@oxy.so/contracts 1.0.0

package/dist/cjs/inference/accountBilling.js

@@ -0,0 +1,334 @@
+"use strict";
+/**
+ * The account-scoped billing surface: who pays, what they hold, what bounds
+ * them, and how it reconciles against the payment processor.
+ *
+ * Every shape here is denominated in {@link exactDecimalSchema} — an exact
+ * decimal string — for the reason `money.ts` gives at length: a JS `number`
+ * cannot represent `0.1 + 0.2`, and a balance is the last place a rounding error
+ * should be allowed to accumulate silently.
+ *
+ * ## What is NOT here, and where it is instead
+ *
+ * The BALANCE and the BUDGETS both live at `/inference/reporting` (#972
+ * workstream 8), which owns the customer's view of what they hold and what
+ * bounds them, stamped `{source, consistency}` so a reader can always tell which
+ * kind of number they are looking at. This file declares who PAYS and on what
+ * TERMS, plus the records that sit behind those numbers — invoices, processor
+ * payments, auto-recharge attempts and reconciliation.
+ *
+ * The split is not cosmetic. A second balance shape here would be a second
+ * answer to one question, and the pair would disagree the day one of them stops
+ * accounting for an invoiced account's unused credit line — which is exactly the
+ * kind of drift a customer discovers before we do.
+ *
+ * ## Product entitlements are NOT here
+ *
+ * Alia plans, their monthly allowances and the API-credit product live in
+ * `entitlement.ts`, in a shape that cannot be added to a balance. #972 is
+ * explicit that confusing a product subscription with pay-as-you-go inference
+ * spend is the failure mode, so the two are separate types that share no field
+ * and no unit.
+ *
+ * ## Stripe appears only as a REFERENCE
+ *
+ * `externalRef` names a record in the processor's database; nothing in this file
+ * is derived from Stripe, and no shape here can carry a processor-computed
+ * balance. The epic's invariant is that Stripe is a payment and invoicing
+ * processor and not the authoritative usage ledger, so the reconciliation shapes
+ * below describe a COMPARISON between two independent records rather than an
+ * import of one into the other.
+ *
+ * Decided in: docs/adr/0014-account-billing-and-entitlements.md,
+ * docs/adr/0009-usage-reservation-and-settlement.md.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reconciliationReportSchema = exports.reconciliationRunSchema = exports.reconciliationDiscrepancySchema = exports.reconciliationRunStatusSchema = exports.RECONCILIATION_RUN_STATUSES = exports.reconciliationDiscrepancyKindSchema = exports.RECONCILIATION_DISCREPANCY_KINDS = exports.autoRechargeAttemptSchema = exports.autoRechargeStatusSchema = exports.AUTO_RECHARGE_STATUSES = exports.externalPaymentSchema = exports.externalPaymentKindSchema = exports.EXTERNAL_PAYMENT_KINDS = exports.externalPaymentProviderSchema = exports.EXTERNAL_PAYMENT_PROVIDERS = exports.billingInvoiceSchema = exports.billingInvoiceStatusSchema = exports.BILLING_INVOICE_STATUSES = exports.accountBillingStateSchema = exports.billingProfileSchema = exports.autoRechargeSchema = exports.billingProfileStatusSchema = exports.BILLING_PROFILE_STATUSES = exports.billingModeSchema = exports.BILLING_MODES = void 0;
+const zod_1 = require("zod");
+const identifiers_1 = require("./identifiers");
+const money_1 = require("./money");
+/* -------------------------------------------------------------------------- */
+/*  Billing profile                                                           */
+/* -------------------------------------------------------------------------- */
+/**
+ * How an account pays.
+ *
+ * `prepaid` spends money it topped up in advance. `invoiced` draws against a
+ * credit limit and is billed in arrears — the enterprise shape. Both settle
+ * through the same ledger; the difference is only which bucket a reservation
+ * draws from once the prepaid and granted balances are exhausted.
+ */
+exports.BILLING_MODES = ['prepaid', 'invoiced'];
+exports.billingModeSchema = zod_1.z.enum(exports.BILLING_MODES);
+/** Whether the profile may currently spend at all. */
+exports.BILLING_PROFILE_STATUSES = ['active', 'suspended', 'closed'];
+exports.billingProfileStatusSchema = zod_1.z.enum(exports.BILLING_PROFILE_STATUSES);
+/**
+ * Automatic top-up settings.
