@brite-future-schools-contracts/contracts 1.0.8 → 2.0.2

package/dist/chunk-AEZO7MJD.js

@@ -0,0 +1,127 @@
+// src/schemas/base.ts
+import * as z from "zod";
+var CuidSchema = z.string().regex(/^[a-z][a-z0-9]{24}$/, "Invalid cuid2 identifier").meta({ description: "cuid2 \u2014 prefixed, collision-resistant identifier" });
+var UuidSchema = z.uuidv4().meta({ description: "RFC-4122 UUID v4" });
+var IsoDatetime = z.iso.datetime();
+var TimestampsSchema = z.object({
+  createdAt: IsoDatetime.meta({ description: "ISO-8601 creation time (UTC)" }),
+  updatedAt: IsoDatetime.meta({ description: "ISO-8601 last update time (UTC)" })
+});
+var SoftDeleteSchema = z.object({
+  deletedAt: IsoDatetime.nullable().meta({
+    description: "Set when the record is soft-deleted; null if active"
+  })
+});
+var PaginationInputSchema = z.object({
+  cursor: CuidSchema.optional().meta({
+    description: "Opaque cursor from the previous page response"
+  }),
+  limit: z.int().min(1).max(100).default(20).meta({ description: "Number of items to return (1\u2013100, default 20)" })
+});
+function paginatedOutputSchema(itemSchema) {
+  return z.object({
+    items: z.array(itemSchema),
+    nextCursor: CuidSchema.nullable().meta({
+      description: "Pass as `cursor` on the next request; null when no more pages"
+    }),
+    total: z.int().nonnegative().meta({ description: "Total matching records (before pagination)" })
+  });
+}
+var BranchRefSchema = z.object({
+  branchId: CuidSchema.meta({ description: "The branch this record belongs to" })
+});
+
+// src/schemas/auth.ts
+import * as z2 from "zod";
+var SessionUserRoleSchema = z2.object({
+  id: CuidSchema,
+  name: z2.string().meta({ description: "Role name, e.g. PRINCIPAL" }),
+  branchId: CuidSchema,
+  isPrimary: z2.boolean()
+});
+var SessionUserSubRoleSchema = z2.object({
+  id: CuidSchema,
+  name: z2.string().meta({ description: "Sub-role name, e.g. HEAD_PREFECT" }),
+  branchId: CuidSchema
+});
+var SessionUserOutputSchema = z2.object({
+  id: CuidSchema,
+  email: z2.email(),
+  firstName: z2.string(),
+  lastName: z2.string(),
+  activeBranchId: CuidSchema,
+  roles: z2.array(SessionUserRoleSchema),
+  subRoles: z2.array(SessionUserSubRoleSchema),
+  isActive: z2.boolean(),
+  mustChangePassword: z2.boolean()
+});
+var LoginInputSchema = z2.object({
+  email: z2.email().meta({ description: "User email address" }),
+  password: z2.string().min(1).meta({ description: "Plain-text password (sent over TLS)" }),
+  branchId: CuidSchema.optional().meta({
+    description: "Branch to activate on login; defaults to user primary branch"
+  })
+});
+var LoginOutputSchema = z2.object({
+  accessToken: z2.string().meta({ description: "Short-lived JWT (15 min)" }),
+  refreshToken: z2.string().meta({ description: "Long-lived opaque refresh token (7 days)" }),
+  expiresIn: z2.int().positive().meta({ description: "Access token TTL in seconds" }),
+  user: SessionUserOutputSchema
+});
+var RefreshTokenInputSchema = z2.object({
+  refreshToken: z2.string().min(1)
+});
+var RefreshTokenOutputSchema = z2.object({
+  accessToken: z2.string(),
+  expiresIn: z2.int().positive()
+});
+var LogoutInputSchema = z2.object({
+  refreshToken: z2.string().min(1).meta({
+    description: "The refresh token to revoke; also invalidated server-side"
+  })
+});
+var ChangePasswordInputSchema = z2.object({
+  currentPassword: z2.string().min(1),
+  newPassword: z2.string().min(8, { error: "Password must be at least 8 characters" }),
+  confirmPassword: z2.string().min(1)
+}).refine((v) => v.newPassword === v.confirmPassword, {
+  error: "Passwords do not match",
+  path: ["confirmPassword"]
+});
+var RequestPasswordResetInputSchema = z2.object({
+  email: z2.email()
+});
+var ResetPasswordInputSchema = z2.object({
+  token: z2.string().min(1).meta({ description: "One-time reset token from email link" }),
+  newPassword: z2.string().min(8, { error: "Password must be at least 8 characters" }),
+  confirmPassword: z2.string().min(1)
+}).refine((v) => v.newPassword === v.confirmPassword, {
+  error: "Passwords do not match",
+  path: ["confirmPassword"]
+});
+var SwitchBranchInputSchema = z2.object({
+  branchId: CuidSchema.meta({ description: "Branch to switch the active session to" })
+});
+
+export {
+  CuidSchema,
+  UuidSchema,
+  TimestampsSchema,
+  SoftDeleteSchema,
+  PaginationInputSchema,
+  paginatedOutputSchema,
+  BranchRefSchema,
+  SessionUserRoleSchema,
+  SessionUserSubRoleSchema,
+  SessionUserOutputSchema,
+  LoginInputSchema,
+  LoginOutputSchema,
+  RefreshTokenInputSchema,
+  RefreshTokenOutputSchema,
+  LogoutInputSchema,
+  ChangePasswordInputSchema,
+  RequestPasswordResetInputSchema,
+  ResetPasswordInputSchema,
+  SwitchBranchInputSchema
+};
+//# sourceMappingURL=chunk-AEZO7MJD.js.map

package/dist/chunk-AEZO7MJD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/schemas/base.ts","../src/schemas/auth.ts"],"sourcesContent":["/**\n * Brite Future Schools — bfs-contracts\n * Base Zod schemas: reusable primitives shared across all domain schemas.\n *\n * Phase History:\n *   Phase 0.1 (2026-06-05): Initial creation\n *\n * @module src/schemas/base\n * @since Phase 0.1\n */\n\nimport * as z from 'zod'\n\n// ── ID ─────────────────────────────────────────────────────────────────────────\n\nexport const CuidSchema = z\n    .string()\n    .regex(/^[a-z][a-z0-9]{24}$/, 'Invalid cuid2 identifier')\n    .meta({ description: 'cuid2 — prefixed, collision-resistant identifier' })\n\n// ── UUID ───────────────────────────────────────────────────────────────────────\n\nexport const UuidSchema = z\n    .uuidv4()\n    .meta({ description: 'RFC-4122 UUID v4' })\n\n// ── Timestamps ─────────────────────────────────────────────────────────────────\n\nconst IsoDatetime = z.iso.datetime()\n\nexport const TimestampsSchema = z.object({\n    createdAt: IsoDatetime.meta({ description: 'ISO-8601 creation time (UTC)' }),\n    updatedAt: IsoDatetime.meta({ description: 'ISO-8601 last update time (UTC)' }),\n})\n\n// ── Soft-delete ────────────────────────────────────────────────────────────────\n\nexport const SoftDeleteSchema = z.object({\n    deletedAt: IsoDatetime.nullable().meta({\n        description: 'Set when the record is soft-deleted; null if active',\n    }),\n})\n\n// ── Pagination ─────────────────────────────────────────────────────────────────\n\nexport