@getpara/shared 1.29.0 → 1.31.0

package/dist/cjs/schemas/permissionsV2.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.permissionsV2ValidationErrorSchema = exports.permissionsV2DelegationConsentDiscoveryResponseSchema = exports.permissionsV2DelegationConsentRequestSchema = exports.permissionsV2DelegationConsentViewSchema = exports.permissionsV2DelegationConsentStandingMutationSchema = exports.permissionsV2DelegationConsentMutationSchema = exports.permissionsV2DelegationConsentApiStatusSchema = exports.permissionsV2DelegationPolicyDefinitionSchema = exports.permissionsV2PartnerAuthoredPolicyDefinitionSchema = exports.permissionsV2PartnerPolicyCandidateSchema = exports.permissionsV2PolicyRuleSchema = exports.permissionsV2PartnerPolicyMetadataSchema = exports.permissionsV2PolicyMetadataSchema = exports.permissionsV2PartnerAuthoredPolicySelectorSchema = exports.permissionsV2ConditionSchema = exports.policyAuthoringJsonObjectSchema = exports.policyAuthoringJsonValueSchema = exports.policyAuthoringJsonPrimitiveSchema = exports.permissionsV2SigningRequestTypeSchema = exports.permissionsV2SigningRequestRouteSchema = exports.permissionsV2SigningWalletTypeSchema = exports.permissionsV2AggregateOperatorSchema = exports.permissionsV2CompareOperatorSchema = exports.permissionsV2PolicyEffectSchema = exports.permissionsV2PolicyModeSchema = exports.permissionsV2PolicyLayerSchema = exports.permissionsV2SigningRequestTypes = exports.policyAuthoringSigningRequestRoutes = exports.policyAuthoringSigningWalletTypes = void 0;
+exports.permissionsV2DelegationConsentViewSchema = exports.permissionsV2DelegationConsentSubmissionSchema = exports.permissionsV2DelegationConsentStandingRouteMutationSchema = exports.permissionsV2DelegationConsentNativeStandingMutationSchema = exports.permissionsV2DelegationConsentStandingMutationSchema = exports.permissionsV2DelegationConsentMutationSchema = exports.permissionsV2DelegationConsentApiStatusSchema = exports.permissionsV2DelegationPolicyDefinitionSchema = exports.permissionsV2PartnerAuthoredPolicyDefinitionSchema = exports.permissionsV2PartnerPolicyCandidateSchema = exports.permissionsV2PolicyRuleSchema = exports.permissionsV2ConditionalApprovalCaseListSchema = exports.permissionsV2TransactionSignatureCollectionSchema = exports.permissionsV2ConditionalApprovalSignatureSchema = exports.permissionsV2ConditionalApprovalDecisionSchema = exports.permissionsV2AuthorizationConfigurationViewSchema = exports.permissionsV2AuthorizationConfigurationWriteSchema = exports.permissionsV2AuthorizationScopeBindingViewSchema = exports.permissionsV2AuthorizationScopeBindingWriteSchema = exports.permissionsV2AuthoritySetViewSchema = exports.permissionsV2AuthoritySetWriteSchema = exports.permissionsV2AuthorityAssignmentSchema = exports.permissionsV2ConditionalApprovalCaseViewSchema = exports.permissionsV2ConditionalApprovalRequirementIdentitySchema = exports.permissionsV2ConditionalApprovalDecisionCapabilitySchema = exports.permissionsV2ConditionalApprovalDecisionUnavailableReasonSchema = exports.permissionsV2ConditionalApprovalCaseStatusSchema = exports.permissionsV2ConditionalApprovalRequirementSchema = exports.permissionsV2ConditionalApprovalSafeKnobSchema = exports.permissionsV2ConditionalApprovalStageSchema = exports.permissionsV2ConditionalApprovalEligibilitySchema = exports.permissionsV2PartnerPolicyMetadataSchema = exports.permissionsV2PolicyMetadataSchema = exports.permissionsV2PartnerAuthoredPolicySelectorSchema = exports.permissionsV2ConditionSchema = exports.policyAuthoringJsonObjectSchema = exports.policyAuthoringJsonValueSchema = exports.policyAuthoringJsonPrimitiveSchema = exports.permissionsV2SigningRequestTypeSchema = exports.permissionsV2SigningRequestRouteSchema = exports.permissionsV2SigningWalletTypeSchema = exports.permissionsV2AggregateOperatorSchema = exports.permissionsV2CompareOperatorSchema = exports.permissionsV2PolicyEffectSchema = exports.permissionsV2PolicyModeSchema = exports.permissionsV2PolicyLayerSchema = exports.permissionsV2ParameterDeclarationSchema = exports.permissionsV2SigningRequestTypes = exports.policyAuthoringSigningRequestRoutes = exports.policyAuthoringSigningWalletTypes = void 0;