+ *
+ * An IMPLICATION rather than a biconditional, matching the column CHECK: the
+ * two amounts may be configured before the feature is switched on, but an
+ * `enabled` recharge with either missing is a setting that reads as "on" and can
+ * never fire — the shape a customer discovers only when their traffic stops.
+ */
+exports.autoRechargeSchema = zod_1.z
+    .object({
+    enabled: zod_1.z.boolean(),
+    /** Recharge when the spendable balance falls below this. */
+    threshold: money_1.exactDecimalSchema.optional(),
+    /** How much to add. */
+    amount: money_1.exactDecimalSchema.optional(),
+})
+    .strict()
+    .refine((value) => !value.enabled || (value.threshold !== undefined && value.amount !== undefined), { message: 'an enabled auto-recharge must carry both a threshold and an amount' });
+/**
+ * Which account pays for a workload, and on what terms.
+ *
+ * `accountId` is an Oxy account of ANY kind — personal, organization, project,
+ * bot or channel — because `Application.ownerAccountId` may be any of them. It
+ * is branded (`oxyAccountIdSchema`), so a delegated end-user id cannot be
+ * substituted for it anywhere in this contract.
+ */
+exports.billingProfileSchema = zod_1.z
+    .object({
+    /** See `version.ts`: this shape is served to Console and to Alia. */
+    schemaVersion: zod_1.z.literal(1),
+    accountId: identifiers_1.oxyAccountIdSchema,
+    currency: money_1.currencyCodeSchema,
+    billingMode: exports.billingModeSchema,
+    status: exports.billingProfileStatusSchema,
+    /**
+     * How far an `invoiced` account may draw before a reservation is refused.
+     * Always `'0'` for a `prepaid` account, where it is not consulted at all.
+     */
+    creditLimit: money_1.exactDecimalSchema,
+    autoRecharge: exports.autoRechargeSchema,
+    createdAt: zod_1.z.string().datetime(),
+    updatedAt: zod_1.z.string().datetime(),
+})
+    .strict();
+/* -------------------------------------------------------------------------- */
+/*  Billing state                                                             */
+/* -------------------------------------------------------------------------- */
+/**
+ * WHO pays for an account and on what TERMS. Deliberately not how much they
+ * have.
+ *
+ * The balance lives at `GET /inference/reporting/accounts/:accountId/balance`
+ * (#972 workstream 8), which reads `account_balances` and stamps every response
+ * with `{source: 'financial_ledger', consistency: 'authoritative'}`. Restating
+ * those amounts here would be a second answer to one question, and the failure
+ * mode of two balance endpoints is the pair disagreeing on the day one of them
+ * stops accounting for the credit line.
+ *
+ * What this shape adds, and what nothing else carries: `billingAccountId` and
+ * `inherited`. A project draws on the nearest ancestor that has a profile
+ * (ADR 0014), so a Console page has to be able to say "this project spends the
+ * organization's balance" — showing somebody else's money under a project's name
+ * with no indication whose it is would be worse than showing nothing.
+ */
+exports.accountBillingStateSchema = zod_1.z
+    .object({
+    /** See `version.ts`: this shape is served to Console and to Alia. */
+    schemaVersion: zod_1.z.literal(1),
+    accountId: identifiers_1.oxyAccountIdSchema,
+    billingAccountId: identifiers_1.oxyAccountIdSchema,
+    inherited: zod_1.z.boolean(),
+    profile: exports.billingProfileSchema,
+})
+    .strict();
+/*
+ * SPENDING LIMITS AND THEIR ALERTS ARE NOT DECLARED HERE.
+ *
+ * `/inference/reporting` owns the budget surface (#972 workstream 8) and
+ * declares its own shapes beside the router that serves them, stamped
+ * `{source, consistency}` so a reader can always tell which kind of number they
+ * are looking at. A second set here would be a second answer to what a budget
+ * is, on a table both would write — and the closed alert-threshold set already
+ * lives once more where it is ENFORCED, as a CHECK on
+ * `spending_limits.alert_threshold_bps`.
