@oxy.so/contracts 4.17.0 → 4.21.0

package/dist/esm/applicationRoles.js

@@ -0,0 +1,207 @@
+/**
+ * Application roles — the wire contract for permissions an APPLICATION declares
+ * about its own users, and for the grants that give them to Oxy users.
+ *
+ * Oxy decides who holds an app's operator powers (who may run Mercaria's
+ * payments desk, moderate GoWay, administer Homiio), so no app keeps an
+ * allow-list of Oxy user ids in its environment. The app declares a closed
+ * vocabulary of keys, its owners grant them to people, and the app's backend
+ * asks Oxy which of them the human behind a request holds
+ * (`GET /applications/:appId/roles/me`, read through `@oxy.so/core/server`).
+ *
+ * ## Why an application key can never collide with an Oxy permission
+ *
+ * Every permission Oxy itself checks (`app:update`, `apps:create`,
+ * `credentials:rotate`, every scope) is spelled with a COLON. An application key
+ * is dot-separated lowercase segments and cannot contain one, so the two
+ * vocabularies are disjoint by syntax, not by convention. They are also stored
+ * apart (scoped to one application id) and no Oxy gate ever reads an
+ * application key. A key means something only to the application that declared
+ * it.
+ *
+ * The pattern is exported as a SOURCE string because the API renders the same
+ * text into a Postgres CHECK; JavaScript's `RegExp` and Postgres' ARE agree on
+ * everything it uses (anchors, classes, a capturing group, a bounded repeat).
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo.
+ */
+import { z } from 'zod';
+/**
+ * Two to four dot-separated segments, each a lowercase letter followed by
+ * lowercase letters, digits or underscores: `payments.operate`,
+ * `catalog.review.publish`. At least two segments so a key always names an
+ * area and an action; never a colon (see the header).
+ */
+export const APPLICATION_PERMISSION_KEY_PATTERN_SOURCE = '^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*){1,3}$';
+export const APPLICATION_PERMISSION_KEY_PATTERN = new RegExp(APPLICATION_PERMISSION_KEY_PATTERN_SOURCE);
+export const APPLICATION_PERMISSION_KEY_MAX_LENGTH = 64;
+export const APPLICATION_PERMISSION_DESCRIPTION_MAX_LENGTH = 280;
+/** How many live keys one application may declare. Operator powers are few. */
+export const APPLICATION_PERMISSIONS_MAX_DECLARED = 64;
+export const APPLICATION_ROLE_REASON_MAX_LENGTH = 500;
+export const APPLICATION_ROLE_GRANTS_PAGE_DEFAULT = 50;
+export const APPLICATION_ROLE_GRANTS_PAGE_MAX = 200;
+/**
+ * The `error` codes the application-roles routes answer beyond the generic
+ * ones (`BAD_REQUEST`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`). Renaming one
+ * is a breaking change.
+ */
+export const APPLICATION_ROLE_ERROR_CODES = {
+    /** 403: a grant naming yourself on an application you do not own outright. */
+    selfGrantForbidden: 'SELF_GRANT_FORBIDDEN',
+    /** 422: the key is not a live declared permission of this application. */
+    unknownPermission: 'UNKNOWN_PERMISSION',
+    /** 422: the grantee is not a person (an organization, project, bot or channel). */
+    granteeNotAPerson: 'GRANTEE_NOT_A_PERSON',
+    /** 409: the grantee already holds the key; `details.grantId` names the live grant. */
+    alreadyGranted: 'ALREADY_GRANTED',
+    /** 409: the grant was already revoked. */
+    alreadyRevoked: 'ALREADY_REVOKED',
+    /** 403: the bearer's session belongs to a DIFFERENT application. */
+    sessionApplicationMismatch: 'SESSION_APPLICATION_MISMATCH',
+};
+/** Whether `value` is a well-formed application permission key. */
+export function isApplicationPermissionKey(value) {
+    return (typeof value === 'string' &&
+        value.length <= APPLICATION_PERMISSION_KEY_MAX_LENGTH &&
+        APPLICATION_PERMISSION_KEY_PATTERN.test(value));
+}
+export const applicationPermissionKeySchema = z
+    .string()
+    .max(APPLICATION_PERMISSION_KEY_MAX_LENGTH)
+    .regex(APPLICATION_PERMISSION_KEY_PATTERN, 'A permission key is 2-4 dot-separated lowercase segments, e.g. payments.operate');
+/** Plain text: no control characters other than a newline or a tab. */
+function plainText(max) {
+    return z
+        .string()
+        .trim()
+        .min(1)
+        .max(max)
+        .refine((value) => Array.from(value).every((character) => {
+        const code = character.charCodeAt(0);
+        return (code >= 32 && code !== 127) || character === '\n' || character === '\t';
+    }), 'Must be plain text');
+}
+const id = z.string().min(1).max(128);
+const isoTimestamp = z.string().min(1);
+const reasonSchema = plainText(APPLICATION_ROLE_REASON_MAX_LENGTH);