+exports.permissionsV2ValidationErrorSchema = exports.permissionsV2DelegationConsentDiscoveryResponseSchema = exports.permissionsV2DelegationConsentSubmissionResponseSchema = exports.permissionsV2DelegationConsentRequestSchema = void 0;
 const zod_1 = require("zod");
-exports.policyAuthoringSigningWalletTypes = ['EVM'];
+const permissionsV2UserParameters_js_1 = require("./permissionsV2UserParameters.js");
+exports.policyAuthoringSigningWalletTypes = ['EVM', 'SOLANA', 'COSMOS', 'STELLAR', 'SUI'];
 exports.policyAuthoringSigningRequestRoutes = [
     'evm.sign_transaction',
     'evm.sign_raw',
@@ -10,6 +12,10 @@ exports.policyAuthoringSigningRequestRoutes = [
     'evm.sign_authorization',
     'evm.sign_message',
     'smart_account.user_operation',
+    'solana.sign_transaction',
+    'cosmos.sign_transaction',
+    'stellar.sign_transaction',
+    'sui.sign_transaction',
 ];
 exports.permissionsV2SigningRequestTypes = [
     'evm_transaction',
@@ -18,8 +24,20 @@ exports.permissionsV2SigningRequestTypes = [
     'evm_typed_data',
     'evm_authorization',
     'smart_account_user_operation',
+    'solana_transaction',
+    'cosmos_transaction',
+    'cosmos_message',
+    'stellar_transaction',
+    'sui_transaction',
+    'raw_message',
 ];
 const nonEmptyStringSchema = zod_1.z.string().min(1);
+exports.permissionsV2ParameterDeclarationSchema = zod_1.z
+    .object({
+    id: nonEmptyStringSchema,
+    label: nonEmptyStringSchema,
+})
+    .strict();
 const uniqueNonEmptyStringsSchema = zod_1.z
     .array(nonEmptyStringSchema)
     .min(1)
@@ -51,6 +69,7 @@ exports.permissionsV2ConditionSchema = zod_1.z.lazy(() => zod_1.z.discriminatedU
         fact: nonEmptyStringSchema,
         op: exports.permissionsV2CompareOperatorSchema,
         value: exports.policyAuthoringJsonValueSchema,
+        parameter: exports.permissionsV2ParameterDeclarationSchema.optional(),
     })
         .strict(),
     zod_1.z
@@ -61,6 +80,7 @@ exports.permissionsV2ConditionSchema = zod_1.z.lazy(() => zod_1.z.discriminatedU
         value: nonEmptyStringSchema,
         window: nonEmptyStringSchema,
         asset: nonEmptyStringSchema.optional(),
+        parameter: exports.permissionsV2ParameterDeclarationSchema.optional(),
     })
         .strict(),
     zod_1.z
@@ -82,7 +102,7 @@ exports.permissionsV2ConditionSchema = zod_1.z.lazy(() => zod_1.z.discriminatedU
     })
         .strict(),
 ]));
-exports.permissionsV2PartnerAuthoredPolicySelectorSchema = zod_1.z
+const permissionsV2PartnerAuthoredPolicySelectorObjectSchema = zod_1.z
     .object({
     walletId: nonEmptyStringSchema.optional(),
     chainId: zod_1.z.union([nonEmptyStringSchema, uniqueNonEmptyStringsSchema]).optional(),
@@ -91,6 +111,7 @@ exports.permissionsV2PartnerAuthoredPolicySelectorSchema = zod_1.z
     requestType: exports.permissionsV2SigningRequestTypeSchema.optional(),
 })
     .strict();
+exports.permissionsV2PartnerAuthoredPolicySelectorSchema = permissionsV2PartnerAuthoredPolicySelectorObjectSchema;
 exports.permissionsV2PolicyMetadataSchema = zod_1.z
     .object({
     label: zod_1.z.string().optional(),
@@ -102,19 +123,544 @@ exports.permissionsV2PolicyMetadataSchema = zod_1.z
 exports.permissionsV2PartnerPolicyMetadataSchema = exports.permissionsV2PolicyMetadataSchema.extend({
     productMode: exports.permissionsV2PolicyModeSchema,
 });
+const conditionalApprovalNameSchema = zod_1.z
+    .string()
+    .trim()
