@newco-ai-platform/types

Cross-product wire-format envelopes and auth domain primitives for the NewCo Suite. Pure zod schemas + type inference + the audit-chain hash helper. No runtime side effects, fully isomorphic (Node 18+, browsers, Vercel Edge).

What's in here

| Subpath import | Exports | |---|---| | @newco-ai-platform/types | everything below, re-exported | | @newco-ai-platform/types/auth | User, Org, Role, Permission, Session, IdentityProvider zod schemas + inferred types | | @newco-ai-platform/types/envelopes | WorkflowSpec, AuditEntry, KpiEvent, AcceleratorPipeline, ComplianceBaseline, FeeEvent, ReuseEvent | | @newco-ai-platform/types/hash-chain | canonicalize, sha256Hex, computeEntryHash for the audit chain | | @newco-ai-platform/types/version | CURRENT_SCHEMA_VERSION, AUDIT_CHAIN_VERSION, AUDIT_HASH_FN constants |

The schema_version contract

Every envelope carries a top-level schema_version: number field. v1 producers emit schema_version: 1. Consumers:

1. Match version → parse strictly. Strict object validation, fail closed on unknown fields. A new field requires a schema_version bump.
2. Future version → log + drop. A consumer expecting v1 that receives v2 logs the rejection and drops the envelope. Never throws into the request pipeline.
3. Past version → translator. When v2 ships, a v1ToV2(input) migration lives next to the v2 schema. Producers stay current-only.

This is forward-compatibility without coordinated migrations. The wire format can evolve while five product teams ship in parallel.

The audit chain contract

AuditEntry and FeeEvent are hash-chained:

• chain_version: 1 and hash_fn: 'sha256' are explicit envelope fields. Future hash function changes ship via chain_version: 2 without rewriting history.
• prev_hash: string | null references the previous entry's entry_hash. The chain head carries prev_hash: null.
• entry_hash is SHA-256(canonicalize(entry without entry_hash)) hex-encoded.

The canonicalize algorithm is documented in src/hash-chain.ts and MUST be replicated bit-identical by the Python newco-sdk so cross-language verification works.

Versioning

This package is the contract surface for the whole suite. Token-level diligence:

• Patch bumps (0.1.0 → 0.1.1) — non-semantic edits (docs, type-narrow clarification with no wire-format change).
• Minor bumps (0.1.0 → 0.2.0) — additive new envelopes or new optional fields.
• Major bumps (0.1.0 → 1.0.0) — once the first paying customer signs. Major version = schema_version bump.

All changes go through contracts-owner review (suite-coordinator sub-role).