@oxy.so/contracts 4.17.0 → 4.22.0

package/dist/esm/contentClaims.js

@@ -0,0 +1,229 @@
+/**
+ * Content claims (ADR 0043 D10): the public "Report content / rights claim"
+ * intake, `POST /content-claims`, and the staff review of a claim.
+ *
+ * {@link contentClaimSubmissionSchema} is the request body the API parses and
+ * the Oxy website validates its form with before posting, so the form cannot
+ * accept what the API would answer 400 to. Every validation message is a
+ * stable KEY under `contentClaim.errors.*` (filled with
+ * {@link CONTENT_CLAIM_LIMITS} by whoever shows it), never English: the website
+ * translates the key, and the API answers its own English sentence for it in
+ * `fields`.
+ */
+import { z } from 'zod';
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// it is re-exported here so the root entry carries the whole contract.
+import { CLAIMANT_RELATIONSHIPS, CONTENT_CLAIM_COUNTER_NOTICE_LIMITS, CONTENT_CLAIM_KINDS, CONTENT_CLAIM_LIMITS, CONTENT_CLAIM_REFERENCE_PATTERN, } from './client/contentClaims.js';
+export { CLAIMANT_RELATIONSHIPS, CLOSED_CONTENT_CLAIM_STATES, CONTENT_CLAIM_COUNTER_NOTICE_LIMITS, CONTENT_CLAIM_ERROR_CODES, CONTENT_CLAIM_KINDS, CONTENT_CLAIM_LIMITS, CONTENT_CLAIM_REFERENCE_PATTERN, CONTENT_CLAIM_STATES, COUNTER_NOTICE_STATEMENT_VERSION, COUNTER_NOTICE_STATEMENTS, ERASURE_REQUEST_DEADLINE_DAYS, OPEN_CONTENT_CLAIM_STATES, isErasureRequest, isRightsClaim, } from './client/contentClaims.js';
+/** Every key a submission's validation can produce, under `contentClaim.errors.*`. */
+export const CONTENT_CLAIM_VALIDATION_KEYS = [
+    'contentClaim.errors.kind',
+    'contentClaim.errors.contentUrlsRequired',
+    'contentClaim.errors.contentUrlsTooMany',
+    'contentClaim.errors.contentUrlInvalid',
+    'contentClaim.errors.descriptionShort',
+    'contentClaim.errors.descriptionLong',
+    'contentClaim.errors.originalWorkUrl',
+    'contentClaim.errors.name',
+    'contentClaim.errors.email',
+    'contentClaim.errors.organization',
+    'contentClaim.errors.relationship',
+    'contentClaim.errors.goodFaith',
+    'contentClaim.errors.accurate',
+    'contentClaim.errors.signature',
+];
+function isHttpsUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' && url.hostname.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+const httpsUrl = (message) => z.string().trim().max(CONTENT_CLAIM_LIMITS.maxUrlLength, message).refine(isHttpsUrl, message);
+/**
+ * `POST /content-claims` — a claim, as the claimant sends it. Strict: an
+ * unknown key is refused rather than dropped.
