@vouched-dev/schema 0.1.0

package/dist/events.d.ts

@@ -0,0 +1,153 @@
+import { z } from 'zod';
+export declare const Version: z.ZodString;
+export declare const EventType: z.ZodEnum<{
+    incident: "incident";
+    "session.end": "session.end";
+    "session.start": "session.start";
+    "task.claimed": "task.claimed";
+    "task.outcome": "task.outcome";
+    "task.submitted": "task.submitted";
+    "tool.call": "tool.call";
+    usage: "usage";
+}>;
+export type EventType = z.infer<typeof EventType>;
+export declare const IncidentKind: z.ZodEnum<{
+    flagged: "flagged";
+    leak_suspected: "leak_suspected";
+    scope: "scope";
+    tool_denied: "tool_denied";
+}>;
+export type IncidentKind = z.infer<typeof IncidentKind>;
+export declare const EventPayload: {
+    'session.start': z.ZodObject<{
+        session_id: z.ZodString;
+    }, z.core.$strict>;
+    'session.end': z.ZodObject<{
+        session_id: z.ZodString;
+        duration_ms: z.ZodInt;
+    }, z.core.$strict>;
+    'tool.call': z.ZodObject<{
+        tool: z.ZodString;
+        duration_ms: z.ZodInt;
+        ok: z.ZodBoolean;
+        error_class: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    'task.claimed': z.ZodObject<{
+        task_id: z.ZodUUID;
+        task_type: z.ZodString;
+    }, z.core.$strict>;
+    'task.submitted': z.ZodObject<{
+        task_id: z.ZodUUID;
+        task_type: z.ZodString;
+    }, z.core.$strict>;
+    'task.outcome': z.ZodObject<{
+        task_id: z.ZodUUID;
+        outcome: z.ZodEnum<{
+            failure: "failure";
+            success: "success";
+        }>;
+        evidence_hash: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    incident: z.ZodObject<{
+        kind: z.ZodEnum<{
+            flagged: "flagged";
+            leak_suspected: "leak_suspected";
+            scope: "scope";
+            tool_denied: "tool_denied";
+        }>;
+        detail_hash: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    usage: z.ZodObject<{
+        tokens_in: z.ZodInt;
+        tokens_out: z.ZodInt;
+        latency_ms: z.ZodInt;
+        model: z.ZodString;
+    }, z.core.$strict>;
+};
+export type EventPayload<T extends EventType> = z.infer<(typeof EventPayload)[T]>;
+export declare const Event: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    event_id: z.ZodUUID;
+    type: z.ZodLiteral<"session.start">;
+    occurred_at: z.ZodISODateTime;
+    version: z.ZodString;
+    payload: z.ZodObject<{
+        session_id: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    event_id: z.ZodUUID;
+    type: z.ZodLiteral<"session.end">;
+    occurred_at: z.ZodISODateTime;
+    version: z.ZodString;
+    payload: z.ZodObject<{
+        session_id: z.ZodString;
+        duration_ms: z.ZodInt;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    event_id: z.ZodUUID;
+    type: z.ZodLiteral<"tool.call">;
+    occurred_at: z.ZodISODateTime;
+    version: z.ZodString;
+    payload: z.ZodObject<{
+        tool: z.ZodString;
+        duration_ms: z.ZodInt;
+        ok: z.ZodBoolean;
+        error_class: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    event_id: z.ZodUUID;
+    type: z.ZodLiteral<"task.claimed">;
+    occurred_at: z.ZodISODateTime;
+    version: z.ZodString;
+    payload: z.ZodObject<{
+        task_id: z.ZodUUID;
+        task_type: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    event_id: z.ZodUUID;
+    type: z.ZodLiteral<"task.submitted">;
+    occurred_at: z.ZodISODateTime;
+    version: z.ZodString;
+    payload: z.ZodObject<{
+        task_id: z.ZodUUID;
+        task_type: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    event_id: z.ZodUUID;
+    type: z.ZodLiteral<"task.outcome">;
+    occurred_at: z.ZodISODateTime;
+    version: z.ZodString;
+    payload: z.ZodObject<{
+        task_id: z.ZodUUID;
+        outcome: z.ZodEnum<{
+            failure: "failure";
+            success: "success";
+        }>;
+        evidence_hash: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    event_id: z.ZodUUID;
+    type: z.ZodLiteral<"incident">;
+    occurred_at: z.ZodISODateTime;
+    version: z.ZodString;
+    payload: z.ZodObject<{
+        kind: z.ZodEnum<{
+            flagged: "flagged";
+            leak_suspected: "leak_suspected";
+            scope: "scope";
+            tool_denied: "tool_denied";
+        }>;
+        detail_hash: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    event_id: z.ZodUUID;
+    type: z.ZodLiteral<"usage">;
+    occurred_at: z.ZodISODateTime;
+    version: z.ZodString;
+    payload: z.ZodObject<{
+        tokens_in: z.ZodInt;
+        tokens_out: z.ZodInt;
+        latency_ms: z.ZodInt;
+        model: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>], "type">;
+export type Event = z.infer<typeof Event>;

