{
  "openapi": "3.1.1",
  "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
  "info": {
    "title": "Naumio Service Closeout PDF",
    "version": "0.1.1",
    "description": "Authenticated, deterministic tools for non-sensitive integration evaluation. Prepare returns usable bytes. Digests bind content; they are not human consent. Muse rendering, downloads and user authorization remain subject to separate provider integration review."
  },
  "servers": [
    {
      "url": "https://muse-api.naumio.com",
      "description": "Authenticated endpoint; no anonymous tool processing."
    }
  ],
  "tags": [
    {
      "name": "CropCheck",
      "description": "Deterministic static-image Fit/Cover PNGs and ZIP; no AI redraw."
    },
    {
      "name": "Service Closeout",
      "description": "Supplied-evidence PDF; no truth certification or job completion inference."
    }
  ],
  "security": [
    {
      "CallerBearer": []
    }
  ],
  "paths": {
    "/api/report/prepare": {
      "post": {
        "operationId": "prepareServiceCloseout",
        "tags": [
          "Service Closeout"
        ],
        "summary": "Prepare supplied-evidence PDF and page previews",
        "description": "Returns full PDF plus exact PDF page PNGs and sources-free record. All labels/facts are caller supplied. No semantic verification. Full source notes are prohibited on prepare.",
        "x-core-request-body-max-bytes": 100000,
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ReportPrepareRequest"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Existing core JSON result; generation is not download, sending, submission or approval.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReportPrepareResponse"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "429": {
            "$ref": "#/components/responses/Busy"
          },
          "401": {
            "description": "Missing or invalid caller credential.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "413": {
            "description": "Request exceeds the endpoint byte limit.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "415": {
            "description": "Content-Type must be exactly application/json.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "502": {
            "description": "Origin unavailable or redirect rejected.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "503": {
            "description": "Gateway configuration unavailable.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/api/report/export": {
      "post": {
        "operationId": "exportServiceCloseout",
        "tags": [
          "Service Closeout"
        ],
        "summary": "Export reviewed PDF and optional private backup",
        "description": "Resupply complete data and record.approval_digest as approvalDigest. Revalidates input and digest. Full-note backup is separate opt-in; omission/false returns no privateSources. No sending, signature, billing or completion certification.",
        "x-core-request-body-max-bytes": 100000,
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ReportExportRequest"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Existing core JSON result; generation is not download, sending, submission or approval.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReportExportResponse"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "429": {
            "$ref": "#/components/responses/Busy"
          },
          "401": {
            "description": "Missing or invalid caller credential.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "413": {
            "description": "Request exceeds the endpoint byte limit.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "415": {
            "description": "Content-Type must be exactly application/json.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "502": {
            "description": "Origin unavailable or redirect rejected.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "503": {
            "description": "Gateway configuration unavailable.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "CallerBearer": {
        "type": "http",
        "scheme": "bearer",
        "description": "Dedicated integration credential in Authorization: Bearer. Obtain through an agreed secure exchange; never paste secrets into documentation. No OAuth or JWT format claimed."
      }
    },
    "schemas": {
      "Digest": {
        "type": "string",
        "pattern": "^[a-f0-9]{64}$",
        "description": "Use the exact digest returned by prepare. Content binding only, not authentication, human consent, expiry or single-use proof."
      },
      "Base64": {
        "type": "string",
        "minLength": 4,
        "contentEncoding": "base64",
        "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$",
        "description": "Canonical standard base64, not a URL or data URL. Content decoding/type validation remains a runtime check."
      },
      "PngDataUrl": {
        "type": "string",
        "pattern": "^data:image/png;base64,[A-Za-z0-9+/]+={0,2}$",
        "description": "Usable PNG bytes encoded as a data URL, not a remote artifact URL. Inspect all returned images."
      },
      "Identifier": {
        "type": "string",
        "pattern": "^[a-zA-Z0-9_-]{1,40}$"
      },
      "Source": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "id",
          "text"
        ],
        "properties": {
          "id": {
            "$ref": "#/components/schemas/Identifier"
          },
          "text": {
            "type": "string",
            "minLength": 1,
            "maxLength": 2000,
            "description": "Nonblank; NFC normalization; bounded Vera glyph support; newline/tab allowed, unsupported controls/bidi refused. Private notes; do not log or include in ordinary outputs.",
            "pattern": "\\S"
          }
        }
      },
      "Finding": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "id",
          "state",
          "source_id",
          "excerpt"
        ],
        "properties": {
          "id": {
            "$ref": "#/components/schemas/Identifier"
          },
          "state": {
            "type": "string",
            "enum": [
              "performed",
              "verified",
              "not_tested",
              "unresolved"
            ],
            "description": "Caller-supplied label, not an independently verified finding."
          },
          "source_id": {
            "$ref": "#/components/schemas/Identifier"
          },
          "excerpt": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1000,
            "description": "Must exactly occur in the referenced NFC-normalized source text. Source ID resolution and excerpt relationship are core checks, not JSON Schema assertions.",
            "pattern": "\\S"
          }
        }
      },
      "ReportInput": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "brand",
          "job_id",
          "job_date",
          "scope",
          "sources",
          "findings",
          "next_actions"
        ],
        "properties": {
          "brand": {
            "type": "string",
            "minLength": 1,
            "maxLength": 80,
            "pattern": "\\S"
          },
          "job_id": {
            "$ref": "#/components/schemas/Identifier"
          },
          "job_date": {
            "type": "string",
            "format": "date",
            "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$"
          },
          "scope": {
            "type": "string",
            "minLength": 1,
            "maxLength": 2000,
            "pattern": "\\S"
          },
          "sources": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Source"
            },
            "minItems": 1,
            "maxItems": 20,
            "description": "Unique IDs, including unused source notes in validation and digest."