+ */
+export const contentClaimSubmissionSchema = z
+    .object({
+    kind: z.enum(CONTENT_CLAIM_KINDS, { message: 'contentClaim.errors.kind' }),
+    contentUrls: z
+        .array(httpsUrl('contentClaim.errors.contentUrlInvalid'), {
+        message: 'contentClaim.errors.contentUrlsRequired',
+    })
+        .min(CONTENT_CLAIM_LIMITS.minUrls, 'contentClaim.errors.contentUrlsRequired')
+        .max(CONTENT_CLAIM_LIMITS.maxUrls, 'contentClaim.errors.contentUrlsTooMany'),
+    description: z
+        .string({ message: 'contentClaim.errors.descriptionShort' })
+        .trim()
+        .min(CONTENT_CLAIM_LIMITS.minDescription, 'contentClaim.errors.descriptionShort')
+        .max(CONTENT_CLAIM_LIMITS.maxDescription, 'contentClaim.errors.descriptionLong'),
+    originalWorkUrl: httpsUrl('contentClaim.errors.originalWorkUrl').optional(),
+    claimant: z
+        .object({
+        name: z
+            .string({ message: 'contentClaim.errors.name' })
+            .trim()
+            .min(1, 'contentClaim.errors.name')
+            .max(CONTENT_CLAIM_LIMITS.maxName, 'contentClaim.errors.name'),
+        email: z
+            .string({ message: 'contentClaim.errors.email' })
+            .trim()
+            .email('contentClaim.errors.email')
+            .max(CONTENT_CLAIM_LIMITS.maxEmail, 'contentClaim.errors.email'),
+        organization: z
+            .string({ message: 'contentClaim.errors.organization' })
+            .trim()
+            .max(CONTENT_CLAIM_LIMITS.maxOrganization, 'contentClaim.errors.organization')
+            .optional(),
+        relationship: z.enum(CLAIMANT_RELATIONSHIPS, {
+            message: 'contentClaim.errors.relationship',
+        }),
+    }, { message: 'contentClaim.errors.name' })
+        .strict(),
+    statements: z
+        .object({
+        goodFaith: z.literal(true, {
+            errorMap: () => ({ message: 'contentClaim.errors.goodFaith' }),
+        }),
+        accurate: z.literal(true, {
+            errorMap: () => ({ message: 'contentClaim.errors.accurate' }),
+        }),
+    }, { message: 'contentClaim.errors.goodFaith' })
+        .strict(),
+    signature: z
+        .string({ message: 'contentClaim.errors.signature' })
+        .trim()
+        .min(1, 'contentClaim.errors.signature')
+        .max(CONTENT_CLAIM_LIMITS.maxName, 'contentClaim.errors.signature'),
+})
+    .strict();
+// ---------------------------------------------------------------------------
+// The staff review (`/content-claims` behind the `content:claims` capability)
+// ---------------------------------------------------------------------------
+/** How a target's URL was understood. */
+export const CONTENT_CLAIM_TARGET_RESOLUTIONS = [
+    /** An Oxy file: `cloud.oxy.so/<id>`, `/cdn/<id>`, `/assets/<id>…`, a stored key. */
+    'file',
+    /** A page of an Oxy app or anything else: a person attaches the files it shows. */
+    'unresolved',
+];
+/** Who added a target: the claimant's URL, or staff attaching a file by id. */
+export const CONTENT_CLAIM_TARGET_SOURCES = ['claimant', 'staff'];
+/** What the audit trail records. */
+export const CONTENT_CLAIM_EVENT_ACTIONS = [
+    'submitted',
+    'review_started',
+    'targets_attached',
+    'targets_blocked',
+    'rejected',
+    'counter_notice_recorded',
+    /** The owner of the blocked content sent a counter-notice themselves (`POST /content-claims/counter-notices`). */
+    'counter_notice_submitted',
+    'reinstated',
+    'upheld',
+    'note_added',
+];
+// ---------------------------------------------------------------------------
+// The owner's counter-notice (`POST /content-claims/counter-notices`)
+// ---------------------------------------------------------------------------
+/** Every key a counter-notice's validation can produce, under `contentClaim.counterNotice.errors.*`. */
+export const CONTENT_CLAIM_COUNTER_NOTICE_VALIDATION_KEYS = [
+    'contentClaim.counterNotice.errors.claim',
+    'contentClaim.counterNotice.errors.reference',
+    'contentClaim.counterNotice.errors.claimId',
+    'contentClaim.counterNotice.errors.fileIds',
+    'contentClaim.counterNotice.errors.name',
+    'contentClaim.counterNotice.errors.address',
+    'contentClaim.counterNotice.errors.phone',
+    'contentClaim.counterNotice.errors.email',
+    'contentClaim.counterNotice.errors.materialDescription',
+    'contentClaim.counterNotice.errors.materialLocation',
+    'contentClaim.counterNotice.errors.explanation',
+    'contentClaim.counterNotice.errors.perjury',
+    'contentClaim.counterNotice.errors.jurisdiction',
+    'contentClaim.counterNotice.errors.serviceOfProcess',
+    'contentClaim.counterNotice.errors.disclosure',
+    'contentClaim.counterNotice.errors.signature',
+];
+const N = CONTENT_CLAIM_COUNTER_NOTICE_LIMITS;
+const boundedText = (min, max, message) => z.string({ message }).trim().min(min, message).max(max, message);
+const affirmed = (message) => z.literal(true, { errorMap: () => ({ message }) });
+/**
+ * `POST /content-claims/counter-notices` — the owner of content a claim took
+ * down disputes it (17 U.S.C. § 512(g)(3)). Signed in: the API answers only
+ * for files the caller owns.
