@oxyhq/crowdsource-contracts 0.1.0

package/dist/taxonomy.d.ts

@@ -0,0 +1,266 @@
+/**
+ * The universal classification layer (§6.1, §6.3).
+ *
+ * §6.1 separates three layers and warns that mixing them makes the service
+ * unusable across applications with different rules. This module is the FIRST
+ * layer only — "what does the material contain or represent?" — and it belongs
+ * to CrowdSource. Whether that content violates anything is the second layer
+ * (`policies.ts`, per tenant) and whether it should move global trust is the
+ * third (`reputation-events.ts`). Nothing here may encode a single tenant's
+ * vocabulary.
+ *
+ * The code list is CLOSED. `other.policy_specific` and `other.unclassifiable`
+ * are the escape hatches the plan provides for material that does not fit; an
+ * open string would let a tenant mint private codes, which is precisely the
+ * cross-application comparability §6.1 exists to protect. Adding a code is an
+ * additive change that bumps `UNIVERSAL_TAXONOMY_VERSION`, and §6.4 requires
+ * every decision to record the version it was classified under, so historical
+ * decisions keep meaning what they meant.
+ */
+import { z } from 'zod';
+/** §6.3 families. */
+export declare const TAXONOMY_FAMILIES: readonly ["integrity", "harassment", "hate", "violence", "sexual_content", "child_safety", "self_harm", "privacy", "commerce", "platform_abuse", "other"];
+export declare const TaxonomyFamilySchema: z.ZodEnum<{
+    integrity: "integrity";
+    harassment: "harassment";
+    hate: "hate";
+    violence: "violence";
+    sexual_content: "sexual_content";
+    child_safety: "child_safety";
+    self_harm: "self_harm";
+    privacy: "privacy";
+    commerce: "commerce";
+    platform_abuse: "platform_abuse";
+    other: "other";
+}>;
+export type TaxonomyFamily = z.infer<typeof TaxonomyFamilySchema>;
+/**
+ * §6.3, grouped.
+ *
+ * §9.4 requires consensus on the "main taxonomic family", not only on the exact
+ * code, so the grouping is part of the contract rather than something the
+ * consensus engine re-derives from string prefixes.
+ */
+export declare const TAXONOMY_CODES_BY_FAMILY: Readonly<{
+    readonly integrity: readonly ["integrity.spam", "integrity.scam", "integrity.fraud", "integrity.impersonation", "integrity.coordinated_manipulation"];
+    readonly harassment: readonly ["harassment.insult", "harassment.targeted_abuse", "harassment.sexual_harassment", "harassment.doxxing", "harassment.credible_threat"];
+    readonly hate: readonly ["hate.dehumanization", "hate.slur", "hate.incitement", "hate.protected_targeting"];
+    readonly violence: readonly ["violence.graphic", "violence.threat", "violence.instruction", "violence.celebration"];
+    readonly sexual_content: readonly ["sexual_content.nudity", "sexual_content.explicit_activity", "sexual_content.non_consensual", "sexual_content.exploitation"];
+    readonly child_safety: readonly ["child_safety.sexualization", "child_safety.grooming", "child_safety.exploitation"];
+    readonly self_harm: readonly ["self_harm.promotion", "self_harm.instruction", "self_harm.imminent_risk"];
+    readonly privacy: readonly ["privacy.personal_information", "privacy.intimate_media", "privacy.location_exposure"];
+    readonly commerce: readonly ["commerce.prohibited_item", "commerce.counterfeit", "commerce.misleading_listing", "commerce.unsafe_product"];
+    readonly platform_abuse: readonly ["platform_abuse.ban_evasion", "platform_abuse.report_abuse", "platform_abuse.automation_abuse"];
+    readonly other: readonly ["other.policy_specific", "other.unclassifiable"];
+}>;
+export declare const UNIVERSAL_TAXONOMY_CODES: readonly ["integrity.spam", "integrity.scam", "integrity.fraud", "integrity.impersonation", "integrity.coordinated_manipulation", "harassment.insult", "harassment.targeted_abuse", "harassment.sexual_harassment", "harassment.doxxing", "harassment.credible_threat", "hate.dehumanization", "hate.slur", "hate.incitement", "hate.protected_targeting", "violence.graphic", "violence.threat", "violence.instruction", "violence.celebration", "sexual_content.nudity", "sexual_content.explicit_activity", "sexual_content.non_consensual", "sexual_content.exploitation", "child_safety.sexualization", "child_safety.grooming", "child_safety.exploitation", "self_harm.promotion", "self_harm.instruction", "self_harm.imminent_risk", "privacy.personal_information", "privacy.intimate_media", "privacy.location_exposure", "commerce.prohibited_item", "commerce.counterfeit", "commerce.misleading_listing", "commerce.unsafe_product", "platform_abuse.ban_evasion", "platform_abuse.report_abuse", "platform_abuse.automation_abuse", "other.policy_specific", "other.unclassifiable"];
