@oxy.so/contracts 4.23.0 → 4.25.0

package/dist/types/appAssertions.d.ts

@@ -0,0 +1,335 @@
+/**
+ * App assertions (ADR 0045): how an Oxy app proves which app it is.
+ *
+ * ## The registry
+ *
+ * Each application may declare how it is recognised, written only by Oxy staff
+ * through the application administration lane
+ * (`PUT /applications/:appId/recognition`): its exact `https://` web origins,
+ * its Android package and signing certificates, and its iOS team and bundle.
+ * A platform it does not declare can never assert it.
+ *
+ * ## The exchange
+ *
+ * With the person's own bearer, the app asks `POST /apps/assertions` for an
+ * `OXY-APP+JWT` naming the application, and proves itself by platform: on the
+ * web the browser's `Origin`; on Android a Play Integrity token whose request
+ * hash is a challenge from `POST /apps/assertions/challenge`; on iOS an App
+ * Attest assertion over such a challenge, made with a key registered through
+ * `POST /apps/attest-keys`. The assertion lives five minutes and names the
+ * person (`sub`) and the session (`sid`) it was issued to.
+ *
+ * The Zod-free half (vocabularies, header name, response checks) is
+ * `./client/appAssertions.ts`.
+ */
+import { z } from 'zod';
+import { APP_ASSERTION_CHALLENGE_PURPOSES, APP_ASSERTION_ERROR_CODES, APP_ASSERTION_PLATFORMS, OXY_APP_ASSERTION_AUDIENCE, OXY_APP_ASSERTION_HEADER, OXY_APP_ASSERTION_TTL_SECONDS, OXY_APP_ASSERTION_TYPE } from './client/appAssertions';
+export { APP_ASSERTION_CHALLENGE_PURPOSES, APP_ASSERTION_ERROR_CODES, APP_ASSERTION_PLATFORMS, OXY_APP_ASSERTION_AUDIENCE, OXY_APP_ASSERTION_HEADER, OXY_APP_ASSERTION_TTL_SECONDS, OXY_APP_ASSERTION_TYPE, };
+export declare const appAssertionPlatformSchema: z.ZodEnum<["web", "android", "ios"]>;
+export declare const appAssertionErrorCodeSchema: z.ZodEnum<["application_unavailable", "session_other_application", "platform_not_registered", "origin_not_registered", "challenge_invalid", "integrity_refused", "integrity_unconfigured", "integrity_unavailable", "attest_key_unknown", "attest_key_exists", "attestation_invalid", "assertion_invalid", "signing_unavailable"]>;
+/** True for an exact origin: `https:`, no path, query, fragment or credentials, in canonical form. */
+export declare function isExactHttpsOrigin(value: string): boolean;
+/** An exact `https://` origin, in the form a browser sends in `Origin` (`https://mention.earth`). */
+export declare const applicationWebOriginSchema: z.ZodEffects<z.ZodString, string, string>;
+/** A Java-style Android application id, at least two segments. */
+export declare const androidPackageNameSchema: z.ZodString;
+/** A signing certificate's SHA-256, 64 lowercase hex characters (keytool's digest without colons). */
+export declare const signingCertSha256Schema: z.ZodString;
+/** An Apple Developer team id. */
+export declare const appleTeamIdSchema: z.ZodString;
+/** An Apple bundle id. */
+export declare const appleBundleIdSchema: z.ZodString;
+export declare const applicationAndroidRecognitionSchema: z.ZodObject<{
+    packageName: z.ZodString;
+    signingCertSha256: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
+}, "strict", z.ZodTypeAny, {
+    packageName: string;
+    signingCertSha256: string[];
+}, {
+    packageName: string;
+    signingCertSha256: string[];
+}>;
+export declare const applicationIosRecognitionSchema: z.ZodObject<{
+    teamId: z.ZodString;
+    bundleId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    teamId: string;
+    bundleId: string;
+}, {
+    teamId: string;
+    bundleId: string;
+}>;
+/**
+ * What Oxy staff write for an application: the whole declaration, replaced at
+ * once. `null` and `[]` declare nothing for that platform.
