@ziffer-io/types 0.1.0

package/LICENSE

@@ -0,0 +1,120 @@
+ZIFFER SDK LICENSE
+
+Copyright (c) 2026 code75 SASU, Paris, France. All rights reserved.
+ZIFFER is a registered trademark of code75 SASU ("code75") — code75.io · ziffer.io
+
+This licence governs the software package it accompanies (the "SDK"): the ZIFFER client
+libraries, receipt verifier, wire types and MCP server published by code75. The SDK is
+proprietary software. It is not open source.
+
+1. DEFINITIONS
+   "Agreement" means the written contract under which code75 provides the ZIFFER service to
+   you or the organisation you act for. code75's standard form of that contract is the ZIFFER
+   Customer Agreement, docs/legal/ziffer-customer-agreement.md, v0.1, provided on request.
+   "Service" means the ZIFFER service so provided. "You" means the person or organisation
+   using the SDK under an Agreement.
+
+2. LICENCE
+   Subject to the Agreement and to this licence, code75 grants you a limited, non-exclusive,
+   non-transferable, non-sublicensable, revocable licence to install and run the SDK, in
+   unmodified form, solely to interact with the Service and to verify the receipts it issues,
+   for the term of the Agreement.
+
+3. RESTRICTIONS
+   Except as expressly permitted by section 2 or by a law that cannot be excluded by
+   contract, you shall not, and shall not permit anyone else to:
+   (a) copy, distribute, publish, sublicense, sell, rent, lease or lend the SDK, or make it
+       available to any third party;
+   (b) modify, adapt, translate or create derivative works of the SDK;
+   (c) reverse engineer, decompile, disassemble or otherwise attempt to derive the source
+       code, algorithms or protocols of the SDK or the Service;
+   (d) use the SDK to build, train or benchmark a product or service that competes with the
+       Service, or to access the Service other than through the interfaces code75 documents;
+   (e) circumvent, disable or interfere with any security, verification or usage-control
+       mechanism of the SDK or the Service;
+   (f) remove, obscure or alter any copyright, trademark or other proprietary notice on or
+       in the SDK.
+
+4. OWNERSHIP AND INTELLECTUAL PROPERTY
+   The SDK is licensed, not sold. code75 and its licensors own and retain all right, title
+   and interest in and to the SDK and the Service, including all copyright, patent, trade
+   secret, trademark and other intellectual property rights, and all improvements and
+   derivative works, by whomever made. Nothing in this licence transfers any such right to
+   you. All rights not expressly granted are reserved. Any suggestion, idea or feedback you
+   provide about the SDK or the Service may be used by code75 without restriction or
+   compensation. "ZIFFER" and "code75" and the associated logos are brands and marks of
+   code75; this licence grants no right to use them.
+
+5. THIRD-PARTY COMPONENTS
+   The SDK includes third-party open-source components listed in the accompanying file
+   THIRD-PARTY-NOTICES. Those components are licensed under their own terms, which govern
+   them and prevail over this licence for those components only. This licence does not
+   apply to them.
+
+6. UPDATES
+   code75 may release updated versions of the SDK. This licence applies to each version you
+   install unless a later version is accompanied by a different licence. code75 has no
+   obligation to provide updates or support except as stated in the Agreement.
+
+7. YOUR RESPONSIBILITY FOR YOUR ACTIONS AND YOUR DATA
+   The Service issues decisions and signed receipts; it does not perform any action. You
+   alone decide what your systems do with a decision, you alone hold the credentials with
+   which any action is performed, and you alone are responsible for every action your
+   systems take or fail to take, for the policy you write and sign, for the data you submit
+   to the Service, and for your compliance with applicable law, including data protection,
+   export control and sanctions laws. A decision or receipt is not legal, regulatory,
+   financial or professional advice and is not a guarantee that any action is lawful,
+   appropriate or safe.
+
+7A. INDEMNITY
+   You shall defend, indemnify and hold harmless code75, its officers, employees and
+   contractors from and against any claim, loss, liability, damage, cost or expense
+   (including reasonable legal fees) arising out of or relating to: (a) your use of the
+   SDK or the Service; (b) any action taken or not taken by your systems; (c) the policy,
+   data or content you provide; or (d) your breach of this licence, the Agreement or
+   applicable law.
+
+7B. PRE-RELEASE SOFTWARE
+   The SDK and the Service may be provided in a pre-release, evaluation or limited form.
+   You accept that such software may contain errors and may change or be withdrawn, and
+   you use it at your own risk.
+
+8. NO WARRANTY
+   THE SDK IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS,
+   IMPLIED OR STATUTORY, INCLUDING WITHOUT LIMITATION ANY WARRANTY OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE, TITLE OR NON-INFRINGEMENT, TO THE MAXIMUM EXTENT
+   PERMITTED BY LAW.
+
+9. LIMITATION OF LIABILITY
+   TO THE MAXIMUM EXTENT PERMITTED BY LAW, CODE75 SHALL NOT BE LIABLE FOR ANY INDIRECT,
+   INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS,
+   REVENUE, DATA OR GOODWILL, ARISING OUT OF OR RELATING TO THE SDK, HOWEVER CAUSED AND
+   UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+   CODE75'S TOTAL LIABILITY UNDER THIS LICENCE SHALL NOT EXCEED THE AMOUNT STATED IN THE
+   AGREEMENT OR, IF NONE IS STATED, ONE HUNDRED EUROS (EUR 100). Nothing in this licence
+   excludes or limits liability that cannot be excluded or limited under applicable law.
+
+10. TERMINATION
+   This licence terminates automatically, without notice, if you breach it or when the
+   Agreement ends. On termination you shall stop all use of the SDK and destroy every copy
+   in your possession or control. Sections 3, 4, 7, 7A, 8, 9, 10, 11 and 12 survive
+   termination.
+
+11. GOVERNING LAW AND JURISDICTION
+   This licence is governed by the laws of France, without regard to conflict-of-law rules.
+   Any dispute arising out of or relating to this licence is submitted to the exclusive
+   jurisdiction of the competent courts of Paris, France, unless the Agreement states
+   otherwise.
+
+12. GENERAL
+   This licence, the Agreement and THIRD-PARTY-NOTICES are the entire terms for the SDK.
+   Where this licence and the Agreement conflict, the Agreement prevails. If any provision
+   of this licence is held unenforceable, it is enforced to the maximum extent permitted
+   and the remainder stays in effect. No failure or delay by code75 in exercising a right
+   is a waiver of it. You may not assign this licence without code75's written consent;
+   code75 may assign it to a successor of the ZIFFER business. Any claim by you relating to
+   the SDK must be brought within one (1) year after it arises, to the extent the law
+   allows. This licence is written in English; a translation is for convenience only and
+   the English text prevails.
+
+Contact: code75 SASU, Paris — code75.io · ziffer.io

