verdifax 1.3.0 → 1.5.0

package/dist/index.d.mts

@@ -569,6 +569,11 @@ interface RunsExport {
  *  key in the account, with the account's policy documents and changes. */
 interface AccountRunsExport extends RunsExport {
     account_id: string;
+    /** The account's whole chain of sign-offs, oldest first, as
+     *  {@link VerdifaxClient.getSignOffHistory} returns it. Only the owner
+     *  key's export carries it, and the SDK returns it as the server sent
+     *  it, without checking it: check it with `verdifax-verify`. */
+    signoffs?: SignOffRecord[];
 }
 /** Returned by {@link VerdifaxClient.exportRunsCSV}. */
 interface RunsExportCSV {
@@ -755,6 +760,294 @@ interface AdminAPIKey {
     run_count: number;
     revoked: boolean;
 }
+/** The kind of result a sign-off names: a completed run's record, a
+ *  refused or halted run's receipt, or a whole job by its final step. */
+type SignOffTargetKind = "record" | "receipt" | "job";
+/** An approver's decision on one result. */
+type SignOffDecision = "approve" | "reject";
+/** The exact result a sign-off names, by what its public-log entry
+ *  covers. */
+interface SignOffTarget {
+    kind: SignOffTargetKind;
+    /** The run: for a job, the run of its final step. */
+    run_id: number;
+    /** What the result's public-log entry covers. For a record, its
+     *  `bundle_anchor.anchored_digest` in the bundle
+     *  {@link VerdifaxClient.getRunArtifacts} returns. For a receipt, its
+     *  hash. For a job, the final step's record digest, read the same way
+     *  as a record's. 64 lowercase hex characters. */
+    digest: Hex64;
+    /** The job, for a job target only. */
+    job_id?: string;
+}
+/** One sign-off, verdifax.signoff.v1, as the server records it and
+ *  `verdifax-verify --signoff` and `--signoff-history` read it. */
+interface SignOffRecord {
+    format: string;
+    /** The account's chain, `account-N`. */
+    chain_id: string;
+    sequence: number;
+    /** The sign-off this one follows, or 64 zeros for the account's first. */
+    previous_signoff_hash: Hex64;
+    target: SignOffTarget;
+    decision: SignOffDecision;
+    /** SHA-256 of the approver's note, when there was one. The note's text
+     *  never reaches Verdifax. */
+    note_hash?: string;
+    /** The base64 Ed25519 public key of the approver who signed. */
+    approver_key: string;
+    /** Base64 Ed25519 signature by the approver key. */
+    signature: string;
+    signed_at: string;
+    nonce: string;
+    recorded_at: string;
+    signoff_hash: Hex64;
+    /** Where the sign-off was logged on the public log. */
+    anchor?: Record<string, unknown>;
+}
+/** What an approver signs against: the account's chain and its newest
+ *  sign-off. Returned by {@link VerdifaxClient.getNewestSignOff}. */
+interface NewestSignOff {
+    ok: boolean;
+    /** The account's chain, `account-N`. */
+    chain_id: string;
+    /** The newest sign-off's hash, or 64 zeros when there is none yet. */
+    newest_signoff_hash: Hex64;
+    /** The newest sign-off's place in the chain, 0 when there is none. */
+    sequence: number;
+}
+/** The approver key's part of a sign-off. */
+interface SignOffSignature {
+    /** The base64 Ed25519 public key of the approver. */
+    approver_key: string;
+    /** Base64 Ed25519 signature by the approver key. */
+    signature: string;
+    /** RFC 3339 UTC with whole seconds. */
+    signed_at: string;
+    /** 16 random bytes as 32 lowercase hex characters, fresh per sign-off. */
+    nonce: string;
+}
+/** Options for {@link VerdifaxClient.signOff}. */
+interface SignOffOptions {
+    /** The approver's note. It is hashed on this machine and only its
+     *  SHA-256 is sent and signed: the text never reaches Verdifax. Keep the
+     *  text yourself to show it matches the hash. */