+ */
+/* -------------------------------------------------------------------------- */
+/*  Invoices                                                                  */
+/* -------------------------------------------------------------------------- */
+exports.BILLING_INVOICE_STATUSES = ['draft', 'open', 'paid', 'void'];
+exports.billingInvoiceStatusSchema = zod_1.z.enum(exports.BILLING_INVOICE_STATUSES);
+/**
+ * A period's charges, aggregated — the invoiced-enterprise settlement document.
+ *
+ * `subtotalAmount` is the EXACT sum of the receipts on the invoice, at full
+ * scale; `totalAmount` is the rounded figure actually charged. The difference is
+ * booked as an `invoice_rounding` ledger entry rather than discarded, because a
+ * discarded remainder is money that exists in one system and not the other.
+ *
+ * `minorUnitExponent` is carried rather than derived from the currency code:
+ * USD is 2, JPY is 0, BHD is 3, and that is not a property this platform's
+ * database knows. Storing what was used keeps the invoice reproducible.
+ */
+exports.billingInvoiceSchema = zod_1.z
+    .object({
+    /** See `version.ts`: this shape is served to Console and to Alia. */
+    schemaVersion: zod_1.z.literal(1),
+    id: zod_1.z.string().min(1).max(64),
+    accountId: identifiers_1.oxyAccountIdSchema,
+    currency: money_1.currencyCodeSchema,
+    periodStart: zod_1.z.string().datetime(),
+    periodEnd: zod_1.z.string().datetime(),
+    status: exports.billingInvoiceStatusSchema,
+    subtotalAmount: money_1.exactDecimalSchema,
+    totalAmount: money_1.exactDecimalSchema,
+    minorUnitExponent: zod_1.z.number().int().min(0).max(4),
+    /** The processor's own invoice id, for reconciliation. Never an authority. */
+    externalInvoiceRef: zod_1.z.string().min(1).max(255).optional(),
+    issuedAt: zod_1.z.string().datetime().optional(),
+    paidAt: zod_1.z.string().datetime().optional(),
+    receiptCount: zod_1.z.number().int().nonnegative().safe(),
+})
+    .strict();
+/* -------------------------------------------------------------------------- */
+/*  Payment processor boundary                                                */
+/* -------------------------------------------------------------------------- */
+/** The processors this platform records payments from. */
+exports.EXTERNAL_PAYMENT_PROVIDERS = ['stripe'];
+exports.externalPaymentProviderSchema = zod_1.z.enum(exports.EXTERNAL_PAYMENT_PROVIDERS);
+/**
+ * What kind of processor record `externalRef` names.
+ *
+ * Kept explicit because reconciliation compares like with like: a payment intent
+ * and the invoice it paid are two records of one movement of money, and counting
+ * both would double the external total.
+ */
+exports.EXTERNAL_PAYMENT_KINDS = ['payment_intent', 'invoice'];
+exports.externalPaymentKindSchema = zod_1.z.enum(exports.EXTERNAL_PAYMENT_KINDS);
+/**
+ * A processor payment that funded an Oxy balance.
+ *
+ * This is the reconciliation ANCHOR: one row per charge that landed in the
+ * ledger, carrying both the processor's reference and the ledger entry it
+ * produced. Without it, matching a Stripe charge back to a ledger entry means
+ * parsing an idempotency key, and a parser is not a foreign key.
+ */
+exports.externalPaymentSchema = zod_1.z
+    .object({
+    id: zod_1.z.string().min(1).max(64),
+    accountId: identifiers_1.oxyAccountIdSchema,
+    provider: exports.externalPaymentProviderSchema,
+    externalKind: exports.externalPaymentKindSchema,
+    externalRef: zod_1.z.string().min(1).max(255),
+    amount: money_1.exactDecimalSchema,
+    currency: money_1.currencyCodeSchema,
+    ledgerEntryId: zod_1.z.string().min(1).max(64),
+    occurredAt: zod_1.z.string().datetime(),
+    createdAt: zod_1.z.string().datetime(),
+})
+    .strict();
+/** Lifecycle of one automatic top-up. */
+exports.AUTO_RECHARGE_STATUSES = ['pending', 'succeeded', 'failed'];
+exports.autoRechargeStatusSchema = zod_1.z.enum(exports.AUTO_RECHARGE_STATUSES);
+/**
+ * One attempt to top an account up automatically.
+ *
+ * Recorded BEFORE the processor is called and keyed on the account, currency and
+ * the window it fired in, so a sweep that runs twice — or two instances of it —
+ * charges a customer's card once. An off-session charge is the one operation on
+ * this surface where a duplicate is not merely a wrong number in a report.
