@xemahq/kernel-contracts 0.1.0 → 0.2.1

package/src/document-render/lib/render-record.ts

@@ -0,0 +1,38 @@
+import type { RenderFormat, RenderStatus } from './render-enums';
+import type { RenderSource } from './render-source';
+
+/**
+ * The persistent record returned by `GET /renders/:id` (and embedded in
+ * `POST /renders` responses). Once `status === READY`, `downloadUrl` is a
+ * pre-signed URL the FE can navigate to directly.
+ */
+export interface RenderRecordDto {
+  readonly id: string;
+  readonly format: RenderFormat;
+  readonly status: RenderStatus;
+  readonly source: RenderSource;
+  readonly downloadUrl: string | null;
+  readonly failureReason: string | null;
+  /** ISO-8601 timestamp. */
+  readonly createdAt: string;
+  /** ISO-8601 timestamp; null until terminal. */
+  readonly completedAt: string | null;
+  /** Convenience: byte size of the rendered file when READY. */
+  readonly byteSize: number | null;
+}
+
+/**
+ * SSE event payload streamed from `GET /renders/:id/stream`. The FE
+ * subscribes once after `POST /renders` and tears down on terminal
+ * status. Progress percent is best-effort and may be null for fast
+ * renders that flip QUEUED → RUNNING → READY without a measurable
+ * mid-state.
+ */
+export interface RenderProgressEventDto {
+  readonly renderId: string;
+  readonly status: RenderStatus;
+  readonly progressPercent: number | null;
+  readonly message: string | null;
+  readonly downloadUrl: string | null;
+  readonly failureReason: string | null;
+}

package/src/document-render/lib/render-request.ts

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+
+import { RenderFormat } from './render-enums';
+import { RenderSourceSchema } from './render-source';
+
+/**
+ * Request body for `POST /renders`. `idempotencyKey` deduplicates retries
+ * from the same caller — when present, repeat POSTs return the existing
+ * record instead of enqueueing duplicate work.
+ */
+export const RenderRequestSchema = z.object({
+  source: RenderSourceSchema,
+  format: z.enum(RenderFormat),
+  idempotencyKey: z.string().min(1).max(200).optional(),
+});
+export type RenderRequestDto = z.infer<typeof RenderRequestSchema>;

package/src/document-render/lib/render-source.ts

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+
+import { RenderSourceKind } from './render-enums';
+
+export const PageRenderSourceSchema = z.object({
+  kind: z.literal(RenderSourceKind.PAGE),
+  pageId: z.string().min(1),
+  /** Omit for the latest published version. */
+  version: z.number().int().min(1).optional(),
+});
+export type PageRenderSource = z.infer<typeof PageRenderSourceSchema>;
+
+export const DesignSystemBuilderExportRenderSourceSchema = z.object({
+  kind: z.literal(RenderSourceKind.DESIGN_SYSTEM_BUILDER_EXPORT),
+  designSystemBuildId: z.string().min(1),
+});
+export type DesignSystemBuilderExportRenderSource = z.infer<
+  typeof DesignSystemBuilderExportRenderSourceSchema
+>;
+
+export const WorkflowDeliverableRenderSourceSchema = z.object({
+  kind: z.literal(RenderSourceKind.WORKFLOW_DELIVERABLE),
+  artifactId: z.string().min(1),
+  versionId: z.string().min(1),
+});
+export type WorkflowDeliverableRenderSource = z.infer<
+  typeof WorkflowDeliverableRenderSourceSchema
+>;
+
+export const InlineHtmlRenderSourceSchema = z.object({
+  kind: z.literal(RenderSourceKind.INLINE_HTML),
+  /** Full HTML document. Must include the A4 template CSS to paginate. */
+  html: z.string().min(1).max(2_000_000),
+  title: z.string().max(200).optional(),
+});
+export type InlineHtmlRenderSource = z.infer<typeof InlineHtmlRenderSourceSchema>;
+
+export const RenderSourceSchema = z.discriminatedUnion('kind', [
+  PageRenderSourceSchema,
+  DesignSystemBuilderExportRenderSourceSchema,
+  WorkflowDeliverableRenderSourceSchema,
+  InlineHtmlRenderSourceSchema,
+]);
+export type RenderSource = z.infer<typeof RenderSourceSchema>;

