@company-semantics/contracts 100.0.0 → 101.0.0

package/src/org/schemas.ts

@@ -1,26 +1,16 @@
 /**
  * Org/Workspace Response Schemas
  *
- * Zod response schemas for workspace core endpoints.
- * Canonical location for runtime validation of workspace API responses.
- *
- * Covers (defined here):
- *  - workspace.ts (GET /api/workspace, /access, /members)
- *  - members.ts   (DELETE/PATCH /api/workspace/members)
- *  - user-orgs.ts (GET /api/user/orgs, POST /api/user/active-org, /leave)
- *  - scope-check.ts (GET /api/scope/check, POST /api/scope/check-batch)
- *  - capabilities (GET /api/capabilities)
- *
- * The rest of the org schema corpus lives in sibling `*-schemas.ts` modules
- * and is re-exported below, so `./schemas` stays the one import path for
- * every org schema.
+ * The one import path for every org schema. The corpus lives in sibling
+ * `*-schemas.ts` modules, each re-exported whole below:
+ *  - workspace-member-schemas.ts   (GET/DELETE/PATCH /api/workspace/members)
+ *  - workspace-overview-schemas.ts (GET /api/workspace, /access)
+ *  - reporting-write-schemas.ts    (PUT /api/reporting/positions/:id/manager,
+ *                                   POST /api/chat/interactive-tasks/submit)
+ *  - user-org-schemas.ts           (GET /api/user/orgs, POST /api/user/active-org,
+ *                                   /leave, GET/POST /api/scope/check*)
+ *  - capability-schemas.ts         (GET /api/capabilities)
  */
-import { z } from "zod";
-import { CursorPageSchema } from "../api/primitives";
-import { AI_PAUSE_REASONS } from "../billing/vocabulary";
-import { OrgChartRoleSchema } from "../permissions/orgchart-roles";
-import { PositionRefSchema } from "../identity/position-ref";
-import { AuthorityMutabilitySchema } from "./authority-schemas";
 
 // Sibling schema modules — re-exported whole; ./schemas is their only import path.
 export * from "./workspace-admin-schemas";
@@ -29,532 +19,8 @@ export * from "./org-governance-schemas";
 export * from "./org-unit-schemas";
 export * from "./authority-schemas";
 export * from "./org-unit-api-schemas";
-
-// ---------------------------------------------------------------------------
-// Sub-schemas
-// ---------------------------------------------------------------------------
-
-const WorkspaceMemberUnitSummarySchema = z.object({
-  unitId: z.string(),
-  unitName: z.string(),
-  unitPath: z.string(),
-  role: z.enum(["owner", "manager", "member"]),
-});
-
-/**
- * Designation a member holds over a unit they manage (ADR-CTRL-112).
- *
- * Precedence, highest-first: whole_org > admin > unit_owner > delegate > member.
- * The org-wide designations (`whole_org`, `admin`) anchor to the org root
- * unit. This vocabulary is DISPLAY-ONLY — it summarizes management reach for
- * UI surfaces and is NEVER an authorization input (authority resolution uses
- * the orthogonal membership/delegation axes, not this enum).
- */
-export const OrgUnitDesignationSchema = z.enum([
-  "whole_org",
-  "admin",
-  "unit_owner",
-  "delegate",
-  "member",
-]);
-export type OrgUnitDesignation = z.infer<typeof OrgUnitDesignationSchema>;
-
-export const WorkspaceMemberUnitDesignationEntrySchema = z.object({
-  unitId: z.string(),
-  unitName: z.string(),
-  designation: OrgUnitDesignationSchema,
-  /**
-   * Whether this designation is REMOVABLE in place (`user_managed` — an explicit
-   * overlay grant or `l{N}_unit_owner` membership) or DERIVED from reporting
-   * topology (`derived` — the senior person homed in a unit with no manager
-   * inside it, ADR-BE-267/294). A `derived` owner can't be revoked: the holder
-   * must relinquish it (recorded as a higher-provenance suppression that the
-   * structural projection honors) or the upstream chart must change. Display +
-   * affordance gating only; never an authorization input.