+    note?: string;
+    /** Use the owner key's routes, /account/signoffs/newest and
+     *  /account/signoffs, instead of a member key's. */
+    asOwner?: boolean;
+}
+/** For a method that serves both a member key's route and the owner
+ *  key's /account route. */
+interface AsOwnerOptions {
+    /** Use the owner key's /account route. */
+    asOwner?: boolean;
+}
+/** An approver key's public key and the proof that its holder has the
+ *  private key, from {@link approverKeyProof}. */
+interface ApproverKeyProof {
+    /** Base64 of the raw 32-byte public key. */
+    public_key: string;
+    /** Base64 Ed25519 signature over verdifax.approver-key.v1, a zero byte
+     *  and the base64 public key. */
+    proof: string;
+}
+/** An approver key registered to an account. A key is not an identity:
+ *  `name` is the label the owner gave it. */
+interface Approver {
+    id: number;
+    public_key: string;
+    name: string;
+    /** The account, `account-N`. */
+    account_id: string;
+    registered_at: string;
+    revoked: boolean;
+    revoked_at?: string;
+}
+/** Returned by {@link VerdifaxClient.registerApprover}. */
+interface ApproverRegistration extends Approver {
+    ok: boolean;
+}
+/** Returned by {@link VerdifaxClient.listApprovers}: revoked keys
+ *  included. */
+interface ApproverList {
+    ok: boolean;
+    account_id: string;
+    approvers: Approver[];
+}
+/** Returned by {@link VerdifaxClient.revokeApprover}. */
+interface ApproverRevocation {
+    ok: boolean;
+    id: number;
+    revoked: boolean;
+}
+/** The kind of a control signal. Each is also a CloudEvents type,
+ *  `com.verdifax.` and the kind. */
+type SignalKind = "run.refused" | "run.halted" | "run.failed" | "policy.changed" | "signoff.recorded" | "approver.registered" | "approver.revoked" | "key.created" | "key.revoked";
+/** The Verdifax event inside a {@link SignalEvent}, verdifax.signal.v1. */
+interface SignalEventData {
+    /** `verdifax.signal.v1`. */
+    form: string;
+    kind: SignalKind | (string & {});
+    /** The account, `account-N`. */
+    account: string;
+    /** The event's place in the account's feed, from 1. */
+    sequence: number;
+    /** The previous event's `event_hash`, or 64 zeros for the account's
+     *  first event. */
+    previous_signal_hash: Hex64;
+    /** {@link signalEventHash} of the kind, the entry's hash and the place. */
+    event_hash: Hex64;
+    run_id?: number;
+    api_key_id?: number;
+    /** A short reason a reader can route on, for a refused, halted or
+     *  failed run. */
+    reason?: string;
+    /** The sealed entry the event names, in the exact form
+     *  `verdifax-verify` reads. */
+    entry: Record<string, unknown>;
+}
+/** One control signal, as a CloudEvents 1.0 envelope. */
+interface SignalEvent {
+    specversion: string;
+    /** `account-N/SEQUENCE`. */
+    id: string;
+    source: string;
+    /** `com.verdifax.` and the kind. */
+    type: string;
+    time: string;
+    datacontenttype: string;
+    data: SignalEventData;
+}
+/** One page of the feed. Returned by {@link VerdifaxClient.getSignals}. */
+interface SignalPage {
+    /** The events after the place asked for, oldest first. */
+    events: SignalEvent[];
+    /** The place to read from next: the last event's sequence, or the
+     *  place asked for when the page is empty. */
+    next_after: number;
+    /** The newest sequence in the account's feed, 0 when it is empty. */
+    newest: number;
+}
+/** Options for {@link VerdifaxClient.getSignals}. */
+interface GetSignalsOptions {
+    /** The last sequence already read. 0, the default, reads from the start. */
+    after?: number;
+    /** 1 to 500 events. The server's default is 100. */
+    limit?: number;
+    /** 0 to 25 seconds to hold the request open when there is no event yet.