+ *
+ * Names the claim by its `reference` (the `OXY-XXXX-XXXX` the owner was
+ * emailed), its `claimId`, or the blocked `fileIds` — at least one. With
+ * `fileIds` the notice covers exactly those files; without, every one of the
+ * caller's files the claim blocked. Strict: an unknown key is refused.
+ */
+export const contentClaimCounterNoticeSchema = z
+    .object({
+    reference: z
+        .string({ message: 'contentClaim.counterNotice.errors.reference' })
+        .trim()
+        .toUpperCase()
+        .regex(CONTENT_CLAIM_REFERENCE_PATTERN, 'contentClaim.counterNotice.errors.reference')
+        .optional(),
+    claimId: z
+        .string({ message: 'contentClaim.counterNotice.errors.claimId' })
+        .trim()
+        .uuid('contentClaim.counterNotice.errors.claimId')
+        .optional(),
+    fileIds: z
+        .array(boundedText(1, N.maxFileId, 'contentClaim.counterNotice.errors.fileIds'), {
+        message: 'contentClaim.counterNotice.errors.fileIds',
+    })
+        .min(1, 'contentClaim.counterNotice.errors.fileIds')
+        .max(N.maxFileIds, 'contentClaim.counterNotice.errors.fileIds')
+        .optional(),
+    subscriber: z
+        .object({
+        name: boundedText(1, N.maxName, 'contentClaim.counterNotice.errors.name'),
+        address: boundedText(1, N.maxAddress, 'contentClaim.counterNotice.errors.address'),
+        phone: boundedText(N.minPhone, N.maxPhone, 'contentClaim.counterNotice.errors.phone').regex(/^\+?[0-9 ().-]+$/, 'contentClaim.counterNotice.errors.phone'),
+        email: z
+            .string({ message: 'contentClaim.counterNotice.errors.email' })
+            .trim()
+            .email('contentClaim.counterNotice.errors.email')
+            .max(N.maxEmail, 'contentClaim.counterNotice.errors.email'),
+    }, { message: 'contentClaim.counterNotice.errors.name' })
+        .strict(),
+    material: z
+        .object({
+        /** What was removed. */
+        description: boundedText(N.minMaterial, N.maxMaterial, 'contentClaim.counterNotice.errors.materialDescription'),
+        /** Where it appeared before it was removed (a URL, or where in an app). */
+        location: boundedText(1, N.maxLocation, 'contentClaim.counterNotice.errors.materialLocation'),
+    }, { message: 'contentClaim.counterNotice.errors.materialDescription' })
+        .strict(),
+    /** Why it was a mistake or a misidentification, in the owner's words. */
+    explanation: boundedText(N.minExplanation, N.maxExplanation, 'contentClaim.counterNotice.errors.explanation'),
+    /** Each of `COUNTER_NOTICE_STATEMENTS`, affirmed. */
+    statements: z
+        .object({
+        perjury: affirmed('contentClaim.counterNotice.errors.perjury'),
+        jurisdiction: affirmed('contentClaim.counterNotice.errors.jurisdiction'),
+        serviceOfProcess: affirmed('contentClaim.counterNotice.errors.serviceOfProcess'),
+        disclosure: affirmed('contentClaim.counterNotice.errors.disclosure'),
+    }, { message: 'contentClaim.counterNotice.errors.perjury' })
+        .strict(),
+    /** The owner's full legal name, typed as their signature. */
+    signature: boundedText(1, N.maxSignature, 'contentClaim.counterNotice.errors.signature'),
+})
+    .strict()
+    .superRefine((value, ctx) => {
+    if (value.reference === undefined &&
+        value.claimId === undefined &&
+        value.fileIds === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['reference'],
+            message: 'contentClaim.counterNotice.errors.claim',
+        });
+    }
+});

package/dist/esm/index.js

@@ -180,13 +180,14 @@ PRODUCT_PLAN_STATUSES, productPlanStatusSchema, LIVE_PRODUCT_PLAN_STATUSES, plan
 export { 
 // Economic treatment (I09): derived by the server, never sent by a caller.