+ */
+export declare const applicationRecognitionWriteSchema: z.ZodObject<{
+    webOrigins: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+    android: z.ZodNullable<z.ZodObject<{
+        packageName: z.ZodString;
+        signingCertSha256: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
+    }, "strict", z.ZodTypeAny, {
+        packageName: string;
+        signingCertSha256: string[];
+    }, {
+        packageName: string;
+        signingCertSha256: string[];
+    }>>;
+    ios: z.ZodNullable<z.ZodObject<{
+        teamId: z.ZodString;
+        bundleId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        teamId: string;
+        bundleId: string;
+    }, {
+        teamId: string;
+        bundleId: string;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    android: {
+        packageName: string;
+        signingCertSha256: string[];
+    } | null;
+    ios: {
+        teamId: string;
+        bundleId: string;
+    } | null;
+    webOrigins: string[];
+}, {
+    android: {
+        packageName: string;
+        signingCertSha256: string[];
+    } | null;
+    ios: {
+        teamId: string;
+        bundleId: string;
+    } | null;
+    webOrigins: string[];
+}>;
+/** An application's recognition as the registry holds it; `updatedAt` is `null` when none was written. */
+export declare const applicationRecognitionSchema: z.ZodObject<{
+    webOrigins: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+    android: z.ZodNullable<z.ZodObject<{
+        packageName: z.ZodString;
+        signingCertSha256: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
+    }, "strict", z.ZodTypeAny, {
+        packageName: string;
+        signingCertSha256: string[];
+    }, {
+        packageName: string;
+        signingCertSha256: string[];
+    }>>;
+    ios: z.ZodNullable<z.ZodObject<{
+        teamId: z.ZodString;
+        bundleId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        teamId: string;
+        bundleId: string;
+    }, {
+        teamId: string;
+        bundleId: string;
+    }>>;
+} & {
+    applicationId: z.ZodString;
+    updatedAt: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    updatedAt: string | null;
+    applicationId: string;
+    android: {
+        packageName: string;
+        signingCertSha256: string[];
+    } | null;
+    ios: {
+        teamId: string;
+        bundleId: string;
+    } | null;
+    webOrigins: string[];
+}, {
+    updatedAt: string | null;
+    applicationId: string;
+    android: {
+        packageName: string;
+        signingCertSha256: string[];
+    } | null;
+    ios: {
+        teamId: string;
+        bundleId: string;
+    } | null;
+    webOrigins: string[];
+}>;
+/** `POST /apps/assertions/challenge`: a single-use challenge for a device proof. */
+export declare const appAssertionChallengeRequestSchema: z.ZodDiscriminatedUnion<"platform", [z.ZodObject<{
+    applicationId: z.ZodString;
+    platform: z.ZodLiteral<"android">;
+}, "strict", z.ZodTypeAny, {
+    applicationId: string;
+    platform: "android";
+}, {
+    applicationId: string;
+    platform: "android";
+}>, z.ZodObject<{
+    applicationId: z.ZodString;
+    platform: z.ZodLiteral<"ios">;
+    purpose: z.ZodEnum<["assertion", "attest_key"]>;
+}, "strict", z.ZodTypeAny, {
+    purpose: "assertion" | "attest_key";
+    applicationId: string;
+    platform: "ios";
+}, {
+    purpose: "assertion" | "attest_key";
+    applicationId: string;
+    platform: "ios";
+}>]>;
+/**
+ * The challenge, and `requestHash`: what the device signs or hands to Play
+ * Integrity, binding the challenge to this application, platform, purpose and
+ * session. `cloudProjectNumber` is the Google Cloud project Play Integrity
+ * tokens are requested for (Android only).