+     *  Defaults to 0. */
+    wait?: number;
+    /** Read GET /account/signals with the owner key instead of GET /signals
+     *  with a feed key. */
+    asOwner?: boolean;
+}
+/** Options for {@link VerdifaxClient.followSignals}. */
+interface FollowSignalsOptions {
+    /** The last sequence already read. 0, the default, reads from the start. */
+    after?: number;
+    /** 0 to 25 seconds each read waits for the next event. Defaults to 25. */
+    wait?: number;
+    /** Read GET /account/signals with the owner key instead of GET /signals
+     *  with a feed key. */
+    asOwner?: boolean;
+}
+/** Options for {@link VerdifaxClient.createFeedKey}. */
+interface CreateFeedKeyOptions {
+    /** RFC 3339 or YYYY-MM-DD. */
+    expiresAt?: string;
+}
+/** A new feed key with its secret, which is shown this once. A feed key
+ *  reads the account's signal feed and nothing else. Returned by
+ *  {@link VerdifaxClient.createFeedKey}. */
+type CreatedFeedKey = CreatedAccountKey;
+/** Returned by {@link VerdifaxClient.revokeFeedKey}. */
+interface FeedKeyRevocation {
+    ok: boolean;
+    id: number;
+    revoked: boolean;
+}
+/** Options for {@link VerdifaxClient.createWebhook}. */
+interface CreateWebhookOptions {
+    /** The kinds to deliver, each once. Empty or left out takes every kind. */
+    types?: SignalKind[];
+}
+/** A webhook subscription, without its secret. */
+interface Webhook {
+    id: number;
+    url: string;
+    /** The kinds it delivers. Empty means every kind. */
+    types: SignalKind[];
+    created_at: string;
+}
+/** A new webhook subscription with its secret, `whsec_` and base64,
+ *  which is shown this once. Check each delivery with it using
+ *  {@link verifyWebhook}. Returned by {@link VerdifaxClient.createWebhook}. */
+interface CreatedWebhook extends Webhook {
+    ok: boolean;
+    secret: string;
+    hint: string;
+}
+/** Returned by {@link VerdifaxClient.listWebhooks}. */
+interface WebhookList {
+    ok: boolean;
+    webhooks: Webhook[];
+}
+/** Returned by {@link VerdifaxClient.deleteWebhook}. */
+interface WebhookDeletion {
+    ok: boolean;
+    id: number;
+    deleted: boolean;
+}
+/** Options for {@link VerdifaxClient.listWebhookDeliveries}. */
+interface ListWebhookDeliveriesOptions {
+    /** 1 to 500 deliveries. The server's default is 50. */
+    limit?: number;
+}
+/** One delivery of one event to a webhook. A delivery is a copy: the pull
+ *  feed and the public log are the record. */
+interface WebhookDelivery {
+    /** The event's place in the account's feed. */
+    sequence: number;
+    /** `pending`, `delivered` or `failed`. */
+    status: string;
+    attempts: number;
+    last_status_code: number;
+    last_error: string;
+    created_at: string;
+    delivered_at?: string;
+    next_attempt_at?: string;
+}
+/** Returned by {@link VerdifaxClient.listWebhookDeliveries}: the newest
+ *  deliveries first. */
+interface WebhookDeliveryList {
+    ok: boolean;
+    webhook_id: number;
+    deliveries: WebhookDelivery[];
+}
+/** The headers of a webhook delivery: a fetch `Headers`, or an object such
+ *  as Node's `req.headers`. Names are read without regard to case. */
+type WebhookHeaders = {
+    get(name: string): string | null;
+} | Record<string, string | string[] | undefined>;
+/** Options for {@link verifyWebhook}. */
+interface VerifyWebhookOptions {
+    /** How far, in seconds, `webhook-timestamp` may be from `now` in either
+     *  direction. Defaults to 300. */
+    toleranceSeconds?: number;
+    /** The time to check the timestamp against. Defaults to the current
+     *  time. */
+    now?: Date;
+}
+/** An event's place in its account's feed, for {@link signalEventHash}. */
+interface SignalEventHashFields {
+    /** The account, `account-N`. */
+    account: string;
+    /** The event's sequence, a whole number. */
+    sequence: number;