 INFERENCE_ECONOMIC_TREATMENTS, inferenceEconomicTreatmentSchema, PROVIDER_COST_SOURCES, providerCostSourceSchema, costCenterUsageSchema, } from './inference/economics.js';
-export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, executionActorRefSchema, foregroundExecutionAuthorizationInputSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, capabilityCatalogBindingSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, capabilityTicketRequestSchema, delegationGrantSchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, invocationPrincipalSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency.js';
+export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, executionActorRefSchema, foregroundExecutionAuthorizationInputSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, capabilityCatalogBindingSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, capabilityTicketRequestSchema, delegationGrantSchema, AGENT_REQUESTER_CEILING_AUTONOMY, agentRequesterCeilingWriteSchema, agentRequesterCeilingSchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, invocationPrincipalSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, catalogFeatureSchema, CATALOG_INTERNAL_TRANSPORTS, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency.js';
 export { catalogInvocationPathParameters, catalogInvocationsOverlap, catalogInvocationTemplatesEquivalent, findOverlappingCatalogInvocations, matchCatalogInvocation, resolveCatalogInvocation, } from './capabilityInvocation.js';
 export { emailContextAddressSchema, emailContextMailboxSchema, emailContextMessageSchema, emailAgentContextSchema, } from './emailAgentContext.js';
 export { inboxComposeRequestSchema, inboxDailyBriefRequestSchema, inboxDailyBriefResponseSchema, INBOX_DAILY_BRIEF_SECTIONS, inboxNaturalSearchRequestSchema, inboxMessageInferenceParamsSchema, inboxInferenceTextResponseSchema, inboxNaturalSearchResponseSchema, inboxSmartRepliesResponseSchema, inboxThreadSummaryResponseSchema, inboxInferenceStreamEventSchema, } from './inference/inbox.js';
 export * from './externalIdentity.js';
 export * from './linkedAccounts.js';
 export * from './federationInstanceFetch.js';
+export * from './accountAccess.js';
 export * from './notifications.js';
 export * from './email/messages.js';
 export * from './stickers.js';
@@ -204,3 +205,6 @@ export { personalPlanDisplayPriceSchema, personalPlanCatalogueSchema, } from './
 export * from './products/checkout.js';
 export * from './organizations.js';
 export * from './safety.js';
+export { serviceTokenScopesSchema, serviceTokenOptionsSchema, } from './serviceToken.js';
+export * from './applicationRoles.js';
+export * from './contentClaims.js';

package/dist/esm/safety.js

@@ -1,4 +1,12 @@
 import { z } from 'zod';
+import { accountActorChainSchema } from './accountSubject.js';
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// its vocabularies are re-exported here so the root entry is unchanged.