+    .min(1)
+    .max(64)
+    .refine((value) => value === value.normalize('NFKC'), {
+    message: 'names must use normalized Unicode',
+});
+const conditionalApprovalIdentifierSchema = zod_1.z.string().trim().min(1).max(64);
+const conditionalApprovalActorIdSchema = zod_1.z.string().trim().min(1).max(128);
+const conditionalApprovalRequestIdSchema = zod_1.z.string().trim().min(1).max(256);
+exports.permissionsV2ConditionalApprovalEligibilitySchema = zod_1.z.union([
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('role'),
+        name: conditionalApprovalNameSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('attribute'),
+        name: conditionalApprovalNameSchema,
+        operator: zod_1.z.literal('eq'),
+        value: conditionalApprovalNameSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('attribute'),
+        name: conditionalApprovalNameSchema,
+        operator: zod_1.z.literal('in'),
+        values: zod_1.z
+            .array(conditionalApprovalNameSchema)
+            .min(1)
+            .refine((values) => new Set(values).size === values.length, {
+            message: 'attribute values must be unique',
+        }),
+    })
+        .strict(),
+]);
+const conditionalApprovalEligibilityListSchema = zod_1.z
+    .array(exports.permissionsV2ConditionalApprovalEligibilitySchema)
+    .min(1)
+    .max(10)
+    .refine((eligibility) => new Set(eligibility.map((clause) => JSON.stringify(clause))).size === eligibility.length, {
+    message: 'eligibility clauses must be unique',
+});
+exports.permissionsV2ConditionalApprovalStageSchema = zod_1.z
+    .object({
+    id: conditionalApprovalIdentifierSchema,
+    requiredApprovals: zod_1.z.union([zod_1.z.number().int().min(1).max(25), zod_1.z.literal('all')]),
+    eligibility: conditionalApprovalEligibilityListSchema,
+    minimumAmount: zod_1.z
+        .string()
+        .regex(/^(0|[1-9][0-9]*)$/)
+        .optional(),
+})
+    .strict();
+const conditionalApprovalRequiredCountKnobSchema = zod_1.z
+    .object({
+    id: conditionalApprovalIdentifierSchema,
+    kind: zod_1.z.literal('required_approvals'),
+    stageId: conditionalApprovalIdentifierSchema,
+    min: zod_1.z.number().int().min(1).max(25),
+    max: zod_1.z.number().int().min(1).max(25),
+})
+    .strict()
+    .refine((knob) => knob.min <= knob.max, { message: 'minimum required approvals must not exceed maximum' });
+const conditionalApprovalEligibleGroupOptionSchema = zod_1.z
+    .object({
+    id: conditionalApprovalIdentifierSchema,
+    eligibility: conditionalApprovalEligibilityListSchema,
+})
+    .strict();
+const conditionalApprovalEligibleGroupKnobSchema = zod_1.z
+    .object({
+    id: conditionalApprovalIdentifierSchema,
+    kind: zod_1.z.literal('eligible_group'),
+    stageId: conditionalApprovalIdentifierSchema,
+    defaultOptionId: conditionalApprovalIdentifierSchema,
+    options: zod_1.z
+        .array(conditionalApprovalEligibleGroupOptionSchema)
+        .min(1)
+        .max(25)
+        .refine((options) => new Set(options.map((option) => option.id)).size === options.length, {
+        message: 'eligible group option identifiers must be unique',
+    }),
+})
+    .strict();
+exports.permissionsV2ConditionalApprovalSafeKnobSchema = zod_1.z.union([
+    conditionalApprovalRequiredCountKnobSchema,
+    conditionalApprovalEligibleGroupKnobSchema,
+    zod_1.z
+        .object({
+        id: conditionalApprovalIdentifierSchema,
+        kind: zod_1.z.literal('minimum_amount'),
+        stageId: conditionalApprovalIdentifierSchema,
+    })
+        .strict(),
+]);
+exports.permissionsV2ConditionalApprovalRequirementSchema = zod_1.z
+    .object({
+    id: conditionalApprovalIdentifierSchema,
+    evidence: zod_1.z.enum(['authenticated_approval', 'transaction_signature']).optional(),