+ */
+export declare const appAssertionChallengeResponseSchema: z.ZodObject<{
+    challenge: z.ZodString;
+    requestHash: z.ZodString;
+    expiresAt: z.ZodString;
+    cloudProjectNumber: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    expiresAt: string;
+    challenge: string;
+    requestHash: string;
+    cloudProjectNumber?: string | undefined;
+}, {
+    expiresAt: string;
+    challenge: string;
+    requestHash: string;
+    cloudProjectNumber?: string | undefined;
+}>;
+/** An App Attest key id: the standard base64 of the SHA-256 of the key. */
+export declare const appAttestKeyIdSchema: z.ZodString;
+/** `POST /apps/attest-keys`: register an App Attest key, attested over a `attest_key` challenge. */
+export declare const appAttestKeyRequestSchema: z.ZodObject<{
+    applicationId: z.ZodString;
+    keyId: z.ZodString;
+    challenge: z.ZodString;
+    attestation: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    applicationId: string;
+    challenge: string;
+    keyId: string;
+    attestation: string;
+}, {
+    applicationId: string;
+    challenge: string;
+    keyId: string;
+    attestation: string;
+}>;
+export declare const appAttestKeyResponseSchema: z.ZodObject<{
+    keyId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    keyId: string;
+}, {
+    keyId: string;
+}>;
+/**
+ * `POST /apps/assertions`. The body names the application and the platform;
+ * the proof is the platform's: none on the web (the browser's `Origin` is), a
+ * Play Integrity token on Android, an App Attest assertion on iOS, each over a
+ * challenge minted for `assertion`.
+ */
+export declare const appAssertionRequestSchema: z.ZodDiscriminatedUnion<"platform", [z.ZodObject<{
+    applicationId: z.ZodString;
+    platform: z.ZodLiteral<"web">;
+}, "strict", z.ZodTypeAny, {
+    applicationId: string;
+    platform: "web";
+}, {
+    applicationId: string;
+    platform: "web";
+}>, z.ZodObject<{
+    applicationId: z.ZodString;
+    platform: z.ZodLiteral<"android">;
+    proof: z.ZodObject<{
+        challenge: z.ZodString;
+        integrityToken: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        challenge: string;
+        integrityToken: string;
+    }, {
+        challenge: string;
+        integrityToken: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    applicationId: string;
+    proof: {
+        challenge: string;
+        integrityToken: string;
+    };
+    platform: "android";
+}, {
+    applicationId: string;
+    proof: {
+        challenge: string;
+        integrityToken: string;
+    };
+    platform: "android";
+}>, z.ZodObject<{
+    applicationId: z.ZodString;
+    platform: z.ZodLiteral<"ios">;
+    proof: z.ZodObject<{
+        challenge: z.ZodString;
+        keyId: z.ZodString;
+        assertion: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        challenge: string;
+        assertion: string;
+        keyId: string;
+    }, {
+        challenge: string;
+        assertion: string;
+        keyId: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    applicationId: string;
+    proof: {
+        challenge: string;
+        assertion: string;
+        keyId: string;
+    };
+    platform: "ios";
+}, {
+    applicationId: string;
+    proof: {
+        challenge: string;
+        assertion: string;
+        keyId: string;
+    };
+    platform: "ios";
+}>]>;
+/** The assertion, and what it says. Send it as {@link OXY_APP_ASSERTION_HEADER}. */
+export declare const appAssertionResponseSchema: z.ZodObject<{
+    assertion: z.ZodString;
+    applicationId: z.ZodString;
+    platform: z.ZodEnum<["web", "android", "ios"]>;
+    expiresAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    expiresAt: string;
+    applicationId: string;
+    assertion: string;
+    platform: "web" | "android" | "ios";
+}, {
+    expiresAt: string;
+    applicationId: string;
+    assertion: string;
+    platform: "web" | "android" | "ios";
+}>;
+export type AppAssertionPlatform = (typeof APP_ASSERTION_PLATFORMS)[number];
+export type AppAssertionChallengePurpose = (typeof APP_ASSERTION_CHALLENGE_PURPOSES)[number];
+export type AppAssertionErrorCode = (typeof APP_ASSERTION_ERROR_CODES)[number];
+export type ApplicationAndroidRecognition = z.infer<typeof applicationAndroidRecognitionSchema>;
+export type ApplicationIosRecognition = z.infer<typeof applicationIosRecognitionSchema>;
+export type ApplicationRecognitionWrite = z.infer<typeof applicationRecognitionWriteSchema>;
+export type ApplicationRecognition = z.infer<typeof applicationRecognitionSchema>;
+export type AppAssertionChallengeRequest = z.infer<typeof appAssertionChallengeRequestSchema>;
+export type AppAssertionChallengeResponse = z.infer<typeof appAssertionChallengeResponseSchema>;
+export type AppAttestKeyRequest = z.infer<typeof appAttestKeyRequestSchema>;
+export type AppAttestKeyResponse = z.infer<typeof appAttestKeyResponseSchema>;
+export type AppAssertionRequest = z.infer<typeof appAssertionRequestSchema>;
+export type AppAssertionResponse = z.infer<typeof appAssertionResponseSchema>;

package/dist/types/client/appAssertions.d.ts

@@ -0,0 +1,60 @@
+/**
+ * App assertions (ADR 0045), without Zod. Schemas: `../appAssertions.ts`.