-   */
-  mutability: AuthorityMutabilitySchema,
-});
-export type WorkspaceMemberUnitDesignationEntry = z.infer<
-  typeof WorkspaceMemberUnitDesignationEntrySchema
->;
-
-const WorkspaceMemberSchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  email: z.string(),
-  /**
-   * Resolved avatar photo URL for the member, or `null`/absent when none is
-   * stored. SOURCE-AGNOSTIC: today the backend resolves this from the Slack
-   * profile photo cached on the user record, but the field name deliberately
-   * does not encode the origin so future sources (in-app upload, etc.) slot in
-   * behind the backend avatar resolver without a contract change. UI MUST fall
-   * back to initials when this is absent. Optional because it is an additive
-   * display-only enrichment (see ADR-CONTRACTS-055).
-   */
-  avatarUrl: z.string().nullable().optional(),
-  /** The occupant's Position seat title (org-scoped). Null when the seat is untitled. */
-  jobTitle: z.string().nullable(),
-  /**
-   * The member's Position seat in the org graph — the id every reporting write
-   * is keyed on (ADR-CONTRACTS-131). Present here so a user-ADDRESSED surface
-   * (the members table, a person picker) can resolve a seat by READ and hand
-   * the position straight to `PUT /api/reporting/positions/{positionId}/manager`,
-   * instead of a write path minting one with `resolveSeat(create: true)`.
-   *
-   * Nullable: a member with no materialized seat is a legitimate state, and a
-   * read must report that honestly rather than force the server to create one.
-   */
-  seatPositionId: z.string().uuid().nullable(),
-  /**
-   * Display role — the member's highest org-chart standing, or `null` for a
-   * plain member with no org-chart authority. Render via `orgChartRoleLabel`.
-   */
-  role: OrgChartRoleSchema.nullable(),
-  /** Raw RBAC role names (e.g. 'owner', 'admin', 'delegate'). Superset of `role`. */
-  roleNames: z.array(z.string()),
-  joinedAt: z.string(),
-  /** ISO timestamp of last activity; null if never recorded. */
-  lastActiveAt: z.string().nullable(),
-  /**
-   * Home org-unit (`users.primary_unit_id`). Null for org-scoped users
-   * (no level-2 home assignment). Used by the unit-detail Members table to
-   * roll up "people in this org-unit" across the subtree.
-   */
-  primaryUnitId: z.string().uuid().nullable(),
-  /** OrgUnit memberships for this member, capped at a small number server-side. */
-  unitMemberships: z.array(WorkspaceMemberUnitSummarySchema),
-  /**
-   * Per-unit org-chart designations the member holds (ADR-CTRL-112). Carries
-   * BOTH management-reach entries (whole_org/admin/unit_owner/delegate) and
-   * plain contributor entries (`member`); consumers split by designation.
-   * Display-only summary; never an authorization input. Empty array when the
-   * member holds no per-unit designation.
-   */
-  unitDesignations: z.array(WorkspaceMemberUnitDesignationEntrySchema),
-  /** True when server truncated `unitMemberships`; detail endpoint returns the full list. */
-  unitMembershipsTruncated: z.boolean(),
-  /** Invite lifecycle status. `null` for members without an invite record. */
-  inviteStatus: z.enum(["active", "pending", "expired"]).nullable(),
-});
-
-const MemberRecentActionSchema = z.object({
-  id: z.string(),
-  timestamp: z.string(),
-  action: z.string(),
-  summary: z.string(),
-});
-
-/**
- * Which bundle or role contributed a resolved scope (ADR-CTRL-360).
- *
- * `member_default` / `admin` / `account_owner` are the static actor-class
- * bundles AUTH-011C re-homed the deleted role scope lists onto (ADR-BE-184);
- * `role:<name>` is a surviving RBAC role assignment. Open string rather than an
- * enum because `rbac_roles` is data, not a closed vocabulary.
- *
- * A scope carries EVERY band that granted it — composition is a union, not a
- * ladder, so an owner who also holds admin authority legitimately shows both.
- * Display/audit only; `effectiveScopes` remains the authorization surface.
- */
-const ScopeProvenanceEntrySchema = z.object({
-  scope: z.string(),
-  bands: z.array(z.string()).min(1),
-});
-
-export const WorkspaceMemberDetailSchema = WorkspaceMemberSchema.extend({
-  effectiveScopes: z.array(z.string()),
-  /**
-   * Per-scope provenance for {@link WorkspaceMemberDetailSchema.shape.effectiveScopes}.
-   * Optional: absence means the server did not compute it (legacy callsite, or a
-   * non-user actor), never that the scopes were granted by nothing.