+ */
+exports.autoRechargeAttemptSchema = zod_1.z
+    .object({
+    /** See `version.ts`: this shape is served to Console and to Alia. */
+    schemaVersion: zod_1.z.literal(1),
+    id: zod_1.z.string().min(1).max(64),
+    accountId: identifiers_1.oxyAccountIdSchema,
+    currency: money_1.currencyCodeSchema,
+    requestedAmount: money_1.exactDecimalSchema,
+    /** The spendable balance that triggered it — why this attempt exists. */
+    balanceAtTrigger: money_1.exactDecimalSchema,
+    status: exports.autoRechargeStatusSchema,
+    externalRef: zod_1.z.string().min(1).max(255).optional(),
+    /** The processor's own decline code. Never a free-form message. */
+    failureCode: zod_1.z.string().min(1).max(64).optional(),
+    createdAt: zod_1.z.string().datetime(),
+    updatedAt: zod_1.z.string().datetime(),
+})
+    .strict();
+/* -------------------------------------------------------------------------- */
+/*  Reconciliation                                                            */
+/* -------------------------------------------------------------------------- */
+/**
+ * How an Oxy record and a processor record fail to agree.
+ *
+ * A closed set, and every member is a DIFFERENT operational problem:
+ *
+ *  - `missing_in_ledger` — the processor took money Oxy never credited. The
+ *    customer paid and has no balance. This is the one that costs a customer.
+ *  - `missing_in_external` — Oxy credited a balance with no processor charge
+ *    behind it. This is the one that costs Oxy.
+ *  - `amount_mismatch` — both exist and disagree.
+ *  - `account_unresolved` — a processor charge whose customer maps to no Oxy
+ *    account. Money arrived and nobody owns it.
+ *
+ * Collapsing them into a single "discrepancy" count is what makes a
+ * reconciliation report a number nobody acts on.
+ */
+exports.RECONCILIATION_DISCREPANCY_KINDS = [
+    'missing_in_ledger',
+    'missing_in_external',
+    'amount_mismatch',
+    'account_unresolved',
+];
+exports.reconciliationDiscrepancyKindSchema = zod_1.z.enum(exports.RECONCILIATION_DISCREPANCY_KINDS);
+exports.RECONCILIATION_RUN_STATUSES = ['running', 'completed', 'failed'];
+exports.reconciliationRunStatusSchema = zod_1.z.enum(exports.RECONCILIATION_RUN_STATUSES);
+exports.reconciliationDiscrepancySchema = zod_1.z
+    .object({
+    /** See `version.ts`: this shape is served to Console and to Alia. */
+    schemaVersion: zod_1.z.literal(1),
+    id: zod_1.z.string().min(1).max(64),
+    runId: zod_1.z.string().min(1).max(64),
+    kind: exports.reconciliationDiscrepancyKindSchema,
+    accountId: identifiers_1.oxyAccountIdSchema.optional(),
+    externalRef: zod_1.z.string().min(1).max(255).optional(),
+    ledgerEntryId: zod_1.z.string().min(1).max(64).optional(),
+    /** What Oxy recorded. Absent for `missing_in_ledger`. */
+    ledgerAmount: money_1.exactDecimalSchema.optional(),
+    /** What the processor recorded. Absent for `missing_in_external`. */
+    externalAmount: money_1.exactDecimalSchema.optional(),
+    currency: money_1.currencyCodeSchema,
+    createdAt: zod_1.z.string().datetime(),
+})
+    .strict();
+/**
+ * One reconciliation pass over a window.
+ *
+ * The totals are carried beside the discrepancy list on purpose: two totals that
+ * agree while the lists differ is a real and common state (a charge recorded
+ * against the wrong account), and a report that only published a difference
+ * would call it clean.
