@oxy.so/contracts 4.17.0 → 4.22.0

package/dist/esm/applicationRoles.js

@@ -0,0 +1,207 @@
+/**
+ * Application roles — the wire contract for permissions an APPLICATION declares
+ * about its own users, and for the grants that give them to Oxy users.
+ *
+ * Oxy decides who holds an app's operator powers (who may run Mercaria's
+ * payments desk, moderate GoWay, administer Homiio), so no app keeps an
+ * allow-list of Oxy user ids in its environment. The app declares a closed
+ * vocabulary of keys, its owners grant them to people, and the app's backend
+ * asks Oxy which of them the human behind a request holds
+ * (`GET /applications/:appId/roles/me`, read through `@oxy.so/core/server`).
+ *
+ * ## Why an application key can never collide with an Oxy permission
+ *
+ * Every permission Oxy itself checks (`app:update`, `apps:create`,
+ * `credentials:rotate`, every scope) is spelled with a COLON. An application key
+ * is dot-separated lowercase segments and cannot contain one, so the two
+ * vocabularies are disjoint by syntax, not by convention. They are also stored
+ * apart (scoped to one application id) and no Oxy gate ever reads an
+ * application key. A key means something only to the application that declared
+ * it.
+ *
+ * The pattern is exported as a SOURCE string because the API renders the same
+ * text into a Postgres CHECK; JavaScript's `RegExp` and Postgres' ARE agree on
+ * everything it uses (anchors, classes, a capturing group, a bounded repeat).
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo.
+ */
+import { z } from 'zod';
+/**
+ * Two to four dot-separated segments, each a lowercase letter followed by
+ * lowercase letters, digits or underscores: `payments.operate`,
+ * `catalog.review.publish`. At least two segments so a key always names an
+ * area and an action; never a colon (see the header).
+ */
+export const APPLICATION_PERMISSION_KEY_PATTERN_SOURCE = '^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*){1,3}$';
+export const APPLICATION_PERMISSION_KEY_PATTERN = new RegExp(APPLICATION_PERMISSION_KEY_PATTERN_SOURCE);
+export const APPLICATION_PERMISSION_KEY_MAX_LENGTH = 64;
+export const APPLICATION_PERMISSION_DESCRIPTION_MAX_LENGTH = 280;
+/** How many live keys one application may declare. Operator powers are few. */
+export const APPLICATION_PERMISSIONS_MAX_DECLARED = 64;
+export const APPLICATION_ROLE_REASON_MAX_LENGTH = 500;
+export const APPLICATION_ROLE_GRANTS_PAGE_DEFAULT = 50;
+export const APPLICATION_ROLE_GRANTS_PAGE_MAX = 200;
+/**
+ * The `error` codes the application-roles routes answer beyond the generic
+ * ones (`BAD_REQUEST`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`). Renaming one
+ * is a breaking change.