const PaginationInputSchema = z.object({\n    cursor: CuidSchema.optional().meta({\n        description: 'Opaque cursor from the previous page response',\n    }),\n    limit: z\n        .int()\n        .min(1)\n        .max(100)\n        .default(20)\n        .meta({ description: 'Number of items to return (1–100, default 20)' }),\n})\n\nexport function paginatedOutputSchema<T extends z.ZodTypeAny>(itemSchema: T) {\n    return z.object({\n        items: z.array(itemSchema),\n        nextCursor: CuidSchema.nullable().meta({\n            description: 'Pass as `cursor` on the next request; null when no more pages',\n        }),\n        total: z\n            .int()\n            .nonnegative()\n            .meta({ description: 'Total matching records (before pagination)' }),\n    })\n}\n\n// ── Branch reference ───────────────────────────────────────────────────────────\n\nexport const BranchRefSchema = z.object({\n    branchId: CuidSchema.meta({ description: 'The branch this record belongs to' }),\n})\n\n// ── Inferred types ─────────────────────────────────────────────────────────────\n\nexport type Timestamps = z.infer<typeof TimestampsSchema>\nexport type SoftDelete = z.infer<typeof SoftDeleteSchema>\nexport type PaginationInput = z.infer<typeof PaginationInputSchema>","/**\n * Brite Future Schools — bfs-contracts\n * Auth-related Zod schemas.\n *\n * Phase History:\n *   Phase 0.1 (2026-06-05): Initial creation\n *\n * @module src/schemas/auth\n * @since Phase 0.1\n */\n\nimport * as z from 'zod'\nimport { CuidSchema } from './base.js'\n\n// ── Session user (defined first — referenced by LoginOutputSchema below) ───────\n\nexport const SessionUserRoleSchema = z.object({\n    id: CuidSchema,\n    name: z.string().meta({ description: 'Role name, e.g. PRINCIPAL' }),\n    branchId: CuidSchema,\n    isPrimary: z.boolean(),\n})\n\nexport const SessionUserSubRoleSchema = z.object({\n    id: CuidSchema,\n    name: z.string().meta({ description: 'Sub-role name, e.g. HEAD_PREFECT' }),\n    branchId: CuidSchema,\n})\n\nexport const SessionUserOutputSchema = z.object({\n    id: CuidSchema,\n    email: z.email(),\n    firstName: z.string(),\n    lastName: z.string(),\n    activeBranchId: CuidSchema,\n    roles: z.array(SessionUserRoleSchema),\n    subRoles: z.array(SessionUserSubRoleSchema),\n    isActive: z.boolean(),\n    mustChangePassword: z.boolean(),\n})\n\n// ── Login ──────────────────────────────────────────────────────────────────────\n\nexport const LoginInputSchema = z.object({\n    email: z.email().meta({ description: 'User email address' }),\n    password: z.string().min(1).meta({ description: 'Plain-text password (sent over TLS)' }),\n    branchId: CuidSchema.optional().meta({\n        description: 'Branch to activate on login; defaults to user primary branch',\n    }),\n})\n\nexport const LoginOutputSchema = z.object({\n    accessToken: z.string().meta({ description: 'Short-lived JWT (15 min)' }),\n    refreshToken: z.string().meta({ description: 'Long-lived opaque refresh token (7 days)' }),\n    expiresIn: z.int().positive().meta({ description: 'Access token TTL in seconds' }),\n    user: SessionUserOutputSchema,\n})\n\n// ── Token refresh ──────────────────────────────────────────────────────────────\n\nexport const RefreshTokenInputSchema = z.object({\n    refreshToken: z.string().min(1),\n})\n\nexport const RefreshTokenOutputSchema = z.object({\n    accessToken: z.string(),\n    expiresIn: z.int().positive(),\n})\n\n// ── Logout ─────────────────────────────────────────────────────────────────────\n\nexport const LogoutInputSchema = z.object({\n    refreshToken: z.string().min(1).meta({\n        description: 'The refresh token to revoke; also invalidated server-side',\n    }),\n})\n\n// ── Password change ─────────────────────────────────────────────────────────────\n\nexport const ChangePasswordInputSchema = z\n    .object({\n        currentPassword: z.string().min(1),\n        newPassword: z\n            .string()\n            .min(8, { error: 'Password must be at least 8 characters' }),\n        confirmPassword: z.string().min(1),\n    })\n    .refine((v) => v.newPassword === v.confirmPassword, {\n        error: 'Passwords do not match',\n        path: ['confirmPassword'],\n    })\n\n// ── Password reset ─────────────────────────────────────────────────────────────\n\nexport const RequestPasswordResetInputSchema = z.object({\n    email: z.email(),\n})\n\nexport const ResetPasswordInputSchema = z\n    .object({\n        token: z.string().min(1).meta({ description: 'One-time reset token from email link' }),\n        newPassword: z.string().min(8, { error: 'Password must be at least 8 characters' }),\n        confirmPassword: z.string().min(1),\n    })\n    .refine((v) => v.newPassword === v.confirmPassword, {\n        error: 'Passwords do not match',\n        path: ['confirmPassword'],\n    })\n\n// ── Branch switch ───────────────────────────────────────────────────────────────\n\nexport const SwitchBranchInputSchema = z.object({\n    branchId: CuidSchema.meta({ description: 'Branch to switch the active session to' }),\n})\n\n// ── Inferred types ──────────────────────────────────────────────────────────────\n\nexport type LoginInput = z.infer<typeof LoginInputSchema>\nexport type LoginOutput = z.infer<typeof LoginOutputSchema>\nexport type SessionUserOutput = z.infer<typeof SessionUserOutputSchema>\nexport type RefreshTokenInput = z.infer<typeof RefreshTokenInputSchema>\nexport type RefreshTokenOutput = z.infer<typeof RefreshTokenOutputSchema>\nexport type ChangePasswordInput = z.infer<typeof ChangePasswordInputSchema>\nexport type SwitchBranchInput = z.infer<typeof