+    amountFact: zod_1.z.enum(['request.value.baseUnits', 'request.token.value.baseUnits']).optional(),
+    stages: zod_1.z
+        .array(exports.permissionsV2ConditionalApprovalStageSchema)
+        .min(1)
+        .max(5)
+        .refine((stages) => new Set(stages.map((stage) => stage.id)).size === stages.length, {
+        message: 'stage identifiers must be unique',
+    }),
+    configurationManagerEligibility: conditionalApprovalEligibilityListSchema.optional(),
+    safeKnobs: zod_1.z
+        .array(exports.permissionsV2ConditionalApprovalSafeKnobSchema)
+        .min(1)
+        .refine((knobs) => new Set(knobs.map((knob) => knob.id)).size === knobs.length, {
+        message: 'safe knob identifiers must be unique',
+    })
+        .optional(),
+})
+    .strict()
+    .superRefine((requirement, context) => {
+    const stagesById = new Map(requirement.stages.map((stage) => [stage.id, stage]));
+    const configuredStageIds = new Set();
+    const hasBands = requirement.stages.some((stage) => stage.minimumAmount !== undefined);
+    if (hasBands !== (requirement.amountFact !== undefined)) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['amountFact'],
+            message: 'amount bands require an explicit amount fact',
+        });
+    }
+    let previousAmount = BigInt(0);
+    requirement.stages.forEach((stage, index) => {
+        if (index === 0) {
+            if (stage.minimumAmount !== undefined) {
+                context.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: ['stages', index, 'minimumAmount'],
+                    message: 'the first stage must apply to every amount',
+                });
+            }
+            return;
+        }
+        if (!hasBands)
+            return;
+        if (stage.minimumAmount === undefined ||
+            !/^(0|[1-9][0-9]*)$/.test(stage.minimumAmount) ||
+            BigInt(stage.minimumAmount) <= previousAmount) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['stages', index, 'minimumAmount'],
+                message: 'stage amount thresholds must be positive and strictly increasing',
+            });
+        }
+        else {
+            previousAmount = BigInt(stage.minimumAmount);
+        }
+    });
+    requirement.safeKnobs?.forEach((knob, index) => {
+        const stage = stagesById.get(knob.stageId);
+        if (stage === undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['safeKnobs', index, 'stageId'],
+                message: 'safe knob must reference an existing stage',
+            });
+            return;
+        }
+        const settingKey = `${knob.stageId}:${knob.kind === 'minimum_amount' ? 'amount' : 'participation'}`;
+        if (configuredStageIds.has(settingKey)) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['safeKnobs', index, 'stageId'],
+                message: 'a stage may expose one participation setting and one amount threshold',
+            });
+        }
+        configuredStageIds.add(settingKey);
+        if (knob.kind === 'minimum_amount') {
+            if (stage.minimumAmount === undefined) {
+                context.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: ['safeKnobs', index, 'stageId'],
+                    message: 'amount settings must reference a declared stage threshold',
+                });
+            }
+            return;
+        }
+        if (knob.kind === 'required_approvals') {
+            if (typeof stage.requiredApprovals !== 'number') {
+                context.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: ['safeKnobs', index, 'stageId'],
+                    message: 'required count ranges apply only to numeric approval counts',
+                });
+            }
+            else if (stage.requiredApprovals < knob.min || stage.requiredApprovals > knob.max) {