+export declare const TaxonomyCodeSchema: z.ZodEnum<{
+    "integrity.spam": "integrity.spam";
+    "integrity.scam": "integrity.scam";
+    "integrity.fraud": "integrity.fraud";
+    "integrity.impersonation": "integrity.impersonation";
+    "integrity.coordinated_manipulation": "integrity.coordinated_manipulation";
+    "harassment.insult": "harassment.insult";
+    "harassment.targeted_abuse": "harassment.targeted_abuse";
+    "harassment.sexual_harassment": "harassment.sexual_harassment";
+    "harassment.doxxing": "harassment.doxxing";
+    "harassment.credible_threat": "harassment.credible_threat";
+    "hate.dehumanization": "hate.dehumanization";
+    "hate.slur": "hate.slur";
+    "hate.incitement": "hate.incitement";
+    "hate.protected_targeting": "hate.protected_targeting";
+    "violence.graphic": "violence.graphic";
+    "violence.threat": "violence.threat";
+    "violence.instruction": "violence.instruction";
+    "violence.celebration": "violence.celebration";
+    "sexual_content.nudity": "sexual_content.nudity";
+    "sexual_content.explicit_activity": "sexual_content.explicit_activity";
+    "sexual_content.non_consensual": "sexual_content.non_consensual";
+    "sexual_content.exploitation": "sexual_content.exploitation";
+    "child_safety.sexualization": "child_safety.sexualization";
+    "child_safety.grooming": "child_safety.grooming";
+    "child_safety.exploitation": "child_safety.exploitation";
+    "self_harm.promotion": "self_harm.promotion";
+    "self_harm.instruction": "self_harm.instruction";
+    "self_harm.imminent_risk": "self_harm.imminent_risk";
+    "privacy.personal_information": "privacy.personal_information";
+    "privacy.intimate_media": "privacy.intimate_media";
+    "privacy.location_exposure": "privacy.location_exposure";
+    "commerce.prohibited_item": "commerce.prohibited_item";
+    "commerce.counterfeit": "commerce.counterfeit";
+    "commerce.misleading_listing": "commerce.misleading_listing";
+    "commerce.unsafe_product": "commerce.unsafe_product";
+    "platform_abuse.ban_evasion": "platform_abuse.ban_evasion";
+    "platform_abuse.report_abuse": "platform_abuse.report_abuse";
+    "platform_abuse.automation_abuse": "platform_abuse.automation_abuse";
+    "other.policy_specific": "other.policy_specific";
+    "other.unclassifiable": "other.unclassifiable";
+}>;
+export type TaxonomyCode = z.infer<typeof TaxonomyCodeSchema>;
+/**
+ * The version of the code list above.
+ *
+ * §6.4: every decision records the taxonomy version it was decided under, and a
+ * policy update never silently rewrites history. Keeping the constant in the
+ * same module as the codes is what makes that possible — the two cannot drift.
+ * The value is the one the plan uses in Appendix B and §11.6.
+ */
+export declare const UNIVERSAL_TAXONOMY_VERSION = "2026.1";
+/** The family a code belongs to. */
+export declare function taxonomyFamilyOf(code: TaxonomyCode): TaxonomyFamily;
+/** §9.4 / §11.8 severity scale. */
+export declare const SEVERITIES: readonly ["low", "medium", "high", "critical"];
+export declare const SeveritySchema: z.ZodEnum<{
+    low: "low";
+    medium: "medium";
+    high: "high";
+    critical: "critical";
+}>;
+export type Severity = z.infer<typeof SeveritySchema>;
+/**
+ * How far a finding reaches.
+ *
+ * §11.6 and Appendix B use `oxy_network`; §11.7.5 additionally names
+ * `identity_integrity` as a scope that may produce an Oxy Trust effect. The
+ * plan never names the third value — the one that means "this matters to the
+ * application and stops there" — even though §6.5's entire argument is that
+ * most local restrictions must NOT become global sanctions. `application_local`
+ * is the contract's name for it and is the ONE token in this package invented
+ * rather than quoted. Modelling it as an absent field instead would make
+ * §11.7.5 a presence check, which fails open.