          },
          "findings": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Finding"
            },
            "minItems": 1,
            "maxItems": 30,
            "description": "Unique finding IDs; referenced source must exist."
          },
          "next_actions": {
            "type": "array",
            "items": {
              "type": "string",
              "minLength": 1,
              "maxLength": 500,
              "pattern": "\\S"
            },
            "minItems": 0,
            "maxItems": 10
          }
        },
        "description": "Text length limits apply before NFC normalization. Both Vera font faces must support characters. No OCR, extraction, semantic validation, certification, invoice or signature."
      },
      "ReportSnapshot": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "brand",
          "job_id",
          "job_date",
          "scope",
          "findings",
          "next_actions"
        ],
        "properties": {
          "brand": {
            "type": "string",
            "minLength": 1,
            "maxLength": 80
          },
          "job_id": {
            "$ref": "#/components/schemas/Identifier"
          },
          "job_date": {
            "type": "string",
            "format": "date"
          },
          "scope": {
            "type": "string",
            "minLength": 1,
            "maxLength": 2000
          },
          "findings": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Finding"
            },
            "minItems": 1,
            "maxItems": 30
          },
          "next_actions": {
            "type": "array",
            "items": {
              "type": "string",
              "minLength": 1,
              "maxLength": 500
            },
            "minItems": 0,
            "maxItems": 10
          }
        },
        "description": "Normalized projection, deliberately excludes full source notes. Selected excerpts and identifiers can still be sensitive."
      },
      "ReportRecord": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "schema",
          "snapshot",
          "approval_digest",
          "unresolved_count",
          "warnings"
        ],
        "properties": {
          "schema": {
            "type": "string",
            "const": "naumio.service-closeout.v1"
          },
          "snapshot": {
            "$ref": "#/components/schemas/ReportSnapshot"
          },
          "approval_digest": {
            "$ref": "#/components/schemas/Digest"
          },
          "unresolved_count": {
            "type": "integer",
            "minimum": 0,
            "maximum": 30,
            "description": "Count of unresolved OR not_tested findings."
          },
          "warnings": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "minItems": 3
          }
        }
      },
      "ReportPrepareRequest": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "data"
        ],
        "properties": {
          "data": {
            "$ref": "#/components/schemas/ReportInput"
          },
          "includePrivateSources": {
            "type": "boolean",
            "const": false,
            "default": false
          }
        }
      },
      "ReportExportRequest": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "data",
          "approvalDigest"
        ],
        "properties": {
          "data": {
            "$ref": "#/components/schemas/ReportInput"
          },
          "approvalDigest": {
            "$ref": "#/components/schemas/Digest"
          },
          "includePrivateSources": {
            "type": "boolean",
            "const": false,
            "default": false,
            "description": "This hosted adapter rejects true. Full source-note backup is not available through this integration."
          }
        }
      },
      "ReportPrepareResponse": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "record",
          "pdfBase64",
          "previewPages"
        ],
        "properties": {
          "record": {
            "$ref": "#/components/schemas/ReportRecord"
          },
          "pdfBase64": {
            "allOf": [
              {
                "$ref": "#/components/schemas/Base64"
              }
            ],
            "contentMediaType": "application/pdf"
          },
          "previewPages": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/PngDataUrl"
            },
            "minItems": 1,
            "maxItems": 40,
            "description": "In PDF page order, rendered from exactly pdfBase64 at 1.25 scale; Letter pages 765x990. Prepare already returns the complete usable PDF."
          }
        }
      },
      "ReportExportResponse": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "record",
          "pdfBase64"
        ],
        "properties": {
          "record": {
            "$ref": "#/components/schemas/ReportRecord"
          },
          "pdfBase64": {
            "allOf": [
              {
                "$ref": "#/components/schemas/Base64"
              }
            ],
            "contentMediaType": "application/pdf"
          },
          "privateSources": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Source"
            },
            "minItems": 1,
            "maxItems": 20,
            "description": "Present only when includePrivateSources=true. Never nested in record.snapshot or attached to PDF. Preserve private-note warning in record.warnings."
          }
        }
      },
      "Error": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "error"
        ],
        "properties": {
          "error": {
            "oneOf": [
              {
                "type": "string"
              },
              {
                "type": "object",
                "required": [
                  "code"
                ],
                "properties": {
                  "code": {
                    "type": "string"
                  },
                  "requestId": {
                    "type": "string"
                  }
                },
                "additionalProperties": false
              }
            ]
          }
        }
      }
    },
    "responses": {
      "BadRequest": {
        "description": "Existing shim: malformed JSON, input/decoder/font/renderer/resource failure or missing/stale approval. All handled processing errors use 400; not separate typed codes. Correct input or reprepare and obtain fresh review. Some stream/timeout failures instead terminate transport.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            }
          }
        }
      },
      "Forbidden": {
        "description": "Existing shim: Host/Origin/local-token or exact Content-Type check failed. Not evidence of public authentication. Proposed adapter must supply its own authenticated rejection policy before release.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            }
          }
        }
      },
      "NotFound": {
        "description": "Existing shim: unknown route or unsupported method.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            }
          }
        }
      },
      "Busy": {
        "description": "Existing shim: one process-global operation is active. No queue, per-user quota or Retry-After guarantee. Retry after completion; reconcile any uncertain external delivery separately.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            }
          }
        }
      }
    }
  }
}