+ */
+export const APPLICATION_ROLE_ERROR_CODES = {
+    /** 403: a grant naming yourself on an application you do not own outright. */
+    selfGrantForbidden: 'SELF_GRANT_FORBIDDEN',
+    /** 422: the key is not a live declared permission of this application. */
+    unknownPermission: 'UNKNOWN_PERMISSION',
+    /** 422: the grantee is not a person (an organization, project, bot or channel). */
+    granteeNotAPerson: 'GRANTEE_NOT_A_PERSON',
+    /** 409: the grantee already holds the key; `details.grantId` names the live grant. */
+    alreadyGranted: 'ALREADY_GRANTED',
+    /** 409: the grant was already revoked. */
+    alreadyRevoked: 'ALREADY_REVOKED',
+    /** 403: the bearer's session belongs to a DIFFERENT application. */
+    sessionApplicationMismatch: 'SESSION_APPLICATION_MISMATCH',
+};
+/** Whether `value` is a well-formed application permission key. */
+export function isApplicationPermissionKey(value) {
+    return (typeof value === 'string' &&
+        value.length <= APPLICATION_PERMISSION_KEY_MAX_LENGTH &&
+        APPLICATION_PERMISSION_KEY_PATTERN.test(value));
+}
+export const applicationPermissionKeySchema = z
+    .string()
+    .max(APPLICATION_PERMISSION_KEY_MAX_LENGTH)
+    .regex(APPLICATION_PERMISSION_KEY_PATTERN, 'A permission key is 2-4 dot-separated lowercase segments, e.g. payments.operate');
+/** Plain text: no control characters other than a newline or a tab. */
+function plainText(max) {
+    return z
+        .string()
+        .trim()
+        .min(1)
+        .max(max)
+        .refine((value) => Array.from(value).every((character) => {
+        const code = character.charCodeAt(0);
+        return (code >= 32 && code !== 127) || character === '\n' || character === '\t';
+    }), 'Must be plain text');
+}
+const id = z.string().min(1).max(128);
+const isoTimestamp = z.string().min(1);
+const reasonSchema = plainText(APPLICATION_ROLE_REASON_MAX_LENGTH);
+/** One key as the application's owners declare it. */
+export const applicationPermissionDeclarationSchema = z
+    .object({
+    key: applicationPermissionKeySchema,
+    description: plainText(APPLICATION_PERMISSION_DESCRIPTION_MAX_LENGTH),
+})
+    .strict();
+/**
+ * `PUT /applications/:appId/roles/permissions` — the WHOLE vocabulary.
+ *
+ * Declarative: a key present here and not live is added, a live key absent
+ * here is retired (and every grant of it revoked), a live key present here
+ * keeps its identity and takes the new description. Sending the same body twice
+ * changes nothing.
+ */
+export const declareApplicationPermissionsRequestSchema = z
+    .object({
+    permissions: z
+        .array(applicationPermissionDeclarationSchema)
+        .max(APPLICATION_PERMISSIONS_MAX_DECLARED),
+})
+    .strict()
+    .superRefine((value, ctx) => {
+    const seen = new Set();
+    value.permissions.forEach((permission, index) => {
+        if (seen.has(permission.key)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ['permissions', index, 'key'],
+                message: `Duplicate permission key ${permission.key}`,
+            });
+        }
+        seen.add(permission.key);
+    });
+});
+/** A declared key. Retired keys are history: they confer nothing. */
+export const applicationPermissionSchema = z.object({
+    key: applicationPermissionKeySchema,
+    description: z.string(),
+    declaredAt: isoTimestamp,
+    declaredByUserId: id.nullable(),
+    retiredAt: isoTimestamp.nullable(),
+    retiredByUserId: id.nullable(),
+});
+export const applicationPermissionListSchema = z.object({
+    items: z.array(applicationPermissionSchema),
+});
+export const declareApplicationPermissionsResponseSchema = applicationPermissionListSchema.extend({
+    /** Keys that became live with this declaration. */
+    added: z.array(applicationPermissionKeySchema),
+    /** Keys this declaration retired. */
+    retired: z.array(applicationPermissionKeySchema),
+    /** Live keys whose description changed. */
+    described: z.array(applicationPermissionKeySchema),
+    /** Live grants revoked because their key was retired. */
+    revokedGrants: z.number().int().nonnegative(),
+});
+/** One grant of one key to one Oxy user. Revocation is a stamp, never a delete. */
+export const applicationRoleGrantSchema = z.object({