+    /** The previous event's hash, or 64 zeros for the account's first. */
+    previousSignalHash: string;
+}
 
 /**
  * The job helper: runs the steps of one job and keeps the map of step ids
@@ -869,6 +1162,22 @@ declare const MAX_BATCH_ROWS = 1000;
  * | `testAccountPolicy(req)` | POST /account/policies/test | owner key |
  * | `getAccountPolicyHistory()` | GET /account/policies/history | owner key |
  * | `activateAccountPolicy(documentHash)` | POST /account/policies/{document_hash}/activate | owner key |
+ * | `registerApprover(name, approver)` | POST /account/approvers | owner key |
+ * | `listApprovers()` | GET /account/approvers | owner key |
+ * | `revokeApprover(id)` | DELETE /account/approvers/{id} | owner key |
+ * | `signOff(target, decision, approverKey, options)` | POST /signoffs, or POST /account/signoffs with asOwner | required |
+ * | `getNewestSignOff(options)` | GET /signoffs/newest, or GET /account/signoffs/newest with asOwner | required |
+ * | `getSignOffs(runId, options)` | GET /runs/{id}/signoffs, or GET /account/runs/{id}/signoffs with asOwner | required |
+ * | `getSignOffHistory()` | GET /account/signoffs/history | owner key |
+ * | `getSignals(options)` | GET /signals, or GET /account/signals with asOwner | feed key, or owner key |
+ * | `followSignals(options)` | GET /signals page after page, or GET /account/signals with asOwner | feed key, or owner key |
+ * | `createFeedKey(name, options)` | POST /account/feed-keys | owner key |
+ * | `revokeFeedKey(id)` | DELETE /account/feed-keys/{id} | owner key |
+ * | `createWebhook(url, options)` | POST /account/webhooks | owner key |
+ * | `listWebhooks()` | GET /account/webhooks | owner key |
+ * | `deleteWebhook(id)` | DELETE /account/webhooks/{id} | owner key |
+ * | `listWebhookDeliveries(id, options)` | GET /account/webhooks/{id}/deliveries | owner key |
+ * | `getFailureReceipt(id)` | GET /runs/{id}/failure-receipt | required |
  * | `job(jobId)` | none, returns a {@link VerdifaxJob} | none |
  *
  * With the `signingKey` option set, every path to POST /execute carries
@@ -1037,6 +1346,94 @@ declare class VerdifaxClient {
      *  `account-N`. The server refuses an unsigned account change, so this
      *  needs the `signingKey` option and refuses to send without it. */
     activateAccountPolicy(documentHash: Hex64): Promise<PolicyActivation>;
+    /** Registers an approver key to the owner's account. `approver` is the
+     *  approver's signing key, from which the proof is made on this machine,
+     *  or the `{ public_key, proof }` that {@link approverKeyProof} made on
+     *  the approver's own machine, so the owner need not hold the private
+     *  key. A proof that does not verify is refused before sending. The
+     *  server refuses a key that is a request key in the same account.
+     *  `name` is a label, not an identity. */
+    registerApprover(name: string, approver: Uint8Array | KeyObject | ApproverKeyProof): Promise<ApproverRegistration>;
+    /** The account's approver keys, revoked ones included. */
+    listApprovers(): Promise<ApproverList>;
+    /** Revokes one of the account's approver keys. Its earlier sign-offs
+     *  stay on the record. A key that is not an active approver in the
+     *  account throws {@link NotFoundError}. */
+    revokeApprover(approverId: number): Promise<ApproverRevocation>;
+    /** What an approver signs against: the account's chain `account-N` and
+     *  its newest sign-off (64 zeros when there is none yet). With
+     *  `asOwner` it reads the owner key's route. */
+    getNewestSignOff(options?: AsOwnerOptions): Promise<NewestSignOff>;
+    /** Signs an approver's decision, approve or reject, on one exact result
+     *  and submits it. It first reads {@link getNewestSignOff} for the
+     *  account's chain and its newest sign-off, then signs over them with
+     *  `approverKey` on this machine. The approver's private key is never
+     *  sent.