package/dist/events.js

@@ -0,0 +1,96 @@
+import { z } from 'zod';
+import { TaskType } from './dimensions.js';
+import { Sha256Hex, TaskOutcome } from './tasks.js';
+/*
+ * The Zod pattern, shown once. Every schema file in this package follows it.
+ *
+ * 1. A strict object schema rejects unknown keys, so a payload cannot carry
+ *    anything the taxonomy does not name.
+ *
+ *      const ToolCall = z.strictObject({ tool: Name, ok: z.boolean() });
+ *      ToolCall.parse({ tool: 'Bash', ok: true, prompt: 'hi' });  // throws
+ *
+ * 2. A discriminated union picks the member schema by one literal field, so
+ *    `type` decides which payload schema runs and errors name the right one.
+ *
+ *      const Event = z.discriminatedUnion('type', [
+ *        z.strictObject({ type: z.literal('tool.call'), payload: ToolCall }),
+ *        z.strictObject({ type: z.literal('usage'), payload: Usage }),
+ *      ]);
+ *
+ * 3. z.infer derives the TypeScript type from the schema. The schema and the
+ *    type share one name, so `Event` works as a value and as a type.
+ *
+ *      export type Event = z.infer<typeof Event>;
+ *
+ * Use parse to throw on bad input and safeParse to get { success, data, error }.
+ */
+export const Version = z.string().min(1).max(32);
+const Name = z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[A-Za-z0-9._:/@-]+$/);
+const Millis = z.int().min(0).max(604_800_000);
+const Count = z.int().min(0).max(100_000_000);
+export const EventType = z.enum([
+    'session.start',
+    'session.end',
+    'tool.call',
+    'task.claimed',
+    'task.submitted',
+    'task.outcome',
+    'incident',
+    'usage',
+]);
+export const IncidentKind = z.enum([
+    'scope',
+    'tool_denied',
+    'leak_suspected',
+    'flagged',
+]);
+const TaskRef = z.strictObject({ task_id: z.uuid(), task_type: TaskType });
+export const EventPayload = {
+    'session.start': z.strictObject({ session_id: Name }),
+    'session.end': z.strictObject({ session_id: Name, duration_ms: Millis }),
+    'tool.call': z.strictObject({
+        tool: Name,
+        duration_ms: Millis,
+        ok: z.boolean(),
+        error_class: Name.optional(),
+    }),
+    'task.claimed': TaskRef,
+    'task.submitted': TaskRef,
+    'task.outcome': z.strictObject({
+        task_id: z.uuid(),
+        outcome: TaskOutcome,
+        evidence_hash: Sha256Hex.optional(),
+    }),
+    incident: z.strictObject({
+        kind: IncidentKind,
+        detail_hash: Sha256Hex.optional(),
+    }),
+    usage: z.strictObject({
+        tokens_in: Count,
+        tokens_out: Count,
+        latency_ms: Millis,
+        model: Name,
+    }),
+};
+const eventOf = (type) => z.strictObject({
+    event_id: z.uuid(),
+    type: z.literal(type),
+    occurred_at: z.iso.datetime(),
+    version: Version,
+    payload: EventPayload[type],
+});
+export const Event = z.discriminatedUnion('type', [
+    eventOf('session.start'),
+    eventOf('session.end'),
+    eventOf('tool.call'),
+    eventOf('task.claimed'),
+    eventOf('task.submitted'),
+    eventOf('task.outcome'),
+    eventOf('incident'),
+    eventOf('usage'),
+]);