+ *
+ * An Oxy app proves which app it is by trading platform evidence (the browser's
+ * `Origin`, a Play Integrity verdict, an App Attest assertion) for a short-lived
+ * `OXY-APP+JWT` signed by Oxy. A service that needs to know the app reads it
+ * from {@link OXY_APP_ASSERTION_HEADER} and verifies it against Oxy's JWKS
+ * (`verifyAppAssertion` in `@oxy.so/core/server`).
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+/** How an app proves itself: the browser's origin, Play Integrity, or App Attest. */
+export declare const APP_ASSERTION_PLATFORMS: readonly ["web", "android", "ios"];
+/**
+ * What a device challenge is spent on: an assertion, or (iOS only) registering
+ * an App Attest key. A challenge minted for one is refused for the other.
+ */
+export declare const APP_ASSERTION_CHALLENGE_PURPOSES: readonly ["assertion", "attest_key"];
+/** The JOSE `typ` of an app assertion. No other Oxy token carries it. */
+export declare const OXY_APP_ASSERTION_TYPE = "OXY-APP+JWT";
+/** The `aud` of every app assertion. */
+export declare const OXY_APP_ASSERTION_AUDIENCE = "oxy-apps";
+/** The request header an app (or an SDK acting for it) sends the assertion in. */
+export declare const OXY_APP_ASSERTION_HEADER = "X-Oxy-App-Assertion";
+/** Oxy signs an app assertion for exactly this long. */
+export declare const OXY_APP_ASSERTION_TTL_SECONDS = 300;
+/**
+ * Why Oxy refused an app assertion, a challenge or an App Attest key. The API
+ * answers `{ error: <code>, message }`.
+ *
+ * - `application_unavailable`: no active application has that id.
+ * - `session_other_application`: the bearer's session belongs to another application.
+ * - `platform_not_registered`: the application declares no recognition for that platform.
+ * - `origin_not_registered`: the request's `Origin` is not one of the application's web origins.
+ * - `challenge_invalid`: the challenge is unknown, used, expired, or minted for something else.
+ * - `integrity_refused`: the Play Integrity verdict does not name this app, a registered
+ *   certificate, a Play-recognised install and this challenge.
+ * - `integrity_unconfigured` / `integrity_unavailable`: Oxy cannot ask Google (503).
+ * - `attest_key_unknown`: no App Attest key with that id is registered for the app; attest a new one.
+ * - `attest_key_exists`: that App Attest key is already registered.
+ * - `attestation_invalid`: the App Attest attestation does not verify.
+ * - `assertion_invalid`: the App Attest assertion does not verify, or its counter did not advance.
+ * - `signing_unavailable`: Oxy cannot sign (503).