-   */
-  scopeProvenance: z.array(ScopeProvenanceEntrySchema).optional(),
-  recentActions: z.array(MemberRecentActionSchema),
-});
-
-/**
- * Workspace member for the members list. Human users only (no agent actors).
- * Canonical type — inferred from {@link WorkspaceMemberSchema} so the runtime
- * schema is the single source of truth (no parallel hand-written interface).
- */
-export type WorkspaceMember = z.infer<typeof WorkspaceMemberSchema>;
-
-/**
- * Full member detail (GET /api/workspace/members/:userId and /api/me self-view).
- * Inferred from {@link WorkspaceMemberDetailSchema}.
- */
-export type WorkspaceMemberDetail = z.infer<typeof WorkspaceMemberDetailSchema>;
-
-export const RoleCatalogEntrySchema = z.object({
-  name: z.string(),
-  type: z.enum(["system", "custom"]),
-  description: z.string(),
-  scopes: z.array(z.string()),
-  memberCount: z.number().int().nonnegative(),
-});
-
-export const RoleCatalogResponseSchema = z.object({
-  roles: z.array(RoleCatalogEntrySchema),
-});
-
-const WorkspaceOwnerSchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  email: z.string(),
-});
-
-// ---------------------------------------------------------------------------
-// GET /api/workspace/access
-// ---------------------------------------------------------------------------
-
-export const WorkspaceAccessResponseSchema = z.object({
-  hasAccess: z.boolean(),
-});
-
-export type WorkspaceAccessResponse = z.infer<
-  typeof WorkspaceAccessResponseSchema
->;
-
-// ---------------------------------------------------------------------------
-// GET /api/workspace
-// PATCH /api/workspace/name (returns WorkspaceOverview)
-// ---------------------------------------------------------------------------
-
-/**
- * Icon options for the `owner` org-chart role (ADR-CONT-070). Selected
- * alongside the owner title in the Organization structure editor; `crown` is
- * the default. Presentation only — never an authorization input.
- */
-export const OrgOwnerIconSchema = z.enum([
-  "crown",
-  "crown-cross",
-  "person-simple-run",
-  "person",
-  "medal-military",
-  "dog",
-  "cat",
-  "steering-wheel",
-]);
-
-/**
- * An org's stored marks. See `OrgLogos` for what each slot means and
- * `resolveOrgMark` for the order the square tile prefers them in.
- */
-export const OrgLogosSchema = z.object({
-  appLogoUrl: z.string().nullable(),
-  logoUrl: z.string().nullable(),
-});
-
-export type OrgLogosShape = z.infer<typeof OrgLogosSchema>;
-
-export const WorkspaceOverviewSchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  slug: z.string(),
-  type: z.enum(["personal", "shared"]),
-  /**
-   * The org's two marks. See `OrgLogos` for what each slot means and
-   * `resolveOrgMark` for the order the square tile prefers them in.
-   */
-  logos: OrgLogosSchema,
-  owner: WorkspaceOwnerSchema,
-  /**
-   * Org-configured display title for the `owner` org-chart role
-   * (ADR-CONTRACTS-061). Server-resolved: `orgs.owner_title` when set,
-   * otherwise the default "CEO". Always present; pass to
-   * `orgChartRoleLabel(role, { ownerTitle })` wherever the owner badge or
-   * section heading renders. Presentation only — never an authorization input.
-   */
-  ownerTitle: z.string(),
-  /**
-   * Org-configured icon for the `owner` org-chart role (ADR-CONT-070).
-   * Server-resolved: `orgs.owner_icon` when set, otherwise the default
-   * "crown". Always present. Presentation only — never an authorization input.