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export * from './agent-id.js';
+export * from './api.js';
+export * from './base64url.js';
+export * from './credential.js';
+export * from './dimensions.js';
+export * from './envelope.js';
+export * from './events.js';
+export * from './tasks.js';
+export declare const SCHEMA_VERSION = 1;

package/dist/index.js

@@ -0,0 +1,9 @@
+export * from './agent-id.js';
+export * from './api.js';
+export * from './base64url.js';
+export * from './credential.js';
+export * from './dimensions.js';
+export * from './envelope.js';
+export * from './events.js';
+export * from './tasks.js';
+export const SCHEMA_VERSION = 1;

package/dist/tasks.d.ts

@@ -0,0 +1,46 @@
+import { z } from 'zod';
+export declare const Sha256Hex: z.ZodString;
+export declare const JSON_SCHEMA_MAX_BYTES = 16384;
+export declare const HashVerification: z.ZodObject<{
+    kind: z.ZodLiteral<"hash">;
+    sha256: z.ZodString;
+}, z.core.$strict>;
+export declare const SchemaVerification: z.ZodObject<{
+    kind: z.ZodLiteral<"schema">;
+    jsonSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>;
+export declare const CounterpartyVerification: z.ZodObject<{
+    kind: z.ZodLiteral<"counterparty">;
+}, z.core.$strict>;
+export declare const VerificationSpec: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"hash">;
+    sha256: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"schema">;
+    jsonSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"counterparty">;
+}, z.core.$strict>], "kind">;
+export type VerificationSpec = z.infer<typeof VerificationSpec>;
+export declare const TaskOutcome: z.ZodEnum<{
+    failure: "failure";
+    success: "success";
+}>;
+export type TaskOutcome = z.infer<typeof TaskOutcome>;
+export declare const TaskState: z.ZodEnum<{
+    claimed: "claimed";
+    expired: "expired";
+    open: "open";
+    submitted: "submitted";
+    verified: "verified";
+}>;
+export type TaskState = z.infer<typeof TaskState>;
+type Timestamp = Date | string;
+export type TaskTimestamps = {
+    claimedAt: Timestamp | null;
+    submittedAt: Timestamp | null;
+    verifiedAt: Timestamp | null;
+    expiresAt: Timestamp;
+};
+export declare function taskState(task: TaskTimestamps, now?: Date): TaskState;
+export {};

package/dist/tasks.js

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+import { utf8Encode } from './base64url.js';
+export const Sha256Hex = z.string().regex(/^[0-9a-f]{64}$/);
+export const JSON_SCHEMA_MAX_BYTES = 16384;
+export const HashVerification = z.strictObject({
+    kind: z.literal('hash'),
+    sha256: Sha256Hex,
+});
+export const SchemaVerification = z.strictObject({
+    kind: z.literal('schema'),
+    jsonSchema: z
+        .record(z.string(), z.unknown())
+        .refine((schema) => utf8Encode(JSON.stringify(schema)).length <= JSON_SCHEMA_MAX_BYTES, `jsonSchema must be at most ${JSON_SCHEMA_MAX_BYTES} bytes`),
+});
+export const CounterpartyVerification = z.strictObject({
+    kind: z.literal('counterparty'),
+});
+export const VerificationSpec = z.discriminatedUnion('kind', [
+    HashVerification,
+    SchemaVerification,
+    CounterpartyVerification,
+]);
+export const TaskOutcome = z.enum(['success', 'failure']);
+export const TaskState = z.enum([
+    'open',
+    'claimed',
+    'submitted',
+    'verified',
+    'expired',
+]);
+export function taskState(task, now = new Date()) {
+    if (task.verifiedAt !== null)
+        return 'verified';
+    if (new Date(task.expiresAt).getTime() <= now.getTime())
+        return 'expired';
+    if (task.submittedAt !== null)
+        return 'submitted';
+    if (task.claimedAt !== null)
+        return 'claimed';
+    return 'open';
+}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@vouched-dev/schema",
+  "version": "0.1.0",
+  "private": false,
+  "description": "Zod schemas, event taxonomy and signing helpers for Vouched.",
+  "license": "Apache-2.0",
+  "homepage": "https://vouched.run",
+  "repository": {
+    "type": "git",
+    "url": "https://vouched.run"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./db": {
+      "types": "./dist/db/index.d.ts",
+      "default": "./dist/db/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "rm -rf dist && pnpm run build",
+    "test": "vitest run",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate",
+    "db:migrate:prod": "node dist/db/migrate.js"
+  },
+  "dependencies": {
+    "@noble/ed25519": "^3.2.0",
+    "drizzle-orm": "^0.45.3",
+    "postgres": "^3.4.9",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@types/node": "^24.13.6",
+    "drizzle-kit": "^0.31.11",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.1"
+  }
+}