+ */
+export declare const APP_ASSERTION_ERROR_CODES: readonly ["application_unavailable", "session_other_application", "platform_not_registered", "origin_not_registered", "challenge_invalid", "integrity_refused", "integrity_unconfigured", "integrity_unavailable", "attest_key_unknown", "attest_key_exists", "attestation_invalid", "assertion_invalid", "signing_unavailable"];
+export declare const appAssertionChallengeResponseCheck: import("./check").Check<{
+    expiresAt: string;
+    challenge: string;
+    requestHash: string;
+    cloudProjectNumber?: string | undefined;
+}>;
+export declare const appAttestKeyResponseCheck: import("./check").Check<{
+    keyId: string;
+}>;
+export declare const appAssertionResponseCheck: import("./check").Check<{
+    expiresAt: string;
+    applicationId: string;
+    assertion: string;
+    platform: "web" | "android" | "ios";
+}>;

package/dist/types/client/index.d.ts

@@ -36,3 +36,5 @@ export { EMAIL_ACCOUNTS_MAX, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_SIGNIN_LINK_TTL_M
 export { BOT_USERNAME_INVALID_MESSAGE, BOT_USERNAME_SUFFIX, NUMERIC_USERNAME_MESSAGE, RESERVED_USERNAMES, RESERVED_USERNAME_MESSAGE, USERNAME_INVALID_MESSAGE, USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, USERNAME_PATTERN_SOURCE, applyBotUsernameSuffix, botUsernameCheck, stripDisallowedUsernameCharacters, usernameCheck, usernameCheckForAccountKind, } from './username';
 export { userNameCheck } from './userResponse';
 export { CLAIMANT_RELATIONSHIPS, CLOSED_CONTENT_CLAIM_STATES, CONTENT_CLAIM_COUNTER_NOTICE_LIMITS, CONTENT_CLAIM_ERROR_CODES, CONTENT_CLAIM_KINDS, CONTENT_CLAIM_LIMITS, CONTENT_CLAIM_REFERENCE_PATTERN, CONTENT_CLAIM_STATES, COUNTER_NOTICE_STATEMENT_VERSION, COUNTER_NOTICE_STATEMENTS, ERASURE_REQUEST_DEADLINE_DAYS, OPEN_CONTENT_CLAIM_STATES, isErasureRequest, isRightsClaim, } from './contentClaims';
+export { APP_ASSERTION_CHALLENGE_PURPOSES, APP_ASSERTION_ERROR_CODES, APP_ASSERTION_PLATFORMS, OXY_APP_ASSERTION_AUDIENCE, OXY_APP_ASSERTION_HEADER, OXY_APP_ASSERTION_TTL_SECONDS, OXY_APP_ASSERTION_TYPE, appAssertionChallengeResponseCheck, appAssertionResponseCheck, appAttestKeyResponseCheck, } from './appAssertions';
+export * from '../products/one';

package/dist/types/index.d.ts

@@ -102,8 +102,8 @@ export { PRODUCT_PLAN_STATUSES, productPlanStatusSchema, LIVE_PRODUCT_PLAN_STATU
 export type { ProductPlanStatus, PlanAllowance, ProductPlan, PayAsYouGoEntitlement, CostCenterStatus, CostCenter, CostCenterSpend, ProductEntitlement, } from './inference/entitlement';
 export { INFERENCE_ECONOMIC_TREATMENTS, inferenceEconomicTreatmentSchema, PROVIDER_COST_SOURCES, providerCostSourceSchema, costCenterUsageSchema, } from './inference/economics';
 export type { InferenceEconomicTreatment, ProviderCostSource, CostCenterUsage, } from './inference/economics';
-export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, executionActorRefSchema, foregroundExecutionAuthorizationInputSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, capabilityCatalogBindingSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, capabilityTicketRequestSchema, delegationGrantSchema, AGENT_REQUESTER_CEILING_AUTONOMY, agentRequesterCeilingWriteSchema, agentRequesterCeilingSchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, invocationPrincipalSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, catalogFeatureSchema, CATALOG_INTERNAL_TRANSPORTS, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency';
-export type { AutonomyLevel, CapabilityPackage, ActorRef, ExecutionActorRef, ForegroundExecutionAuthorizationInput, ResourceRef, ToolGrantOverride, GrantLimit, CapabilityCatalogBinding, ExecutionAuthorizationRef, CapabilityCoordinator, CapabilityTicketRequest, DelegationGrant, AutomationTrigger, AutomationActorSelection, AutomationDefinition, CapabilityTicketClaims, InvocationPrincipal, PolicyDecision, AuditEvent, CatalogTool, CatalogEvent, AppCapabilityCatalog, CatalogFeature, CatalogInternalTransport, AgentRequesterCeilingWrite, AgentRequesterCeiling, AgentRequesterCeilingAutonomy, CatalogRegistration, NormalizedAppEvent, } from './agency';