+    id,
+    applicationId: id,
+    permission: applicationPermissionKeySchema,
+    userId: id,
+    /** The grantee's handle, for display. */
+    username: z.string().nullable(),
+    /** The HUMAN who granted it; null once that account was erased. */
+    grantedByUserId: id.nullable(),
+    grantedAt: isoTimestamp,
+    grantReason: z.string().nullable(),
+    revokedAt: isoTimestamp.nullable(),
+    revokedByUserId: id.nullable(),
+    revokeReason: z.string().nullable(),
+});
+export const applicationRoleGrantListSchema = z.object({
+    items: z.array(applicationRoleGrantSchema),
+    nextCursor: z.string().nullable(),
+});
+/** `POST /applications/:appId/roles/grants` — name the grantee by id OR handle. */
+export const createApplicationRoleGrantRequestSchema = z
+    .object({
+    userId: id.optional(),
+    username: z.string().trim().min(1).max(64).optional(),
+    permission: applicationPermissionKeySchema,
+    reason: reasonSchema.optional(),
+})
+    .strict()
+    .refine((value) => (value.userId === undefined) !== (value.username === undefined), {
+    message: 'Name the grantee with exactly one of userId or username',
+    path: ['userId'],
+});
+/** `POST /applications/:appId/roles/grants/:grantId/revoke`. */
+export const revokeApplicationRoleGrantRequestSchema = z
+    .object({
+    reason: reasonSchema.optional(),
+})
+    .strict();
+/** `GET /applications/:appId/roles/grants` query. */
+export const listApplicationRoleGrantsQuerySchema = z
+    .object({
+    permission: applicationPermissionKeySchema.optional(),
+    userId: id.optional(),
+    includeRevoked: z
+        .enum(['true', 'false'])
+        .transform((value) => value === 'true')
+        .optional(),
+    limit: z.coerce.number().int().min(1).max(APPLICATION_ROLE_GRANTS_PAGE_MAX).optional(),
+    cursor: z.string().min(1).max(512).optional(),
+})
+    .strict();
+/**
+ * `GET /applications/:appId/roles/me` — the keys the HUMAN behind the bearer
+ * holds for this application, in no particular order. `userId` is that human
+ * (the operator), which is NOT the account the session speaks as when a person
+ * is acting as an organization.
+ */
+export const applicationRolesMeSchema = z.object({
+    applicationId: id,
+    userId: id,
+    permissions: z.array(applicationPermissionKeySchema),
+});

package/dist/esm/client/check.js

@@ -24,6 +24,7 @@
  *   strictObject(shape)   unknown keys FAIL (`.strict()`)
  *   looseObject(shape)    unknown keys are KEPT (`.passthrough()`)
  *   refine(c, test)       a further condition, run once `c` passes
+ *   transform(c, f)       `f` rewrites the value once `c` passes
  *   union / discriminatedUnion   as Zod 3 reports them
  *
  * A failure carries the first issue Zod would report and whether Zod would have
@@ -229,6 +230,13 @@ export function refineAt(inner, test) {
             : checked;
     };
 }
+/** Zod's `.transform()`: rewrites a value `inner` accepted. */
+export function transform(inner, rewrite) {
+    return (input, path) => {
+        const checked = inner(input, path);
+        return checked.ok ? ok(rewrite(checked.value)) : checked;
+    };
+}
 /** Narrows a checked value to a branded contract type (Zod's `.brand()`). */
 export function branded(inner) {
     return inner;

package/dist/esm/client/contentClaims.js

@@ -0,0 +1,134 @@
+/**
+ * Content claims (ADR 0043 D10) — the constants of the public "Report content
+ * / rights claim" intake and of a claim's review, without Zod. Schemas:
+ * `../contentClaims.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+/** What a claim asserts. */
+export const CONTENT_CLAIM_KINDS = [
+    'copyright',
+    'trademark',
+    'privacy',
+    'illegal_content',
+    'other',
+];
+/** Who the claimant is to the content. */
+export const CLAIMANT_RELATIONSHIPS = [
+    'rights_holder',
+    'authorized_agent',
+    'affected_person',
+    'other',
+];
+/** The bounds of a submission. The website fills its validation messages from these. */
+export const CONTENT_CLAIM_LIMITS = {
+    minUrls: 1,
+    maxUrls: 20,
+    maxUrlLength: 2048,
+    minDescription: 20,
+    maxDescription: 5000,
+    maxName: 200,
+    maxOrganization: 200,
+    maxEmail: 254,
+};
+/**
+ * Where a claim is in its review.