+/** One key as the application's owners declare it. */
+export const applicationPermissionDeclarationSchema = z
+    .object({
+    key: applicationPermissionKeySchema,
+    description: plainText(APPLICATION_PERMISSION_DESCRIPTION_MAX_LENGTH),
+})
+    .strict();
+/**
+ * `PUT /applications/:appId/roles/permissions` — the WHOLE vocabulary.
+ *
+ * Declarative: a key present here and not live is added, a live key absent
+ * here is retired (and every grant of it revoked), a live key present here
+ * keeps its identity and takes the new description. Sending the same body twice
+ * changes nothing.
+ */
+export const declareApplicationPermissionsRequestSchema = z
+    .object({
+    permissions: z
+        .array(applicationPermissionDeclarationSchema)
+        .max(APPLICATION_PERMISSIONS_MAX_DECLARED),
+})
+    .strict()
+    .superRefine((value, ctx) => {
+    const seen = new Set();
+    value.permissions.forEach((permission, index) => {
+        if (seen.has(permission.key)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ['permissions', index, 'key'],
+                message: `Duplicate permission key ${permission.key}`,
+            });
+        }
+        seen.add(permission.key);
+    });
+});
+/** A declared key. Retired keys are history: they confer nothing. */
+export const applicationPermissionSchema = z.object({
+    key: applicationPermissionKeySchema,
+    description: z.string(),
+    declaredAt: isoTimestamp,
+    declaredByUserId: id.nullable(),
+    retiredAt: isoTimestamp.nullable(),
+    retiredByUserId: id.nullable(),
+});
+export const applicationPermissionListSchema = z.object({
+    items: z.array(applicationPermissionSchema),
+});
+export const declareApplicationPermissionsResponseSchema = applicationPermissionListSchema.extend({
+    /** Keys that became live with this declaration. */
+    added: z.array(applicationPermissionKeySchema),
+    /** Keys this declaration retired. */
+    retired: z.array(applicationPermissionKeySchema),
+    /** Live keys whose description changed. */
+    described: z.array(applicationPermissionKeySchema),
+    /** Live grants revoked because their key was retired. */
+    revokedGrants: z.number().int().nonnegative(),
+});
+/** One grant of one key to one Oxy user. Revocation is a stamp, never a delete. */
+export const applicationRoleGrantSchema = z.object({
+    id,
+    applicationId: id,
+    permission: applicationPermissionKeySchema,
+    userId: id,
+    /** The grantee's handle, for display. */
+    username: z.string().nullable(),
+    /** The HUMAN who granted it; null once that account was erased. */
+    grantedByUserId: id.nullable(),
+    grantedAt: isoTimestamp,
+    grantReason: z.string().nullable(),
+    revokedAt: isoTimestamp.nullable(),
+    revokedByUserId: id.nullable(),
+    revokeReason: z.string().nullable(),
+});
+export const applicationRoleGrantListSchema = z.object({
+    items: z.array(applicationRoleGrantSchema),
+    nextCursor: z.string().nullable(),
+});
+/** `POST /applications/:appId/roles/grants` — name the grantee by id OR handle. */
+export const createApplicationRoleGrantRequestSchema = z
+    .object({
+    userId: id.optional(),
+    username: z.string().trim().min(1).max(64).optional(),
+    permission: applicationPermissionKeySchema,
+    reason: reasonSchema.optional(),
+})
+    .strict()
+    .refine((value) => (value.userId === undefined) !== (value.username === undefined), {
+    message: 'Name the grantee with exactly one of userId or username',
+    path: ['userId'],
+});
+/** `POST /applications/:appId/roles/grants/:grantId/revoke`. */
+export const revokeApplicationRoleGrantRequestSchema = z
+    .object({
+    reason: reasonSchema.optional(),
+})
+    .strict();
+/** `GET /applications/:appId/roles/grants` query. */
+export const listApplicationRoleGrantsQuerySchema = z
+    .object({
+    permission: applicationPermissionKeySchema.optional(),
+    userId: id.optional(),
+    includeRevoked: z
+        .enum(['true', 'false'])
+        .transform((value) => value === 'true')
+        .optional(),
+    limit: z.coerce.number().int().min(1).max(APPLICATION_ROLE_GRANTS_PAGE_MAX).optional(),
+    cursor: z.string().min(1).max(512).optional(),
+})
+    .strict();
+/**
+ * `GET /applications/:appId/roles/me` — the keys the HUMAN behind the bearer
+ * holds for this application, in no particular order. `userId` is that human
+ * (the operator), which is NOT the account the session speaks as when a person
+ * is acting as an organization.
+ */
+export const applicationRolesMeSchema = z.object({
+    applicationId: id,
+    userId: id,
+    permissions: z.array(applicationPermissionKeySchema),
+});