+                context.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: ['safeKnobs', index],
+                    message: 'the published approval count must be within the configurable range',
+                });
+            }
+            return;
+        }
+        const defaultOption = knob.options.find((option) => option.id === knob.defaultOptionId);
+        if (defaultOption === undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['safeKnobs', index, 'defaultOptionId'],
+                message: 'default group must reference a declared option',
+            });
+        }
+        else if (JSON.stringify(defaultOption.eligibility) !== JSON.stringify(stage.eligibility)) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['safeKnobs', index, 'defaultOptionId'],
+                message: 'default group must match the published stage eligibility',
+            });
+        }
+    });
+});
+exports.permissionsV2ConditionalApprovalCaseStatusSchema = zod_1.z.enum([
+    'pending',
+    'completed',
+    'rejected',
+    'expired',
+    'invalidated',
+]);
+exports.permissionsV2ConditionalApprovalDecisionUnavailableReasonSchema = zod_1.z.enum([
+    'not_eligible',
+    'initiator',
+    'already_decided',
+    'case_terminal',
+    'authority_changed',
+]);
+exports.permissionsV2ConditionalApprovalDecisionCapabilitySchema = zod_1.z.discriminatedUnion('canDecide', [
+    zod_1.z
+        .object({
+        canDecide: zod_1.z.literal(true),
+        intents: zod_1.z.tuple([zod_1.z.literal('approve'), zod_1.z.literal('reject')]),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        canDecide: zod_1.z.literal(false),
+        reason: exports.permissionsV2ConditionalApprovalDecisionUnavailableReasonSchema,
+    })
+        .strict(),
+]);
+exports.permissionsV2ConditionalApprovalRequirementIdentitySchema = zod_1.z
+    .object({
+    requirementId: conditionalApprovalIdentifierSchema,
+    policyId: conditionalApprovalIdentifierSchema,
+    policyVersion: conditionalApprovalIdentifierSchema,
+    ruleId: conditionalApprovalIdentifierSchema,
+    stackHash: zod_1.z.string().min(1),
+    authorizationScopeId: conditionalApprovalActorIdSchema,
+    configurationHash: zod_1.z.string().min(1).optional(),
+})
+    .strict();
+const conditionalApprovalCaseStageViewSchema = zod_1.z
+    .object({
+    id: conditionalApprovalIdentifierSchema,
+    requiredApprovals: zod_1.z.number().int().min(1).max(25),
+    eligibleActorCount: zod_1.z.number().int().min(1).max(100),
+    approvedActorIds: zod_1.z
+        .array(conditionalApprovalActorIdSchema)
+        .refine((actorIds) => new Set(actorIds).size === actorIds.length, {
+        message: 'approved actor identifiers must be unique',
+    }),
+})
+    .strict();
+const conditionalApprovalRequestArgsSchema = zod_1.z
+    .record(conditionalApprovalIdentifierSchema, zod_1.z.string().min(1).max(512))
+    .refine((args) => Object.keys(args).length <= 25, {
+    message: 'request summaries may include at most twenty-five arguments',
+});
+exports.permissionsV2ConditionalApprovalCaseViewSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal('conditional_approval'),
+    caseId: conditionalApprovalIdentifierSchema,
+    status: exports.permissionsV2ConditionalApprovalCaseStatusSchema,
+    evidence: zod_1.z.enum(['authenticated_approval', 'transaction_signature']).optional(),
+    request: zod_1.z
+        .object({
+        id: conditionalApprovalRequestIdSchema,
+        requestHash: nonEmptyStringSchema,
+        walletId: nonEmptyStringSchema,
+        requestType: exports.permissionsV2SigningRequestTypeSchema,
+        chainId: nonEmptyStringSchema.optional(),
+        classification: nonEmptyStringSchema,
+        // Signature collections expose only an encoded source; some native payloads have none.