+export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, executionActorRefSchema, foregroundExecutionAuthorizationInputSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, capabilityCatalogBindingSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, capabilityTicketRequestSchema, delegationGrantSchema, AGENT_REQUESTER_CEILING_AUTONOMY, agentRequesterCeilingWriteSchema, agentRequesterCeilingSchema, APPLICATION_AGENT_AVAILABILITIES, applicationAgentAvailabilitySchema, applicationAgentWriteSchema, applicationAgentSchema, agentAvailabilitySchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, invocationPrincipalSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, catalogFeatureSchema, CATALOG_INTERNAL_TRANSPORTS, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency';
+export type { AutonomyLevel, CapabilityPackage, ActorRef, ExecutionActorRef, ForegroundExecutionAuthorizationInput, ResourceRef, ToolGrantOverride, GrantLimit, CapabilityCatalogBinding, ExecutionAuthorizationRef, CapabilityCoordinator, CapabilityTicketRequest, DelegationGrant, AutomationTrigger, AutomationActorSelection, AutomationDefinition, CapabilityTicketClaims, InvocationPrincipal, PolicyDecision, AuditEvent, CatalogTool, CatalogEvent, AppCapabilityCatalog, CatalogFeature, CatalogInternalTransport, AgentRequesterCeilingWrite, AgentRequesterCeiling, AgentRequesterCeilingAutonomy, ApplicationAgentAvailability, ApplicationAgentWrite, ApplicationAgent, AgentAvailability, CatalogRegistration, NormalizedAppEvent, } from './agency';
 export { catalogInvocationPathParameters, catalogInvocationsOverlap, catalogInvocationTemplatesEquivalent, findOverlappingCatalogInvocations, matchCatalogInvocation, resolveCatalogInvocation, } from './capabilityInvocation';
 export type { CatalogInvocationMatch, CatalogInvocationTemplate, ResolvedCatalogInvocation, } from './capabilityInvocation';
 export { emailContextAddressSchema, emailContextMailboxSchema, emailContextMessageSchema, emailAgentContextSchema, } from './emailAgentContext';
@@ -140,3 +140,5 @@ export * from './safety';
 export { serviceTokenScopesSchema, serviceTokenOptionsSchema, type ServiceTokenOptions, } from './serviceToken';
 export * from './applicationRoles';
 export * from './contentClaims';
+export * from './appAssertions';
+export * from './products/one';

package/dist/types/inference/aliaModelRelease.d.ts

@@ -140,14 +140,14 @@ export declare const aliaReleaseSignatureSchema: z.ZodObject<{
     signedAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     signature: string;
-    signedAt: string;
     keyId: string;
+    signedAt: string;
     algorithm: "ed25519";
     canonicalization: "jcs";
 }, {
     signature: string;
-    signedAt: string;
     keyId: string;
+    signedAt: string;
     algorithm: "ed25519";
     canonicalization: "jcs";
 }>;
@@ -376,14 +376,14 @@ export declare const aliaModelReleaseManifestSchema: z.ZodEffects<z.ZodObject<{
         signedAt: z.ZodString;
     }, "strict", z.ZodTypeAny, {
         signature: string;
-        signedAt: string;
         keyId: string;
+        signedAt: string;
         algorithm: "ed25519";
         canonicalization: "jcs";
     }, {
         signature: string;
-        signedAt: string;
         keyId: string;
+        signedAt: string;
         algorithm: "ed25519";
         canonicalization: "jcs";
     }>, "many">;
@@ -416,8 +416,8 @@ export declare const aliaModelReleaseManifestSchema: z.ZodEffects<z.ZodObject<{
     issuedAt: string;
     signatures: {
         signature: string;
-        signedAt: string;