+ *
+ * `received → reviewing → actioned | rejected`; an actioned claim can be
+ * answered by the content's owner (`counter_noticed`), which ends either in
+ * `reinstated` (the content is served again) or `upheld` (it stays blocked).
+ * A claim can also be rejected straight from `received`.
+ */
+export const CONTENT_CLAIM_STATES = [
+    'received',
+    'reviewing',
+    'actioned',
+    'rejected',
+    'counter_noticed',
+    'reinstated',
+    'upheld',
+];
+/** The states in which a claim is still open: its evidence is kept and its blocks can change. */
+export const OPEN_CONTENT_CLAIM_STATES = [
+    'received',
+    'reviewing',
+    'actioned',
+    'counter_noticed',
+];
+/** The states a claim ends in. */
+export const CLOSED_CONTENT_CLAIM_STATES = [
+    'rejected',
+    'reinstated',
+    'upheld',
+];
+/**
+ * The kinds whose claimant asserts a right in a work or a mark. Only these
+ * carry the link to the original — a privacy or illegal-content report
+ * asserts no ownership.
+ */
+export function isRightsClaim(kind) {
+    return kind === 'copyright' || kind === 'trademark';
+}
+/**
+ * A request to erase the claimant's OWN personal data (GDPR art. 17): a
+ * privacy claim made by the person it is about. Oxy must answer it within one
+ * month (art. 12(3)); the claim carries that deadline.
+ */
+export function isErasureRequest(kind, relationship) {
+    return kind === 'privacy' && relationship === 'affected_person';
+}
+/** Days Oxy has to answer an erasure request ({@link isErasureRequest}). */
+export const ERASURE_REQUEST_DEADLINE_DAYS = 30;
+/**
+ * Stable error codes a takedown produces elsewhere in the API. A file whose
+ * bytes are on the blocklist cannot be uploaded, imported or copied by anyone
+ * (HTTP 451).
+ */
+export const CONTENT_CLAIM_ERROR_CODES = {
+    /** The submission failed validation; `fields` names each problem. */
+    invalid: 'CONTENT_CLAIM_INVALID',
+    /** These exact bytes were taken down after a claim and cannot be stored again. */
+    contentBlocked: 'CONTENT_BLOCKED',
+    /** A counter-notice failed validation; `fields` names each problem. */
+    counterNoticeInvalid: 'CONTENT_CLAIM_COUNTER_NOTICE_INVALID',
+    /** The files named are blocked by more than one claim: name the claim's reference. */
+    counterNoticeAmbiguous: 'CONTENT_CLAIM_COUNTER_NOTICE_AMBIGUOUS',
+    /** This account already sent a counter-notice for this claim. */
+    counterNoticeExists: 'CONTENT_CLAIM_COUNTER_NOTICE_EXISTS',
+};
+/**
+ * A claim's reference as the claimant and the owner are sent it:
+ * `OXY-XXXX-XXXX`, Crockford base32 (no I, L, O or U).
+ */
+export const CONTENT_CLAIM_REFERENCE_PATTERN = /^OXY-[0-9A-HJKMNP-TV-Z]{4}-[0-9A-HJKMNP-TV-Z]{4}$/;
+/** The bounds of an owner's counter-notice. The website fills its validation messages from these. */
+export const CONTENT_CLAIM_COUNTER_NOTICE_LIMITS = {
+    maxFileIds: 50,
+    maxFileId: 64,
+    maxName: 200,
+    maxAddress: 500,
+    minPhone: 5,
+    maxPhone: 40,
+    maxEmail: 254,
+    minMaterial: 10,
+    maxMaterial: 2000,
+    maxLocation: 2048,
+    minExplanation: 20,
+    maxExplanation: 5000,
+    maxSignature: 200,
+};
+/**
+ * The statements an owner's counter-notice makes, word for word — what the
+ * form shows beside each box (17 U.S.C. § 512(g)(3)(C) and (D), and what Oxy
+ * does with the notice). The API records {@link COUNTER_NOTICE_STATEMENT_VERSION}
+ * with every notice, so the wording a person agreed to can always be told
+ * apart from a later one. Change the text only together with the version.