+import { PURCHASE_APPROVAL_STATUSES, SAFETY_POLICY_VERSION, SUPERVISED_ACTIONS, SUPERVISION_CONSENT_VERSION, SUPERVISION_INVITATION_STATUSES, SUPERVISION_STATUSES, } from './client/safety.js';
+import { ORGANIZATION_TYPES } from './organizations.js';
+import { reauthProofSchema } from './signIn.js';
+import { userResponseSchema } from './userResponse.js';
+export { PURCHASE_APPROVAL_STATUSES, SAFETY_POLICY_VERSION, SUPERVISED_ACTIONS, SUPERVISION_CONSENT_VERSION, SUPERVISION_INVITATION_STATUSES, SUPERVISION_STATUSES, };
 /** The requester is authenticated by the bearer; applications cannot submit viewer IDs. */
 export const profileAccessInputSchema = z
     .object({ subjectAccountId: z.string().min(1).max(128) })
@@ -10,3 +18,418 @@ export const profileAccessDecisionSchema = z
     policyVersion: z.literal('1'),
 })
     .strict();
+export const SAFETY_DECISION_REASONS = [
+    'allowed',
+    'owner',
+    'public',
+    'private',
+    'blocked',
+    'unavailable',
+    'unsupported_consumer',
+    'contact_not_approved',
+    'mature_content',
+    'unrated_content',
+    'approval_required',
+];
+const accountId = z.string().min(1).max(128);
+const resourceId = z.string().trim().min(1).max(256);
+const uniqueIds = (max, min = 1) => z
+    .array(accountId)
+    .min(min)
+    .max(max)
+    .refine((ids) => new Set(ids).size === ids.length, 'Account IDs must be unique');
+export const safetyDecisionSchema = z
+    .object({
+    allowed: z.boolean(),
+    reason: z.enum(SAFETY_DECISION_REASONS),
+    policyVersion: z.literal(SAFETY_POLICY_VERSION),
+})
+    .strict();
+export const profileAccessBatchInputSchema = z
+    .object({ subjectAccountIds: uniqueIds(100) })
+    .strict();
+export const profileAccessBatchResponseSchema = z
+    .object({
+    items: z
+        .array(z
+        .object({
+        subjectAccountId: accountId,
+        decision: safetyDecisionSchema,
+    })
+        .strict())
+        .max(100),
+})
+    .strict();
+export const MESSAGE_ACCESS_MAX_RESOURCES = 100;
+export const MESSAGE_ACCESS_MAX_PARTICIPANTS = 1024;
+export const MESSAGE_ACCESS_MAX_SUPERVISED_PARTICIPANTS = 256;
+export const MESSAGE_ACCESS_MAX_PARTICIPANT_SLOTS = 4096;
+/** Leaves room for the original requester proof in a 512 KiB request. */
+export const MESSAGE_ACCESS_MAX_INPUT_BYTES = 448 * 1024;
+export const messageAccessInputSchema = z
+    .object({ participantAccountIds: uniqueIds(MESSAGE_ACCESS_MAX_PARTICIPANTS), resourceId })
+    .strict();
+export const contactAccessInputSchema = z.object({ targetAccountIds: uniqueIds(1000) }).strict();
+export const contactAccessResponseSchema = z
+    .object({
+    items: z
+        .array(z
+        .object({
+        targetAccountId: accountId,
+        decision: safetyDecisionSchema,
+    })
+        .strict())
+        .max(1000),
+})
+    .strict();
+export const CONTENT_CLASSIFICATIONS = ['general', 'mature', 'unrated'];
+export const contentAccessInputSchema = z
+    .object({
+    resourceId,
+    classification: z.enum(CONTENT_CLASSIFICATIONS),
+    authorAccountId: accountId.optional(),
+    audience: z.enum(['public', 'private', 'followers']).optional(),
+    applicationAudienceAllowed: z.boolean().optional(),
+    applicationResourceGrant: z.boolean().optional(),
+    operation: z.enum(['read', 'manage_own']).optional(),
+})
+    .strict()
+    .refine((item) => !item.audience ||
+    item.audience === 'public' ||
+    (!!item.authorAccountId && item.applicationAudienceAllowed !== undefined), 'Nonpublic content requires its authoritative author and application audience decision')
+    .refine((item) => item.operation !== 'manage_own' || !!item.authorAccountId, 'Own management requires its authoritative author');
+export const publicationPolicySchema = z
+    .object({
+    publicationAllowed: z.boolean(),
+    requiredAudience: z.literal('private').nullable(),
+    collaborationAllowed: z.boolean(),
+    federationAllowed: z.boolean(),
+    policyVersion: z.literal(SAFETY_POLICY_VERSION),
+})
+    .strict();