         keyId: string;
+        signedAt: string;
         algorithm: "ed25519";
         canonicalization: "jcs";
     }[];
@@ -470,8 +470,8 @@ export declare const aliaModelReleaseManifestSchema: z.ZodEffects<z.ZodObject<{
     issuedAt: string;
     signatures: {
         signature: string;
-        signedAt: string;
         keyId: string;
+        signedAt: string;
         algorithm: "ed25519";
         canonicalization: "jcs";
     }[];
@@ -524,8 +524,8 @@ export declare const aliaModelReleaseManifestSchema: z.ZodEffects<z.ZodObject<{
     issuedAt: string;
     signatures: {
         signature: string;
-        signedAt: string;
         keyId: string;
+        signedAt: string;
         algorithm: "ed25519";
         canonicalization: "jcs";
     }[];
@@ -578,8 +578,8 @@ export declare const aliaModelReleaseManifestSchema: z.ZodEffects<z.ZodObject<{
     issuedAt: string;
     signatures: {
         signature: string;
-        signedAt: string;
         keyId: string;
+        signedAt: string;
         algorithm: "ed25519";
         canonicalization: "jcs";
     }[];

package/dist/types/inference/modelDocumentation.d.ts

@@ -692,14 +692,14 @@ export declare const modelReleaseIngestionRequestSchema: z.ZodObject<{
             signedAt: z.ZodString;
         }, "strict", z.ZodTypeAny, {
             signature: string;
-            signedAt: string;
             keyId: string;
+            signedAt: string;
             algorithm: "ed25519";
             canonicalization: "jcs";
         }, {
             signature: string;
-            signedAt: string;
             keyId: string;
+            signedAt: string;
             algorithm: "ed25519";
             canonicalization: "jcs";
         }>, "many">;
@@ -732,8 +732,8 @@ export declare const modelReleaseIngestionRequestSchema: z.ZodObject<{
         issuedAt: string;
         signatures: {
             signature: string;
-            signedAt: string;
             keyId: string;
+            signedAt: string;
             algorithm: "ed25519";
             canonicalization: "jcs";
         }[];
@@ -786,8 +786,8 @@ export declare const modelReleaseIngestionRequestSchema: z.ZodObject<{
         issuedAt: string;
         signatures: {
             signature: string;
-            signedAt: string;
             keyId: string;
+            signedAt: string;
             algorithm: "ed25519";
             canonicalization: "jcs";
         }[];
@@ -840,8 +840,8 @@ export declare const modelReleaseIngestionRequestSchema: z.ZodObject<{
         issuedAt: string;
         signatures: {
             signature: string;
-            signedAt: string;
             keyId: string;
+            signedAt: string;
             algorithm: "ed25519";
             canonicalization: "jcs";
         }[];
@@ -894,8 +894,8 @@ export declare const modelReleaseIngestionRequestSchema: z.ZodObject<{
         issuedAt: string;
         signatures: {
             signature: string;
-            signedAt: string;
             keyId: string;
+            signedAt: string;
             algorithm: "ed25519";
             canonicalization: "jcs";
         }[];
@@ -1225,8 +1225,8 @@ export declare const modelReleaseIngestionRequestSchema: z.ZodObject<{
         issuedAt: string;
         signatures: {
             signature: string;
-            signedAt: string;
             keyId: string;
+            signedAt: string;
             algorithm: "ed25519";
             canonicalization: "jcs";
         }[];
@@ -1321,8 +1321,8 @@ export declare const modelReleaseIngestionRequestSchema: z.ZodObject<{
         issuedAt: string;
         signatures: {
             signature: string;
-            signedAt: string;
             keyId: string;
+            signedAt: string;
             algorithm: "ed25519";
             canonicalization: "jcs";
         }[];