@oxy.so/contracts 4.21.0 → 4.22.0

package/dist/esm/contentClaims.js

@@ -0,0 +1,229 @@
+/**
+ * Content claims (ADR 0043 D10): the public "Report content / rights claim"
+ * intake, `POST /content-claims`, and the staff review of a claim.
+ *
+ * {@link contentClaimSubmissionSchema} is the request body the API parses and
+ * the Oxy website validates its form with before posting, so the form cannot
+ * accept what the API would answer 400 to. Every validation message is a
+ * stable KEY under `contentClaim.errors.*` (filled with
+ * {@link CONTENT_CLAIM_LIMITS} by whoever shows it), never English: the website
+ * translates the key, and the API answers its own English sentence for it in
+ * `fields`.
+ */
+import { z } from 'zod';
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// it is re-exported here so the root entry carries the whole contract.
+import { CLAIMANT_RELATIONSHIPS, CONTENT_CLAIM_COUNTER_NOTICE_LIMITS, CONTENT_CLAIM_KINDS, CONTENT_CLAIM_LIMITS, CONTENT_CLAIM_REFERENCE_PATTERN, } from './client/contentClaims.js';
+export { CLAIMANT_RELATIONSHIPS, CLOSED_CONTENT_CLAIM_STATES, CONTENT_CLAIM_COUNTER_NOTICE_LIMITS, CONTENT_CLAIM_ERROR_CODES, CONTENT_CLAIM_KINDS, CONTENT_CLAIM_LIMITS, CONTENT_CLAIM_REFERENCE_PATTERN, CONTENT_CLAIM_STATES, COUNTER_NOTICE_STATEMENT_VERSION, COUNTER_NOTICE_STATEMENTS, ERASURE_REQUEST_DEADLINE_DAYS, OPEN_CONTENT_CLAIM_STATES, isErasureRequest, isRightsClaim, } from './client/contentClaims.js';
+/** Every key a submission's validation can produce, under `contentClaim.errors.*`. */
+export const CONTENT_CLAIM_VALIDATION_KEYS = [
+    'contentClaim.errors.kind',
+    'contentClaim.errors.contentUrlsRequired',
+    'contentClaim.errors.contentUrlsTooMany',
+    'contentClaim.errors.contentUrlInvalid',
+    'contentClaim.errors.descriptionShort',
+    'contentClaim.errors.descriptionLong',
+    'contentClaim.errors.originalWorkUrl',
+    'contentClaim.errors.name',
+    'contentClaim.errors.email',
+    'contentClaim.errors.organization',
+    'contentClaim.errors.relationship',
+    'contentClaim.errors.goodFaith',
+    'contentClaim.errors.accurate',
+    'contentClaim.errors.signature',
+];
+function isHttpsUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' && url.hostname.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+const httpsUrl = (message) => z.string().trim().max(CONTENT_CLAIM_LIMITS.maxUrlLength, message).refine(isHttpsUrl, message);
+/**
+ * `POST /content-claims` — a claim, as the claimant sends it. Strict: an
+ * unknown key is refused rather than dropped.
+ */
+export const contentClaimSubmissionSchema = z
+    .object({
+    kind: z.enum(CONTENT_CLAIM_KINDS, { message: 'contentClaim.errors.kind' }),
+    contentUrls: z
+        .array(httpsUrl('contentClaim.errors.contentUrlInvalid'), {
+        message: 'contentClaim.errors.contentUrlsRequired',
+    })
+        .min(CONTENT_CLAIM_LIMITS.minUrls, 'contentClaim.errors.contentUrlsRequired')
+        .max(CONTENT_CLAIM_LIMITS.maxUrls, 'contentClaim.errors.contentUrlsTooMany'),
+    description: z
+        .string({ message: 'contentClaim.errors.descriptionShort' })
+        .trim()
+        .min(CONTENT_CLAIM_LIMITS.minDescription, 'contentClaim.errors.descriptionShort')
+        .max(CONTENT_CLAIM_LIMITS.maxDescription, 'contentClaim.errors.descriptionLong'),
+    originalWorkUrl: httpsUrl('contentClaim.errors.originalWorkUrl').optional(),
+    claimant: z
+        .object({
+        name: z
+            .string({ message: 'contentClaim.errors.name' })
+            .trim()
+            .min(1, 'contentClaim.errors.name')
+            .max(CONTENT_CLAIM_LIMITS.maxName, 'contentClaim.errors.name'),
+        email: z
+            .string({ message: 'contentClaim.errors.email' })