+        from: nonEmptyStringSchema.optional(),
+        to: nonEmptyStringSchema.optional(),
+        value: zod_1.z
+            .object({
+            baseUnits: zod_1.z.string().regex(/^(0|[1-9][0-9]*)$/),
+            asset: nonEmptyStringSchema.optional(),
+            decimals: zod_1.z.number().int().nonnegative().optional(),
+        })
+            .strict()
+            .optional(),
+        method: zod_1.z.string().min(1).max(256).optional(),
+        payloadDigest: zod_1.z.string().min(1).max(256).optional(),
+        args: conditionalApprovalRequestArgsSchema.optional(),
+    })
+        .strict(),
+    requirementIdentity: exports.permissionsV2ConditionalApprovalRequirementIdentitySchema,
+    currentStageIndex: zod_1.z.number().int().nonnegative(),
+    stages: zod_1.z.array(conditionalApprovalCaseStageViewSchema).min(1).max(5),
+    decisions: zod_1.z
+        .array(zod_1.z
+        .object({
+        actorId: conditionalApprovalActorIdSchema,
+        stageId: conditionalApprovalIdentifierSchema,
+        intent: zod_1.z.enum(['approve', 'reject']),
+        decidedAt: zod_1.z.string().datetime(),
+    })
+        .strict())
+        .max(126),
+    expiresAt: zod_1.z.string().datetime(),
+    terminalReason: zod_1.z.string().min(1).optional(),
+    decision: exports.permissionsV2ConditionalApprovalDecisionCapabilitySchema,
+})
+    .strict();
+exports.permissionsV2AuthorityAssignmentSchema = zod_1.z.union([
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('role'),
+        name: conditionalApprovalNameSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('attribute'),
+        name: conditionalApprovalNameSchema,
+        value: conditionalApprovalNameSchema,
+    })
+        .strict(),
+]);
+const conditionalApprovalRevisionSchema = zod_1.z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const conditionalApprovalChangeActorSchema = zod_1.z
+    .object({
+    type: zod_1.z.enum(['partner_secret', 'configuration_manager']),
+    id: conditionalApprovalActorIdSchema,
+})
+    .strict();
+exports.permissionsV2AuthoritySetWriteSchema = zod_1.z
+    .object({
+    expectedRevision: conditionalApprovalRevisionSchema,
+    assignments: zod_1.z
+        .array(exports.permissionsV2AuthorityAssignmentSchema)
+        .max(25)
+        .refine((assignments) => new Set(assignments.map((assignment) => JSON.stringify(assignment))).size === assignments.length, {
+        message: 'authority assignments must be unique',
+    }),
+})
+    .strict();
+exports.permissionsV2AuthoritySetViewSchema = zod_1.z
+    .object({
+    userId: conditionalApprovalActorIdSchema,
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    authorizationScopeId: conditionalApprovalActorIdSchema,
+    revision: zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    assignments: zod_1.z.array(exports.permissionsV2AuthorityAssignmentSchema).max(25),
+    changedAt: zod_1.z.string().datetime(),
+    changedBy: conditionalApprovalChangeActorSchema,
+})
+    .strict();
+exports.permissionsV2AuthorizationScopeBindingWriteSchema = zod_1.z
+    .object({
+    expectedRevision: conditionalApprovalRevisionSchema,
+    authorizationScopeId: conditionalApprovalActorIdSchema,
+})
+    .strict();
+exports.permissionsV2AuthorizationScopeBindingViewSchema = zod_1.z
+    .object({
+    walletId: nonEmptyStringSchema,
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    authorizationScopeId: conditionalApprovalActorIdSchema,
+    revision: zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    changedAt: zod_1.z.string().datetime(),
+    changedBy: conditionalApprovalChangeActorSchema,
+})
+    .strict();
+const conditionalApprovalConfigurationValuesSchema = zod_1.z
+    .record(conditionalApprovalIdentifierSchema, zod_1.z.union([zod_1.z.string(), zod_1.z.number().int()]))
+    .refine((values) => Object.keys(values).length <= 25, {
+    message: 'conditional approval configuration may contain at most 25 values',
+});
+exports.permissionsV2AuthorizationConfigurationWriteSchema = zod_1.z
+    .object({
+    expectedRevision: conditionalApprovalRevisionSchema,
+    values: conditionalApprovalConfigurationValuesSchema,
+})
+    .strict();
+exports.permissionsV2AuthorizationConfigurationViewSchema = zod_1.z
+    .object({