+export const publicationPoliciesInputSchema = z
+    .object({
+    authorAccountIds: z
+        .array(accountId)
+        .min(1)
+        .max(100)
+        .refine((ids) => new Set(ids).size === ids.length, 'Author IDs must be unique'),
+})
+    .strict();
+export const publicationPoliciesResponseSchema = z
+    .object({
+    items: z
+        .array(z.object({ authorAccountId: accountId, policy: publicationPolicySchema }).strict())
+        .max(100),
+})
+    .strict();
+export const contentAccessBatchInputSchema = z
+    .object({
+    items: z
+        .array(contentAccessInputSchema)
+        .min(1)
+        .max(100)
+        .refine((items) => new Set(items.map((item) => item.resourceId)).size === items.length, 'Resource IDs must be unique'),
+})
+    .strict();
+export const contentAccessBatchResponseSchema = z
+    .object({
+    items: z
+        .array(z
+        .object({
+        resourceId,
+        decision: safetyDecisionSchema,
+    })
+        .strict())
+        .max(100),
+})
+    .strict();
+/** A reviewed background consumer may decide delivery, but never authenticate as the sender. */
+export const deliveryAccessInputSchema = messageAccessInputSchema
+    .extend({ senderAccountId: accountId })
+    .strict();
+/** Count repeated participants across resources too: this bounds both graph and pair evaluations. */
+const messageBatch = (schema) => z
+    .object({ items: z.array(schema).min(1).max(MESSAGE_ACCESS_MAX_RESOURCES) })
+    .strict()
+    .refine((value) => new Set(value.items.map((item) => item.resourceId)).size === value.items.length, 'Resource IDs must be unique')
+    .refine((value) => value.items.reduce((total, item) => total + item.participantAccountIds.length, 0) <=
+    MESSAGE_ACCESS_MAX_PARTICIPANT_SLOTS, 'Participant budget exceeded')
+    .refine((value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <=
+    MESSAGE_ACCESS_MAX_INPUT_BYTES, 'Message batch byte budget exceeded');
+export const messageAccessBatchInputSchema = messageBatch(messageAccessInputSchema);
+export const deliveryAccessBatchInputSchema = messageBatch(deliveryAccessInputSchema);
+export const messageAccessBatchResponseSchema = contentAccessBatchResponseSchema;
+/** Live socket-recipient proof; a request ID correlates the result and never identifies an account. */
+export const messagingSessionsInputSchema = z
+    .object({
+    items: z
+        .array(z
+        .object({
+        requestId: resourceId,
+        accessToken: z.string().min(1).max(16384),
+    })
+        .strict())
+        .min(1)
+        .max(100),
+})
+    .strict()
+    .refine((value) => new Set(value.items.map((item) => item.requestId)).size === value.items.length, 'Request IDs must be unique')
+    .refine((value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= MESSAGE_ACCESS_MAX_INPUT_BYTES, 'Session proof byte budget exceeded');
+export const messagingSessionsResponseSchema = z
+    .object({
+    items: z
+        .array(z.discriminatedUnion('allowed', [
+        z.object({ requestId: resourceId, allowed: z.literal(true), accountId }).strict(),
+        z.object({ requestId: resourceId, allowed: z.literal(false) }).strict(),
+    ]))
+        .max(100),
+})
+    .strict();
+export const safetyRequesterSchema = z.union([
+    z.object({ accessToken: z.string().min(1).max(16384).nullable() }).strict(),
+    z.object({ connectionToken: z.string().min(1).max(16384) }).strict(),
+]);
+export const supervisionSchema = z
+    .object({
+    childAccountId: accountId,
+    guardianAccountId: accountId.nullable(),
+    status: z.enum(SUPERVISION_STATUSES),
+    policyVersion: z.literal(SAFETY_POLICY_VERSION),
+    consentVersion: z.literal(SUPERVISION_CONSENT_VERSION),
+    createdAt: z.string().datetime(),
+})
+    .strict();
+export const supervisionInvitationSchema = z
+    .object({
+    id: accountId,
+    childAccountId: accountId,
+    guardianAccountId: accountId,
+    status: z.enum(SUPERVISION_INVITATION_STATUSES),
+    expiresAt: z.string().datetime(),