+ */
+export declare const FINDING_SCOPES: readonly ["application_local", "oxy_network", "identity_integrity"];
+export declare const FindingScopeSchema: z.ZodEnum<{
+    application_local: "application_local";
+    oxy_network: "oxy_network";
+    identity_integrity: "identity_integrity";
+}>;
+export type FindingScope = z.infer<typeof FindingScopeSchema>;
+/**
+ * Scopes that §11.7.5 allows to reach Oxy Trust.
+ *
+ * Exported as its own schema so `reputation-events.ts` states the rule in the
+ * type rather than re-checking it at runtime.
+ */
+export declare const REPUTATION_ELIGIBLE_FINDING_SCOPES: readonly ["oxy_network", "identity_integrity"];
+export declare const ReputationEligibleFindingScopeSchema: z.ZodEnum<{
+    oxy_network: "oxy_network";
+    identity_integrity: "identity_integrity";
+}>;
+export type ReputationEligibleFindingScope = z.infer<typeof ReputationEligibleFindingScopeSchema>;
+/**
+ * Who a finding attributes conduct to.
+ *
+ * Appendix B and §11.6 use `author`. §11.11 and §11.12 describe confirmed
+ * report abuse and confirmed review abuse producing conduct effects of their
+ * own, which is where the other two values come from. There is deliberately no
+ * `unknown`: attribution exists to name a principal, and §11.7.4 will not let
+ * an effect land without a binding proof for that principal anyway.
+ */
+export declare const FINDING_ATTRIBUTIONS: readonly ["author", "reporter", "reviewer"];
+export declare const FindingAttributionSchema: z.ZodEnum<{
+    author: "author";
+    reporter: "reporter";
+    reviewer: "reviewer";
+}>;
+export type FindingAttribution = z.infer<typeof FindingAttributionSchema>;
+/**
+ * What CrowdSource may recommend an application do.
+ *
+ * The plan writes action tokens in two places. §6.2, §9.3, §10.7 and Appendix B
+ * recommend `remove_or_restrict` and `allow_with_label`; §7.6 tabulates, per
+ * decision outcome, the actions an application may take in response. They are
+ * the same vocabulary seen from the two ends of one exchange, so the contract
+ * carries the union as one closed list — otherwise a recommendation and the
+ * enforcement that answers it would not be comparable, and §7.6's requirement
+ * that an application "record what it did and why" would compare apples to
+ * pears.
+ *
+ * §7.6's outcome→action table is NOT reproduced as a constraint. It bounds what
+ * an application may do in response to an outcome, not what a jury may
+ * recommend — Appendix B recommends `remove_or_restrict`, which does not appear
+ * in §7.6's `violation` row at all. Binding the two would reject the plan's own
+ * reference decision.
+ */
+export declare const RECOMMENDED_ACTIONS: readonly ["remove_or_restrict", "allow_with_label", "remove", "hide", "label", "age_gate", "reduce_distribution", "freeze_transaction", "suspend_user", "request_changes", "allow", "restore", "no_action", "request_more_context", "hold", "local_manual_review", "keep_restricted_temporarily", "escalate", "no_global_effect", "specialist_queue", "legal_queue", "safety_queue"];
+export declare const RecommendedActionSchema: z.ZodEnum<{
+    remove_or_restrict: "remove_or_restrict";
+    allow_with_label: "allow_with_label";
+    remove: "remove";
+    hide: "hide";
+    label: "label";
+    age_gate: "age_gate";
+    reduce_distribution: "reduce_distribution";
+    freeze_transaction: "freeze_transaction";
+    suspend_user: "suspend_user";
+    request_changes: "request_changes";
+    allow: "allow";
+    restore: "restore";
+    no_action: "no_action";
+    request_more_context: "request_more_context";
+    hold: "hold";
+    local_manual_review: "local_manual_review";
+    keep_restricted_temporarily: "keep_restricted_temporarily";
+    escalate: "escalate";
+    no_global_effect: "no_global_effect";
+    specialist_queue: "specialist_queue";
+    legal_queue: "legal_queue";
+    safety_queue: "safety_queue";
+}>;
+export type RecommendedAction = z.infer<typeof RecommendedActionSchema>;
+/**
+ * The context that makes a classification not mean what it usually means —
+ * §9.2's and §9.4's "excepción", §6.2's `context`.
+ *
+ * §6.2's worked example is where this field comes from and what fixes its
+ * shape: the jury's finding is `sexual_content.nudity, severity = medium,
+ * context = artistic`, and it is that qualifier — not the code and not the
+ * severity — that turns the same classification into a violation under one
+ * application's policy and not under another's. It therefore belongs to layer
+ * one, beside the code: a reviewer describes what the material IS, and
+ * "artistic nudity" is a different description from "nudity".