package/dist/esm/client/check.js

@@ -24,6 +24,7 @@
  *   strictObject(shape)   unknown keys FAIL (`.strict()`)
  *   looseObject(shape)    unknown keys are KEPT (`.passthrough()`)
  *   refine(c, test)       a further condition, run once `c` passes
+ *   transform(c, f)       `f` rewrites the value once `c` passes
  *   union / discriminatedUnion   as Zod 3 reports them
  *
  * A failure carries the first issue Zod would report and whether Zod would have
@@ -229,6 +230,13 @@ export function refineAt(inner, test) {
             : checked;
     };
 }
+/** Zod's `.transform()`: rewrites a value `inner` accepted. */
+export function transform(inner, rewrite) {
+    return (input, path) => {
+        const checked = inner(input, path);
+        return checked.ok ? ok(rewrite(checked.value)) : checked;
+    };
+}
 /** Narrows a checked value to a branded contract type (Zod's `.brand()`). */
 export function branded(inner) {
     return inner;

package/dist/esm/client/index.js

@@ -30,7 +30,7 @@ export { ORGANIZATION_ALIAS_KINDS, ORGANIZATION_CLAIM_DECISIONS, ORGANIZATION_CL
 export { cancelProductSubscriptionCheck, personalPlanCatalogueCheck, personalPlanCheckoutRequestCheck, personalPlanCheckoutResultCheck, productSubscriptionCancellationResultCheck, productSubscriptionsResponseCheck, subjectProductAccessCheck, subjectProductAccessQueryCheck, subscriptionCreditGrantsResponseCheck, } from './products.js';
 export { recommendationRequestCheck } from './recommendations.js';
 export { isFullReputationBalance } from './reputation.js';
-export { profileAccessDecisionCheck, profileAccessInputCheck } from './safety.js';
+export { PURCHASE_APPROVAL_STATUSES, SAFETY_POLICY_VERSION, SUPERVISED_ACTIONS, SUPERVISION_CONSENT_VERSION, SUPERVISION_INVITATION_STATUSES, SUPERVISION_STATUSES, profileAccessDecisionCheck, profileAccessInputCheck, purchaseApprovalCheck, purchaseApprovalListCheck, purchaseReviewInputCheck, safetyOrganizationsInputCheck, safetyOrganizationsResponseCheck, safetyPeopleInputCheck, safetyPeopleResponseCheck, supervisionAcceptInputCheck, supervisionContactInputCheck, supervisionContactsResponseCheck, supervisionInvitationCheck, supervisionInviteInputCheck, supervisionReviewInputCheck, supervisionStateCheck, } from './safety.js';
 export { publicApplicationCheck } from './sessionStatus.js';
 export { EMAIL_ACCOUNTS_MAX, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_SIGNIN_LINK_TTL_MS, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, REAUTH_ACTIONS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGN_IN_ERROR_CODES, TOTP_BACKUP_CODE_COUNT, TOTP_DIGITS, TOTP_PERIOD_SECONDS, emailSignInChooseAccountCheck, emailSignInLinkResponseCheck, emailSignInPendingCheck, emailSignInStartResponseCheck, isEmailSignInChooseAccount, isSecondFactorRequired, normalizeEmailSignInCode, reauthProofCheck, secondFactorRequiredCheck, signInMethodsCheck, totpBackupCodesResponseCheck, totpEnrollResponseCheck, } from './signIn.js';
 export { BOT_USERNAME_INVALID_MESSAGE, BOT_USERNAME_SUFFIX, NUMERIC_USERNAME_MESSAGE, RESERVED_USERNAMES, RESERVED_USERNAME_MESSAGE, USERNAME_INVALID_MESSAGE, USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, USERNAME_PATTERN_SOURCE, applyBotUsernameSuffix, botUsernameCheck, stripDisallowedUsernameCharacters, usernameCheck, usernameCheckForAccountKind, } from './username.js';