+ */
+export const COUNTER_NOTICE_STATEMENTS = {
+    perjury: 'I swear, under penalty of perjury, that I have a good faith belief that the material identified above was removed or disabled as a result of a mistake or misidentification of the material to be removed or disabled.',
+    jurisdiction: 'I consent to the jurisdiction of the Federal District Court for the judicial district in which my address is located or, if my address is outside of the United States, any judicial district in which Oxy may be found.',
+    serviceOfProcess: 'I will accept service of process from the person who provided the notification of the claimed infringement, or an agent of such person.',
+    disclosure: 'I understand that Oxy sends a copy of this counter-notice, including my name and contact details, to the person who made the claim, as the law requires.',
+};
+/** The version of {@link COUNTER_NOTICE_STATEMENTS} in force. */
+export const COUNTER_NOTICE_STATEMENT_VERSION = '2026-10-16';

package/dist/esm/client/index.js

@@ -30,8 +30,9 @@ export { ORGANIZATION_ALIAS_KINDS, ORGANIZATION_CLAIM_DECISIONS, ORGANIZATION_CL
 export { cancelProductSubscriptionCheck, personalPlanCatalogueCheck, personalPlanCheckoutRequestCheck, personalPlanCheckoutResultCheck, productSubscriptionCancellationResultCheck, productSubscriptionsResponseCheck, subjectProductAccessCheck, subjectProductAccessQueryCheck, subscriptionCreditGrantsResponseCheck, } from './products.js';
 export { recommendationRequestCheck } from './recommendations.js';
 export { isFullReputationBalance } from './reputation.js';
-export { profileAccessDecisionCheck, profileAccessInputCheck } from './safety.js';
+export { PURCHASE_APPROVAL_STATUSES, SAFETY_POLICY_VERSION, SUPERVISED_ACTIONS, SUPERVISION_CONSENT_VERSION, SUPERVISION_INVITATION_STATUSES, SUPERVISION_STATUSES, profileAccessDecisionCheck, profileAccessInputCheck, purchaseApprovalCheck, purchaseApprovalListCheck, purchaseReviewInputCheck, safetyOrganizationsInputCheck, safetyOrganizationsResponseCheck, safetyPeopleInputCheck, safetyPeopleResponseCheck, supervisionAcceptInputCheck, supervisionContactInputCheck, supervisionContactsResponseCheck, supervisionInvitationCheck, supervisionInviteInputCheck, supervisionReviewInputCheck, supervisionStateCheck, } from './safety.js';
 export { publicApplicationCheck } from './sessionStatus.js';
 export { EMAIL_ACCOUNTS_MAX, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_SIGNIN_LINK_TTL_MS, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, REAUTH_ACTIONS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGN_IN_ERROR_CODES, TOTP_BACKUP_CODE_COUNT, TOTP_DIGITS, TOTP_PERIOD_SECONDS, emailSignInChooseAccountCheck, emailSignInLinkResponseCheck, emailSignInPendingCheck, emailSignInStartResponseCheck, isEmailSignInChooseAccount, isSecondFactorRequired, normalizeEmailSignInCode, reauthProofCheck, secondFactorRequiredCheck, signInMethodsCheck, totpBackupCodesResponseCheck, totpEnrollResponseCheck, } from './signIn.js';
 export { BOT_USERNAME_INVALID_MESSAGE, BOT_USERNAME_SUFFIX, NUMERIC_USERNAME_MESSAGE, RESERVED_USERNAMES, RESERVED_USERNAME_MESSAGE, USERNAME_INVALID_MESSAGE, USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, USERNAME_PATTERN_SOURCE, applyBotUsernameSuffix, botUsernameCheck, stripDisallowedUsernameCharacters, usernameCheck, usernameCheckForAccountKind, } from './username.js';
 export { userNameCheck } from './userResponse.js';