+            .trim()
+            .email('contentClaim.errors.email')
+            .max(CONTENT_CLAIM_LIMITS.maxEmail, 'contentClaim.errors.email'),
+        organization: z
+            .string({ message: 'contentClaim.errors.organization' })
+            .trim()
+            .max(CONTENT_CLAIM_LIMITS.maxOrganization, 'contentClaim.errors.organization')
+            .optional(),
+        relationship: z.enum(CLAIMANT_RELATIONSHIPS, {
+            message: 'contentClaim.errors.relationship',
+        }),
+    }, { message: 'contentClaim.errors.name' })
+        .strict(),
+    statements: z
+        .object({
+        goodFaith: z.literal(true, {
+            errorMap: () => ({ message: 'contentClaim.errors.goodFaith' }),
+        }),
+        accurate: z.literal(true, {
+            errorMap: () => ({ message: 'contentClaim.errors.accurate' }),
+        }),
+    }, { message: 'contentClaim.errors.goodFaith' })
+        .strict(),
+    signature: z
+        .string({ message: 'contentClaim.errors.signature' })
+        .trim()
+        .min(1, 'contentClaim.errors.signature')
+        .max(CONTENT_CLAIM_LIMITS.maxName, 'contentClaim.errors.signature'),
+})
+    .strict();
+// ---------------------------------------------------------------------------
+// The staff review (`/content-claims` behind the `content:claims` capability)
+// ---------------------------------------------------------------------------
+/** How a target's URL was understood. */
+export const CONTENT_CLAIM_TARGET_RESOLUTIONS = [
+    /** An Oxy file: `cloud.oxy.so/<id>`, `/cdn/<id>`, `/assets/<id>…`, a stored key. */
+    'file',
+    /** A page of an Oxy app or anything else: a person attaches the files it shows. */
+    'unresolved',
+];
+/** Who added a target: the claimant's URL, or staff attaching a file by id. */
+export const CONTENT_CLAIM_TARGET_SOURCES = ['claimant', 'staff'];
+/** What the audit trail records. */
+export const CONTENT_CLAIM_EVENT_ACTIONS = [
+    'submitted',
+    'review_started',
+    'targets_attached',
+    'targets_blocked',
+    'rejected',
+    'counter_notice_recorded',
+    /** The owner of the blocked content sent a counter-notice themselves (`POST /content-claims/counter-notices`). */
+    'counter_notice_submitted',
+    'reinstated',
+    'upheld',
+    'note_added',
+];
+// ---------------------------------------------------------------------------
+// The owner's counter-notice (`POST /content-claims/counter-notices`)
+// ---------------------------------------------------------------------------
+/** Every key a counter-notice's validation can produce, under `contentClaim.counterNotice.errors.*`. */
+export const CONTENT_CLAIM_COUNTER_NOTICE_VALIDATION_KEYS = [
+    'contentClaim.counterNotice.errors.claim',
+    'contentClaim.counterNotice.errors.reference',
+    'contentClaim.counterNotice.errors.claimId',
+    'contentClaim.counterNotice.errors.fileIds',
+    'contentClaim.counterNotice.errors.name',
+    'contentClaim.counterNotice.errors.address',
+    'contentClaim.counterNotice.errors.phone',
+    'contentClaim.counterNotice.errors.email',
+    'contentClaim.counterNotice.errors.materialDescription',
+    'contentClaim.counterNotice.errors.materialLocation',
+    'contentClaim.counterNotice.errors.explanation',
+    'contentClaim.counterNotice.errors.perjury',
+    'contentClaim.counterNotice.errors.jurisdiction',
+    'contentClaim.counterNotice.errors.serviceOfProcess',
+    'contentClaim.counterNotice.errors.disclosure',
+    'contentClaim.counterNotice.errors.signature',
+];
+const N = CONTENT_CLAIM_COUNTER_NOTICE_LIMITS;
+const boundedText = (min, max, message) => z.string({ message }).trim().min(min, message).max(max, message);
+const affirmed = (message) => z.literal(true, { errorMap: () => ({ message }) });
