@ziffer-io/types 0.1.0 → 0.1.1

package/README.md

@@ -1,58 +1,45 @@
-# `@ziffer-io/types`
+# @ziffer-io/types
 
-The ACP wire format as TypeScript types, generated from `spec/schemas/` in the engine repository
-and published at the commit this workspace pins.
+The ZIFFER wire format as TypeScript types.
+
+## Install
 
 ```bash
 npm install @ziffer-io/types
 ```
 
-You do not usually install this directly. `@ziffer-io/client` depends on it, so a client install
-brings the wire types with it.
-
-## What it is
-
-`spec/schemas/wire/` and `spec/schemas/bundle/` are the only normative definition of every ACP
-message. The engine's `tools/codegen.sh` turns them into Rust and TypeScript; this package is that
-TypeScript output, compiled, with the engine commit it came from recorded in its own
-`package.json` under `ziffer.enginePin`.
+Most integrations never install this directly. `@ziffer-io/client` depends on it, so installing
+the client brings the wire types with it.
 
-So the types are not a transcription of the schemas. They are the schemas' output, and a field this
-package does not have is a field the specification does not state.
+## Usage
 
-## What is in the tarball
+```ts
+import type { wire } from '@ziffer-io/types';
 
-`dist/` only — compiled JavaScript and `.d.ts`. There is no build step on your machine and no
-dependency to fetch: the previous arrangement had `@ziffer-io/client` naming the engine repository
-as a `git+` dependency, which a consumer could not resolve at all, and which would have compiled
-our wire types on their machine if they could.
+function store(receipt: wire.DecisionReceipt): void {
+  // your code
+}
+```
 
-## What it does not do
+These types are generated from the ZIFFER specification. The specification is public at
+https://github.com/ziffer-hq/ziffer-spec. A field this package does not carry is a field the
+specification does not state. The package holds types only, so nothing here calls an API or
+checks a signature.
 
-- **It carries no behaviour.** These are types and the fail-safe accessors the generator emits for
-  signed-policy tables. Nothing here verifies a receipt, canonicalises bytes or talks to an API —
-  `@ziffer-io/verify` and `@ziffer-io/client` do those, each in one place.
-- **It is not a validator.** A value typed as a `Proposal` has satisfied `tsc`, not the schema.
-  Nothing in this repository validates a document against `spec/schemas/` yet; that gap is
-  ACP-52, and it is disclosed rather than closed.
-- **A version of this package does not pin the specification.** It pins an engine *commit*. Read
-  `ziffer.enginePin` for which one.
+## Documentation
 
-## Development
+- The specification: https://ziffer.io/docs/specification
+- Integrating the SDK: https://ziffer.io/docs/developers/sdk
+- Quickstart: https://ziffer.io/docs/quickstart
+- Glossary: https://ziffer.io/docs/glossary
 
-```sh
-pnpm --filter @ziffer-io/types test   # vendor from the pin, tsc -b, assert the entry resolves
-```
+## Support
 
-`src/` is gitignored: it is a build-time copy of the engine's `packages/acp-types/src`, taken from
-the pinned commit and regenerated on every build, so there is no committed second copy of the wire
-format to drift. `scripts/vendor-engine-types.mjs` refuses — by name — a pin it cannot read, a
-lockfile that resolved a different commit, an absent checkout, and two checkouts at once.
+Write to hello@ziffer.io.
 
-## Licence
+## License
 
-Proprietary. Copyright (c) 2026 code75 SASU, Paris, France. ZIFFER is a registered trademark of code75
-SASU. This package is **not open source**: it is licensed for use with the ZIFFER service under
-your agreement with code75, on the terms in `LICENSE` beside this file. The third-party
-open-source components it redistributes are listed in `THIRD-PARTY-NOTICES` and are governed by
-their own licences.
+Proprietary. Copyright (c) 2026 code75 SASU, Paris, France. ZIFFER is a registered trademark of
+code75 SASU. This package is not open source. Its use is governed by your agreement with code75
+and by `LICENSE` beside this file. The open-source components it redistributes are listed in
+`THIRD-PARTY-NOTICES`, under their own licences.

package/dist/generated.js

@@ -1,6 +1,6 @@
 // @ziffer-io/types build-time copy — DO NOT EDIT.
 // Regenerated by packages/types/scripts/vendor-engine-types.mjs on every build.
-// source: packages/acp-types/src/generated.ts @ fed43d10b427e0a4435a8f04e474334d88a5aa6e (the engine pin in Cargo.toml)
+// source: packages/acp-types/src/generated.ts @ 8ae262196dbe75210a975a456785df5d9f0524a3 (the engine pin in Cargo.toml)
 // @generated by tools/codegen.sh from spec/schemas/bundle/ — DO NOT EDIT.
 //
 // Regenerate with `./tools/codegen.sh`. `./tools/codegen.sh --check` asserts

package/dist/generated_wire.js

@@ -1,6 +1,6 @@
 // @ziffer-io/types build-time copy — DO NOT EDIT.
 // Regenerated by packages/types/scripts/vendor-engine-types.mjs on every build.
-// source: packages/acp-types/src/generated_wire.ts @ fed43d10b427e0a4435a8f04e474334d88a5aa6e (the engine pin in Cargo.toml)
+// source: packages/acp-types/src/generated_wire.ts @ 8ae262196dbe75210a975a456785df5d9f0524a3 (the engine pin in Cargo.toml)
 // @generated by tools/codegen.sh from spec/schemas/wire/ — DO NOT EDIT.
 //
 // Regenerate with `./tools/codegen.sh`. `./tools/codegen.sh --check` asserts