package/src/document-render/lib/xema-prompt.ts

@@ -0,0 +1,100 @@
+// ═══════════════════════════════════════════════════════════════════════════
+// Inline "Ask Buddy" prompt blocks — the `xema-prompt` fenced-code contract.
+//
+// A user can drop an instruction for the Document Buddy agent *inside* a
+// MARKDOWN_DOCUMENT, at the exact spot the work belongs, as a fenced code
+// block whose info string is `xema-prompt`:
+//
+//   ```xema-prompt
+//   Rewrite the section above to be tighter; keep the table.
+//   ```
+//
+// The block is an instruction to the agent, never document content — it
+// must never reach the Paged.js preview, the exported PDF, or the DOCX.
+// This module is the single source of truth for that contract, shared by:
+//   - the render pipeline (PDF/DOCX/measure) — strips blocks before render;
+//   - the Monaco "Ask Buddy" editor — inserts blocks and locates them for
+//     the inline Run affordance (the file is frontend-bridged).
+//
+// Pure string utilities. Zero runtime deps so the file bridges cleanly.
+// ═══════════════════════════════════════════════════════════════════════════
+
+/** Fenced-code-block info string that marks an inline "Ask Buddy" prompt. */
+export const XEMA_PROMPT_FENCE = 'xema-prompt';
+
+/**
+ * Matches a whole `xema-prompt` fenced block: an opening fence (3+
+ * backticks or tildes, up to 3 spaces of indent) whose info string is
+ * `xema-prompt`, the body, and the matching closing fence. Global +
+ * multiline so every block in the document is removed; the trailing
+ * newline is consumed so no blank gap is left behind.
+ */
+export const XEMA_PROMPT_BLOCK_RE = new RegExp(
+  '^ {0,3}(`{3,}|~{3,})[ \\t]*' +
+    XEMA_PROMPT_FENCE +
+    '[^\\n]*\\n[\\s\\S]*?^ {0,3}\\1[ \\t]*$\\n?',
+  'gm',
+);
+
+/** Remove every inline "Ask Buddy" prompt block from markdown source. */
+export function stripXemaPromptBlocks(markdown: string): string {
+  return markdown.replace(XEMA_PROMPT_BLOCK_RE, '');
+}
+
+/**
+ * Build a canonical `xema-prompt` block (3 backticks) carrying an
+ * optional instruction. Used by the Monaco editor's `/ask` completion so
+ * the inserted block always matches what the strip + locate logic
+ * expects. Ends with a newline so the block sits on its own lines.
+ */
+export function buildXemaPromptBlock(instruction = ''): string {
+  return '```' + XEMA_PROMPT_FENCE + '\n' + instruction + '\n```\n';
+}
+
+/** A located `xema-prompt` block, with 1-based inclusive line bounds. */
+export interface XemaPromptBlockRange {
+  /** 1-based line of the opening fence. */
+  readonly startLine: number;
+  /** 1-based line of the closing fence. */
+  readonly endLine: number;
+  /** Instruction text between the fences (may be empty / whitespace). */
+  readonly instruction: string;
+}
+
+/**
+ * Locate every `xema-prompt` block in `text`, returning 1-based line
+ * ranges. Drives the Monaco "Ask Buddy" CodeLens — the editor renders a
+ * Run affordance over each range. Unterminated blocks (no closing fence)
+ * are skipped: they are still being typed and carry no actionable lens.
+ */
+export function findXemaPromptBlockRanges(text: string): XemaPromptBlockRange[] {
+  const lines = text.split('\n');
+  const openRe = new RegExp(
+    '^ {0,3}(`{3,}|~{3,})[ \\t]*' + XEMA_PROMPT_FENCE + '[^\\n]*$',
+  );
+  const ranges: XemaPromptBlockRange[] = [];
+  let i = 0;
+  while (i < lines.length) {
+    const open = openRe.exec(lines[i] ?? '');
+    if (!open) {
+      i += 1;
+      continue;
+    }
+    const fence = open[1] ?? '```';
+    const closeRe = new RegExp('^ {0,3}' + fence + '[ \\t]*$');
+    let j = i + 1;
+    while (j < lines.length && !closeRe.test(lines[j] ?? '')) {
+      j += 1;
+    }
+    if (j >= lines.length) {
+      break; // unterminated block — no actionable lens
+    }
+    ranges.push({
+      startLine: i + 1,
+      endLine: j + 1,
+      instruction: lines.slice(i + 1, j).join('\n'),
+    });
+    i = j + 1;
+  }
+  return ranges;
+}