SwitchBranchInputSchema>"],"mappings":";AAWA,YAAY,OAAO;AAIZ,IAAM,aACR,SAAO,EACP,MAAM,uBAAuB,0BAA0B,EACvD,KAAK,EAAE,aAAa,wDAAmD,CAAC;AAItE,IAAM,aACR,SAAO,EACP,KAAK,EAAE,aAAa,mBAAmB,CAAC;AAI7C,IAAM,cAAgB,MAAI,SAAS;AAE5B,IAAM,mBAAqB,SAAO;AAAA,EACrC,WAAW,YAAY,KAAK,EAAE,aAAa,+BAA+B,CAAC;AAAA,EAC3E,WAAW,YAAY,KAAK,EAAE,aAAa,kCAAkC,CAAC;AAClF,CAAC;AAIM,IAAM,mBAAqB,SAAO;AAAA,EACrC,WAAW,YAAY,SAAS,EAAE,KAAK;AAAA,IACnC,aAAa;AAAA,EACjB,CAAC;AACL,CAAC;AAIM,IAAM,wBAA0B,SAAO;AAAA,EAC1C,QAAQ,WAAW,SAAS,EAAE,KAAK;AAAA,IAC/B,aAAa;AAAA,EACjB,CAAC;AAAA,EACD,OACK,MAAI,EACJ,IAAI,CAAC,EACL,IAAI,GAAG,EACP,QAAQ,EAAE,EACV,KAAK,EAAE,aAAa,qDAAgD,CAAC;AAC9E,CAAC;AAEM,SAAS,sBAA8C,YAAe;AACzE,SAAS,SAAO;AAAA,IACZ,OAAS,QAAM,UAAU;AAAA,IACzB,YAAY,WAAW,SAAS,EAAE,KAAK;AAAA,MACnC,aAAa;AAAA,IACjB,CAAC;AAAA,IACD,OACK,MAAI,EACJ,YAAY,EACZ,KAAK,EAAE,aAAa,6CAA6C,CAAC;AAAA,EAC3E,CAAC;AACL;AAIO,IAAM,kBAAoB,SAAO;AAAA,EACpC,UAAU,WAAW,KAAK,EAAE,aAAa,oCAAoC,CAAC;AAClF,CAAC;;;AC/DD,YAAYA,QAAO;AAKZ,IAAM,wBAA0B,UAAO;AAAA,EAC1C,IAAI;AAAA,EACJ,MAAQ,UAAO,EAAE,KAAK,EAAE,aAAa,4BAA4B,CAAC;AAAA,EAClE,UAAU;AAAA,EACV,WAAa,WAAQ;AACzB,CAAC;AAEM,IAAM,2BAA6B,UAAO;AAAA,EAC7C,IAAI;AAAA,EACJ,MAAQ,UAAO,EAAE,KAAK,EAAE,aAAa,mCAAmC,CAAC;AAAA,EACzE,UAAU;AACd,CAAC;AAEM,IAAM,0BAA4B,UAAO;AAAA,EAC5C,IAAI;AAAA,EACJ,OAAS,SAAM;AAAA,EACf,WAAa,UAAO;AAAA,EACpB,UAAY,UAAO;AAAA,EACnB,gBAAgB;AAAA,EAChB,OAAS,SAAM,qBAAqB;AAAA,EACpC,UAAY,SAAM,wBAAwB;AAAA,EAC1C,UAAY,WAAQ;AAAA,EACpB,oBAAsB,WAAQ;AAClC,CAAC;AAIM,IAAM,mBAAqB,UAAO;AAAA,EACrC,OAAS,SAAM,EAAE,KAAK,EAAE,aAAa,qBAAqB,CAAC;AAAA,EAC3D,UAAY,UAAO,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,sCAAsC,CAAC;AAAA,EACvF,UAAU,WAAW,SAAS,EAAE,KAAK;AAAA,IACjC,aAAa;AAAA,EACjB,CAAC;AACL,CAAC;AAEM,IAAM,oBAAsB,UAAO;AAAA,EACtC,aAAe,UAAO,EAAE,KAAK,EAAE,aAAa,2BAA2B,CAAC;AAAA,EACxE,cAAgB,UAAO,EAAE,KAAK,EAAE,aAAa,2CAA2C,CAAC;AAAA,EACzF,WAAa,OAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,8BAA8B,CAAC;AAAA,EACjF,MAAM;AACV,CAAC;AAIM,IAAM,0BAA4B,UAAO;AAAA,EAC5C,cAAgB,UAAO,EAAE,IAAI,CAAC;AAClC,CAAC;AAEM,IAAM,2BAA6B,UAAO;AAAA,EAC7C,aAAe,UAAO;AAAA,EACtB,WAAa,OAAI,EAAE,SAAS;AAChC,CAAC;AAIM,IAAM,oBAAsB,UAAO;AAAA,EACtC,cAAgB,UAAO,EAAE,IAAI,CAAC,EAAE,KAAK;AAAA,IACjC,aAAa;AAAA,EACjB,CAAC;AACL,CAAC;AAIM,IAAM,4BACR,UAAO;AAAA,EACJ,iBAAmB,UAAO,EAAE,IAAI,CAAC;AAAA,EACjC,aACK,UAAO,EACP,IAAI,GAAG,EAAE,OAAO,yCAAyC,CAAC;AAAA,EAC/D,iBAAmB,UAAO,EAAE,IAAI,CAAC;AACrC,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB;AAAA,EAChD,OAAO;AAAA,EACP,MAAM,CAAC,iBAAiB;AAC5B,CAAC;AAIE,IAAM,kCAAoC,UAAO;AAAA,EACpD,OAAS,SAAM;AACnB,CAAC;AAEM,IAAM,2BACR,UAAO;AAAA,EACJ,OAAS,UAAO,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,uCAAuC,CAAC;AAAA,EACrF,aAAe,UAAO,EAAE,IAAI,GAAG,EAAE,OAAO,yCAAyC,CAAC;AAAA,EAClF,iBAAmB,UAAO,EAAE,IAAI,CAAC;AACrC,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB;AAAA,EAChD,OAAO;AAAA,EACP,MAAM,CAAC,iBAAiB;AAC5B,CAAC;AAIE,IAAM,0BAA4B,UAAO;AAAA,EAC5C,UAAU,WAAW,KAAK,EAAE,aAAa,yCAAyC,CAAC;AACvF,CAAC;","names":["z"]}

package/dist/chunk-IR6JUP6L.js

@@ -0,0 +1,48 @@
+import {
+  ChangePasswordInputSchema,
+  LoginInputSchema,
+  LoginOutputSchema,
+  LogoutInputSchema,
+  RefreshTokenInputSchema,
+  RefreshTokenOutputSchema,
+  RequestPasswordResetInputSchema,
+  ResetPasswordInputSchema,
+  SessionUserOutputSchema,
+  SwitchBranchInputSchema
+} from "./chunk-AEZO7MJD.js";
+
+// src/contracts/auth.ts
+import { oc } from "@orpc/contract";
+import * as z from "zod";
+var EmptyOutputSchema = z.object({}).meta({ description: "Empty success response" });
+var loginContract = oc.route({ method: "POST", path: "/auth/login" }).input(LoginInputSchema).output(LoginOutputSchema);
+var refreshTokenContract = oc.route({ method: "POST", path: "/auth/refresh" }).input(RefreshTokenInputSchema).output(RefreshTokenOutputSchema);
+var logoutContract = oc.route({ method: "POST", path: "/auth/logout" }).input(LogoutInputSchema).output(EmptyOutputSchema);
+var getMeContract = oc.route({ method: "GET", path: "/auth/me" }).output(SessionUserOutputSchema);
+var changePasswordContract = oc.route({ method: "POST", path: "/auth/change-password" }).input(ChangePasswordInputSchema).output(EmptyOutputSchema);
+var requestPasswordResetContract = oc.route({ method: "POST", path: "/auth/request-password-reset" }).input(RequestPasswordResetInputSchema).output(EmptyOutputSchema);
+var resetPasswordContract = oc.route({ method: "POST", path: "/auth/reset-password" }).input(ResetPasswordInputSchema).output(EmptyOutputSchema);
+var switchBranchContract = oc.route({ method: "POST", path: "/auth/switch-branch" }).input(SwitchBranchInputSchema).output(SessionUserOutputSchema);
+var authContract = {
+  login: loginContract,
+  refreshToken: refreshTokenContract,
+  logout: logoutContract,
+  me: getMeContract,
+  changePassword: changePasswordContract,
+  requestPasswordReset: requestPasswordResetContract,
+  resetPassword: resetPasswordContract,
+  switchBranch: switchBranchContract
+};
+
+export {
+  loginContract,
+  refreshTokenContract,
+  logoutContract,
+  getMeContract,
+  changePasswordContract,
+  requestPasswordResetContract,
+  resetPasswordContract,
+  switchBranchContract,
+  authContract
+};
+//# sourceMappingURL=chunk-IR6JUP6L.js.map

package/dist/chunk-IR6JUP6L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/contracts/auth.ts"],"sourcesContent":["/**\n * Brite Future Schools — bfs-contracts\n * Auth oRPC contract.\n *\n * Defines the API surface for authentication. The bfs-api module\n * imports this and passes it to `implement()` — no logic lives here.\n *\n * HTTP method + path pairs follow REST conventions and feed into the\n * OpenAPI spec that oRPC generates automatically.\n *\n * Phase History:\n *   Phase 0.1 (2026-06-05): Initial creation\n *\n * @module src/contracts/auth\n * @since Phase 0.1\n */\n\nimport { oc } from '@orpc/contract'\nimport * as z from 'zod'\nimport {\n  ChangePasswordInputSchema,\n  LoginInputSchema,\n  LoginOutputSchema,\n  LogoutInputSchema,\n  RefreshTokenInputSchema,\n  RefreshTokenOutputSchema,\n  RequestPasswordResetInputSchema,\n  ResetPasswordInputSchema,\n  SessionUserOutputSchema,\n  SwitchBranchInputSchema,\n} from '../schemas/auth.js'\n\n/** Reusable empty-success output — used by mutations that return nothing */\nconst EmptyOutputSchema = z.object({}).meta({ description: 'Empty success response' })\n\n// ── Individual procedure contracts ────────────────────────────────────────────\n\n/** Exchange email + password for access/refresh token pair */\nexport const loginContract = oc\n  .route({ method: 'POST', path: '/auth/login' })\n  .input(LoginInputSchema)\n  .output(LoginOutputSchema)\n\n/** Exchange a refresh token for a new access token */\nexport const refreshTokenContract = oc\n  .route({ method: 'POST', path: '/auth/refresh' })\n  .input(RefreshTokenInputSchema)\n  .output(RefreshTokenOutputSchema)\n\n/** Revoke the current refresh token and end the session */\nexport const logoutContract = oc\n  .route({ method: 'POST', path: '/auth/logout' })\n  .input(LogoutInputSchema)\n  .output(EmptyOutputSchema)\n\n/** Return the session user object