+     *
+     *  `target.digest` is what the result's public-log entry covers: for a
+     *  record, the `bundle_anchor.anchored_digest` of the bundle
+     *  {@link getRunArtifacts} returns; for a receipt, its hash; for a job,
+     *  the final step's record digest, read as a record's, with `job_id`.
+     *
+     *  `note` is hashed here and only its SHA-256 is sent and signed: the
+     *  text never reaches Verdifax. With `asOwner` it uses the owner key's
+     *  routes. Bad input is refused before anything is sent.
+     *
+     *  The record the server returns must carry the signature,
+     *  approver_key, decision, previous_signoff_hash and target that were
+     *  sent, or this throws {@link VerdifaxError}.
+     *
+     *  A later sign-off on the same result supersedes this one, and neither
+     *  is deleted. An HTTP 409 means the chain moved or the target is not
+     *  this account's result: it throws the usual {@link APIError} and is
+     *  not retried. */
+    signOff(target: SignOffTarget, decision: SignOffDecision, approverKey: Uint8Array | KeyObject, options?: SignOffOptions): Promise<SignOffRecord>;
+    /** The sign-offs on one run, oldest first, in the form
+     *  `verdifax-verify --signoff FILE` reads: for a member key, a run it
+     *  made; with `asOwner`, any run of the account. The latest is the
+     *  decision in force. */
+    getSignOffs(runId: number, options?: AsOwnerOptions): Promise<SignOffRecord[]>;
+    /** The account's whole chain of sign-offs, oldest first, in the form
+     *  `verdifax-verify --signoff-history FILE` reads. Needs the owner key. */
+    getSignOffHistory(): Promise<SignOffRecord[]>;
+    /** One page of the account's feed: the events after `after`, oldest
+     *  first, with `next_after` to read from next. With `wait` the server
+     *  holds the request open up to that many seconds for the next event, and
+     *  this call's timeout is at least the wait plus 30 seconds. With
+     *  `asOwner` it reads GET /account/signals with the owner key. Bad
+     *  options are refused before sending. Save the events and check them
+     *  with `verdifax-verify --signals`. */
+    getSignals(options?: GetSignalsOptions): Promise<SignalPage>;
+    /** Follows the feed from `after`, yielding each event once, in order,
+     *  until you stop with `break` or `return`. Each read starts at the page
+     *  before's `next_after`, waits up to `wait` seconds (default 25) when
+     *  there is no event, and is retried like any GET. A read that still
+     *  fails throws {@link SignalFeedError}, whose `lastSequence` is the last
+     *  sequence yielded: follow again from there and nothing is lost. Bad
+     *  options are refused here, before anything is sent. */
+    followSignals(options?: FollowSignalsOptions): AsyncGenerator<SignalEvent, void, undefined>;
+    /** Creates a feed key in the owner's account. A feed key reads the
+     *  account's signal feed, with {@link getSignals} and
+     *  {@link followSignals}, and nothing else. The secret is in the result
+     *  this once. */
+    createFeedKey(name: string, options?: CreateFeedKeyOptions): Promise<CreatedFeedKey>;
+    /** Revokes one of the account's feed keys. An id that is not a feed key
+     *  of the account throws {@link NotFoundError}. */
+    revokeFeedKey(id: number): Promise<FeedKeyRevocation>;
+    /** Subscribes an https address to the account's signals. `types` are the
+     *  kinds to deliver, each once; empty or left out takes every kind. The
+     *  secret, `whsec_` and base64, is in the result this once: check each
+     *  delivery with {@link verifyWebhook}. A delivery is a copy: the pull
+     *  feed and the public log are the record. The server checks the address