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    authorizationScopeId: conditionalApprovalActorIdSchema,
+    policyId: conditionalApprovalIdentifierSchema,
+    policyVersion: conditionalApprovalIdentifierSchema,
+    requirementId: conditionalApprovalIdentifierSchema,
+    revision: zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    values: conditionalApprovalConfigurationValuesSchema,
+    configurationHash: nonEmptyStringSchema,
+    changedAt: zod_1.z.string().datetime(),
+    changedBy: conditionalApprovalChangeActorSchema,
+})
+    .strict();
+exports.permissionsV2ConditionalApprovalDecisionSchema = zod_1.z
+    .object({
+    intent: zod_1.z.enum(['approve', 'reject']),
+})
+    .strict();
+exports.permissionsV2ConditionalApprovalSignatureSchema = zod_1.z
+    .object({
+    walletId: zod_1.z.string().min(1).max(128),
+    signature: zod_1.z.string().min(1).max(512),
+})
+    .strict();
+/** Original transaction payloads for signature collection, not caller-provided policy facts. */
+exports.permissionsV2TransactionSignatureCollectionSchema = zod_1.z
+    .object({
+    requestId: zod_1.z.string().min(1).max(128),
+    walletId: zod_1.z.string().uuid(),
+    transaction: zod_1.z.discriminatedUnion('format', [
+        zod_1.z
+            .object({
+            format: zod_1.z.literal('safe_eip712'),
+            typedDataJson: zod_1.z.string().min(1).max(131072),
+            chainId: zod_1.z
+                .string()
+                .regex(/^[1-9][0-9]*$/)
+                .max(78),
+        })
+            .strict(),
+        zod_1.z
+            .object({
+            format: zod_1.z.literal('evm_typed_data'),
+            typedDataJson: zod_1.z.string().min(1).max(131072),
+            chainId: zod_1.z
+                .string()
+                .regex(/^[1-9][0-9]*$/)
+                .max(78),
+        })
+            .strict(),
+        zod_1.z
+            .object({
+            format: zod_1.z.literal('evm_transaction'),
+            transactionBase64: zod_1.z.string().min(1).max(131072),
+            chainId: zod_1.z
+                .string()
+                .regex(/^[1-9][0-9]*$/)
+                .max(78),
+        })
+            .strict(),
+        zod_1.z
+            .object({
+            format: zod_1.z.literal('solana_transaction'),
+            transactionBase64: zod_1.z.string().min(1).max(131072),
+        })
+            .strict(),
+        zod_1.z
+            .object({
+            format: zod_1.z.literal('cosmos_transaction'),
+            signMode: zod_1.z.enum(['DIRECT', 'AMINO']),
+            signDocBase64: zod_1.z.string().min(1).max(131072),
+        })
+            .strict(),
+        zod_1.z
+            .object({
+            format: zod_1.z.literal('stellar_xdr'),
+            transactionXdr: zod_1.z.string().min(1).max(131072),
+            networkPassphrase: zod_1.z.string().min(1).max(256),
+        })
+            .strict(),
+        zod_1.z
+            .object({
+            format: zod_1.z.literal('sui_transaction'),
+            transactionBase64: zod_1.z.string().min(1).max(131072),
+        })
+            .strict(),
+    ]),
+})
+    .strict();
+exports.permissionsV2ConditionalApprovalCaseListSchema = zod_1.z
+    .object({
+    cases: zod_1.z.array(exports.permissionsV2ConditionalApprovalCaseViewSchema),
+})
+    .strict();
 exports.permissionsV2PolicyRuleSchema = zod_1.z
     .object({
     id: nonEmptyStringSchema,
     effect: exports.permissionsV2PolicyEffectSchema,
     when: exports.permissionsV2ConditionSchema,
+    approvalRequirement: exports.permissionsV2ConditionalApprovalRequirementSchema.optional(),
 })
-    .strict();
+    .strict()
+    .superRefine((rule, context) => {
+    if (rule.approvalRequirement !== undefined && rule.effect !== 'require_approval') {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['approvalRequirement'],
+            message: 'structured approval requirements are only valid for require_approval rules',
+        });
+    }
+});
+const permissionsV2PolicyRulesSchema = zod_1.z
+    .array(exports.permissionsV2PolicyRuleSchema)
+    .min(1)
+    .superRefine((rules, context) => {
+    const requirementIds = new Set();
+    rules.forEach((rule, index) => {
+        const requirementId = rule.approvalRequirement?.id;