for the current access token */\nexport const getMeContract = oc\n  .route({ method: 'GET', path: '/auth/me' })\n  .output(SessionUserOutputSchema)\n\n/** Change password (authenticated, requires current password) */\nexport const changePasswordContract = oc\n  .route({ method: 'POST', path: '/auth/change-password' })\n  .input(ChangePasswordInputSchema)\n  .output(EmptyOutputSchema)\n\n/** Request a password-reset email */\nexport const requestPasswordResetContract = oc\n  .route({ method: 'POST', path: '/auth/request-password-reset' })\n  .input(RequestPasswordResetInputSchema)\n  .output(EmptyOutputSchema)\n\n/** Complete a password reset using the emailed one-time token */\nexport const resetPasswordContract = oc\n  .route({ method: 'POST', path: '/auth/reset-password' })\n  .input(ResetPasswordInputSchema)\n  .output(EmptyOutputSchema)\n\n/** Switch the active branch within an existing session */\nexport const switchBranchContract = oc\n  .route({ method: 'POST', path: '/auth/switch-branch' })\n  .input(SwitchBranchInputSchema)\n  .output(SessionUserOutputSchema)\n\n// ── Auth contract router ──────────────────────────────────────────────────────\n\nexport const authContract = {\n  login: loginContract,\n  refreshToken: refreshTokenContract,\n  logout: logoutContract,\n  me: getMeContract,\n  changePassword: changePasswordContract,\n  requestPasswordReset: requestPasswordResetContract,\n  resetPassword: resetPasswordContract,\n  switchBranch: switchBranchContract,\n}\n"],"mappings":";;;;;;;;;;;;;;AAiBA,SAAS,UAAU;AACnB,YAAY,OAAO;AAenB,IAAM,oBAAsB,SAAO,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,yBAAyB,CAAC;AAK9E,IAAM,gBAAgB,GAC1B,MAAM,EAAE,QAAQ,QAAQ,MAAM,cAAc,CAAC,EAC7C,MAAM,gBAAgB,EACtB,OAAO,iBAAiB;AAGpB,IAAM,uBAAuB,GACjC,MAAM,EAAE,QAAQ,QAAQ,MAAM,gBAAgB,CAAC,EAC/C,MAAM,uBAAuB,EAC7B,OAAO,wBAAwB;AAG3B,IAAM,iBAAiB,GAC3B,MAAM,EAAE,QAAQ,QAAQ,MAAM,eAAe,CAAC,EAC9C,MAAM,iBAAiB,EACvB,OAAO,iBAAiB;AAGpB,IAAM,gBAAgB,GAC1B,MAAM,EAAE,QAAQ,OAAO,MAAM,WAAW,CAAC,EACzC,OAAO,uBAAuB;AAG1B,IAAM,yBAAyB,GACnC,MAAM,EAAE,QAAQ,QAAQ,MAAM,wBAAwB,CAAC,EACvD,MAAM,yBAAyB,EAC/B,OAAO,iBAAiB;AAGpB,IAAM,+BAA+B,GACzC,MAAM,EAAE,QAAQ,QAAQ,MAAM,+BAA+B,CAAC,EAC9D,MAAM,+BAA+B,EACrC,OAAO,iBAAiB;AAGpB,IAAM,wBAAwB,GAClC,MAAM,EAAE,QAAQ,QAAQ,MAAM,uBAAuB,CAAC,EACtD,MAAM,wBAAwB,EAC9B,OAAO,iBAAiB;AAGpB,IAAM,uBAAuB,GACjC,MAAM,EAAE,QAAQ,QAAQ,MAAM,sBAAsB,CAAC,EACrD,MAAM,uBAAuB,EAC7B,OAAO,uBAAuB;AAI1B,IAAM,eAAe;AAAA,EAC1B,OAAO;AAAA,EACP,cAAc;AAAA,EACd,QAAQ;AAAA,EACR,IAAI;AAAA,EACJ,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,eAAe;AAAA,EACf,cAAc;AAChB;","names":[]}

package/dist/chunk-PCHAGP5X.js

@@ -0,0 +1 @@
+//# sourceMappingURL=chunk-PCHAGP5X.js.map

package/dist/contracts/index.cjs

@@ -0,0 +1,179 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/contracts/index.ts
+var contracts_exports = {};
+__export(contracts_exports, {
+  authContract: () => authContract,
+  changePasswordContract: () => changePasswordContract,
+  getMeContract: () => getMeContract,
+  loginContract: () => loginContract,
+  logoutContract: () => logoutContract,
+  refreshTokenContract: () => refreshTokenContract,
+  requestPasswordResetContract: () => requestPasswordResetContract,
+  resetPasswordContract: () => resetPasswordContract,
+  switchBranchContract: () => switchBranchContract
+});
+module.exports = __toCommonJS(contracts_exports);
+
+// src/contracts/auth.ts
+var import_contract = require("@orpc/contract");
+var z3 = __toESM(require("zod"), 1);
+
+// src/schemas/auth.ts
+var z2 = __toESM(require("zod"), 1);
+
+// src/schemas/base.ts
+var z = __toESM(require("zod"), 1);
+var CuidSchema = z.string().regex(/^[a-z][a-z0-9]{24}$/, "Invalid cuid2 identifier").meta({ description: "cuid2 \u2014 prefixed, collision-resistant identifier" });
+var UuidSchema = z.uuidv4().meta({ description: "RFC-4122 UUID v4" });
+var IsoDatetime = z.iso.datetime();
+var TimestampsSchema = z.object({
+  createdAt: IsoDatetime.meta({ description: "ISO-8601 creation time (UTC)" }),
+  updatedAt: IsoDatetime.meta({ description: "ISO-8601 last update time (UTC)" })
+});
+var SoftDeleteSchema = z.object({
+  deletedAt: IsoDatetime.nullable().meta({
+    description: "Set when the record is soft-deleted; null if active"
+  })
+});
+var PaginationInputSchema = z.object({
+  cursor: CuidSchema.optional().meta({
+    description: "Opaque cursor from the previous page response"
+  }),
+  limit: z.int().min(1).max(100).default(20).meta({ description: "Number of items to return (1\u2013100, default 20)" })
+});
+var BranchRefSchema = z.object({
+  branchId: CuidSchema.meta({ description: "The branch this record belongs to" })
+});
+
+// src/schemas/auth.ts
+var SessionUserRoleSchema = z2.object({
+  id: CuidSchema,
+  name: z2.string().meta({ description: "Role name, e.g. PRINCIPAL" }),
+  branchId: CuidSchema,
+  isPrimary: z2.boolean()
+});
+var SessionUserSubRoleSchema = z2.object({
+  id: CuidSchema,
+  name: z2.string().meta({ description: "Sub-role name, e.g. HEAD_PREFECT" }),
+  branchId: CuidSchema
+});
+var SessionUserOutputSchema = z2.object({
+  id: CuidSchema,
+  email: z2.email(),
+  firstName: z2.string(),
+  lastName: z2.string(),
+  activeBranchId: CuidSchema,
+  roles: z2.array(SessionUserRoleSchema),
+  subRoles: z2.array(SessionUserSubRoleSchema),
+  isActive: z2.boolean(),
+  mustChangePassword: z2.boolean()
+});
+var LoginInputSchema = z2.object({
+  email: z2.email().meta({ description: "User email address" }),
+  password: z2.string().min(1).meta({ description: "Plain-text password (sent over TLS)" }),
+  branchId: CuidSchema.optional().meta({
+    description: "Branch to activate on login; defaults to user primary branch"
+  })
+});
+var LoginOutputSchema = z2.object({
+  accessToken: z2.string().meta({ description: "Short-lived JWT (15 min)" }),
+  refreshToken: z2.string().meta({ description: "Long-lived opaque refresh token (7 days)" }),
+  expiresIn: z2.int().positive().meta({ description: "Access token TTL in seconds" }),
+  user: SessionUserOutputSchema
+});
+var RefreshTokenInputSchema = z2.object({
+  refreshToken: z2.string().min(1)
+});
+var RefreshTokenOutputSchema = z2.object({
+  accessToken: z2.string(),
+  expiresIn: z2.int().positive()
+});
+var LogoutInputSchema = z2.object({
+  refreshToken: z2.string().min(1).meta({
+    description: "The refresh token to revoke; also invalidated server-side"