-   */
-  ownerIcon: OrgOwnerIconSchema,
-  createdAt: z.string(),
-  memberCount: z.number(),
-  claimable: z.boolean(),
-});
-
-export type OrgOwnerIcon = z.infer<typeof OrgOwnerIconSchema>;
-
-export type WorkspaceOverview = z.infer<typeof WorkspaceOverviewSchema>;
-
-// ---------------------------------------------------------------------------
-// GET /api/workspace/members
-// ---------------------------------------------------------------------------
-
-export const WorkspaceMembersResponseSchema = CursorPageSchema(
-  WorkspaceMemberSchema,
-);
-
-export type WorkspaceMembersResponse = z.infer<
-  typeof WorkspaceMembersResponseSchema
->;
-
-// ---------------------------------------------------------------------------
-// DELETE /api/workspace/members/:id
-// ---------------------------------------------------------------------------
-
-export const RemoveMemberResponseSchema = z.object({
-  success: z.boolean(),
-  memberId: z.string(),
-  memberEmail: z.string(),
-  message: z.string(),
-});
-
-export type RemoveMemberResponse = z.infer<typeof RemoveMemberResponseSchema>;
-
-// ---------------------------------------------------------------------------
-// PATCH /api/workspace/members/:id/role
-// ---------------------------------------------------------------------------
-
-export const ChangeMemberRoleResponseSchema = z.object({
-  success: z.boolean(),
-  memberId: z.string(),
-  memberEmail: z.string(),
-  previousRole: z.string(),
-  newRole: z.string(),
-  message: z.string(),
-});
-
-export type ChangeMemberRoleResponse = z.infer<
-  typeof ChangeMemberRoleResponseSchema
->;
-
-// ---------------------------------------------------------------------------
-// PUT /api/reporting/positions/:positionId/manager
-// ---------------------------------------------------------------------------
-
-/**
- * Response for the one idempotent set-or-clear of a seat's solid-line manager —
- * the reporting edge the org chart is built from. Position-keyed at BOTH ends
- * (ADR-CONTRACTS-131): `reportPositionId` is the seat whose edge moved and
- * `manager` is the POSITION it now reports to, null after a clear. A position
- * names a vacant seat and an accountless occupant's seat just as well as a
- * filled one, which the retired member-or-open-role union could not.
- *
- * `relationshipType` is a literal rather than the identity-domain
- * `ReportingRelationshipTypeSchema`: importing that here would invert the
- * existing people-org-chart → org/schemas dependency and recreate the
- * module-init cycle. This route only ever writes solid edges, so the narrower
- * literal is also the truthful shape. (`PositionReportingRelationshipTypeSchema`
- * in ./position-reporting carries the open {solid, dotted} vocabulary for the
- * read model.)
- *
- * Distinct from team membership (RBAC scopes) and `primary_unit_id` (home
- * unit): neither of those places a person in the reporting hierarchy.
- * See ADR-BE-253.
- */
-export const SetSeatManagerResponseSchema = z.object({
-  success: z.boolean(),
-  reportPositionId: z.string().uuid(),
-  manager: PositionRefSchema.nullable(),
-  relationshipType: z.literal("solid"),
-  message: z.string(),
-});
-
-export type SetSeatManagerResponse = z.infer<
-  typeof SetSeatManagerResponseSchema
->;
-
-// ---------------------------------------------------------------------------
-// POST /api/chat/interactive-tasks/submit
-// ---------------------------------------------------------------------------
-
-/**
- * Response for submitting a filled-in interactive chat task surface (e.g. the
- * editable "change reporting manager" form). The submit endpoint runs the
- * Deterministic Execution & Governance Engine: it creates an execution and,
- * when no further confirmation is required, drives it to execution in the same
- * request. The frontend then drives the surface's lifecycle card off
- * `executionId` (the execution-lifecycle stream), exactly like a confirmation.
- *
- * See ADR-CONTRACTS-068.