+        if (requirementId === undefined)
+            return;
+        if (requirementIds.has(requirementId)) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: [index, 'approvalRequirement', 'id'],
+                message: 'approval requirement identifiers must be unique within a policy',
+            });
+        }
+        requirementIds.add(requirementId);
+    });
+});
 const partnerPolicyCandidateFields = {
     id: nonEmptyStringSchema,
     schemaVersion: zod_1.z.literal('permissions.policy.v1'),
     version: nonEmptyStringSchema,
     selector: exports.permissionsV2PartnerAuthoredPolicySelectorSchema,
-    rules: zod_1.z.array(exports.permissionsV2PolicyRuleSchema).min(1),
+    rules: permissionsV2PolicyRulesSchema,
     metadata: exports.permissionsV2PolicyMetadataSchema.optional(),
 };
 exports.permissionsV2PartnerPolicyCandidateSchema = zod_1.z.object(partnerPolicyCandidateFields).strict();
@@ -123,7 +669,7 @@ exports.permissionsV2PartnerAuthoredPolicyDefinitionSchema = exports.permissions
 });
 exports.permissionsV2DelegationPolicyDefinitionSchema = exports.permissionsV2PartnerAuthoredPolicyDefinitionSchema.extend({
     layer: zod_1.z.literal('partner'),
-    selector: exports.permissionsV2PartnerAuthoredPolicySelectorSchema.extend({
+    selector: permissionsV2PartnerAuthoredPolicySelectorObjectSchema.extend({
         partnerId: nonEmptyStringSchema,
         appId: nonEmptyStringSchema,
     }),
@@ -145,6 +691,7 @@ exports.permissionsV2DelegationConsentMutationSchema = zod_1.z
     walletId: nonEmptyStringSchema,
     policyVersion: nonEmptyStringSchema,
     policyHash: nonEmptyStringSchema,
+    configurationHash: nonEmptyStringSchema.optional(),
     expiresAt: zod_1.z.string().datetime().optional(),
 })
     .strict();
@@ -153,6 +700,23 @@ exports.permissionsV2DelegationConsentStandingMutationSchema = exports.permissio
     pendingTransactionId: nonEmptyStringSchema,
 })
     .strict();
+exports.permissionsV2DelegationConsentNativeStandingMutationSchema = exports.permissionsV2DelegationConsentMutationSchema
+    .extend({
+    requestId: exports.permissionsV2TransactionSignatureCollectionSchema.shape.requestId,
+    walletId: exports.permissionsV2TransactionSignatureCollectionSchema.shape.walletId,
+    transaction: exports.permissionsV2TransactionSignatureCollectionSchema.shape.transaction,
+})
+    .strict();
+exports.permissionsV2DelegationConsentStandingRouteMutationSchema = zod_1.z.union([
+    exports.permissionsV2DelegationConsentStandingMutationSchema,
+    exports.permissionsV2DelegationConsentNativeStandingMutationSchema,
+]);
+/** Explicit owner consent, optionally committed together with personal settings. */
+exports.permissionsV2DelegationConsentSubmissionSchema = exports.permissionsV2DelegationConsentMutationSchema.extend({
+    posture: zod_1.z.enum(['standing', 'manual_review']),
+    pendingTransactionId: nonEmptyStringSchema.optional(),
+    settings: permissionsV2UserParameters_js_1.permissionsV2UserParameterSaveSchema.pick({ expectedRevision: true, values: true }).optional(),
+});
 exports.permissionsV2DelegationConsentViewSchema = zod_1.z
     .object({
     status: exports.permissionsV2DelegationConsentApiStatusSchema,
@@ -163,6 +727,7 @@ exports.permissionsV2DelegationConsentViewSchema = zod_1.z
     policyId: nonEmptyStringSchema,
     policyVersion: nonEmptyStringSchema,
     policyHash: nonEmptyStringSchema,
+    configurationHash: nonEmptyStringSchema.optional(),
     grantedAt: zod_1.z.string().datetime().optional(),
     expiresAt: zod_1.z.string().datetime().optional(),
     revokedAt: zod_1.z.string().datetime().optional(),
@@ -174,6 +739,12 @@ exports.permissionsV2DelegationConsentRequestSchema = zod_1.z
     consent: exports.permissionsV2DelegationConsentViewSchema,
 })
     .strict();
+exports.permissionsV2DelegationConsentSubmissionResponseSchema = zod_1.z
+    .object({
+    consent: exports.permissionsV2DelegationConsentViewSchema,
+    settings: permissionsV2UserParameters_js_1.permissionsV2UserParameterViewSchema.nullable(),
+})
+    .strict();
 exports.permissionsV2DelegationConsentDiscoveryResponseSchema = zod_1.z
     .object({
     requests: zod_1.z.array(exports.permissionsV2DelegationConsentRequestSchema),