+  })
+});
+var ChangePasswordInputSchema = z2.object({
+  currentPassword: z2.string().min(1),
+  newPassword: z2.string().min(8, { error: "Password must be at least 8 characters" }),
+  confirmPassword: z2.string().min(1)
+}).refine((v) => v.newPassword === v.confirmPassword, {
+  error: "Passwords do not match",
+  path: ["confirmPassword"]
+});
+var RequestPasswordResetInputSchema = z2.object({
+  email: z2.email()
+});
+var ResetPasswordInputSchema = z2.object({
+  token: z2.string().min(1).meta({ description: "One-time reset token from email link" }),
+  newPassword: z2.string().min(8, { error: "Password must be at least 8 characters" }),
+  confirmPassword: z2.string().min(1)
+}).refine((v) => v.newPassword === v.confirmPassword, {
+  error: "Passwords do not match",
+  path: ["confirmPassword"]
+});
+var SwitchBranchInputSchema = z2.object({
+  branchId: CuidSchema.meta({ description: "Branch to switch the active session to" })
+});
+
+// src/contracts/auth.ts
+var EmptyOutputSchema = z3.object({}).meta({ description: "Empty success response" });
+var loginContract = import_contract.oc.route({ method: "POST", path: "/auth/login" }).input(LoginInputSchema).output(LoginOutputSchema);
+var refreshTokenContract = import_contract.oc.route({ method: "POST", path: "/auth/refresh" }).input(RefreshTokenInputSchema).output(RefreshTokenOutputSchema);
+var logoutContract = import_contract.oc.route({ method: "POST", path: "/auth/logout" }).input(LogoutInputSchema).output(EmptyOutputSchema);
+var getMeContract = import_contract.oc.route({ method: "GET", path: "/auth/me" }).output(SessionUserOutputSchema);
+var changePasswordContract = import_contract.oc.route({ method: "POST", path: "/auth/change-password" }).input(ChangePasswordInputSchema).output(EmptyOutputSchema);
+var requestPasswordResetContract = import_contract.oc.route({ method: "POST", path: "/auth/request-password-reset" }).input(RequestPasswordResetInputSchema).output(EmptyOutputSchema);
+var resetPasswordContract = import_contract.oc.route({ method: "POST", path: "/auth/reset-password" }).input(ResetPasswordInputSchema).output(EmptyOutputSchema);
+var switchBranchContract = import_contract.oc.route({ method: "POST", path: "/auth/switch-branch" }).input(SwitchBranchInputSchema).output(SessionUserOutputSchema);
+var authContract = {
+  login: loginContract,
+  refreshToken: refreshTokenContract,
+  logout: logoutContract,
+  me: getMeContract,
+  changePassword: changePasswordContract,
+  requestPasswordReset: requestPasswordResetContract,
+  resetPassword: resetPasswordContract,
+  switchBranch: switchBranchContract
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  authContract,
+  changePasswordContract,
+  getMeContract,
+  loginContract,
+  logoutContract,
+  refreshTokenContract,
+  requestPasswordResetContract,
+  resetPasswordContract,
+  switchBranchContract
+});
+//# sourceMappingURL=index.cjs.map

package/dist/contracts/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/contracts/index.ts","../../src/contracts/auth.ts","../../src/schemas/auth.ts","../../src/schemas/base.ts"],"sourcesContent":["/**\n * Brite Future Schools — bfs-contracts\n * Contracts barrel.\n *\n * @module src/contracts/index\n * @since Phase 0.1\n */\n\nexport * from './auth.js'","/**\n * Brite Future Schools — bfs-contracts\n * Auth oRPC contract.\n *\n * Defines the API surface for authentication. The bfs-api module\n * imports this and passes it to `implement()` — no logic lives here.\n *\n * HTTP method + path pairs follow REST conventions and feed into the\n * OpenAPI spec that oRPC generates automatically.\n *\n * Phase History:\n *   Phase 0.1 (2026-06-05): Initial creation\n *\n * @module src/contracts/auth\n * @since Phase 0.1\n */\n\nimport { oc } from '@orpc/contract'\nimport * as z from 'zod'\nimport {\n  ChangePasswordInputSchema,\n  LoginInputSchema,\n  LoginOutputSchema,\n  LogoutInputSchema,\n  RefreshTokenInputSchema,\n  RefreshTokenOutputSchema,\n  RequestPasswordResetInputSchema,\n  ResetPasswordInputSchema,\n  SessionUserOutputSchema,\n  SwitchBranchInputSchema,\n} from '../schemas/auth.js'\n\n/** Reusable empty-success output — used by mutations that return nothing */\nconst EmptyOutputSchema = z.object({}).meta({ description: 'Empty success response' })\n\n// ── Individual procedure contracts ────────────────────────────────────────────\n\n/** Exchange email + password for access/refresh token pair */\nexport const loginContract = oc\n  .route({ method: 'POST', path: '/auth/login' })\n  .input(LoginInputSchema)\n  .output(LoginOutputSchema)\n\n/** Exchange a refresh token for a new access token */\nexport const refreshTokenContract = oc\n  .route({ method: 'POST', path: '/auth/refresh' })\n  .input(RefreshTokenInputSchema)\n  .output(RefreshTokenOutputSchema)\n\n/** Revoke the current refresh token and end the session */\nexport const logoutContract = oc\n  .route({ method: 'POST', path: '/auth/logout' })\n  .input(LogoutInputSchema)\n  .output(EmptyOutputSchema)\n\n/** Return the session user object for the current access token */\nexport const getMeContract = oc\n  .route({ method: 'GET', path: '/auth/me' })\n  .output(SessionUserOutputSchema)\n\n/** Change password (authenticated, requires current password) */\nexport const changePasswordContract = oc\n  .route({ method: 'POST', path: '/auth/change-password' })\n  .input(ChangePasswordInputSchema)\n  .output(EmptyOutputSchema)\n\n/** Request a password-reset email */\nexport const requestPasswordResetContract = oc\n  .route({ method: 'POST', path: '/auth/request-password-reset' })\n  .input(RequestPasswordResetInputSchema)\n  .output(EmptyOutputSchema)\n\n/** Complete a password reset using the emailed one-time token */\nexport const resetPasswordContract = oc\n  .route({ method: 'POST', path: '/auth/reset-password' })\n  .input(ResetPasswordInputSchema)\n  .output(EmptyOutputSchema)\n\n/** Switch the active branch within an existing session */\nexport const switchBranchContract = oc\n  .route({ method: 'POST', path: '/auth/switch-branch' })\n  .input(SwitchBranchInputSchema)\n  .output(SessionUserOutputSchema)\n\n// ── Auth contract router ──────────────────────────────────────────────────────\n\nexport const authContract = {\n  login: loginContract,\n  refreshToken: refreshTokenContract,\n  logout: logoutContract,\n  me: getMeContract,\n  changePassword: changePasswordContract,\n  requestPasswordReset: requestPasswordResetContract,\n  resetPassword: resetPasswordContract,\n  switchBranch: switchBranchContract,\n}\n","/**\n * Brite Future Schools — bfs-contracts\n * Auth-related Zod schemas.