package/dist/index.js

@@ -1,6 +1,6 @@
 // @ziffer-io/types build-time copy — DO NOT EDIT.
 // Regenerated by packages/types/scripts/vendor-engine-types.mjs on every build.
-// source: packages/acp-types/src/index.ts @ fed43d10b427e0a4435a8f04e474334d88a5aa6e (the engine pin in Cargo.toml)
+// source: packages/acp-types/src/index.ts @ 8ae262196dbe75210a975a456785df5d9f0524a3 (the engine pin in Cargo.toml)
 /**
  * Wire types for ACP.
  *

package/package.json

@@ -1,10 +1,17 @@
 {
   "name": "@ziffer-io/types",
-  "version": "0.1.0",
-  "description": "The ZIFFER wire format as TypeScript types, generated from the ACP schemas at the engine pin.",
+  "version": "0.1.1",
+  "description": "TypeScript types for the ZIFFER wire format, generated from the public ZIFFER specification.",
+  "keywords": [
+    "ziffer",
+    "agent",
+    "ai-agent",
+    "guardrail",
+    "approval",
+    "receipt"
+  ],
   "author": "code75 SASU",
   "license": "SEE LICENSE IN LICENSE",
-  "comment-license": "The SDK is proprietary (code75 SASU). \"license\" is the SPDX escape hatch for exactly this case: there is no SPDX identifier for these terms, so the field points at the file that states them, and LICENSE ships in the tarball beside THIRD-PARTY-NOTICES. Do not put an OSI identifier here -- Apache-2.0 stood in these four files until ACP-214 and was wrong the whole time.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -32,14 +39,9 @@
   "publishConfig": {
     "access": "public"
   },
-  "comment-no-provenance": "There is deliberately no \"provenance\": true here, and it was removed rather than never added. npm generates a provenance attestation only from a recognised CI runner, and its documentation states plainly that provenance is NOT SUPPORTED for private repositories (docs.npmjs.com/trusted-publishers, read 2026-09-03) -- ziffer-hq/ziffer is private (`gh api` says so). Setting the flag does not degrade to a warning: npm attempts the attestation and the publish FAILS, so the field would have broken the operator's very first publish from a laptop and every CI publish after it. tools/release-npm.sh asserts the field stays absent, and that assertion is the thing to delete on the day this repository becomes public -- at which point trusted publishing generates provenance on its own, with no flag at all.",
   "ziffer": {
-    "enginePin": "fed43d10b427e0a4435a8f04e474334d88a5aa6e"
+    "enginePin": "8ae262196dbe75210a975a456785df5d9f0524a3"
   },
-  "comment-enginePin": "The engine commit this package wraps, so a published artifact states it rather than leaving a reader to ask. It is a COPY of the rev in Cargo.toml, which is the one authority guard.sh reads. tools/release-npm.sh refuses to release when the two differ, by name. DISCLOSED: tools/bump-pin.sh does NOT move this field -- its three patterns are the Cargo `rev =` syntax, the package.json git+ URL syntax and a bare-sha schemas/PIN file, and none of them matches `\"enginePin\": \"<sha>\"`. So a pin bump leaves this stale and the release refuses until the four package.json files are brought forward by hand. That refusal is real and falsified in --selfcheck; it is still one hand step, and closing it is a fourth pattern in bump-pin.sh (ACP-208's shape, one more time).",
-  "comment-why-this-package-exists": "ACP-214. @ziffer-io/client used to declare the engine's @acp/types as a GIT dependency on ziffer-hq/agent-control-plane. That repository is PRIVATE (gh api says private:true, 2026-09-03), so a developer who installed the published client could not resolve it at all -- not 'has to build it', cannot fetch it. A published package may not depend on a private git URL, and it may not depend on a public one either: pnpm runs `prepare` for a git dependency and a consumer would be compiling our wire types on their machine. So the wire format is published, from the pinned engine commit, as compiled dist/ that a consumer just installs.",
-  "comment-no-engine-dependency-here": "There is deliberately NO @acp/types dependency in this file, and the absence is load-bearing rather than an oversight. `pnpm pack` keeps devDependencies in the published package.json -- measured, not assumed -- so a git+ URL declared here would ship to the registry, publishing the private engine repository's address and tripping the no-git+ assertion in tools/release-npm.sh over our own tarball. scripts/vendor-engine-types.mjs finds the engine sources through the pin instead, and refuses every way of not finding them.",
-  "comment-vendored-not-forked": "src/ is BUILD OUTPUT and gitignored, exactly as sdk/python/src/ziffer/_engine is (sdk/python/build.sh carries the argument at length): committed source here is the packaging only, the engine's generated types are copied in verbatim from the pin at build time, and the copy is regenerated on every build so there is no divergent lineage to drift. A committed copy would be a second definition of the wire format, which is the encoding-split defect this whole repository is organised against.",
   "devDependencies": {
     "typescript": "^5.9.2"
   },