package/src/inquiry/index.ts

@@ -0,0 +1,23 @@
+// ═══════════════════════════════════════════════════════════════════════════
+// @xemahq/inquiry-contracts — Kernel layer
+//
+// Abstract types for the Inquiry primitive: "ask one or more recipients
+// (humans, agents, endpoints) a typed prompt, validate replies against a
+// kind-specific schema, aggregate per a policy, return a verdict."
+//
+// Runtime-agnostic. Pure types + Zod schemas. Zero framework / persistence /
+// workflow-runtime imports. The plan-of-record lives at
+// .claude/plans/i-think-what-we-ve-transient-zebra.md.
+//
+// Per-kind prompt + reply Zod schemas live in their own contract packages
+// (`@xemahq/decision-gate-contracts`, `@xemahq/agent-tool-inquiry-
+// contracts`) and are registered with this package's `KindSchemaRegistry`
+// at the engine boundary.
+// ═══════════════════════════════════════════════════════════════════════════
+
+export * from './lib/enums';
+export * from './lib/recipient';
+export * from './lib/policy';
+export * from './lib/inquiry';
+export * from './lib/kind-registry';
+export * from './lib/workflow-verdict-evaluator';

package/src/inquiry/lib/enums.ts

@@ -0,0 +1,103 @@
+/**
+ * Discriminator on the inquiry row. Determines which Zod schemas apply to
+ * the `prompt` and `reply` payloads. Future kinds (e.g. TOOL_PROMPT,
+ * CONFIRMATION) extend this enum without breaking existing rows.
+ *
+ * `REVIEW` is the comment-only review surface — pins one or more
+ * artifact versions and asks recipients to leave free-form commentary.
+ * No approve/reject verdict, no policy aggregation, no terminal
+ * "approved/rejected" outcome. Compose with DECISION_GATE when both
+ * review-and-gate semantics are needed.
+ */
+export enum InquiryKind {
+  DECISION_GATE = 'decision_gate',
+  AGENT_TOOL_INQUIRY = 'agent_tool_inquiry',
+  REVIEW = 'review',
+}
+
+/**
+ * Lifecycle states. Once an inquiry is non-PENDING, no further replies are
+ * accepted; reply ingest returns 409.
+ */
+export enum InquiryStatus {
+  PENDING = 'pending',
+  RESOLVED = 'resolved',
+  EXPIRED = 'expired',
+  CANCELLED = 'cancelled',
+}
+
+/**
+ * Source of a recipient's reply. Discriminates the `target` payload shape
+ * on `Recipient` and the `submittedBy` attribution on `InquiryReply`.
+ *
+ * `IDENTITY_GROUP` is an *authoring* kind: it is never persisted as a
+ * recipient row. The engine resolves it at inquiry-create time against
+ * the identity-system group registry (recursive members) and replaces it
+ * with N concrete `HUMAN` recipients. From the moment the inquiry exists
+ * the wire payload is identical to today's recipient list. Resolution is
+ * snapshot-at-create — later membership changes do not affect the
+ * inquiry.
+ *
+ * `WORKFLOW` is a non-human responder: the engine dispatches a child
+ * workflow (slug + inputs) and maps its outputs to a verdict. Same
+ * uniform reply contract as `HUMAN`/`AGENT`/`ENDPOINT`. Useful for
+ * "approval-as-workflow" — e.g. compliance-review.workflow.yaml as a
+ * recipient that produces approve/reject after running its own gates.
+ */
+export enum RecipientKind {
+  HUMAN = 'human',
+  AGENT = 'agent',
+  ENDPOINT = 'endpoint',
+  IDENTITY_GROUP = 'identity_group',
+  WORKFLOW = 'workflow',
+}
+
+/**
+ * Per-recipient lifecycle. The engine flips PENDING → REPLIED atomically
+ * under `SELECT … FOR UPDATE` so concurrent reply attempts can't both win.
+ * SKIPPED is set when the policy short-circuits (e.g. quorum reached);
+ * ERRORED when a non-human decider activity exhausted its retries.
+ */
+export enum InquiryRecipientStatus {
+  PENDING = 'pending',
+  REPLIED = 'replied',
+  SKIPPED = 'skipped',
+  ERRORED = 'errored',
+}
+
+/**
+ * Aggregation rules applied across recipients' replies. Discriminated union
+ * shapes live in `./policy.ts`. The decider workflow short-circuits as soon
+ * as the policy is provably decided (e.g. M_OF_N approves once `m`
+ * approvals are in; rejects once remaining recipients can no longer reach
+ * `m`).
+ */
+export enum ReplyPolicyKind {
+  SINGLE = 'single',
+  M_OF_N = 'm_of_n',
+  ALL_OF = 'all_of',
+  ANY_OF = 'any_of',
+}
+
+/**
+ * Action when the inquiry's deadline passes with no terminal verdict.
+ *
+ * - `REJECT` / `APPROVE` — auto-decide on timeout. For DECISION_GATE this
+ *   becomes `EXPIRED_REJECTED` / `EXPIRED_APPROVED`. For
+ *   AGENT_TOOL_INQUIRY only `REJECT` is meaningful (the activity returns
+ *   `null`, which aborts the tool); `APPROVE` is rejected by the
+ *   schema for that kind.
+ * - `ESCALATE` — instead of auto-deciding, advance to the next level in
+ *   the inquiry's `escalationChain`. Pending recipients are marked
+ *   skipped(`escalation_timeout`); the next level's recipients are
+ *   inserted as fresh PENDING rows; `expiresAt` resets to
+ *   `now + nextLevel.timeoutSeconds`. When the chain is exhausted,
+ *   `escalationChain[].onExhaustion` (or the inquiry's
+ *   `onEscalationExhaustion` field) decides the final action — defaults
+ *   to REJECT so a misconfigured chain never silently approves.
+ */
+export enum InquiryTimeoutAction {
+  REJECT = 'reject',
+  APPROVE = 'approve',
+  ESCALATE = 'escalate',
+}