+/**
+ * `POST /content-claims/counter-notices` — the owner of content a claim took
+ * down disputes it (17 U.S.C. § 512(g)(3)). Signed in: the API answers only
+ * for files the caller owns.
+ *
+ * Names the claim by its `reference` (the `OXY-XXXX-XXXX` the owner was
+ * emailed), its `claimId`, or the blocked `fileIds` — at least one. With
+ * `fileIds` the notice covers exactly those files; without, every one of the
+ * caller's files the claim blocked. Strict: an unknown key is refused.
+ */
+export const contentClaimCounterNoticeSchema = z
+    .object({
+    reference: z
+        .string({ message: 'contentClaim.counterNotice.errors.reference' })
+        .trim()
+        .toUpperCase()
+        .regex(CONTENT_CLAIM_REFERENCE_PATTERN, 'contentClaim.counterNotice.errors.reference')
+        .optional(),
+    claimId: z
+        .string({ message: 'contentClaim.counterNotice.errors.claimId' })
+        .trim()
+        .uuid('contentClaim.counterNotice.errors.claimId')
+        .optional(),
+    fileIds: z
+        .array(boundedText(1, N.maxFileId, 'contentClaim.counterNotice.errors.fileIds'), {
+        message: 'contentClaim.counterNotice.errors.fileIds',
+    })
+        .min(1, 'contentClaim.counterNotice.errors.fileIds')
+        .max(N.maxFileIds, 'contentClaim.counterNotice.errors.fileIds')
+        .optional(),
+    subscriber: z
+        .object({
+        name: boundedText(1, N.maxName, 'contentClaim.counterNotice.errors.name'),
+        address: boundedText(1, N.maxAddress, 'contentClaim.counterNotice.errors.address'),
+        phone: boundedText(N.minPhone, N.maxPhone, 'contentClaim.counterNotice.errors.phone').regex(/^\+?[0-9 ().-]+$/, 'contentClaim.counterNotice.errors.phone'),
+        email: z
+            .string({ message: 'contentClaim.counterNotice.errors.email' })
+            .trim()
+            .email('contentClaim.counterNotice.errors.email')
+            .max(N.maxEmail, 'contentClaim.counterNotice.errors.email'),
+    }, { message: 'contentClaim.counterNotice.errors.name' })
+        .strict(),
+    material: z
+        .object({
+        /** What was removed. */
+        description: boundedText(N.minMaterial, N.maxMaterial, 'contentClaim.counterNotice.errors.materialDescription'),
+        /** Where it appeared before it was removed (a URL, or where in an app). */
+        location: boundedText(1, N.maxLocation, 'contentClaim.counterNotice.errors.materialLocation'),
+    }, { message: 'contentClaim.counterNotice.errors.materialDescription' })
+        .strict(),
+    /** Why it was a mistake or a misidentification, in the owner's words. */
+    explanation: boundedText(N.minExplanation, N.maxExplanation, 'contentClaim.counterNotice.errors.explanation'),
+    /** Each of `COUNTER_NOTICE_STATEMENTS`, affirmed. */
+    statements: z
+        .object({
+        perjury: affirmed('contentClaim.counterNotice.errors.perjury'),
+        jurisdiction: affirmed('contentClaim.counterNotice.errors.jurisdiction'),
+        serviceOfProcess: affirmed('contentClaim.counterNotice.errors.serviceOfProcess'),
+        disclosure: affirmed('contentClaim.counterNotice.errors.disclosure'),
+    }, { message: 'contentClaim.counterNotice.errors.perjury' })
+        .strict(),
+    /** The owner's full legal name, typed as their signature. */
+    signature: boundedText(1, N.maxSignature, 'contentClaim.counterNotice.errors.signature'),
+})
+    .strict()
+    .superRefine((value, ctx) => {
+    if (value.reference === undefined &&
+        value.claimId === undefined &&
+        value.fileIds === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['reference'],
+            message: 'contentClaim.counterNotice.errors.claim',
+        });
+    }
+});