+ *
+ * §9.4 makes it one of the six dimensions consensus is measured on, which is
+ * the reason it must be a CLOSED list. Two reviewers who both answer
+ * `no_violation` but for incompatible reasons — one because the material is
+ * documentary, one because they think the rule does not cover it at all — have
+ * not agreed about the material, and a free-text field could not tell the two
+ * apart. An open token would also be a channel for case content to reach a
+ * decision record, which §13.5 forbids.
+ *
+ * Only `artistic` is the plan's own word. The rest are the exception vocabulary
+ * every published moderation policy shares, and they are named here rather than
+ * left to a tenant because layer one is CrowdSource's (§6.1) — a tenant that
+ * could mint its own exception tokens would make findings incomparable across
+ * applications, which is exactly what §6.1 exists to prevent. Absence means no
+ * exception applies, which is the safe direction: a finding with no exception
+ * stands as classified.
+ */
+export declare const FINDING_CONTEXTS: readonly ["artistic", "educational", "documentary", "newsworthy", "satire", "counter_speech", "medical", "consensual", "fictional"];
+export declare const FindingContextSchema: z.ZodEnum<{
+    artistic: "artistic";
+    educational: "educational";
+    documentary: "documentary";
+    newsworthy: "newsworthy";
+    satire: "satire";
+    counter_speech: "counter_speech";
+    medical: "medical";
+    consensual: "consensual";
+    fictional: "fictional";
+}>;
+export type FindingContext = z.infer<typeof FindingContextSchema>;
+/**
+ * A tenant's advance classification of how exposing the material is.
+ *
+ * The plan names exactly one value — `standard`, in Appendix A — and §7.5
+ * clearly implies at least one more (categories that never reach a community
+ * jury). Rather than invent the rest, this stays an open lowercase token: it is
+ * a HINT (§5.2: "never shown as a verdict"), the authoritative
+ * `sensitivity_class` is computed by triage server-side (§12.8), and access to
+ * sensitive material is gated on that computed class, never on what the tenant
+ * asserted. Closing this list is a product decision that has not been made.
+ */
+export declare const SensitivityHintSchema: z.ZodString;
+export type SensitivityHint = z.infer<typeof SensitivityHintSchema>;
+//# sourceMappingURL=taxonomy.d.ts.map

package/dist/taxonomy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taxonomy.d.ts","sourceRoot":"","sources":["../src/taxonomy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qBAAqB;AACrB,eAAO,MAAM,iBAAiB,2JAYpB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAA4B,CAAC;AAC9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAwElE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;EAY1B,CAAC;AAEZ,eAAO,MAAM,wBAAwB,qiCAY3B,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAmC,CAAC;AACnE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,WAAW,CAAC;AAEnD,oCAAoC;AACpC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,cAAc,CAGnE;AAED,mCAAmC;AACnC,eAAO,MAAM,UAAU,gDAAiD,CAAC;AACzE,eAAO,MAAM,cAAc;;;;;EAAqB,CAAC;AACjD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,qEAAsE,CAAC;AAClG,eAAO,MAAM,kBAAkB;;;;EAAyB,CAAC;AACzD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,gDAAiD,CAAC;AACjG,eAAO,MAAM,oCAAoC;;;EAA6C,CAAC;AAC/F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,6CAA8C,CAAC;AAChF,eAAO,MAAM,wBAAwB;;;;EAA+B,CAAC;AACrE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,mBAAmB,sXAuBtB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;EAA8B,CAAC;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,gBAAgB,qIAUnB,CAAC;AACX,eAAO,MAAM,oBAAoB;;;;;;;;;;EAA2B,CAAC;AAC7D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,aAIwB,CAAC;AAC3D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/taxonomy.js

@@ -0,0 +1,282 @@
+"use strict";
+/**
+ * The universal classification layer (§6.1, §6.3).
+ *
+ * §6.1 separates three layers and warns that mixing them makes the service
+ * unusable across applications with different rules. This module is the FIRST
+ * layer only — "what does the material contain or represent?" — and it belongs
+ * to CrowdSource. Whether that content violates anything is the second layer
+ * (`policies.ts`, per tenant) and whether it should move global trust is the
+ * third (`reputation-events.ts`). Nothing here may encode a single tenant's
+ * vocabulary.