- */
-export const SubmitInteractiveTaskResponseSchema = z.object({
-  /** Lifecycle record id created for this submission. */
-  executionId: z.string(),
-  /** Coarse lifecycle status at the time the request returns. */
-  status: z.enum(["executing", "completed", "failed", "pending_confirmation"]),
-});
-
-export type SubmitInteractiveTaskResponse = z.infer<
-  typeof SubmitInteractiveTaskResponseSchema
->;
-
-// ---------------------------------------------------------------------------
-// GET /api/user/orgs
-// ---------------------------------------------------------------------------
-
-const UserOrgMembershipSchema = z.object({
-  userId: z.string(),
-  orgId: z.string(),
-  orgName: z.string(),
-  orgSlug: z.string(),
-  role: OrgChartRoleSchema.nullable(),
-  joinedAt: z.string(),
-  isActive: z.boolean(),
-  orgType: z.enum(["personal", "shared"]),
-});
-
-export const UserOrgsResponseSchema = z.object({
-  orgs: z.array(UserOrgMembershipSchema),
-});
-
-export type UserOrgsResponse = z.infer<typeof UserOrgsResponseSchema>;
-
-// ---------------------------------------------------------------------------
-// POST /api/user/active-org
-// ---------------------------------------------------------------------------
-
-export const SetActiveOrgResponseSchema = z.object({
-  success: z.literal(true),
-  activeOrgId: z.string(),
-});
-
-export type SetActiveOrgResponse = z.infer<typeof SetActiveOrgResponseSchema>;
-
-// ---------------------------------------------------------------------------
-// POST /api/user/orgs/:orgId/leave
-// ---------------------------------------------------------------------------
-
-export const LeaveOrgResponseSchema = z.object({
-  success: z.literal(true),
-  nextOrgId: z.string().nullable(),
-});
-
-export type LeaveOrgResponse = z.infer<typeof LeaveOrgResponseSchema>;
-
-// ---------------------------------------------------------------------------
-// GET /api/scope/check
-// ---------------------------------------------------------------------------
-
-export const ScopeCheckResponseSchema = z.object({
-  hasAccess: z.boolean(),
-});
-
-export type ScopeCheckResponse = z.infer<typeof ScopeCheckResponseSchema>;
-
-// ---------------------------------------------------------------------------
-// POST /api/scope/check-batch
-// ---------------------------------------------------------------------------
-
-export const ScopeCheckBatchResponseSchema = z.object({
-  results: z.record(z.string(), z.object({ hasAccess: z.boolean() })),
-});
-
-export type ScopeCheckBatchResponse = z.infer<
-  typeof ScopeCheckBatchResponseSchema
->;
-
-// =============================================================================
-// Mutation Capabilities (GET /api/capabilities) — ADR-BE-241 / PRD-00707 F4
-// =============================================================================
-// Canonical home for the viewer's resolved mutation-capability projection. The
-// backend derives it (src/capabilities/derive.ts) and validates the response
-// against CapabilitiesResponseSchema via sendValidated; the frontend reads the
-// inferred types to render lock/allow affordances. Previously duplicated as a
-// backend-local Zod + hand-written frontend interfaces — unified here.
-
-/** Scope identifiers are dot-namespaced strings (see backend trust/scopes.ts). */
-const RequiredScopeSchema = z.string();
-
-/** A mutable field's gate: editable, or locked with attribution (sso vs rbac). */
-export const FieldCapabilitySchema = z.object({
-  state: z.enum(["editable", "locked"]),
-  reason: z.enum(["sso", "rbac"]).optional(),
-  requiredScope: RequiredScopeSchema.optional(),
-});
-
-/** An action's gate: allowed, or blocked with the scope that would unlock it. */
-export const ActionCapabilitySchema = z.object({
-  state: z.enum(["allowed", "blocked"]),
-  requiredScope: RequiredScopeSchema.optional(),
-});
-
-/**
- * The single validated capability surface the UI reads. Every sub-object is
- * optional, matching the partial derivation in deriveCapabilities() (actions/org
- * are present only when scopes resolved).
- */
-export const CapabilitiesResponseSchema = z.object({
-  profile: z
-    .object({
-      fullName: FieldCapabilitySchema,
-      preferredName: FieldCapabilitySchema,
-    })
-    .optional(),
-  org: z
-    .object({
-      name: FieldCapabilitySchema,
-    })
-    .optional(),
-  actions: z
-    .object({
-      members: z.object({
-        invite: ActionCapabilitySchema,
-        remove: ActionCapabilitySchema,
-        changeRole: ActionCapabilitySchema,
-      }),
-      orgAdmins: z.object({
-        manage: ActionCapabilitySchema,
-      }),
-      orgUnit: z.object({
-        manage: ActionCapabilitySchema,
-      }),
-      // Entity ownership-transfer overrides (backend ADR-BE-259) +
-      // sharing-management custody (backend ADR-BE-288). Optional so older
-      // backends that don't derive them still validate. manageSharing gates the
-      // admin Share affordance on content the admin may not be able to view.
-      companyMd: z
-        .object({
-          transferOwnership: ActionCapabilitySchema,
-          manageSharing: ActionCapabilitySchema,
-        })
-        .optional(),
-      workItem: z
-        .object({
-          transferOwnership: ActionCapabilitySchema,
-          manageSharing: ActionCapabilitySchema,
-        })
-        .optional(),
-      meetingRecording: z
-        .object({
-          manageSharing: ActionCapabilitySchema,
-        })
-        .optional(),
-    })
-    .optional(),
-  // Gates the chat composer's mention affordance (PRD-00988). Optional for the
-  // same rollout symmetry as the action sub-objects above: a backend that does
-  // not yet derive the flag must still validate its own response, and the spec
-  // already carried the field before this schema did.