package/dist/esm/client/safety.js

@@ -1,12 +1,193 @@
 /**
- * Profile-access checks, without Zod. Schemas: `../safety.ts`.
+ * Safety and supervision checks, without Zod. Schemas: `../safety.ts`.
+ *
+ * Only what a browser or device sends and reads is here: the profile-access
+ * read, supervision management and the guardian's purchase review. The service
+ * decision lanes are server-only (`@oxy.so/core/server`) and parse with the
+ * Zod schemas directly.
  *
  * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
  */
-import { boolean, exact, literal, maxLength, minLength, oneOf, strictObject, string, } from './check.js';
+import { array, atLeast, atMost, boolean, datetime, exact, int, literal, maxItems, maxLength, minItems, minLength, nonnegative, nullable, number, oneOf, optional, pattern, refine, refineAt, strictObject, string, transform, trim, union, } from './check.js';
+import { ORGANIZATION_TYPES } from './organizations.js';
+import { reauthProofCheck } from './signIn.js';
+/** Supervision is a personal-account safety policy, never a new login/account kind. */
+export const SUPERVISED_ACTIONS = ['profile', 'messaging', 'content', 'purchases'];
+export const SAFETY_POLICY_VERSION = '2';
+export const SUPERVISION_CONSENT_VERSION = '1';
+export const SUPERVISION_STATUSES = ['active', 'orphaned', 'ended'];
+export const SUPERVISION_INVITATION_STATUSES = ['pending', 'accepted', 'cancelled'];
+export const PURCHASE_APPROVAL_STATUSES = [
+    'pending',
+    'approved',
+    'rejected',
+    'reserved',
+    'confirmed',
+    'cancelled',
+];
 export const profileAccessInputCheck = exact()(strictObject({ subjectAccountId: string(minLength(1), maxLength(128)) }));
 export const profileAccessDecisionCheck = exact()(strictObject({
     allowed: boolean,
     reason: oneOf(['public', 'owner', 'private', 'blocked', 'unavailable']),
     policyVersion: literal('1'),
 }));
+const accountId = string(minLength(1), maxLength(128));
+const resourceId = string(trim, minLength(1), maxLength(256));
+const uniqueIds = (max) => refine(array(accountId, minItems(1), maxItems(max)), (ids) => new Set(ids).size === ids.length, 'Account IDs must be unique');
+/* -------------------------------------------------------------------------- */
+/*  Supervision management                                                    */
+/* -------------------------------------------------------------------------- */
+const supervisionCheck = exact()(strictObject({
+    childAccountId: accountId,
+    guardianAccountId: nullable(accountId),
+    status: oneOf(SUPERVISION_STATUSES),
+    policyVersion: literal(SAFETY_POLICY_VERSION),
+    consentVersion: literal(SUPERVISION_CONSENT_VERSION),
+    createdAt: string(datetime),
+}));
+export const supervisionInvitationCheck = exact()(strictObject({
+    id: accountId,
+    childAccountId: accountId,
+    guardianAccountId: accountId,
+    status: oneOf(SUPERVISION_INVITATION_STATUSES),
+    expiresAt: string(datetime),
+    consentVersion: literal(SUPERVISION_CONSENT_VERSION),
+    createdAt: string(datetime),
+}));
+export const supervisionStateCheck = exact()(strictObject({
+    self: nullable(supervisionCheck),
+    children: array(supervisionCheck, maxItems(100)),
+    invitations: array(supervisionInvitationCheck, maxItems(100)),
+}));
+export const supervisionContactsResponseCheck = exact()(strictObject({
+    items: array(strictObject({
+        childAccountId: accountId,
+        contactAccountId: accountId,
+        approvedAt: string(datetime),
+    }), maxItems(1000)),
+}));
+export const supervisionInviteInputCheck = exact()(strictObject({
+    guardianAccountId: accountId,
+    consentVersion: literal(SUPERVISION_CONSENT_VERSION),
+    reauth: reauthProofCheck,
+}));
+export const supervisionAcceptInputCheck = exact()(strictObject({ consentVersion: literal(SUPERVISION_CONSENT_VERSION), reauth: reauthProofCheck }));
+export const supervisionContactInputCheck = exact()(strictObject({
+    childAccountId: accountId,
+    contactAccountId: accountId,
+    reauth: reauthProofCheck,
+}));
+export const supervisionReviewInputCheck = exact()(strictObject({
+    childAccountId: accountId,
+    action: oneOf(['end', 'transfer']),
+    guardianAccountId: optional(accountId),
+    evidenceReference: string(trim, minLength(1), maxLength(2048)),
+    reauth: reauthProofCheck,
+}));
+/* -------------------------------------------------------------------------- */
+/*  Minimal identities for the management screens                            */
+/* -------------------------------------------------------------------------- */
+const safetyPersonCheck = exact()(strictObject({ accountId, username: nullable(string()), displayName: nullable(string()) }));
+export const safetyPeopleInputCheck = exact()(union(strictObject({ query: string(trim, minLength(2), maxLength(100)) }), strictObject({ accountIds: uniqueIds(100) })));