package/dist/esm/index.js

@@ -207,3 +207,4 @@ export * from './organizations.js';
 export * from './safety.js';
 export { serviceTokenScopesSchema, serviceTokenOptionsSchema, } from './serviceToken.js';
 export * from './applicationRoles.js';
+export * from './contentClaims.js';

package/dist/types/client/contentClaims.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Content claims (ADR 0043 D10) — the constants of the public "Report content
+ * / rights claim" intake and of a claim's review, without Zod. Schemas:
+ * `../contentClaims.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+/** What a claim asserts. */
+export declare const CONTENT_CLAIM_KINDS: readonly ["copyright", "trademark", "privacy", "illegal_content", "other"];
+export type ContentClaimKind = (typeof CONTENT_CLAIM_KINDS)[number];
+/** Who the claimant is to the content. */
+export declare const CLAIMANT_RELATIONSHIPS: readonly ["rights_holder", "authorized_agent", "affected_person", "other"];
+export type ClaimantRelationship = (typeof CLAIMANT_RELATIONSHIPS)[number];
+/** The bounds of a submission. The website fills its validation messages from these. */
+export declare const CONTENT_CLAIM_LIMITS: {
+    readonly minUrls: 1;
+    readonly maxUrls: 20;
+    readonly maxUrlLength: 2048;
+    readonly minDescription: 20;
+    readonly maxDescription: 5000;
+    readonly maxName: 200;
+    readonly maxOrganization: 200;
+    readonly maxEmail: 254;
+};
+/**
+ * Where a claim is in its review.
+ *
+ * `received → reviewing → actioned | rejected`; an actioned claim can be
+ * answered by the content's owner (`counter_noticed`), which ends either in
+ * `reinstated` (the content is served again) or `upheld` (it stays blocked).
+ * A claim can also be rejected straight from `received`.
+ */
+export declare const CONTENT_CLAIM_STATES: readonly ["received", "reviewing", "actioned", "rejected", "counter_noticed", "reinstated", "upheld"];
+export type ContentClaimState = (typeof CONTENT_CLAIM_STATES)[number];
+/** The states in which a claim is still open: its evidence is kept and its blocks can change. */
+export declare const OPEN_CONTENT_CLAIM_STATES: readonly ["received", "reviewing", "actioned", "counter_noticed"];
+/** The states a claim ends in. */
+export declare const CLOSED_CONTENT_CLAIM_STATES: readonly ["rejected", "reinstated", "upheld"];
+/**
+ * The kinds whose claimant asserts a right in a work or a mark. Only these
+ * carry the link to the original — a privacy or illegal-content report
+ * asserts no ownership.
+ */
+export declare function isRightsClaim(kind: ContentClaimKind): boolean;
+/**
+ * A request to erase the claimant's OWN personal data (GDPR art. 17): a
+ * privacy claim made by the person it is about. Oxy must answer it within one
+ * month (art. 12(3)); the claim carries that deadline.
+ */
+export declare function isErasureRequest(kind: ContentClaimKind, relationship: ClaimantRelationship): boolean;
+/** Days Oxy has to answer an erasure request ({@link isErasureRequest}). */
+export declare const ERASURE_REQUEST_DEADLINE_DAYS = 30;
+/**
+ * Stable error codes a takedown produces elsewhere in the API. A file whose
+ * bytes are on the blocklist cannot be uploaded, imported or copied by anyone
+ * (HTTP 451).
+ */
+export declare const CONTENT_CLAIM_ERROR_CODES: {
+    /** The submission failed validation; `fields` names each problem. */
+    readonly invalid: "CONTENT_CLAIM_INVALID";
+    /** These exact bytes were taken down after a claim and cannot be stored again. */
+    readonly contentBlocked: "CONTENT_BLOCKED";
+    /** A counter-notice failed validation; `fields` names each problem. */
+    readonly counterNoticeInvalid: "CONTENT_CLAIM_COUNTER_NOTICE_INVALID";
+    /** The files named are blocked by more than one claim: name the claim's reference. */
+    readonly counterNoticeAmbiguous: "CONTENT_CLAIM_COUNTER_NOTICE_AMBIGUOUS";
+    /** This account already sent a counter-notice for this claim. */
+    readonly counterNoticeExists: "CONTENT_CLAIM_COUNTER_NOTICE_EXISTS";
+};
+export type ContentClaimErrorCode = (typeof CONTENT_CLAIM_ERROR_CODES)[keyof typeof CONTENT_CLAIM_ERROR_CODES];
+/**
+ * A claim's reference as the claimant and the owner are sent it:
+ * `OXY-XXXX-XXXX`, Crockford base32 (no I, L, O or U).
+ */
+export declare const CONTENT_CLAIM_REFERENCE_PATTERN: RegExp;
+/** The bounds of an owner's counter-notice. The website fills its validation messages from these. */
+export declare const CONTENT_CLAIM_COUNTER_NOTICE_LIMITS: {
+    readonly maxFileIds: 50;
+    readonly maxFileId: 64;
+    readonly maxName: 200;
+    readonly maxAddress: 500;
+    readonly minPhone: 5;
+    readonly maxPhone: 40;
+    readonly maxEmail: 254;
+    readonly minMaterial: 10;
+    readonly maxMaterial: 2000;
+    readonly maxLocation: 2048;
+    readonly minExplanation: 20;
+    readonly maxExplanation: 5000;
+    readonly maxSignature: 200;
+};
+/**
+ * The statements an owner's counter-notice makes, word for word — what the
+ * form shows beside each box (17 U.S.C. § 512(g)(3)(C) and (D), and what Oxy
+ * does with the notice). The API records {@link COUNTER_NOTICE_STATEMENT_VERSION}
+ * with every notice, so the wording a person agreed to can always be told
+ * apart from a later one. Change the text only together with the version.
+ */
+export declare const COUNTER_NOTICE_STATEMENTS: {
+    readonly perjury: "I swear, under penalty of perjury, that I have a good faith belief that the material identified above was removed or disabled as a result of a mistake or misidentification of the material to be removed or disabled.";
+    readonly jurisdiction: "I consent to the jurisdiction of the Federal District Court for the judicial district in which my address is located or, if my address is outside of the United States, any judicial district in which Oxy may be found.";
+    readonly serviceOfProcess: "I will accept service of process from the person who provided the notification of the claimed infringement, or an agent of such person.";
+    readonly disclosure: "I understand that Oxy sends a copy of this counter-notice, including my name and contact details, to the person who made the claim, as the law requires.";
+};
+/** The version of {@link COUNTER_NOTICE_STATEMENTS} in force. */
+export declare const COUNTER_NOTICE_STATEMENT_VERSION = "2026-10-16";