-  chatMentions: z.boolean().optional(),
-  // Gates the multi-party chat affordances — the participant header, the invite
-  // flow, speaker labels (PRD-00990/00991). Optional for the same rollout
-  // symmetry as `chatMentions` directly above, and it REQUIRES `chatMentions`:
-  // inviting someone is a mention, so multi-party without mentions is not a
-  // state the backend derives. The two are resolved from ONE flag read, not
-  // two — the capabilities route holds a hard 4-query budget for a P0 own-data
-  // read, and `chatMentions` already took the fourth slot.
-  chatMultiParty: z.boolean().optional(),
-  // Gates every AI affordance at once (PRD-01002). Optional for the same
-  // rollout symmetry as the flags above. It is deliberately a CAPABILITY and
-  // not a billing read: the UI needs to know whether to offer AI and what to
-  // say when it cannot, and nothing more — the balance, the ledger and the
-  // recovery live behind the billing endpoints, which an ordinary member has
-  // no right to. `reason` is the one AiPauseReason a human can act on, and it
-  // is null exactly when `aiPaused` is false.
-  billing: z
-    .object({
-      aiPaused: z.boolean(),
-      reason: z.enum(AI_PAUSE_REASONS).nullable(),
-    })
-    .optional(),
-});
-
-export type FieldCapability = z.infer<typeof FieldCapabilitySchema>;
-export type ActionCapability = z.infer<typeof ActionCapabilitySchema>;
-export type CapabilitiesResponse = z.infer<typeof CapabilitiesResponseSchema>;
+export * from "./workspace-member-schemas";
+export * from "./workspace-overview-schemas";
+export * from "./reporting-write-schemas";
+export * from "./user-org-schemas";
+export * from "./capability-schemas";

package/src/org/user-org-schemas.ts

@@ -0,0 +1,75 @@
+/**
+ * User Org Schemas
+ *
+ * Zod response schemas for a user's orgs (GET /api/user/orgs, POST
+ * /api/user/active-org, /leave) and scope checks (GET /api/scope/check, POST
+ * /api/scope/check-batch). Re-exported from `./schemas`, the one import path
+ * for every org schema.
+ */
+import { z } from "zod";
+import { OrgChartRoleSchema } from "../permissions/orgchart-roles";
+
+// ---------------------------------------------------------------------------
+// GET /api/user/orgs
+// ---------------------------------------------------------------------------
+
+const UserOrgMembershipSchema = z.object({
+  userId: z.string(),
+  orgId: z.string(),
+  orgName: z.string(),
+  orgSlug: z.string(),
+  role: OrgChartRoleSchema.nullable(),
+  joinedAt: z.string(),
+  isActive: z.boolean(),
+  orgType: z.enum(["personal", "shared"]),
+});
+
+export const UserOrgsResponseSchema = z.object({
+  orgs: z.array(UserOrgMembershipSchema),
+});
+
+export type UserOrgsResponse = z.infer<typeof UserOrgsResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// POST /api/user/active-org
+// ---------------------------------------------------------------------------
+
+export const SetActiveOrgResponseSchema = z.object({
+  success: z.literal(true),
+  activeOrgId: z.string(),
+});
+
+export type SetActiveOrgResponse = z.infer<typeof SetActiveOrgResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// POST /api/user/orgs/:orgId/leave
+// ---------------------------------------------------------------------------
+
+export const LeaveOrgResponseSchema = z.object({
+  success: z.literal(true),
+  nextOrgId: z.string().nullable(),
+});
+
+export type LeaveOrgResponse = z.infer<typeof LeaveOrgResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// GET /api/scope/check
+// ---------------------------------------------------------------------------
+
+export const ScopeCheckResponseSchema = z.object({
+  hasAccess: z.boolean(),
+});
+
+export type ScopeCheckResponse = z.infer<typeof ScopeCheckResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// POST /api/scope/check-batch
+// ---------------------------------------------------------------------------
+
+export const ScopeCheckBatchResponseSchema = z.object({
+  results: z.record(z.string(), z.object({ hasAccess: z.boolean() })),
+});
+
+export type ScopeCheckBatchResponse = z.infer<
+  typeof ScopeCheckBatchResponseSchema
+>;