+ */
+exports.reconciliationRunSchema = zod_1.z
+    .object({
+    /** See `version.ts`: this shape is served to Console and to Alia. */
+    schemaVersion: zod_1.z.literal(1),
+    id: zod_1.z.string().min(1).max(64),
+    provider: exports.externalPaymentProviderSchema,
+    /** Absent for a platform-wide pass. */
+    accountId: identifiers_1.oxyAccountIdSchema.optional(),
+    currency: money_1.currencyCodeSchema,
+    periodStart: zod_1.z.string().datetime(),
+    periodEnd: zod_1.z.string().datetime(),
+    status: exports.reconciliationRunStatusSchema,
+    ledgerTotal: money_1.exactDecimalSchema,
+    externalTotal: money_1.exactDecimalSchema,
+    discrepancyCount: zod_1.z.number().int().nonnegative().safe(),
+    startedAt: zod_1.z.string().datetime(),
+    completedAt: zod_1.z.string().datetime().optional(),
+})
+    .strict();
+exports.reconciliationReportSchema = zod_1.z
+    .object({
+    /** See `version.ts`: this shape is served to Console and to Alia. */
+    schemaVersion: zod_1.z.literal(1),
+    run: exports.reconciliationRunSchema,
+    discrepancies: zod_1.z.array(exports.reconciliationDiscrepancySchema),
+})
+    .strict();

package/dist/cjs/inference/aliaModelRelease.js

@@ -0,0 +1,262 @@
+"use strict";
+/**
+ * The signed Alia model release manifest — the ingestion contract for a
+ * first-party model release.
+ *
+ * The catalogue already STORES everything such a manifest carries: the model
+ * card, the licence block, the provenance and base model, the evaluation table,
+ * the safety metadata, and an artifact digest with a `sha256:<64 hex>` CHECK.
+ * What did not exist was the manifest itself — a single document Alia SIGNS,
+ * asserting all of it at once — and that is the gap this shape closes. Nothing
+ * here re-declares a catalogue field; the manifest COMPOSES the published shapes
+ * so a manifest and the catalogue row it produces cannot describe a release
+ * differently.
+ *
+ * ## The manifest tightens the revision it carries
+ *
+ * `modelRevisionSchema` makes `modelCardUrl`, `artifactDigest`, `evaluations`
+ * and `safety` optional, because a third-party route legitimately has none of
+ * them — Oxy did not train those weights and cannot publish a card for them. A
+ * FIRST-PARTY release has no such excuse: the documentation trail is the reason
+ * a release manifest exists at all, and a model Alia ships without one is not a
+ * release, it is a deployment. So the refinement below requires all four,
+ * without changing the catalogue shape that a third-party entry still parses
+ * through.
+ *
+ * ## `.strict()` at the top level, and here that is forced rather than chosen
+ *
+ * The shapes exchanged with the data plane tolerate an unknown field, because
+ * refusing a producer one minor version ahead is a worse failure than ignoring
+ * its addition (`version.ts`). A SIGNED document inverts that: the signature is
+ * over the canonical bytes of the manifest, so a field silently stripped at this
+ * parse is a field missing from the bytes Oxy re-canonicalizes, and verification
+ * fails. A tolerant parse would therefore report "the signature is invalid" for
+ * what is really "this build does not understand this manifest" — the wrong
+ * diagnosis of the right problem. Strict says the true thing, and the cost is
+ * bounded: ingestion is a release-time operation an operator retries once Oxy
+ * takes the newer contract, not a served request that becomes unsettleable.
+ *
+ * ## The ingestion path, which this file used to say did not exist
+ *
+ * It does now: `POST /inference/admin/model-releases`, defined by
+ * `modelReleaseIngestionRequestSchema` in `modelDocumentation.ts`. This shape is
+ * unchanged — the request COMPOSES it, alongside two records that are Oxy's own
+ * rather than the signer's (the GPAI documentation and the capability sheet a
+ * manifest does not carry), precisely so the bytes a signature covers stay
+ * exactly the bytes described here.
+ *
+ * The earlier objection was that a staff write path into an empty catalogue is
+ * an unexercised hazard. What answers it is containment rather than emptiness: an
+ * ingested revision lands with `is_current = false` and no deployment, so nothing
+ * it creates is servable or listed, and a route still needs an approved
+ * contract/legal review before any customer can select it.
+ *
+ * ## What is deliberately NOT here
+ *
+ * **No `payloadDigest` field.** The signature is over the canonical
+ * serialization of this manifest with `signatures` removed, and a verifier
+ * recomputes it. Storing the digest beside the document it digests would be a
+ * second source of truth for one fact, and a verifier that compared the
+ * signature against the DECLARED digest rather than the recomputed one would
+ * verify nothing at all.