+export const safetyPeopleResponseCheck = exact()(strictObject({ items: array(safetyPersonCheck, maxItems(100)) }));
+export const safetyOrganizationsInputCheck = exact()(union(strictObject({
+    query: string(trim, minLength(1), maxLength(100)),
+    limit: optional(number(int, atLeast(1), atMost(20))),
+}), strictObject({ ids: uniqueIds(100) })));
+export const safetyOrganizationsResponseCheck = exact()(strictObject({
+    items: array(strictObject({
+        requestedAccountId: accountId,
+        organization: strictObject({
+            accountId,
+            username: nullable(string()),
+            name: string(),
+            organizationType: oneOf(ORGANIZATION_TYPES),
+        }),
+    }), maxItems(100)),
+    missingIds: array(accountId, maxItems(100)),
+}));
+/* -------------------------------------------------------------------------- */
+/*  Purchase approvals                                                        */
+/* -------------------------------------------------------------------------- */
+const fingerprint = string(pattern(/^[a-f0-9]{64}$/));
+const minorUnits = number(int, nonnegative, atMost(Number.MAX_SAFE_INTEGER));
+const purchaseApprovalLineCheck = exact()(strictObject({
+    itemReference: resourceId,
+    title: string(trim, minLength(1), maxLength(300)),
+    optionsText: string(trim, maxLength(300)),
+    merchantAccountId: accountId,
+    quantity: number(int, atLeast(1), atMost(1000000)),
+    unitAmountMinor: minorUnits,
+    lineAmountMinor: minorUnits,
+}));
+/** The effect fields every approval shape shares, in the schema's key order. */
+const purchaseEffectFields = {
+    operationId: resourceId,
+    resourceId,
+    cartFingerprint: fingerprint,
+    summary: string(trim, minLength(1), maxLength(300)),
+    merchantAccountIds: transform(refine(array(accountId, minItems(1), maxItems(100)), (ids) => new Set(ids).size === ids.length, 'Merchant accounts must be unique'), (ids) => [...ids].sort()),
+};
+const purchaseAmountFields = {
+    shippingMinor: minorUnits,
+    taxMinor: minorUnits,
+    discountMinor: minorUnits,
+    roundingAdjustmentMinor: number(int, atLeast(-Number.MAX_SAFE_INTEGER), atMost(Number.MAX_SAFE_INTEGER)),
+    paymentFingerprint: fingerprint,
+    amountMinor: minorUnits,
+    currency: string(pattern(/^[A-Z]{3}$/)),
+    expiresAt: string(datetime),
+};
+const purchaseApprovalFields = {
+    id: accountId,
+    childAccountId: accountId,
+    applicationId: accountId,
+    status: oneOf(PURCHASE_APPROVAL_STATUSES),
+    createdAt: string(datetime),
+    receiptReference: nullable(string(maxLength(512))),
+};
+/** The first problem `validatePurchaseEvidence` in `../safety.ts` reports, in its order. */
+function purchaseEvidenceProblem(value) {
+    const merchants = new Set(value.merchantAccountIds);
+    const references = new Set();
+    for (const line of value.lineItems) {
+        const key = `${line.merchantAccountId}:${line.itemReference}`;
+        if (!merchants.has(line.merchantAccountId) || references.has(key)) {
+            return {
+                path: [],
+                message: 'Purchase lines must name an included merchant and unique item reference',
+            };
+        }
+        references.add(key);
+    }
+    if (merchants.size !== new Set(value.lineItems.map((line) => line.merchantAccountId)).size) {
+        return { path: [], message: 'Every merchant must have an approval line' };
+    }
+    const total = value.lineItems.reduce((sum, line) => sum + BigInt(line.lineAmountMinor), 0n) +
+        BigInt(value.shippingMinor) +
+        BigInt(value.taxMinor) -
+        BigInt(value.discountMinor) +
+        BigInt(value.roundingAdjustmentMinor);
+    if (total < 0n ||
+        total > BigInt(Number.MAX_SAFE_INTEGER) ||
+        total !== BigInt(value.amountMinor)) {
+        return { path: [], message: 'Approval evidence must equal the exact payment total' };
+    }
+    if (Math.abs(value.roundingAdjustmentMinor) >
+        value.lineItems.length + 3 * value.merchantAccountIds.length) {
+        return { path: [], message: 'Rounding adjustment exceeds the bounded conversion stages' };
+    }
+    return undefined;
+}
+export const purchaseApprovalCheck = exact()(refineAt(strictObject({
+    ...purchaseEffectFields,
+    lineItems: array(purchaseApprovalLineCheck, minItems(1), maxItems(200)),
+    ...purchaseAmountFields,
+    ...purchaseApprovalFields,
+}), purchaseEvidenceProblem));
+const purchaseApprovalSummaryCheck = exact()(strictObject({ ...purchaseEffectFields, ...purchaseAmountFields, ...purchaseApprovalFields }));
+export const purchaseApprovalListCheck = exact()(strictObject({
+    items: array(purchaseApprovalSummaryCheck, maxItems(100)),
+    nextCursor: nullable(string()),
+}));
+export const purchaseReviewInputCheck = exact()(strictObject({ decision: oneOf(['approved', 'rejected']), reauth: reauthProofCheck }));