\n *\n * Phase History:\n *   Phase 0.1 (2026-06-05): Initial creation\n *\n * @module src/schemas/auth\n * @since Phase 0.1\n */\n\nimport * as z from 'zod'\nimport { CuidSchema } from './base.js'\n\n// ── Session user (defined first — referenced by LoginOutputSchema below) ───────\n\nexport const SessionUserRoleSchema = z.object({\n    id: CuidSchema,\n    name: z.string().meta({ description: 'Role name, e.g. PRINCIPAL' }),\n    branchId: CuidSchema,\n    isPrimary: z.boolean(),\n})\n\nexport const SessionUserSubRoleSchema = z.object({\n    id: CuidSchema,\n    name: z.string().meta({ description: 'Sub-role name, e.g. HEAD_PREFECT' }),\n    branchId: CuidSchema,\n})\n\nexport const SessionUserOutputSchema = z.object({\n    id: CuidSchema,\n    email: z.email(),\n    firstName: z.string(),\n    lastName: z.string(),\n    activeBranchId: CuidSchema,\n    roles: z.array(SessionUserRoleSchema),\n    subRoles: z.array(SessionUserSubRoleSchema),\n    isActive: z.boolean(),\n    mustChangePassword: z.boolean(),\n})\n\n// ── Login ──────────────────────────────────────────────────────────────────────\n\nexport const LoginInputSchema = z.object({\n    email: z.email().meta({ description: 'User email address' }),\n    password: z.string().min(1).meta({ description: 'Plain-text password (sent over TLS)' }),\n    branchId: CuidSchema.optional().meta({\n        description: 'Branch to activate on login; defaults to user primary branch',\n    }),\n})\n\nexport const LoginOutputSchema = z.object({\n    accessToken: z.string().meta({ description: 'Short-lived JWT (15 min)' }),\n    refreshToken: z.string().meta({ description: 'Long-lived opaque refresh token (7 days)' }),\n    expiresIn: z.int().positive().meta({ description: 'Access token TTL in seconds' }),\n    user: SessionUserOutputSchema,\n})\n\n// ── Token refresh ──────────────────────────────────────────────────────────────\n\nexport const RefreshTokenInputSchema = z.object({\n    refreshToken: z.string().min(1),\n})\n\nexport const RefreshTokenOutputSchema = z.object({\n    accessToken: z.string(),\n    expiresIn: z.int().positive(),\n})\n\n// ── Logout ─────────────────────────────────────────────────────────────────────\n\nexport const LogoutInputSchema = z.object({\n    refreshToken: z.string().min(1).meta({\n        description: 'The refresh token to revoke; also invalidated server-side',\n    }),\n})\n\n// ── Password change ─────────────────────────────────────────────────────────────\n\nexport const ChangePasswordInputSchema = z\n    .object({\n        currentPassword: z.string().min(1),\n        newPassword: z\n            .string()\n            .min(8, { error: 'Password must be at least 8 characters' }),\n        confirmPassword: z.string().min(1),\n    })\n    .refine((v) => v.newPassword === v.confirmPassword, {\n        error: 'Passwords do not match',\n        path: ['confirmPassword'],\n    })\n\n// ── Password reset ─────────────────────────────────────────────────────────────\n\nexport const RequestPasswordResetInputSchema = z.object({\n    email: z.email(),\n})\n\nexport const ResetPasswordInputSchema = z\n    .object({\n        token: z.string().min(1).meta({ description: 'One-time reset token from email link' }),\n        newPassword: z.string().min(8, { error: 'Password must be at least 8 characters' }),\n        confirmPassword: z.string().min(1),\n    })\n    .refine((v) => v.newPassword === v.confirmPassword, {\n        error: 'Passwords do not match',\n        path: ['confirmPassword'],\n    })\n\n// ── Branch switch ───────────────────────────────────────────────────────────────\n\nexport const SwitchBranchInputSchema = z.object({\n    branchId: CuidSchema.meta({ description: 'Branch to switch the active session to' }),\n})\n\n// ── Inferred types ──────────────────────────────────────────────────────────────\n\nexport type LoginInput = z.infer<typeof LoginInputSchema>\nexport type LoginOutput = z.infer<typeof LoginOutputSchema>\nexport type SessionUserOutput = z.infer<typeof SessionUserOutputSchema>\nexport type RefreshTokenInput = z.infer<typeof RefreshTokenInputSchema>\nexport type RefreshTokenOutput = z.infer<typeof RefreshTokenOutputSchema>\nexport type ChangePasswordInput = z.infer<typeof ChangePasswordInputSchema>\nexport type SwitchBranchInput = z.infer<typeof SwitchBranchInputSchema>","/**\n * Brite Future Schools — bfs-contracts\n * Base Zod schemas: reusable primitives shared across all domain schemas.\n *\n * Phase History:\n *   Phase 0.1 (2026-06-05): Initial creation\n *\n * @module src/schemas/base\n * @since Phase 0.1\n */\n\nimport * as z from 'zod'\n\n// ── ID ─────────────────────────────────────────────────────────────────────────\n\nexport const CuidSchema = z\n    .string()\n    .regex(/^[a-z][a-z0-9]{24}$/, 'Invalid cuid2 identifier')\n    .meta({ description: 'cuid2 — prefixed, collision-resistant identifier' })\n\n// ── UUID ───────────────────────────────────────────────────────────────────────\n\nexport const UuidSchema = z\n    .uuidv4()\n    .meta({ description: 'RFC-4122 UUID v4' })\n\n// ── Timestamps ─────────────────────────────────────────────────────────────────\n\nconst IsoDatetime = z.iso.datetime()\n\nexport const TimestampsSchema = z.object({\n    createdAt: IsoDatetime.meta({ description: 'ISO-8601 creation time (UTC)' }),\n    updatedAt: IsoDatetime.meta({ description: 'ISO-8601 last update time (UTC)' }),\n})\n\n// ── Soft-delete ────────────────────────────────────────────────────────────────\n\nexport const SoftDeleteSchema = z.object({\n    deletedAt: IsoDatetime.nullable().meta({\n        description: 'Set when the record is soft-deleted; null if active',\n    }),\n})\n\n// ── Pagination ─────────────────────────────────────────────────────────────────\n\nexport const PaginationInputSchema = z.object({\n    cursor: CuidSchema.optional().meta({\n        description: 'Opaque cursor from the previous page response',\n    }),\n    limit: z\n        .int()\n        .min(1)\n        .max(100)\n        .default(20)\n        .meta({ description: 'Number of items to return (1–100, default 