package/README.md

@@ -0,0 +1,58 @@
+# `@ziffer-io/types`
+
+The ACP wire format as TypeScript types, generated from `spec/schemas/` in the engine repository
+and published at the commit this workspace pins.
+
+```bash
+npm install @ziffer-io/types
+```
+
+You do not usually install this directly. `@ziffer-io/client` depends on it, so a client install
+brings the wire types with it.
+
+## What it is
+
+`spec/schemas/wire/` and `spec/schemas/bundle/` are the only normative definition of every ACP
+message. The engine's `tools/codegen.sh` turns them into Rust and TypeScript; this package is that
+TypeScript output, compiled, with the engine commit it came from recorded in its own
+`package.json` under `ziffer.enginePin`.
+
+So the types are not a transcription of the schemas. They are the schemas' output, and a field this
+package does not have is a field the specification does not state.
+
+## What is in the tarball
+
+`dist/` only — compiled JavaScript and `.d.ts`. There is no build step on your machine and no
+dependency to fetch: the previous arrangement had `@ziffer-io/client` naming the engine repository
+as a `git+` dependency, which a consumer could not resolve at all, and which would have compiled
+our wire types on their machine if they could.
+
+## What it does not do
+
+- **It carries no behaviour.** These are types and the fail-safe accessors the generator emits for
+  signed-policy tables. Nothing here verifies a receipt, canonicalises bytes or talks to an API —
+  `@ziffer-io/verify` and `@ziffer-io/client` do those, each in one place.
+- **It is not a validator.** A value typed as a `Proposal` has satisfied `tsc`, not the schema.
+  Nothing in this repository validates a document against `spec/schemas/` yet; that gap is
+  ACP-52, and it is disclosed rather than closed.
+- **A version of this package does not pin the specification.** It pins an engine *commit*. Read
+  `ziffer.enginePin` for which one.
+
+## Development
+
+```sh
+pnpm --filter @ziffer-io/types test   # vendor from the pin, tsc -b, assert the entry resolves
+```
+
+`src/` is gitignored: it is a build-time copy of the engine's `packages/acp-types/src`, taken from
+the pinned commit and regenerated on every build, so there is no committed second copy of the wire
+format to drift. `scripts/vendor-engine-types.mjs` refuses — by name — a pin it cannot read, a
+lockfile that resolved a different commit, an absent checkout, and two checkouts at once.
+
+## Licence
+
+Proprietary. Copyright (c) 2026 code75 SASU, Paris, France. ZIFFER is a registered trademark of code75
+SASU. This package is **not open source**: it is licensed for use with the ZIFFER service under
+your agreement with code75, on the terms in `LICENSE` beside this file. The third-party
+open-source components it redistributes are listed in `THIRD-PARTY-NOTICES` and are governed by
+their own licences.

package/THIRD-PARTY-NOTICES

@@ -0,0 +1,18 @@
+THIRD-PARTY NOTICES for @ziffer-io/types
+
+GENERATED FILE -- do not edit by hand.
+Regenerate with: node tools/third-party-notices.mjs
+tools/release-npm.sh refuses to publish when this file is out of date.
+
+The LICENSE beside this file governs the ZIFFER SDK itself, which is
+proprietary software of code75 SASU. The components below are third-party
+open-source, are redistributed under their own licences, and those licences
+govern them and prevail for those components only (SDK licence, section 5).
+Each entry is read from the component as it is installed, at the version
+this release resolves.
+
+This package has no third-party runtime dependencies.
+
+That is a fact about this release and not a promise about the next one:
+the file is regenerated on every release, so a dependency added later
+appears here without anyone having to remember it.