+     *  too, and refuses an eleventh subscription with HTTP 409. */
+    createWebhook(url: string, options?: CreateWebhookOptions): Promise<CreatedWebhook>;
+    /** The account's webhook subscriptions, without their secrets. */
+    listWebhooks(): Promise<WebhookList>;
+    /** Ends a webhook subscription. Its events stay in the pull feed. */
+    deleteWebhook(id: number): Promise<WebhookDeletion>;
+    /** A webhook's newest deliveries first, up to `limit` (1 to 500; the
+     *  server's default is 50). */
+    listWebhookDeliveries(id: number, options?: ListWebhookDeliveriesOptions): Promise<WebhookDeliveryList>;
     getRun(runId: number): Promise<Run>;
     verifyRun(runId: number): Promise<VerifyResponse>;
     listRuns(params?: ListRunsParams): Promise<{
@@ -1073,6 +1470,10 @@ declare class VerdifaxClient {
     getAivpT4HaltReceipt(runId: number): Promise<Record<string, unknown>>;
     getAttestationGapReceipt(runId: number): Promise<Record<string, unknown>>;
     getCESAuditRecord(runId: number): Promise<Record<string, unknown>>;
+    /** A failed run's sealed failure receipt, in the form `verdifax-verify`
+     *  reads. A run that failed before failure receipts were sealed has none
+     *  and throws {@link NotFoundError}. */
+    getFailureReceipt(runId: number): Promise<Record<string, unknown>>;
     /** The audit report for a run, as JSON. */
     getRunReport(runId: number): Promise<Record<string, unknown>>;
     /** The run's sealed audit bundle as the exact JSON text the server
@@ -1349,6 +1750,71 @@ declare function policyActivationApproval(signingKey: Uint8Array | KeyObject, fi
     signedAt?: string;
     nonce?: string;
 }): PolicyActivationSignature;
+/** The bytes an approver key signs for one sign-off, matching the
+ *  orchestrator's SignOffPreimage: the fields joined with single zero
+ *  bytes. `chain_id` and `previous_signoff_hash` come from GET
+ *  /signoffs/newest (or /account/signoffs/newest for the owner key), so a
+ *  signature cannot be moved to another account, another result or
+ *  another point in the chain. `target.job_id` is empty unless the target
+ *  is a job, and `note_hash` is empty when there is no note. */
+declare function signOffPreimage(fields: {
+    chain_id: string;
+    previous_signoff_hash: string;
+    target: SignOffTarget;
+    decision: SignOffDecision;
+    note_hash: string;
+    signed_at: string;
+    nonce: string;
+}): Buffer;
+/** The approver key's base64 public key and its proof: its signature over
+ *  verdifax.approver-key.v1, a zero byte and the base64 public key, which
+ *  shows its holder has the private key. The approver can run this on
+ *  their own machine and give the result to the account's owner, who
+ *  registers it with {@link VerdifaxClient.registerApprover}, so the owner
+ *  never holds the approver's private key. */
+declare function approverKeyProof(approverKey: Uint8Array | KeyObject): ApproverKeyProof;
+
+/**
+ * The signal feed: every control signal Verdifax recorded for an account,
+ * in order, each with its sealed entry. The feed cannot show a signal
+ * Verdifax never recorded.
+ *
+ * A feed key reads the feed and nothing else. The owner key reads the same
+ * feed on its /account route and manages feed keys and webhooks. A webhook
+ * delivery is a copy: the pull feed and the public log are the record.
+ *
+ * The request building, the checks made before sending, the follow loop,
+ * webhook verification and the event hash live here; the client's methods
+ * are thin wrappers over them.
+ */
+
+/**
+ * Checks one webhook delivery under the Standard Webhooks scheme and
+ * returns its CloudEvent. Pass the headers as received, the body as the
+ * exact bytes received (a Buffer, a Uint8Array or a string, never parsed
+ * JSON) and the subscription's `whsec_` secret.