20)' }),\n})\n\nexport function paginatedOutputSchema<T extends z.ZodTypeAny>(itemSchema: T) {\n    return z.object({\n        items: z.array(itemSchema),\n        nextCursor: CuidSchema.nullable().meta({\n            description: 'Pass as `cursor` on the next request; null when no more pages',\n        }),\n        total: z\n            .int()\n            .nonnegative()\n            .meta({ description: 'Total matching records (before pagination)' }),\n    })\n}\n\n// ── Branch reference ───────────────────────────────────────────────────────────\n\nexport const BranchRefSchema = z.object({\n    branchId: CuidSchema.meta({ description: 'The branch this record belongs to' }),\n})\n\n// ── Inferred types ─────────────────────────────────────────────────────────────\n\nexport type Timestamps = z.infer<typeof TimestampsSchema>\nexport type SoftDelete = z.infer<typeof SoftDeleteSchema>\nexport type PaginationInput = z.infer<typeof PaginationInputSchema>"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACiBA,sBAAmB;AACnB,IAAAA,KAAmB;;;ACPnB,IAAAC,KAAmB;;;ACAnB,QAAmB;AAIZ,IAAM,aACR,SAAO,EACP,MAAM,uBAAuB,0BAA0B,EACvD,KAAK,EAAE,aAAa,wDAAmD,CAAC;AAItE,IAAM,aACR,SAAO,EACP,KAAK,EAAE,aAAa,mBAAmB,CAAC;AAI7C,IAAM,cAAgB,MAAI,SAAS;AAE5B,IAAM,mBAAqB,SAAO;AAAA,EACrC,WAAW,YAAY,KAAK,EAAE,aAAa,+BAA+B,CAAC;AAAA,EAC3E,WAAW,YAAY,KAAK,EAAE,aAAa,kCAAkC,CAAC;AAClF,CAAC;AAIM,IAAM,mBAAqB,SAAO;AAAA,EACrC,WAAW,YAAY,SAAS,EAAE,KAAK;AAAA,IACnC,aAAa;AAAA,EACjB,CAAC;AACL,CAAC;AAIM,IAAM,wBAA0B,SAAO;AAAA,EAC1C,QAAQ,WAAW,SAAS,EAAE,KAAK;AAAA,IAC/B,aAAa;AAAA,EACjB,CAAC;AAAA,EACD,OACK,MAAI,EACJ,IAAI,CAAC,EACL,IAAI,GAAG,EACP,QAAQ,EAAE,EACV,KAAK,EAAE,aAAa,qDAAgD,CAAC;AAC9E,CAAC;AAiBM,IAAM,kBAAoB,SAAO;AAAA,EACpC,UAAU,WAAW,KAAK,EAAE,aAAa,oCAAoC,CAAC;AAClF,CAAC;;;AD1DM,IAAM,wBAA0B,UAAO;AAAA,EAC1C,IAAI;AAAA,EACJ,MAAQ,UAAO,EAAE,KAAK,EAAE,aAAa,4BAA4B,CAAC;AAAA,EAClE,UAAU;AAAA,EACV,WAAa,WAAQ;AACzB,CAAC;AAEM,IAAM,2BAA6B,UAAO;AAAA,EAC7C,IAAI;AAAA,EACJ,MAAQ,UAAO,EAAE,KAAK,EAAE,aAAa,mCAAmC,CAAC;AAAA,EACzE,UAAU;AACd,CAAC;AAEM,IAAM,0BAA4B,UAAO;AAAA,EAC5C,IAAI;AAAA,EACJ,OAAS,SAAM;AAAA,EACf,WAAa,UAAO;AAAA,EACpB,UAAY,UAAO;AAAA,EACnB,gBAAgB;AAAA,EAChB,OAAS,SAAM,qBAAqB;AAAA,EACpC,UAAY,SAAM,wBAAwB;AAAA,EAC1C,UAAY,WAAQ;AAAA,EACpB,oBAAsB,WAAQ;AAClC,CAAC;AAIM,IAAM,mBAAqB,UAAO;AAAA,EACrC,OAAS,SAAM,EAAE,KAAK,EAAE,aAAa,qBAAqB,CAAC;AAAA,EAC3D,UAAY,UAAO,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,sCAAsC,CAAC;AAAA,EACvF,UAAU,WAAW,SAAS,EAAE,KAAK;AAAA,IACjC,aAAa;AAAA,EACjB,CAAC;AACL,CAAC;AAEM,IAAM,oBAAsB,UAAO;AAAA,EACtC,aAAe,UAAO,EAAE,KAAK,EAAE,aAAa,2BAA2B,CAAC;AAAA,EACxE,cAAgB,UAAO,EAAE,KAAK,EAAE,aAAa,2CAA2C,CAAC;AAAA,EACzF,WAAa,OAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,8BAA8B,CAAC;AAAA,EACjF,MAAM;AACV,CAAC;AAIM,IAAM,0BAA4B,UAAO;AAAA,EAC5C,cAAgB,UAAO,EAAE,IAAI,CAAC;AAClC,CAAC;AAEM,IAAM,2BAA6B,UAAO;AAAA,EAC7C,aAAe,UAAO;AAAA,EACtB,WAAa,OAAI,EAAE,SAAS;AAChC,CAAC;AAIM,IAAM,oBAAsB,UAAO;AAAA,EACtC,cAAgB,UAAO,EAAE,IAAI,CAAC,EAAE,KAAK;AAAA,IACjC,aAAa;AAAA,EACjB,CAAC;AACL,CAAC;AAIM,IAAM,4BACR,UAAO;AAAA,EACJ,iBAAmB,UAAO,EAAE,IAAI,CAAC;AAAA,EACjC,aACK,UAAO,EACP,IAAI,GAAG,EAAE,OAAO,yCAAyC,CAAC;AAAA,EAC/D,iBAAmB,UAAO,EAAE,IAAI,CAAC;AACrC,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB;AAAA,EAChD,OAAO;AAAA,EACP,MAAM,CAAC,iBAAiB;AAC5B,CAAC;AAIE,IAAM,kCAAoC,UAAO;AAAA,EACpD,OAAS,SAAM;AACnB,CAAC;AAEM,IAAM,2BACR,UAAO;AAAA,EACJ,OAAS,UAAO,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,uCAAuC,CAAC;AAAA,EACrF,aAAe,UAAO,EAAE,IAAI,GAAG,EAAE,OAAO,yCAAyC,CAAC;AAAA,EAClF,iBAAmB,UAAO,EAAE,IAAI,CAAC;AACrC,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB;AAAA,EAChD,OAAO;AAAA,EACP,MAAM,CAAC,iBAAiB;AAC5B,CAAC;AAIE,IAAM,0BAA4B,UAAO;AAAA,EAC5C,UAAU,WAAW,KAAK,EAAE,aAAa,yCAAyC,CAAC;AACvF,CAAC;;;ADhFD,IAAM,oBAAsB,UAAO,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,yBAAyB,CAAC;AAK9E,IAAM,gBAAgB,mBAC1B,MAAM,EAAE,QAAQ,QAAQ,MAAM,cAAc,CAAC,EAC7C,MAAM,gBAAgB,EACtB,OAAO,iBAAiB;AAGpB,IAAM,uBAAuB,mBACjC,MAAM,EAAE,QAAQ,QAAQ,MAAM,gBAAgB,CAAC,EAC/C,MAAM,uBAAuB,EAC7B,OAAO,wBAAwB;AAG3B,IAAM,iBAAiB,mBAC3B,MAAM,EAAE,QAAQ,QAAQ,MAAM,eAAe,CAAC,EAC9C,MAAM,iBAAiB,EACvB,OAAO,iBAAiB;AAGpB,IAAM,gBAAgB,mBAC1B,MAAM,EAAE,QAAQ,OAAO,MAAM,WAAW,CAAC,EACzC,OAAO,uBAAuB;AAG1B,IAAM,yBAAyB,mBACnC,MAAM,EAAE,QAAQ,QAAQ,MAAM,wBAAwB,CAAC,EACvD,MAAM,yBAAyB,EAC/B,OAAO,iBAAiB;AAGpB,IAAM,+BAA+B,mBACzC,MAAM,EAAE,QAAQ,QAAQ,MAAM,+BAA+B,CAAC,EAC9D,MAAM,+BAA+B,EACrC,OAAO,iBAAiB;AAGpB,IAAM,wBAAwB,mBAClC,MAAM,EAAE,QAAQ,QAAQ,MAAM,uBAAuB,CAAC,EACtD,MAAM,wBAAwB,EAC9B,OAAO,iBAAiB;AAGpB,IAAM,uBAAuB,mBACjC,MAAM,EAAE,QAAQ,QAAQ,MAAM,sBAAsB,CAAC,EACrD,MAAM,uBAAuB,EAC7B,OAAO,uBAAuB;AAI1B,IAAM,eAAe;AAAA,EAC1B,OAAO;AAAA,EACP,cAAc;AAAA,EACd,QAAQ;AAAA,EACR,IAAI;AAAA,EACJ,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,eAAe;AAAA,EACf,cAAc;AAChB;","names":["z","z"]}

package/dist/contracts/index.d.cts

@@ -0,0 +1,201 @@
+import * as _orpc_contract from '@orpc/contract';
+import * as z from 'zod';
+
+/** Exchange email + password for access/refresh token pair */
+declare const loginContract: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+    email: z.ZodEmail;
+    password: z.ZodString;
+    branchId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    accessToken: z.ZodString;
+    refreshToken: z.ZodString;
+    expiresIn: z.ZodInt;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodEmail;
+        firstName: z.ZodString;
+        lastName: z.ZodString;
+        activeBranchId: z.ZodString;
+        roles: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            branchId: z.ZodString;
+            isPrimary: z.ZodBoolean;
+        }, z.core.$strip>>;
+        subRoles: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            branchId: z.ZodString;
+        }, z.core.$strip>>;
+        isActive: z.ZodBoolean;
+        mustChangePassword: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>, Record<never, never>, Record<never, never>>;
+/** Exchange a refresh token for a new access token */
+declare const refreshTokenContract: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+    refreshToken: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    accessToken: z.ZodString;
+    expiresIn: z.ZodInt;
+}, z.core.$strip>, Record<never, never>, Record<never, never>>;
+/** Revoke the current refresh token and end the session */
+declare const logoutContract: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+    refreshToken: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{}, z.core.$strip>, Record<never, never>, Record<never, never>>;