+    consentVersion: z.literal(SUPERVISION_CONSENT_VERSION),
+    createdAt: z.string().datetime(),
+})
+    .strict();
+export const supervisionContactSchema = z
+    .object({
+    childAccountId: accountId,
+    contactAccountId: accountId,
+    approvedAt: z.string().datetime(),
+})
+    .strict();
+export const supervisionStateSchema = z
+    .object({
+    self: supervisionSchema.nullable(),
+    children: z.array(supervisionSchema).max(100),
+    invitations: z.array(supervisionInvitationSchema).max(100),
+})
+    .strict();
+export const supervisionContactsResponseSchema = z
+    .object({ items: z.array(supervisionContactSchema).max(1000) })
+    .strict();
+const fingerprint = z.string().regex(/^[a-f0-9]{64}$/);
+const minorUnits = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+export const purchaseApprovalLineSchema = z
+    .object({
+    itemReference: resourceId,
+    title: z.string().trim().min(1).max(300),
+    optionsText: z.string().trim().max(300),
+    merchantAccountId: accountId,
+    quantity: z.number().int().min(1).max(1000000),
+    unitAmountMinor: minorUnits,
+    lineAmountMinor: minorUnits,
+})
+    .strict();
+const purchaseEffectsObject = z
+    .object({
+    operationId: resourceId,
+    resourceId,
+    cartFingerprint: fingerprint,
+    summary: z.string().trim().min(1).max(300),
+    merchantAccountIds: z
+        .array(accountId)
+        .min(1)
+        .max(100)
+        .refine((ids) => new Set(ids).size === ids.length, 'Merchant accounts must be unique')
+        .transform((ids) => [...ids].sort()),
+    lineItems: z.array(purchaseApprovalLineSchema).min(1).max(200),
+    shippingMinor: minorUnits,
+    taxMinor: minorUnits,
+    discountMinor: minorUnits,
+    roundingAdjustmentMinor: z
+        .number()
+        .int()
+        .min(-Number.MAX_SAFE_INTEGER)
+        .max(Number.MAX_SAFE_INTEGER),
+    paymentFingerprint: fingerprint,
+    amountMinor: minorUnits,
+    currency: z.string().regex(/^[A-Z]{3}$/),
+    expiresAt: z.string().datetime(),
+})
+    .strict();
+function validatePurchaseEvidence(value, ctx) {
+    const merchants = new Set(value.merchantAccountIds);
+    const references = new Set();
+    for (const line of value.lineItems) {
+        const key = `${line.merchantAccountId}:${line.itemReference}`;
+        if (!merchants.has(line.merchantAccountId) || references.has(key))
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'Purchase lines must name an included merchant and unique item reference',
+            });
+        references.add(key);
+    }
+    if (merchants.size !== new Set(value.lineItems.map((line) => line.merchantAccountId)).size)
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'Every merchant must have an approval line',
+        });
+    const total = value.lineItems.reduce((sum, line) => sum + BigInt(line.lineAmountMinor), 0n) +
+        BigInt(value.shippingMinor) +
+        BigInt(value.taxMinor) -
+        BigInt(value.discountMinor) +
+        BigInt(value.roundingAdjustmentMinor);
+    if (total < 0n || total > BigInt(Number.MAX_SAFE_INTEGER) || total !== BigInt(value.amountMinor))
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'Approval evidence must equal the exact payment total',
+        });
+    if (Math.abs(value.roundingAdjustmentMinor) >
+        value.lineItems.length + 3 * value.merchantAccountIds.length)
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'Rounding adjustment exceeds the bounded conversion stages',
+        });
+}
+export const purchaseEffectsSchema = purchaseEffectsObject.superRefine(validatePurchaseEvidence);
+const purchaseApprovalFields = {
+    id: accountId,
+    childAccountId: accountId,
+    applicationId: accountId,
+    status: z.enum(PURCHASE_APPROVAL_STATUSES),
+    createdAt: z.string().datetime(),
+    receiptReference: z.string().max(512).nullable(),
+};
+export const purchaseApprovalSchema = purchaseEffectsObject
+    .extend(purchaseApprovalFields)
+    .strict()
+    .superRefine(validatePurchaseEvidence);
+export const purchaseApprovalSummarySchema = purchaseEffectsObject