+ *
+ * The signed content is `webhook-id`, a dot, `webhook-timestamp`, a dot and
+ * the body. `webhook-signature` is a space-separated list of `v1,<base64>`
+ * entries, and any one may match; each is compared in constant time. A
+ * timestamp more than `toleranceSeconds` (default 300) from `now` in either
+ * direction is refused. Header names are read without regard to case. The
+ * body must be a JSON object whose top-level `id` is a string equal to
+ * `webhook-id`.
+ *
+ * Throws {@link VerdifaxError} naming the check that failed. The secret is
+ * never placed in an error message. A delivery is a copy: the pull feed and
+ * the public log are the record.
+ */
+declare function verifyWebhook(headers: WebhookHeaders, body: Uint8Array | string, secret: string, options?: VerifyWebhookOptions): SignalEvent;
+/**
+ * The hash the next event in an account's feed names, matching the
+ * orchestrator's SignalEventHash: hex SHA-256 of `verdifax.signal.v1`, the
+ * kind, the hash of the event's entry, the account, the decimal sequence
+ * and the previous event's hash, joined by single zero bytes. It makes no
+ * request.
+ */
+declare function signalEventHash(kind: string, entryHash: string, fields: SignalEventHashFields): string;
 
 /**
  * Input-validation helpers, mirrors the Python SDK's
@@ -1433,5 +1899,17 @@ declare class APIKeyRequiredError extends VerdifaxError {
     readonly name: string;
     constructor();
 }
+/** Thrown by {@link VerdifaxClient.followSignals} when a read fails or a
+ *  page does not follow on from the last one. `lastSequence` is the last
+ *  sequence the generator handed out, so the feed is never lost: follow
+ *  again with `after: lastSequence`. The error the read threw, after the
+ *  client's normal retries, is `cause`. */
+declare class SignalFeedError extends VerdifaxError {
+    readonly lastSequence: number;
+    readonly name: string;
+    constructor(lastSequence: number, reason: string, options?: {
+        cause?: unknown;
+    });
+}
 
-export { APIError, APIKeyRequiredError, type Account, type AccountInfo, type AccountKey, type AccountKeyList, type AccountKeyRevocation, type AccountRunsExport, type AdminAPIKey, type AdminCreateAccountOptions, type AdminCreateAccountResponse, type AdminCreateKeyOptions, type AdminCreateKeyResponse, type AdminEraseRequest, type AttestRequest, type AttestationList, AuthError, CRES_ENGINE_VERSION, CRES_PREIMAGE_VERSION, type ClientConfig, type CreateAccountKeyOptions, type CreatedAccountKey, type DCAEProofBundle, type DCAEVerdict, DCAE_PREIMAGE_VERSION, DSE_FORMULA_VERSION, type DeletionReceipt, type DeterminismDiff, type DeterminismRun, EXECUTE_FIELDS, type ExecuteBatchResponse, type ExecuteBatchResult, type ExecuteRequest, type ExecuteResponse, type ExecutionManifest, type ExportRow, type ExportRunsParams, type FormulaEra, type Health, type Hex64, type JobLink, type JobStepOptions, type KeyTier, type ListAttestationsParams, type ListRunsParams, MAX_BATCH_ROWS, NotFoundError, type PDFFormat, type Policy, type PolicyActivation, type PolicyActivationSignature, type PolicyActorType, type PolicyClassification, type PolicyContext, type PolicyList, type PolicyObjectType, type PolicyTestRequest, type PolicyTestResult, type PolicyWithDocument, RUN_STATUSES, type ReproducibilityContext, type RequestKeyChange, type RequestKeyPair, type RequestKeyRegistration, type RequestKeyRegistrationBody, type RequestSignature, type RequestSignatureV2, type Run, type RunStats, type RunStatus, type RunSummary, type