package/dist/esm/client/signIn.js

@@ -64,6 +64,8 @@ export const REAUTH_ACTIONS = [
     'link_commons',
     'delete_account',
     'credentials_manage',
+    'supervision',
+    'supervision_purchase',
 ];
 /**
  * Stable error codes (`error.code` in the API error body). Clients map these

package/dist/esm/index.js

@@ -180,13 +180,14 @@ PRODUCT_PLAN_STATUSES, productPlanStatusSchema, LIVE_PRODUCT_PLAN_STATUSES, plan
 export { 
 // Economic treatment (I09): derived by the server, never sent by a caller.
 INFERENCE_ECONOMIC_TREATMENTS, inferenceEconomicTreatmentSchema, PROVIDER_COST_SOURCES, providerCostSourceSchema, costCenterUsageSchema, } from './inference/economics.js';
-export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, executionActorRefSchema, foregroundExecutionAuthorizationInputSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, capabilityCatalogBindingSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, capabilityTicketRequestSchema, delegationGrantSchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, invocationPrincipalSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency.js';
+export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, executionActorRefSchema, foregroundExecutionAuthorizationInputSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, capabilityCatalogBindingSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, capabilityTicketRequestSchema, delegationGrantSchema, AGENT_REQUESTER_CEILING_AUTONOMY, agentRequesterCeilingWriteSchema, agentRequesterCeilingSchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, invocationPrincipalSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, catalogFeatureSchema, CATALOG_INTERNAL_TRANSPORTS, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency.js';
 export { catalogInvocationPathParameters, catalogInvocationsOverlap, catalogInvocationTemplatesEquivalent, findOverlappingCatalogInvocations, matchCatalogInvocation, resolveCatalogInvocation, } from './capabilityInvocation.js';
 export { emailContextAddressSchema, emailContextMailboxSchema, emailContextMessageSchema, emailAgentContextSchema, } from './emailAgentContext.js';
 export { inboxComposeRequestSchema, inboxDailyBriefRequestSchema, inboxDailyBriefResponseSchema, INBOX_DAILY_BRIEF_SECTIONS, inboxNaturalSearchRequestSchema, inboxMessageInferenceParamsSchema, inboxInferenceTextResponseSchema, inboxNaturalSearchResponseSchema, inboxSmartRepliesResponseSchema, inboxThreadSummaryResponseSchema, inboxInferenceStreamEventSchema, } from './inference/inbox.js';
 export * from './externalIdentity.js';
 export * from './linkedAccounts.js';
 export * from './federationInstanceFetch.js';
+export * from './accountAccess.js';
 export * from './notifications.js';
 export * from './email/messages.js';
 export * from './stickers.js';
@@ -204,3 +205,5 @@ export { personalPlanDisplayPriceSchema, personalPlanCatalogueSchema, } from './
 export * from './products/checkout.js';
 export * from './organizations.js';
 export * from './safety.js';
+export { serviceTokenScopesSchema, serviceTokenOptionsSchema, } from './serviceToken.js';
+export * from './applicationRoles.js';