package/dist/types/client/index.d.ts

@@ -35,3 +35,4 @@ export { publicApplicationCheck } from './sessionStatus';
 export { EMAIL_ACCOUNTS_MAX, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_SIGNIN_LINK_TTL_MS, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, REAUTH_ACTIONS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGN_IN_ERROR_CODES, TOTP_BACKUP_CODE_COUNT, TOTP_DIGITS, TOTP_PERIOD_SECONDS, emailSignInChooseAccountCheck, emailSignInLinkResponseCheck, emailSignInPendingCheck, emailSignInStartResponseCheck, isEmailSignInChooseAccount, isSecondFactorRequired, normalizeEmailSignInCode, reauthProofCheck, secondFactorRequiredCheck, signInMethodsCheck, totpBackupCodesResponseCheck, totpEnrollResponseCheck, } from './signIn';
 export { BOT_USERNAME_INVALID_MESSAGE, BOT_USERNAME_SUFFIX, NUMERIC_USERNAME_MESSAGE, RESERVED_USERNAMES, RESERVED_USERNAME_MESSAGE, USERNAME_INVALID_MESSAGE, USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, USERNAME_PATTERN_SOURCE, applyBotUsernameSuffix, botUsernameCheck, stripDisallowedUsernameCharacters, usernameCheck, usernameCheckForAccountKind, } from './username';
 export { userNameCheck } from './userResponse';
+export { CLAIMANT_RELATIONSHIPS, CLOSED_CONTENT_CLAIM_STATES, CONTENT_CLAIM_COUNTER_NOTICE_LIMITS, CONTENT_CLAIM_ERROR_CODES, CONTENT_CLAIM_KINDS, CONTENT_CLAIM_LIMITS, CONTENT_CLAIM_REFERENCE_PATTERN, CONTENT_CLAIM_STATES, COUNTER_NOTICE_STATEMENT_VERSION, COUNTER_NOTICE_STATEMENTS, ERASURE_REQUEST_DEADLINE_DAYS, OPEN_CONTENT_CLAIM_STATES, isErasureRequest, isRightsClaim, } from './contentClaims';

package/dist/types/client/safety.d.ts

@@ -21,7 +21,7 @@ export declare const profileAccessInputCheck: Check<{
 }>;
 export declare const profileAccessDecisionCheck: Check<{
     allowed: boolean;
-    reason: "owner" | "unavailable" | "public" | "private" | "blocked";
+    reason: "owner" | "unavailable" | "blocked" | "private" | "public";
     policyVersion: "1";
 }>;
 export declare const supervisionInvitationCheck: Check<{