+    .omit({ lineItems: true })
+    .extend(purchaseApprovalFields)
+    .strict();
+export const purchaseApprovalListSchema = z
+    .object({
+    items: z.array(purchaseApprovalSummarySchema).max(100),
+    nextCursor: z.string().nullable(),
+})
+    .strict();
+export const reservePurchaseSchema = purchaseEffectsObject
+    .extend({ approvalId: accountId })
+    .strict()
+    .superRefine(validatePurchaseEvidence);
+export const confirmPurchaseSchema = z
+    .object({
+    approvalId: accountId,
+    operationId: resourceId,
+    receiptReference: z.string().trim().min(1).max(512),
+})
+    .strict();
+export const cancelPurchaseSchema = confirmPurchaseSchema.omit({ receiptReference: true });
+export const SAFETY_ERROR_CODES = [
+    'bad_request',
+    'validation_failed',
+    'unauthorized',
+    'forbidden',
+    'not_found',
+    'conflict',
+    'reauth_required',
+    'limit_reached',
+    'service_unavailable',
+    'rate_limited',
+];
+export const safetyErrorSchema = z
+    .object({ error: z.object({ code: z.enum(SAFETY_ERROR_CODES), message: z.string() }).strict() })
+    .strict();
+export const supervisionInviteInputSchema = z
+    .object({
+    guardianAccountId: accountId,
+    consentVersion: z.literal(SUPERVISION_CONSENT_VERSION),
+    reauth: reauthProofSchema,
+})
+    .strict();
+export const supervisionAcceptInputSchema = z
+    .object({ consentVersion: z.literal(SUPERVISION_CONSENT_VERSION), reauth: reauthProofSchema })
+    .strict();
+export const supervisionContactInputSchema = z
+    .object({ childAccountId: accountId, contactAccountId: accountId, reauth: reauthProofSchema })
+    .strict();
+export const supervisionReviewInputSchema = z
+    .object({
+    childAccountId: accountId,
+    action: z.enum(['end', 'transfer']),
+    guardianAccountId: accountId.optional(),
+    evidenceReference: z.string().trim().min(1).max(2048),
+    reauth: reauthProofSchema,
+})
+    .strict();
+export const purchaseReviewInputSchema = z
+    .object({ decision: z.enum(['approved', 'rejected']), reauth: reauthProofSchema })
+    .strict();
+export const safetySessionInputSchema = z
+    .object({
+    sessionId: accountId,
+    accessToken: z.string().min(1).max(16384),
+    action: z.enum(SUPERVISED_ACTIONS),
+})
+    .strict();
+export const safetySessionValidationSchema = z
+    .object({
+    valid: z.literal(true),
+    sessionId: accountId,
+    expiresAt: z.string().datetime(),
+    lastActivity: z.string().datetime(),
+    user: userResponseSchema,
+    actor: accountActorChainSchema,
+})
+    .strict();
+/** Minimal identity for the authenticated account's supervision management, never profile details. */
+export const safetyPersonSchema = z
+    .object({ accountId, username: z.string().nullable(), displayName: z.string().nullable() })
+    .strict();
+export const safetyPeopleInputSchema = z.union([
+    z.object({ query: z.string().trim().min(2).max(100) }).strict(),
+    z.object({ accountIds: uniqueIds(100) }).strict(),
+]);
+export const safetyPeopleResponseSchema = z
+    .object({ items: z.array(safetyPersonSchema).max(100) })
+    .strict();
+/** Existing public employer identity only; never directory content or management authority. */
+export const safetyOrganizationIdentitySchema = z
+    .object({
+    accountId,
+    username: z.string().nullable(),
+    name: z.string(),
+    organizationType: z.enum(ORGANIZATION_TYPES),
+})
+    .strict();
+export const safetyOrganizationsInputSchema = z.union([
+    z
+        .object({
+        query: z.string().trim().min(1).max(100),
+        limit: z.number().int().min(1).max(20).optional(),
+    })
+        .strict(),
+    z.object({ ids: uniqueIds(100) }).strict(),
+]);
+export const safetyOrganizationsResponseSchema = z
+    .object({
+    items: z
+        .array(z
+        .object({ requestedAccountId: accountId, organization: safetyOrganizationIdentitySchema })
+        .strict())
+        .max(100),
+    missingIds: z.array(accountId).max(100),
+})
+    .strict();