+ *
+ * The code list is CLOSED. `other.policy_specific` and `other.unclassifiable`
+ * are the escape hatches the plan provides for material that does not fit; an
+ * open string would let a tenant mint private codes, which is precisely the
+ * cross-application comparability §6.1 exists to protect. Adding a code is an
+ * additive change that bumps `UNIVERSAL_TAXONOMY_VERSION`, and §6.4 requires
+ * every decision to record the version it was classified under, so historical
+ * decisions keep meaning what they meant.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SensitivityHintSchema = exports.FindingContextSchema = exports.FINDING_CONTEXTS = exports.RecommendedActionSchema = exports.RECOMMENDED_ACTIONS = exports.FindingAttributionSchema = exports.FINDING_ATTRIBUTIONS = exports.ReputationEligibleFindingScopeSchema = exports.REPUTATION_ELIGIBLE_FINDING_SCOPES = exports.FindingScopeSchema = exports.FINDING_SCOPES = exports.SeveritySchema = exports.SEVERITIES = exports.UNIVERSAL_TAXONOMY_VERSION = exports.TaxonomyCodeSchema = exports.UNIVERSAL_TAXONOMY_CODES = exports.TAXONOMY_CODES_BY_FAMILY = exports.TaxonomyFamilySchema = exports.TAXONOMY_FAMILIES = void 0;
+exports.taxonomyFamilyOf = taxonomyFamilyOf;
+const zod_1 = require("zod");
+/** §6.3 families. */
+exports.TAXONOMY_FAMILIES = [
+    'integrity',
+    'harassment',
+    'hate',
+    'violence',
+    'sexual_content',
+    'child_safety',
+    'self_harm',
+    'privacy',
+    'commerce',
+    'platform_abuse',
+    'other',
+];
+exports.TaxonomyFamilySchema = zod_1.z.enum(exports.TAXONOMY_FAMILIES);
+const INTEGRITY_CODES = [
+    'integrity.spam',
+    'integrity.scam',
+    'integrity.fraud',
+    'integrity.impersonation',
+    'integrity.coordinated_manipulation',
+];
+const HARASSMENT_CODES = [
+    'harassment.insult',
+    'harassment.targeted_abuse',
+    'harassment.sexual_harassment',
+    'harassment.doxxing',
+    'harassment.credible_threat',
+];
+const HATE_CODES = [
+    'hate.dehumanization',
+    'hate.slur',
+    'hate.incitement',
+    'hate.protected_targeting',
+];
+const VIOLENCE_CODES = [
+    'violence.graphic',
+    'violence.threat',
+    'violence.instruction',
+    'violence.celebration',
+];
+const SEXUAL_CONTENT_CODES = [
+    'sexual_content.nudity',
+    'sexual_content.explicit_activity',
+    'sexual_content.non_consensual',
+    'sexual_content.exploitation',
+];
+const CHILD_SAFETY_CODES = [
+    'child_safety.sexualization',
+    'child_safety.grooming',
+    'child_safety.exploitation',
+];
+const SELF_HARM_CODES = [
+    'self_harm.promotion',
+    'self_harm.instruction',
+    'self_harm.imminent_risk',
+];
+const PRIVACY_CODES = [
+    'privacy.personal_information',
+    'privacy.intimate_media',
+    'privacy.location_exposure',
+];
+const COMMERCE_CODES = [
+    'commerce.prohibited_item',
+    'commerce.counterfeit',
+    'commerce.misleading_listing',
+    'commerce.unsafe_product',
+];
+const PLATFORM_ABUSE_CODES = [
+    'platform_abuse.ban_evasion',
+    'platform_abuse.report_abuse',
+    'platform_abuse.automation_abuse',
+];
+const OTHER_CODES = ['other.policy_specific', 'other.unclassifiable'];
+/**
+ * §6.3, grouped.
+ *
+ * §9.4 requires consensus on the "main taxonomic family", not only on the exact
+ * code, so the grouping is part of the contract rather than something the
+ * consensus engine re-derives from string prefixes.
+ */
+exports.TAXONOMY_CODES_BY_FAMILY = Object.freeze({
+    integrity: INTEGRITY_CODES,
+    harassment: HARASSMENT_CODES,
+    hate: HATE_CODES,
+    violence: VIOLENCE_CODES,
+    sexual_content: SEXUAL_CONTENT_CODES,
+    child_safety: CHILD_SAFETY_CODES,
+    self_harm: SELF_HARM_CODES,
+    privacy: PRIVACY_CODES,
+    commerce: COMMERCE_CODES,
+    platform_abuse: PLATFORM_ABUSE_CODES,
+    other: OTHER_CODES,
+});
+exports.UNIVERSAL_TAXONOMY_CODES = [
+    ...INTEGRITY_CODES,
+    ...HARASSMENT_CODES,
+    ...HATE_CODES,
+    ...VIOLENCE_CODES,
+    ...SEXUAL_CONTENT_CODES,
+    ...CHILD_SAFETY_CODES,
+    ...SELF_HARM_CODES,
+    ...PRIVACY_CODES,
+    ...COMMERCE_CODES,
+    ...PLATFORM_ABUSE_CODES,
+    ...OTHER_CODES,
+];
+exports.TaxonomyCodeSchema = zod_1.z.enum(exports.UNIVERSAL_TAXONOMY_CODES);
+/**
+ * The version of the code list above.