+/** Return the session user object for the current access token */
+declare const getMeContract: _orpc_contract.ContractProcedureBuilderWithOutput<_orpc_contract.Schema<unknown, unknown>, z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodEmail;
+    firstName: z.ZodString;
+    lastName: z.ZodString;
+    activeBranchId: z.ZodString;
+    roles: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        branchId: z.ZodString;
+        isPrimary: z.ZodBoolean;
+    }, z.core.$strip>>;
+    subRoles: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        branchId: z.ZodString;
+    }, z.core.$strip>>;
+    isActive: z.ZodBoolean;
+    mustChangePassword: z.ZodBoolean;
+}, z.core.$strip>, Record<never, never>, Record<never, never>>;
+/** Change password (authenticated, requires current password) */
+declare const changePasswordContract: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+    currentPassword: z.ZodString;
+    newPassword: z.ZodString;
+    confirmPassword: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{}, z.core.$strip>, Record<never, never>, Record<never, never>>;
+/** Request a password-reset email */
+declare const requestPasswordResetContract: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+    email: z.ZodEmail;
+}, z.core.$strip>, z.ZodObject<{}, z.core.$strip>, Record<never, never>, Record<never, never>>;
+/** Complete a password reset using the emailed one-time token */
+declare const resetPasswordContract: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+    token: z.ZodString;
+    newPassword: z.ZodString;
+    confirmPassword: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{}, z.core.$strip>, Record<never, never>, Record<never, never>>;
+/** Switch the active branch within an existing session */
+declare const switchBranchContract: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+    branchId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodEmail;
+    firstName: z.ZodString;
+    lastName: z.ZodString;
+    activeBranchId: z.ZodString;
+    roles: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        branchId: z.ZodString;
+        isPrimary: z.ZodBoolean;
+    }, z.core.$strip>>;
+    subRoles: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        branchId: z.ZodString;
+    }, z.core.$strip>>;
+    isActive: z.ZodBoolean;
+    mustChangePassword: z.ZodBoolean;
+}, z.core.$strip>, Record<never, never>, Record<never, never>>;
+declare const authContract: {
+    login: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        email: z.ZodEmail;
+        password: z.ZodString;
+        branchId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        accessToken: z.ZodString;
+        refreshToken: z.ZodString;
+        expiresIn: z.ZodInt;
+        user: z.ZodObject<{
+            id: z.ZodString;
+            email: z.ZodEmail;
+            firstName: z.ZodString;
+            lastName: z.ZodString;
+            activeBranchId: z.ZodString;
+            roles: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                branchId: z.ZodString;
+                isPrimary: z.ZodBoolean;
+            }, z.core.$strip>>;
+            subRoles: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                branchId: z.ZodString;
+            }, z.core.$strip>>;
+            isActive: z.ZodBoolean;
+            mustChangePassword: z.ZodBoolean;
+        }, z.core.$strip>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    refreshToken: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        refreshToken: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        accessToken: z.ZodString;
+        expiresIn: z.ZodInt;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    logout: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        refreshToken: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{}, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    me: _orpc_contract.ContractProcedureBuilderWithOutput<_orpc_contract.Schema<unknown, unknown>, z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodEmail;
+        firstName: z.ZodString;
+        lastName: z.ZodString;
+        activeBranchId: z.ZodString;
+        roles: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            branchId: z.ZodString;
+            isPrimary: z.ZodBoolean;
+        }, z.core.$strip>>;
+        subRoles: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            branchId: z.ZodString;
+        }, z.core.$strip>>;
+        isActive: z.ZodBoolean;
+        mustChangePassword: z.ZodBoolean;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    changePassword: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        currentPassword: z.ZodString;
+        newPassword: z.ZodString;
+        confirmPassword: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{}, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    requestPasswordReset: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        email: z.ZodEmail;
+    }, z.core.$strip>, z.ZodObject<{}, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    resetPassword: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        token: z.ZodString;
+        newPassword: z.ZodString;
+        confirmPassword: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{}, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    switchBranch: _orpc_contract.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        branchId: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodEmail;
+        firstName: z.ZodString;
+        lastName: z.ZodString;
+        activeBranchId: z.ZodString;
+        roles: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            branchId: z.ZodString;
+            isPrimary: z.ZodBoolean;
+        }, z.core.$strip>>;
+        subRoles: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            branchId: z.ZodString;
+        }, z.core.$strip>>;
+        isActive: z.ZodBoolean;
+        mustChangePassword: z.ZodBoolean;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+};
+
+export { authContract, changePasswordContract, getMeContract, loginContract, logoutContract, refreshTokenContract, requestPasswordResetContract, resetPasswordContract, switchBranchContract };