+export { CLAIMANT_RELATIONSHIPS, CLOSED_CONTENT_CLAIM_STATES, CONTENT_CLAIM_COUNTER_NOTICE_LIMITS, CONTENT_CLAIM_ERROR_CODES, CONTENT_CLAIM_KINDS, CONTENT_CLAIM_LIMITS, CONTENT_CLAIM_REFERENCE_PATTERN, CONTENT_CLAIM_STATES, COUNTER_NOTICE_STATEMENT_VERSION, COUNTER_NOTICE_STATEMENTS, ERASURE_REQUEST_DEADLINE_DAYS, OPEN_CONTENT_CLAIM_STATES, isErasureRequest, isRightsClaim, } from './contentClaims.js';

package/dist/esm/client/safety.js

@@ -1,12 +1,193 @@
 /**
- * Profile-access checks, without Zod. Schemas: `../safety.ts`.
+ * Safety and supervision checks, without Zod. Schemas: `../safety.ts`.
+ *
+ * Only what a browser or device sends and reads is here: the profile-access
+ * read, supervision management and the guardian's purchase review. The service
+ * decision lanes are server-only (`@oxy.so/core/server`) and parse with the
+ * Zod schemas directly.
  *
  * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
  */
-import { boolean, exact, literal, maxLength, minLength, oneOf, strictObject, string, } from './check.js';
+import { array, atLeast, atMost, boolean, datetime, exact, int, literal, maxItems, maxLength, minItems, minLength, nonnegative, nullable, number, oneOf, optional, pattern, refine, refineAt, strictObject, string, transform, trim, union, } from './check.js';
+import { ORGANIZATION_TYPES } from './organizations.js';
+import { reauthProofCheck } from './signIn.js';
+/** Supervision is a personal-account safety policy, never a new login/account kind. */
+export const SUPERVISED_ACTIONS = ['profile', 'messaging', 'content', 'purchases'];
+export const SAFETY_POLICY_VERSION = '2';
+export const SUPERVISION_CONSENT_VERSION = '1';
+export const SUPERVISION_STATUSES = ['active', 'orphaned', 'ended'];
+export const SUPERVISION_INVITATION_STATUSES = ['pending', 'accepted', 'cancelled'];
+export const PURCHASE_APPROVAL_STATUSES = [
+    'pending',
+    'approved',
+    'rejected',
+    'reserved',
+    'confirmed',
+    'cancelled',
+];
 export const profileAccessInputCheck = exact()(strictObject({ subjectAccountId: string(minLength(1), maxLength(128)) }));
 export const profileAccessDecisionCheck = exact()(strictObject({
     allowed: boolean,
     reason: oneOf(['public', 'owner', 'private', 'blocked', 'unavailable']),
     policyVersion: literal('1'),
 }));
+const accountId = string(minLength(1), maxLength(128));
+const resourceId = string(trim, minLength(1), maxLength(256));
+const uniqueIds = (max) => refine(array(accountId, minItems(1), maxItems(max)), (ids) => new Set(ids).size === ids.length, 'Account IDs must be unique');
+/* -------------------------------------------------------------------------- */
+/*  Supervision management                                                    */
+/* -------------------------------------------------------------------------- */
+const supervisionCheck = exact()(strictObject({
+    childAccountId: accountId,
+    guardianAccountId: nullable(accountId),
+    status: oneOf(SUPERVISION_STATUSES),
+    policyVersion: literal(SAFETY_POLICY_VERSION),
+    consentVersion: literal(SUPERVISION_CONSENT_VERSION),
+    createdAt: string(datetime),
+}));
+export const supervisionInvitationCheck = exact()(strictObject({
+    id: accountId,
+    childAccountId: accountId,
+    guardianAccountId: accountId,
+    status: oneOf(SUPERVISION_INVITATION_STATUSES),
+    expiresAt: string(datetime),
+    consentVersion: literal(SUPERVISION_CONSENT_VERSION),
+    createdAt: string(datetime),
+}));
+export const supervisionStateCheck = exact()(strictObject({