package/src/inquiry/lib/inquiry.ts

@@ -0,0 +1,182 @@
+import { z } from 'zod';
+
+import {
+  InquiryKind,
+  InquiryRecipientStatus,
+  InquiryStatus,
+  InquiryTimeoutAction,
+  RecipientKind,
+} from './enums';
+import { ReplyPolicySchema } from './policy';
+import { RecipientSchema } from './recipient';
+
+/**
+ * One step in an inquiry's escalation chain. When the inquiry's
+ * `onTimeout === ESCALATE` and the deadline passes, the engine advances
+ * to the next step: marks all PENDING recipients as
+ * `skipped(reason='escalation_timeout')`, inserts the step's recipients
+ * as fresh PENDING rows, and resets the deadline to
+ * `now + timeoutSeconds`. The step's `policy` (when present) replaces
+ * the inquiry's policy for that level so escalations can demand a
+ * different aggregation rule than the original ask.
+ *
+ * `recipients` MUST be non-empty. The chain is linear; each step is
+ * tried in order. When the chain is exhausted, the inquiry's
+ * `onEscalationExhaustion` field decides the final action — defaults
+ * to `REJECT` when omitted so a misconfigured chain never silently
+ * approves.
+ */
+export const EscalationStepSchema = z.object({
+  recipients: z.array(RecipientSchema).min(1),
+  policy: ReplyPolicySchema.optional(),
+  timeoutSeconds: z.number().int().positive(),
+});
+export type EscalationStep = z.infer<typeof EscalationStepSchema>;
+
+/**
+ * Wire-shape of an Inquiry envelope. The `prompt` and `verdict` fields
+ * are kind-discriminated JSON — their shapes are owned by the per-kind
+ * contract packages (see `KindSchemaRegistry`).
+ *
+ * Engine + worker import this for cross-process consistency. The
+ * persisted model on the engine side mirrors these field names but stores
+ * `prompt`/`policy`/`verdict` as JSON columns; the engine validates the
+ * payload against the kind-registered Zod schemas at the controller
+ * boundary.
+ */
+export const InquirySchema = z.object({
+  id: z.string().min(1),
+  orgId: z.string().min(1),
+  projectId: z.string().min(1),
+  workflowRunId: z.string().min(1),
+  jobRunId: z.string().min(1),
+  kind: z.nativeEnum(InquiryKind),
+  title: z.string(),
+  prompt: z.record(z.string(), z.unknown()),
+  policy: ReplyPolicySchema,
+  status: z.nativeEnum(InquiryStatus),
+  expiresAtIso: z.string(),
+  onTimeout: z.nativeEnum(InquiryTimeoutAction),
+  /**
+   * Escalation chain — linear list of recipient sets, each tried in
+   * order on deadline-passed (`onTimeout === ESCALATE`). Empty when
+   * `onTimeout !== ESCALATE`. Validated at create time.
+   */
+  escalationChain: z.array(EscalationStepSchema),
+  /**
+   * Action when the escalation chain is exhausted (i.e. the final
+   * step's deadline passes with no terminal verdict). Closed set:
+   * `REJECT` (default) or `APPROVE`. `ESCALATE` is rejected here at
+   * the schema level — would be a runtime infinite loop.
+   */
+  onEscalationExhaustion: z.enum(['reject', 'approve']),
+  /**
+   * Zero-based pointer into `escalationChain`. Bumped each time the
+   * engine advances. `0` means "still on the original recipients";
+   * `1` means "currently on chain[0]"; etc. (i.e. it counts how many
+   * escalations have fired, NOT which slot of the chain is active).
+   */
+  currentEscalationLevel: z.number().int().nonnegative(),
+  verdict: z.record(z.string(), z.unknown()).nullable(),
+  resolvedAtIso: z.string().nullable(),
+  cancelledAtIso: z.string().nullable(),
+  createdAtIso: z.string(),
+  updatedAtIso: z.string(),