+ *
+ * §6.4: every decision records the taxonomy version it was decided under, and a
+ * policy update never silently rewrites history. Keeping the constant in the
+ * same module as the codes is what makes that possible — the two cannot drift.
+ * The value is the one the plan uses in Appendix B and §11.6.
+ */
+exports.UNIVERSAL_TAXONOMY_VERSION = '2026.1';
+/** The family a code belongs to. */
+function taxonomyFamilyOf(code) {
+    const [family] = code.split('.');
+    return exports.TaxonomyFamilySchema.parse(family);
+}
+/** §9.4 / §11.8 severity scale. */
+exports.SEVERITIES = ['low', 'medium', 'high', 'critical'];
+exports.SeveritySchema = zod_1.z.enum(exports.SEVERITIES);
+/**
+ * How far a finding reaches.
+ *
+ * §11.6 and Appendix B use `oxy_network`; §11.7.5 additionally names
+ * `identity_integrity` as a scope that may produce an Oxy Trust effect. The
+ * plan never names the third value — the one that means "this matters to the
+ * application and stops there" — even though §6.5's entire argument is that
+ * most local restrictions must NOT become global sanctions. `application_local`
+ * is the contract's name for it and is the ONE token in this package invented
+ * rather than quoted. Modelling it as an absent field instead would make
+ * §11.7.5 a presence check, which fails open.
+ */
+exports.FINDING_SCOPES = ['application_local', 'oxy_network', 'identity_integrity'];
+exports.FindingScopeSchema = zod_1.z.enum(exports.FINDING_SCOPES);
+/**
+ * Scopes that §11.7.5 allows to reach Oxy Trust.
+ *
+ * Exported as its own schema so `reputation-events.ts` states the rule in the
+ * type rather than re-checking it at runtime.
+ */
+exports.REPUTATION_ELIGIBLE_FINDING_SCOPES = ['oxy_network', 'identity_integrity'];
+exports.ReputationEligibleFindingScopeSchema = zod_1.z.enum(exports.REPUTATION_ELIGIBLE_FINDING_SCOPES);
+/**
+ * Who a finding attributes conduct to.
+ *
+ * Appendix B and §11.6 use `author`. §11.11 and §11.12 describe confirmed
+ * report abuse and confirmed review abuse producing conduct effects of their
+ * own, which is where the other two values come from. There is deliberately no
+ * `unknown`: attribution exists to name a principal, and §11.7.4 will not let
+ * an effect land without a binding proof for that principal anyway.
+ */
+exports.FINDING_ATTRIBUTIONS = ['author', 'reporter', 'reviewer'];
+exports.FindingAttributionSchema = zod_1.z.enum(exports.FINDING_ATTRIBUTIONS);
+/**
+ * What CrowdSource may recommend an application do.
+ *
+ * The plan writes action tokens in two places. §6.2, §9.3, §10.7 and Appendix B
+ * recommend `remove_or_restrict` and `allow_with_label`; §7.6 tabulates, per
+ * decision outcome, the actions an application may take in response. They are
+ * the same vocabulary seen from the two ends of one exchange, so the contract
+ * carries the union as one closed list — otherwise a recommendation and the
+ * enforcement that answers it would not be comparable, and §7.6's requirement
+ * that an application "record what it did and why" would compare apples to
+ * pears.
+ *
+ * §7.6's outcome→action table is NOT reproduced as a constraint. It bounds what
+ * an application may do in response to an outcome, not what a jury may
+ * recommend — Appendix B recommends `remove_or_restrict`, which does not appear
+ * in §7.6's `violation` row at all. Binding the two would reject the plan's own
+ * reference decision.
+ */
+exports.RECOMMENDED_ACTIONS = [
+    'remove_or_restrict',
+    'allow_with_label',
+    'remove',
+    'hide',
+    'label',
+    'age_gate',
+    'reduce_distribution',
+    'freeze_transaction',
+    'suspend_user',
+    'request_changes',
+    'allow',
+    'restore',
+    'no_action',
+    'request_more_context',
+    'hold',
+    'local_manual_review',
+    'keep_restricted_temporarily',
+    'escalate',
+    'no_global_effect',
+    'specialist_queue',
+    'legal_queue',
+    'safety_queue',
+];
+exports.RecommendedActionSchema = zod_1.z.enum(exports.RECOMMENDED_ACTIONS);
+/**
+ * The context that makes a classification not mean what it usually means —
+ * §9.2's and §9.4's "excepción", §6.2's `context`.