+    self: nullable(supervisionCheck),
+    children: array(supervisionCheck, maxItems(100)),
+    invitations: array(supervisionInvitationCheck, maxItems(100)),
+}));
+export const supervisionContactsResponseCheck = exact()(strictObject({
+    items: array(strictObject({
+        childAccountId: accountId,
+        contactAccountId: accountId,
+        approvedAt: string(datetime),
+    }), maxItems(1000)),
+}));
+export const supervisionInviteInputCheck = exact()(strictObject({
+    guardianAccountId: accountId,
+    consentVersion: literal(SUPERVISION_CONSENT_VERSION),
+    reauth: reauthProofCheck,
+}));
+export const supervisionAcceptInputCheck = exact()(strictObject({ consentVersion: literal(SUPERVISION_CONSENT_VERSION), reauth: reauthProofCheck }));
+export const supervisionContactInputCheck = exact()(strictObject({
+    childAccountId: accountId,
+    contactAccountId: accountId,
+    reauth: reauthProofCheck,
+}));
+export const supervisionReviewInputCheck = exact()(strictObject({
+    childAccountId: accountId,
+    action: oneOf(['end', 'transfer']),
+    guardianAccountId: optional(accountId),
+    evidenceReference: string(trim, minLength(1), maxLength(2048)),
+    reauth: reauthProofCheck,
+}));
+/* -------------------------------------------------------------------------- */
+/*  Minimal identities for the management screens                            */
+/* -------------------------------------------------------------------------- */
+const safetyPersonCheck = exact()(strictObject({ accountId, username: nullable(string()), displayName: nullable(string()) }));
+export const safetyPeopleInputCheck = exact()(union(strictObject({ query: string(trim, minLength(2), maxLength(100)) }), strictObject({ accountIds: uniqueIds(100) })));
+export const safetyPeopleResponseCheck = exact()(strictObject({ items: array(safetyPersonCheck, maxItems(100)) }));
+export const safetyOrganizationsInputCheck = exact()(union(strictObject({
+    query: string(trim, minLength(1), maxLength(100)),
+    limit: optional(number(int, atLeast(1), atMost(20))),
+}), strictObject({ ids: uniqueIds(100) })));
+export const safetyOrganizationsResponseCheck = exact()(strictObject({
+    items: array(strictObject({
+        requestedAccountId: accountId,
+        organization: strictObject({
+            accountId,
+            username: nullable(string()),
+            name: string(),
+            organizationType: oneOf(ORGANIZATION_TYPES),
+        }),
+    }), maxItems(100)),
+    missingIds: array(accountId, maxItems(100)),
+}));
+/* -------------------------------------------------------------------------- */
+/*  Purchase approvals                                                        */
+/* -------------------------------------------------------------------------- */
+const fingerprint = string(pattern(/^[a-f0-9]{64}$/));
+const minorUnits = number(int, nonnegative, atMost(Number.MAX_SAFE_INTEGER));
+const purchaseApprovalLineCheck = exact()(strictObject({
+    itemReference: resourceId,
+    title: string(trim, minLength(1), maxLength(300)),
+    optionsText: string(trim, maxLength(300)),
+    merchantAccountId: accountId,
+    quantity: number(int, atLeast(1), atMost(1000000)),
+    unitAmountMinor: minorUnits,
+    lineAmountMinor: minorUnits,
+}));
+/** The effect fields every approval shape shares, in the schema's key order. */
+const purchaseEffectFields = {
+    operationId: resourceId,
+    resourceId,
+    cartFingerprint: fingerprint,
