink:m.optional(),resolvedPrincipalRef:a.optional(),pairingState:o.enum(["not_required","confirmed","pending","denied"]),pairing:p.optional(),membershipState:o.enum(["member","not_member","unknown"]),membership:m.optional(),mentionPolicy:o.enum(["not_required","required"]),mentionDetected:o.boolean(),consentState:o.enum(["valid","missing","revoked","expired"]),policyRefs:o.array(a).min(1),evidenceRefs:o.array(a).min(1),evaluatedAt:I}).strict().superRefine((e,i)=>{for(let t of["policyRefs","evidenceRefs"])if(new Set(e[t]).size!==e[t].length)i.addIssue({code:o.ZodIssueCode.custom,path:[t],message:`${t} must be unique`});let n=e.identityState==="linked"||e.identityState==="revoked";if(n!==Boolean(e.identityLink))u(i,"identityLink","linked or revoked identity requires its exact identity link");if(n!==Boolean(e.resolvedPrincipalRef))u(i,"resolvedPrincipalRef","linked or revoked identity requires its resolved principal");if(e.pairingState!=="not_required"!==Boolean(e.pairing))u(i,"pairing","pairing state requires its exact evidence binding");if(e.membershipState!=="unknown"!==Boolean(e.membership))u(i,"membership","membership state requires its exact membership binding")}),B=o.enum(["eligible","connection_inactive","identity_revoked","consent_invalid","pairing_denied","membership_denied","pairing_required","identity_unresolved","membership_unresolved","mention_required"]),ie=o.object({schemaVersion:o.literal(q),decisionRef:a,decisionDigest:d,receipt:p,context:p,scope:g,status:o.enum(["admitted","quarantined","ignored","blocked"]),reason:B,canonicalConversation:p.optional(),normalizedIngestionRef:a.optional(),quarantineRef:a.optional(),decidedAt:I,evidenceRefs:o.array(a).min(1),effectAuthority:o.literal("none")}).strict().superRefine((e,i)=>{let n=e.status==="admitted";if(n!==Boolean(e.canonicalConversation))u(i,"canonicalConversation","only admission binds a conversation");if(n!==Boolean(e.normalizedIngestionRef))u(i,"normalizedIngestionRef","only admission binds normalized ingestion");if(e.status==="quarantined"!==Boolean(e.quarantineRef))u(i,"quarantineRef","only quarantine requires a quarantine ref")});async function P(e){return y(e)}async function w(e){return y(e)}async function L(e){return y(e)}async function ne(e){return await N(e.receipt)&&await O(e.context)&&await E(e.decision)}async function N(e){let{receiptDigest:i,...n}=e;return i===await P(n)}async function O(e){let{contextDigest:i,...n}=e;return i===await w(n)}async function E(e){let{decisionDigest:i,...n}=e;return i===await L(n)}function u(e,i,n){e.addIssue({code:o.ZodIssueCode.custom,path:[i],message:n})}export{_ as COMMUNICATION_INGRESS_ADMISSION_CONTEXT_V1,q as COMMUNICATION_INGRESS_ADMISSION_DECISION_V1,k as COMMUNICATION_INGRESS_RECEIPT_V1,ee as CommunicationIngressAdmissionContextV1Schema,ie as CommunicationIngressAdmissionDecisionV1Schema,B as CommunicationIngressAdmissionReasonV1Schema,W as CommunicationIngressReceiptV1Schema,v as classifyCommunicationIngressAdmissionV1,w as digestCommunicationIngressAdmissionContextV1,L as digestCommunicationIngressAdmissionDecisionV1,P as digestCommunicationIngressReceiptV1,b as validateCommunicationIngressAdmissionBindingV1,A as validateCommunicationIngressContextBindingV1,O as verifyCommunicationIngressAdmissionContextV1,E as verifyCommunicationIngressAdmissionDecisionV1,ne as verifyCommunicationIngressArtifactDigestsV1,N as verifyCommunicationIngressReceiptV1};

package/dist/contracts/ingress-admission.test.d.ts

@@ -0,0 +1 @@
+export {};