+ *
+ * §6.2's worked example is where this field comes from and what fixes its
+ * shape: the jury's finding is `sexual_content.nudity, severity = medium,
+ * context = artistic`, and it is that qualifier — not the code and not the
+ * severity — that turns the same classification into a violation under one
+ * application's policy and not under another's. It therefore belongs to layer
+ * one, beside the code: a reviewer describes what the material IS, and
+ * "artistic nudity" is a different description from "nudity".
+ *
+ * §9.4 makes it one of the six dimensions consensus is measured on, which is
+ * the reason it must be a CLOSED list. Two reviewers who both answer
+ * `no_violation` but for incompatible reasons — one because the material is
+ * documentary, one because they think the rule does not cover it at all — have
+ * not agreed about the material, and a free-text field could not tell the two
+ * apart. An open token would also be a channel for case content to reach a
+ * decision record, which §13.5 forbids.
+ *
+ * Only `artistic` is the plan's own word. The rest are the exception vocabulary
+ * every published moderation policy shares, and they are named here rather than
+ * left to a tenant because layer one is CrowdSource's (§6.1) — a tenant that
+ * could mint its own exception tokens would make findings incomparable across
+ * applications, which is exactly what §6.1 exists to prevent. Absence means no
+ * exception applies, which is the safe direction: a finding with no exception
+ * stands as classified.
+ */
+exports.FINDING_CONTEXTS = [
+    'artistic',
+    'educational',
+    'documentary',
+    'newsworthy',
+    'satire',
+    'counter_speech',
+    'medical',
+    'consensual',
+    'fictional',
+];
+exports.FindingContextSchema = zod_1.z.enum(exports.FINDING_CONTEXTS);
+/**
+ * A tenant's advance classification of how exposing the material is.
+ *
+ * The plan names exactly one value — `standard`, in Appendix A — and §7.5
+ * clearly implies at least one more (categories that never reach a community
+ * jury). Rather than invent the rest, this stays an open lowercase token: it is
+ * a HINT (§5.2: "never shown as a verdict"), the authoritative
+ * `sensitivity_class` is computed by triage server-side (§12.8), and access to
+ * sensitive material is gated on that computed class, never on what the tenant
+ * asserted. Closing this list is a product decision that has not been made.
+ */
+exports.SensitivityHintSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(40)
+    .regex(/^[a-z][a-z0-9_]*$/, 'must be a lowercase token');
+//# sourceMappingURL=taxonomy.js.map