RunsExport, type RunsExportCSV, type SearchRunsParams, type SignedRequestBody, VerdifaxClient, VerdifaxError, VerdifaxJob, type VerdifaxVersion, type VerifyDeterminismResponse, type VerifyResponse, captureEnvironment, cresReceiptHash, dcaeClosureHash, dseDispatchHash, formatProviderPayload, fromEnv, generateRequestKeyPair, policyActivationApproval, policyActivationPreimage, requestKeyChangeApproval, requestKeyChangePreimage, requestKeyRegistrationBody, requestSignaturePreimage, requestSignaturePreimageV2, signRequest, signRequestV2, validateHex64, validateJobName, validateRouteId };
+export { APIError, APIKeyRequiredError, type Account, type AccountInfo, type AccountKey, type AccountKeyList, type AccountKeyRevocation, type AccountRunsExport, type AdminAPIKey, type AdminCreateAccountOptions, type AdminCreateAccountResponse, type AdminCreateKeyOptions, type AdminCreateKeyResponse, type AdminEraseRequest, type Approver, type ApproverKeyProof, type ApproverList, type ApproverRegistration, type ApproverRevocation, type AsOwnerOptions, type AttestRequest, type AttestationList, AuthError, CRES_ENGINE_VERSION, CRES_PREIMAGE_VERSION, type ClientConfig, type CreateAccountKeyOptions, type CreateFeedKeyOptions, type CreateWebhookOptions, type CreatedAccountKey, type CreatedFeedKey, type CreatedWebhook, type DCAEProofBundle, type DCAEVerdict, DCAE_PREIMAGE_VERSION, DSE_FORMULA_VERSION, type DeletionReceipt, type DeterminismDiff, type DeterminismRun, EXECUTE_FIELDS, type ExecuteBatchResponse, type ExecuteBatchResult, type ExecuteRequest, type ExecuteResponse, type ExecutionManifest, type ExportRow, type ExportRunsParams, type FeedKeyRevocation, type FollowSignalsOptions, type FormulaEra, type GetSignalsOptions, type Health, type Hex64, type JobLink, type JobStepOptions, type KeyTier, type ListAttestationsParams, type ListRunsParams, type ListWebhookDeliveriesOptions, MAX_BATCH_ROWS, type NewestSignOff, NotFoundError, type PDFFormat, type Policy, type PolicyActivation, type PolicyActivationSignature, type PolicyActorType, type PolicyClassification, type PolicyContext, type PolicyList, type PolicyObjectType, type PolicyTestRequest, type PolicyTestResult, type PolicyWithDocument, RUN_STATUSES, type ReproducibilityContext, type RequestKeyChange, type RequestKeyPair, type RequestKeyRegistration, type RequestKeyRegistrationBody, type RequestSignature, type RequestSignatureV2, type Run, type RunStats, type RunStatus, type RunSummary, type RunsExport, type RunsExportCSV, type SearchRunsParams, type SignOffDecision, type SignOffOptions, type SignOffRecord, type SignOffSignature, type SignOffTarget, type SignOffTargetKind, type SignalEvent, type SignalEventData, type SignalEventHashFields, SignalFeedError, type SignalKind, type SignalPage, type SignedRequestBody, VerdifaxClient, VerdifaxError, VerdifaxJob, type VerdifaxVersion, type VerifyDeterminismResponse, type VerifyResponse, type VerifyWebhookOptions, type Webhook, type WebhookDeletion, type WebhookDelivery, type WebhookDeliveryList, type WebhookHeaders, type WebhookList, approverKeyProof, captureEnvironment, cresReceiptHash, dcaeClosureHash, dseDispatchHash, formatProviderPayload, fromEnv, generateRequestKeyPair, policyActivationApproval, policyActivationPreimage, requestKeyChangeApproval, requestKeyChangePreimage, requestKeyRegistrationBody, requestSignaturePreimage, requestSignaturePreimageV2, signOffPreimage, signRequest, signRequestV2, signalEventHash, validateHex64, validateJobName, validateRouteId, verifyWebhook };