+  recipients: z.array(
+    z.object({
+      id: z.string().min(1),
+      ord: z.number().int().nonnegative(),
+      kind: z.nativeEnum(RecipientKind),
+      target: z.record(z.string(), z.unknown()),
+      status: z.nativeEnum(InquiryRecipientStatus),
+      replyId: z.string().nullable(),
+      mandatory: z.boolean(),
+    }),
+  ),
+  replies: z
+    .array(
+      z.object({
+        id: z.string().min(1),
+        recipientId: z.string().min(1),
+        payload: z.record(z.string(), z.unknown()),
+        submittedBy: z.string().min(1),
+        submittedAtIso: z.string(),
+      }),
+    )
+    .optional(),
+});
+export type Inquiry = z.infer<typeof InquirySchema>;
+
+/**
+ * Caller-supplied input for `POST /inquiries`. The engine generates the
+ * recipient IDs and timestamps. `id` is caller-supplied so the engine is
+ * idempotent on retry — a duplicate POST returns the existing row.
+ */
+export const CreateInquiryInputSchema = z
+  .object({
+    id: z.string().min(1),
+    orgId: z.string().min(1),
+    projectId: z.string().min(1),
+    workflowRunId: z.string().min(1),
+    jobRunId: z.string().min(1),
+    kind: z.nativeEnum(InquiryKind),
+    title: z.string(),
+    prompt: z.record(z.string(), z.unknown()),
+    policy: ReplyPolicySchema,
+    recipients: z.array(RecipientSchema).min(1),
+    expiresAtIso: z.string(),
+    onTimeout: z.nativeEnum(InquiryTimeoutAction),
+    escalationChain: z.array(EscalationStepSchema).optional(),
+    onEscalationExhaustion: z.enum(['reject', 'approve']).optional(),
+  })
+  .superRefine((value, ctx) => {
+    // ESCALATE without a chain is meaningless — would have to fall back
+    // to REJECT/APPROVE on the first timeout, defeating the point.
+    if (
+      value.onTimeout === InquiryTimeoutAction.ESCALATE &&
+      (value.escalationChain === undefined || value.escalationChain.length === 0)
+    ) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['escalationChain'],
+        message:
+          'onTimeout=ESCALATE requires a non-empty escalationChain. Configure at least one escalation step or change onTimeout.',
+      });
+    }
+    // A chain on a non-escalating inquiry is dead weight; flag it so the
+    // workflow author notices the misconfiguration.
+    if (
+      value.onTimeout !== InquiryTimeoutAction.ESCALATE &&
+      value.escalationChain !== undefined &&
+      value.escalationChain.length > 0
+    ) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['escalationChain'],
+        message: `escalationChain is set but onTimeout=${value.onTimeout} — change onTimeout to ESCALATE or remove the chain.`,
+      });
+    }
+  });
+export type CreateInquiryInput = z.infer<typeof CreateInquiryInputSchema>;
+
+/**
+ * Reply submitted by one recipient. Engine validates `payload` against the
+ * kind-specific reply schema before insert; per-recipient idempotency is
+ * enforced via `SELECT … FOR UPDATE` on the recipient row.
+ */
+export const InquiryReplySchema = z.object({
+  id: z.string().min(1),
+  inquiryId: z.string().min(1),
+  recipientId: z.string().min(1),
+  payload: z.record(z.string(), z.unknown()),
+  submittedBy: z.string().min(1),
+  submittedAtIso: z.string(),
+});
+export type InquiryReply = z.infer<typeof InquiryReplySchema>;
+
+export const SubmitReplyInputSchema = z.object({
+  recipientId: z.string().min(1),
+  payload: z.record(z.string(), z.unknown()),
+  submittedBy: z.string().min(1),
+});
+export type SubmitReplyInput = z.infer<typeof SubmitReplyInputSchema>;