+    summary: string(trim, minLength(1), maxLength(300)),
+    merchantAccountIds: transform(refine(array(accountId, minItems(1), maxItems(100)), (ids) => new Set(ids).size === ids.length, 'Merchant accounts must be unique'), (ids) => [...ids].sort()),
+};
+const purchaseAmountFields = {
+    shippingMinor: minorUnits,
+    taxMinor: minorUnits,
+    discountMinor: minorUnits,
+    roundingAdjustmentMinor: number(int, atLeast(-Number.MAX_SAFE_INTEGER), atMost(Number.MAX_SAFE_INTEGER)),
+    paymentFingerprint: fingerprint,
+    amountMinor: minorUnits,
+    currency: string(pattern(/^[A-Z]{3}$/)),
+    expiresAt: string(datetime),
+};
+const purchaseApprovalFields = {
+    id: accountId,
+    childAccountId: accountId,
+    applicationId: accountId,
+    status: oneOf(PURCHASE_APPROVAL_STATUSES),
+    createdAt: string(datetime),
+    receiptReference: nullable(string(maxLength(512))),
+};
+/** The first problem `validatePurchaseEvidence` in `../safety.ts` reports, in its order. */
+function purchaseEvidenceProblem(value) {
+    const merchants = new Set(value.merchantAccountIds);
+    const references = new Set();
+    for (const line of value.lineItems) {
+        const key = `${line.merchantAccountId}:${line.itemReference}`;
+        if (!merchants.has(line.merchantAccountId) || references.has(key)) {
+            return {
+                path: [],
+                message: 'Purchase lines must name an included merchant and unique item reference',
+            };
+        }
+        references.add(key);
+    }
+    if (merchants.size !== new Set(value.lineItems.map((line) => line.merchantAccountId)).size) {
+        return { path: [], message: 'Every merchant must have an approval line' };
+    }
+    const total = value.lineItems.reduce((sum, line) => sum + BigInt(line.lineAmountMinor), 0n) +
+        BigInt(value.shippingMinor) +
+        BigInt(value.taxMinor) -
+        BigInt(value.discountMinor) +
+        BigInt(value.roundingAdjustmentMinor);
+    if (total < 0n ||
+        total > BigInt(Number.MAX_SAFE_INTEGER) ||
+        total !== BigInt(value.amountMinor)) {
+        return { path: [], message: 'Approval evidence must equal the exact payment total' };
+    }
+    if (Math.abs(value.roundingAdjustmentMinor) >
+        value.lineItems.length + 3 * value.merchantAccountIds.length) {
+        return { path: [], message: 'Rounding adjustment exceeds the bounded conversion stages' };
+    }
+    return undefined;
+}
+export const purchaseApprovalCheck = exact()(refineAt(strictObject({
+    ...purchaseEffectFields,
+    lineItems: array(purchaseApprovalLineCheck, minItems(1), maxItems(200)),
+    ...purchaseAmountFields,
+    ...purchaseApprovalFields,
+}), purchaseEvidenceProblem));
+const purchaseApprovalSummaryCheck = exact()(strictObject({ ...purchaseEffectFields, ...purchaseAmountFields, ...purchaseApprovalFields }));
+export const purchaseApprovalListCheck = exact()(strictObject({
+    items: array(purchaseApprovalSummaryCheck, maxItems(100)),
+    nextCursor: nullable(string()),
+}));
+export const purchaseReviewInputCheck = exact()(strictObject({ decision: oneOf(['approved', 'rejected']), reauth: reauthProofCheck }));

package/dist/esm/client/signIn.js

@@ -64,6 +64,8 @@ export const REAUTH_ACTIONS = [
     'link_commons',
     'delete_account',
     'credentials_manage',
+    'supervision',
+    'supervision_purchase',
 ];
 /**
  * Stable error codes (`error.code` in the API error body). Clients map these