package/dist/taxonomy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taxonomy.js","sourceRoot":"","sources":["../src/taxonomy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AA6IH,4CAGC;AA9ID,6BAAwB;AAExB,qBAAqB;AACR,QAAA,iBAAiB,GAAG;IAC/B,WAAW;IACX,YAAY;IACZ,MAAM;IACN,UAAU;IACV,gBAAgB;IAChB,cAAc;IACd,WAAW;IACX,SAAS;IACT,UAAU;IACV,gBAAgB;IAChB,OAAO;CACC,CAAC;AAEE,QAAA,oBAAoB,GAAG,OAAC,CAAC,IAAI,CAAC,yBAAiB,CAAC,CAAC;AAG9D,MAAM,eAAe,GAAG;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,yBAAyB;IACzB,oCAAoC;CAC5B,CAAC;AAEX,MAAM,gBAAgB,GAAG;IACvB,mBAAmB;IACnB,2BAA2B;IAC3B,8BAA8B;IAC9B,oBAAoB;IACpB,4BAA4B;CACpB,CAAC;AAEX,MAAM,UAAU,GAAG;IACjB,qBAAqB;IACrB,WAAW;IACX,iBAAiB;IACjB,0BAA0B;CAClB,CAAC;AAEX,MAAM,cAAc,GAAG;IACrB,kBAAkB;IAClB,iBAAiB;IACjB,sBAAsB;IACtB,sBAAsB;CACd,CAAC;AAEX,MAAM,oBAAoB,GAAG;IAC3B,uBAAuB;IACvB,kCAAkC;IAClC,+BAA+B;IAC/B,6BAA6B;CACrB,CAAC;AAEX,MAAM,kBAAkB,GAAG;IACzB,4BAA4B;IAC5B,uBAAuB;IACvB,2BAA2B;CACnB,CAAC;AAEX,MAAM,eAAe,GAAG;IACtB,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;CACjB,CAAC;AAEX,MAAM,aAAa,GAAG;IACpB,8BAA8B;IAC9B,wBAAwB;IACxB,2BAA2B;CACnB,CAAC;AAEX,MAAM,cAAc,GAAG;IACrB,0BAA0B;IAC1B,sBAAsB;IACtB,6BAA6B;IAC7B,yBAAyB;CACjB,CAAC;AAEX,MAAM,oBAAoB,GAAG;IAC3B,4BAA4B;IAC5B,6BAA6B;IAC7B,iCAAiC;CACzB,CAAC;AAEX,MAAM,WAAW,GAAG,CAAC,uBAAuB,EAAE,sBAAsB,CAAU,CAAC;AAE/E;;;;;;GAMG;AACU,QAAA,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,SAAS,EAAE,eAAe;IAC1B,UAAU,EAAE,gBAAgB;IAC5B,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,cAAc;IACxB,cAAc,EAAE,oBAAoB;IACpC,YAAY,EAAE,kBAAkB;IAChC,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,cAAc,EAAE,oBAAoB;IACpC,KAAK,EAAE,WAAW;CACV,CAAC,CAAC;AAEC,QAAA,wBAAwB,GAAG;IACtC,GAAG,eAAe;IAClB,GAAG,gBAAgB;IACnB,GAAG,UAAU;IACb,GAAG,cAAc;IACjB,GAAG,oBAAoB;IACvB,GAAG,kBAAkB;IACrB,GAAG,eAAe;IAClB,GAAG,aAAa;IAChB,GAAG,cAAc;IACjB,GAAG,oBAAoB;IACvB,GAAG,WAAW;CACN,CAAC;AAEE,QAAA,kBAAkB,GAAG,OAAC,CAAC,IAAI,CAAC,gCAAwB,CAAC,CAAC;AAGnE;;;;;;;GAOG;AACU,QAAA,0BAA0B,GAAG,QAAQ,CAAC;AAEnD,oCAAoC;AACpC,SAAgB,gBAAgB,CAAC,IAAkB;IACjD,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,4BAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,mCAAmC;AACtB,QAAA,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAC5D,QAAA,cAAc,GAAG,OAAC,CAAC,IAAI,CAAC,kBAAU,CAAC,CAAC;AAGjD;;;;;;;;;;;GAWG;AACU,QAAA,cAAc,GAAG,CAAC,mBAAmB,EAAE,aAAa,EAAE,oBAAoB,CAAU,CAAC;AACrF,QAAA,kBAAkB,GAAG,OAAC,CAAC,IAAI,CAAC,sBAAc,CAAC,CAAC;AAGzD;;;;;GAKG;AACU,QAAA,kCAAkC,GAAG,CAAC,aAAa,EAAE,oBAAoB,CAAU,CAAC;AACpF,QAAA,oCAAoC,GAAG,OAAC,CAAC,IAAI,CAAC,0CAAkC,CAAC,CAAC;AAG/F;;;;;;;;GAQG;AACU,QAAA,oBAAoB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAU,CAAC;AACnE,QAAA,wBAAwB,GAAG,OAAC,CAAC,IAAI,CAAC,4BAAoB,CAAC,CAAC;AAGrE;;;;;;;;;;;;;;;;;GAiBG;AACU,QAAA,mBAAmB,GAAG;IACjC,oBAAoB;IACpB,kBAAkB;IAClB,QAAQ;IACR,MAAM;IACN,OAAO;IACP,UAAU;IACV,qBAAqB;IACrB,oBAAoB;IACpB,cAAc;IACd,iBAAiB;IACjB,OAAO;IACP,SAAS;IACT,WAAW;IACX,sBAAsB;IACtB,MAAM;IACN,qBAAqB;IACrB,6BAA6B;IAC7B,UAAU;IACV,kBAAkB;IAClB,kBAAkB;IAClB,aAAa;IACb,cAAc;CACN,CAAC;AAEE,QAAA,uBAAuB,GAAG,OAAC,CAAC,IAAI,CAAC,2BAAmB,CAAC,CAAC;AAGnE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACU,QAAA,gBAAgB,GAAG;IAC9B,UAAU;IACV,aAAa;IACb,aAAa;IACb,YAAY;IACZ,QAAQ;IACR,gBAAgB;IAChB,SAAS;IACT,YAAY;IACZ,WAAW;CACH,CAAC;AACE,QAAA,oBAAoB,GAAG,OAAC,CAAC,IAAI,CAAC,wBAAgB,CAAC,CAAC;AAG7D;;;;;;;;;;GAUG;AACU,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC"}