package/src/inquiry/lib/kind-registry.ts

@@ -0,0 +1,57 @@
+import type { z } from 'zod';
+
+import type { InquiryKind } from './enums';
+
+/**
+ * Per-kind schema pair. Engine + bridge use these to validate `prompt` on
+ * inquiry creation and `payload` on reply submission. Each consumer of an
+ * `InquiryKind` registers its schemas at module init.
+ *
+ * The registry is intentionally NOT auto-populated here — populating it
+ * would create a hard dependency from this package to every kind's
+ * contract package, defeating the point of keeping per-kind contracts in
+ * their own packages. Instead, the engine imports each contract package
+ * and calls `registerInquiryKind` at boot.
+ */
+export interface InquiryKindSchemas {
+  readonly promptSchema: z.ZodType<unknown>;
+  readonly replySchema: z.ZodType<unknown>;
+  /**
+   * Optional verdict shape — only relevant for kinds that aggregate
+   * across recipients (e.g. DECISION_GATE). For per-reply kinds (e.g.
+   * AGENT_TOOL_INQUIRY with policy=SINGLE), this can be omitted; the
+   * verdict is just the first reply's payload.
+   */
+  readonly verdictSchema?: z.ZodType<unknown>;
+}
+
+/**
+ * In-process registry. The engine has one instance bound at module init;
+ * the worker has another. Tests construct their own registries.
+ */
+export class InquiryKindSchemaRegistry {
+  private readonly entries = new Map<InquiryKind, InquiryKindSchemas>();
+
+  register(kind: InquiryKind, schemas: InquiryKindSchemas): void {
+    if (this.entries.has(kind)) {
+      throw new Error(
+        `InquiryKindSchemaRegistry: kind '${kind}' is already registered`,
+      );
+    }
+    this.entries.set(kind, schemas);
+  }
+
+  get(kind: InquiryKind): InquiryKindSchemas {
+    const schemas = this.entries.get(kind);
+    if (!schemas) {
+      throw new Error(
+        `InquiryKindSchemaRegistry: no schemas registered for kind '${kind}'`,
+      );
+    }
+    return schemas;
+  }
+
+  has(kind: InquiryKind): boolean {
+    return this.entries.has(kind);
+  }
+}

package/src/inquiry/lib/policy.ts

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+
+import { ReplyPolicyKind } from './enums';
+
+/**
+ * What to do when an agent or endpoint recipient submits an ABSTAIN
+ * verdict. `skip` (default) ignores the recipient's vote and waits for the
+ * remaining recipients; `reject_implicit` treats abstention as a rejection
+ * for purposes of M_OF_N / ALL_OF arithmetic. Without this knob, a flaky
+ * LLM can silently sink an inquiry by abstaining.
+ */
+export enum AbstainTreatment {
+  SKIP = 'skip',
+  REJECT_IMPLICIT = 'reject_implicit',
+}
+
+export const ReplyPolicySchema = z.discriminatedUnion('kind', [
+  z.object({ kind: z.literal(ReplyPolicyKind.SINGLE) }),
+  z.object({
+    kind: z.literal(ReplyPolicyKind.M_OF_N),
+    m: z.number().int().positive(),
+    abstainTreatment: z.nativeEnum(AbstainTreatment).optional(),
+  }),
+  z.object({ kind: z.literal(ReplyPolicyKind.ALL_OF) }),
+  z.object({ kind: z.literal(ReplyPolicyKind.ANY_OF) }),
+]);
+export type ReplyPolicy = z.infer<typeof ReplyPolicySchema>;