+ *
+ * **No verification RESULT.** Whether a signature checked out is Oxy's finding
+ * about the document, not a claim the document makes about itself; a `verified`
+ * field inside a signed manifest is the signer asserting its own signature.
+ *
+ * ## The open owner decision this shape does not take
+ *
+ * **What signs, and what verifies, is not decided.** Oxy holds no Alia signing
+ * key, and whether to resolve `keyId` through the existing attestation machinery
+ * (`services/oxyVerificationResolver.ts`, the civic attestation code) or to
+ * introduce a dedicated Alia release key is a real choice with different
+ * custody, rotation and revocation consequences. So `keyId` is an OPAQUE
+ * identifier and this file names no registry that resolves it: either answer
+ * fits, and neither is presupposed. Until it is answered a manifest can be
+ * parsed and cannot be VERIFIED, so the ingestion path records no verification
+ * finding at all: it stores the signatures and the manifest as received, and the
+ * authority for the ingest is the staff member who performed it. A nullable
+ * `verified` column nothing ever writes would read, to whoever scanned the table
+ * later, as a check that ran.
+ *
+ * Decided in: docs/adr/0008-catalogue-concept-separation.md,
+ * docs/adr/0017-authorized-routes-in-the-envelope.md, issue #972 §12.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aliaModelReleaseManifestSchema = exports.aliaReleaseSignatureSchema = exports.aliaReleaseArtifactSchema = void 0;
+const zod_1 = require("zod");
+const catalogue_1 = require("./catalogue");
+const identifiers_1 = require("./identifiers");
+/**
+ * One artifact of a release, by path and digest.
+ *
+ * `sizeBytes` is required beside the digest so a verifier can refuse a stream
+ * that is the wrong length before reading it to the end, rather than only after.
+ */
+exports.aliaReleaseArtifactSchema = zod_1.z
+    .object({
+    /** Path within the release, e.g. `model-00001-of-00004.safetensors`. */
+    path: zod_1.z.string().min(1).max(512),
+    digest: identifiers_1.sha256DigestSchema,
+    sizeBytes: zod_1.z.number().int().positive().safe(),
+    mediaType: zod_1.z.string().min(1).max(255).optional(),
+})
+    .strict();
+/**
+ * One detached signature over the manifest.
+ *
+ * `algorithm` is a CLOSED enum with one member, and both halves of that are
+ * deliberate. Closed, because a verifier that trusts a document's own algorithm
+ * name accepts whatever that document nominates, `none` included. One member,
+ * because Ed25519 is the scheme ADR 0012 already chose for asymmetric
+ * verification on this platform, and naming a scheme nothing here can check
+ * would be advertising a capability that does not exist. A second member lands
+ * when a verifier for it does — which is a closed enum gaining a member, and
+ * therefore a MINOR contract-set change the handshake surfaces (`version.ts`).
+ *
+ * `keyId` is opaque on purpose: see the header. It identifies the public key
+ * without saying what resolves it.
+ *
+ * The signature covers the canonical serialization (RFC 8785 JCS) of the
+ * manifest with `signatures` removed. The canonicalization is NAMED rather than
+ * left implicit because a digest over "the manifest" is not verifiable by two
+ * implementations that serialize JSON differently; naming it is a mechanical
+ * necessity and is independent of the open question of which key signs.
+ */
+exports.aliaReleaseSignatureSchema = zod_1.z
+    .object({
+    algorithm: zod_1.z.enum(['ed25519']),
+    canonicalization: zod_1.z.enum(['jcs']),
+    /** Opaque identifier of the public key. Resolving it is undecided. */
+    keyId: zod_1.z.string().min(1).max(256),
+    /**
+     * Unpadded base64url. Exactly 86 characters, which is a 64-byte Ed25519
+     * signature — the one algorithm above. A second algorithm moves this length
+     * into a refinement keyed on `algorithm`.
+     */
+    signature: zod_1.z
+        .string()
+        .regex(/^[A-Za-z0-9_-]{86}$/, 'signature must be a 64-byte ed25519 signature in unpadded base64url'),
+    signedAt: identifiers_1.inferenceTimestampSchema,
+})
+    .strict();
+/**
+ * A signed release of an `alia/*` model revision.
+ *
+ * `signatures` is a LIST rather than one signature, because "what signs" is
+ * undecided: a single field would presuppose one signer, while a list lets an
+ * Alia release key and an existing attestation co-sign the same document without
+ * either being retrofitted later.
+ */
+exports.aliaModelReleaseManifestSchema = zod_1.z
+    .object({
+    /** See `version.ts`: an ingestion payload is a whole message on the wire. */
+    schemaVersion: zod_1.z.literal(1),
+    /** The release's own identity, so ingestion is idempotent on it. */
+    releaseId: zod_1.z.string().min(1).max(128),
+    issuedAt: identifiers_1.inferenceTimestampSchema,
+    /**
+     * The revision being released. Carries its OWN `schemaVersion`, like
+     * `billingProfileSchema` inside `accountBillingStateSchema`: the manifest's
+     * version governs the manifest and the revision's governs the revision,
+     * which is two versions of two things rather than two versions of one.
+     */
+    revision: catalogue_1.modelRevisionSchema,
+    /** On the MODEL rather than the revision in the catalogue, so carried here. */
+    provenance: catalogue_1.modelProvenanceSchema,
+    license: catalogue_1.modelLicenseSchema,
+    artifacts: zod_1.z.array(exports.aliaReleaseArtifactSchema).min(1),
+    signatures: zod_1.z.array(exports.aliaReleaseSignatureSchema).min(1),
+})
+    .strict()
+    .superRefine((manifest, ctx) => {
+    // The same rule `catalogueModelSchema` enforces on a model, applied to the
+    // carrier that creates one: `alia/*` names models Alia actually owns or
+    // derived, and a manifest is the document that would launder somebody else's
+    // weights into the namespace.
+    const publisher = manifest.revision.modelId.slice(0, manifest.revision.modelId.indexOf('/'));
+    if (publisher !== identifiers_1.RESERVED_ALIA_PUBLISHER) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['revision', 'modelId'],
+            message: `an Alia release manifest releases a ${identifiers_1.RESERVED_ALIA_PUBLISHER}/* model`,
+        });
+    }
+    if (manifest.provenance.releaseKind !== 'first_party_original' &&
+        manifest.provenance.releaseKind !== 'first_party_derived') {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['provenance', 'releaseKind'],
+            message: 'an Alia release manifest describes a first-party release',
+        });
+    }
+    // A derived model's base is the licence-attribution trail. Recording the
+    // derivation without naming what it derives from loses exactly the fact
+    // attribution needs.
+    if (manifest.provenance.releaseKind === 'first_party_derived' &&
+        manifest.provenance.baseModelId === undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['provenance', 'baseModelId'],
+            message: 'a derived release names the model it derives from',
+        });
+    }
+    // The four fields a third-party catalogue entry may omit and a first-party
+    // release may not. See the header.
+    if (manifest.revision.modelCardUrl === undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['revision', 'modelCardUrl'],
+            message: 'a first-party release publishes a model card',
+        });
+    }
+    if (manifest.revision.safety === undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['revision', 'safety'],
+            message: 'a first-party release publishes its safety metadata',
+        });
+    }
+    if (manifest.revision.evaluations.length === 0) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['revision', 'evaluations'],
+            message: 'a first-party release publishes at least one evaluation result',
+        });
+    }
+    // The digest the catalogue will serve has to be one of the digests this
+    // manifest signed. Otherwise the signature covers a set of artifacts that
+    // does not include the weights anybody runs.
+    if (manifest.revision.artifactDigest === undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['revision', 'artifactDigest'],
+            message: 'a first-party release names the digest of the artifact it serves',
+        });
+    }
+    else if (!manifest.artifacts.some((artifact) => artifact.digest === manifest.revision.artifactDigest)) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['revision', 'artifactDigest'],
+            message: 'the served artifact digest must appear among the signed artifacts',
+        });
+    }
+    const paths = manifest.artifacts.map((artifact) => artifact.path);
+    if (new Set(paths).size !== paths.length) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['artifacts'],
+            message: 'each artifact path appears once in a release',
+        });
+    }
+    // Two signatures from one key are one signature written twice, and a
+    // duplicate would make a "two independent signers" check pass on one signer.
+    const keyIds = manifest.signatures.map((signature) => signature.keyId);
+    if (new Set(keyIds).size !== keyIds.length) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['signatures'],
+            message: 'each signing key signs a manifest once',
+        });
+    }
+});