@gamaro.io/core-types 1.0.1 → 1.1.1

package/README.md

@@ -19,12 +19,13 @@ API and wants the same Zod schemas the official widget uses.
 ## Installation
 
 ```bash
-npm install @gamaro.io/core-types zod
+npm install @gamaro.io/core-types
 # or
-pnpm add @gamaro.io/core-types zod
+pnpm add @gamaro.io/core-types
 ```
 
-`zod` is a peer dependency: schemas are runtime-validatable.
+`zod` is a direct dependency (pinned `4.6.5`, installed automatically): schemas
+are runtime-validatable out of the box.
 
 ## Scope (ADR-006)
 
@@ -34,16 +35,17 @@ B2B qualification, scoring rules, …) stay in the workspace that owns the domai
 
 ## Public exports
 
-| Module                  | Contents                                                                 |
-| ----------------------- | ------------------------------------------------------------------------ |
-| `theme`                 | `ThemeConfig`, hex-color constraints, default palette                    |
-| `theme-resolver`        | Merges host-side theme with server-side theme; returns the final config  |
-| `viewport`              | Viewport bucket helpers (`mobile` / `tablet` / `desktop`) + breakpoints  |
-| `widget-config`         | `WidgetConfig` — the public contract of `createWidget(config)`           |
-| `widget-runtime-config` | Internal runtime view of the resolved widget config (after server merge) |
-| `application-config`    | Server-side Agent metadata (vertical, allowed origins, identity)         |
-| `postmessage`           | Discriminated unions for `window.postMessage` host ↔ iframe protocol     |
-| `geo`                   | Lightweight geo primitives (`LatLng`, `BoundingBox`)                     |
+| Module                  | Contents                                                                         |
+| ----------------------- | -------------------------------------------------------------------------------- |
+| `theme`                 | `ThemeConfig`, hex-color constraints, default palette                            |
+| `theme-resolver`        | Merges host-side theme with server-side theme; returns the final config          |
+| `viewport`              | Viewport bucket helpers (`mobile` / `tablet` / `desktop`) + breakpoints          |
+| `widget-config`         | `WidgetConfig` — the public contract of `createWidget(config)`                   |
+| `widget-runtime-config` | Internal runtime view of the resolved widget config (after server merge)         |
+| `application-config`    | Server-side Agent metadata (vertical, allowed origins, identity)                 |
+| `postmessage`           | Discriminated unions for `window.postMessage` host ↔ iframe protocol             |
+| `geo`                   | Lightweight geo primitives (`LatLng`, `BoundingBox`)                             |
+| `motion`                | Motion tokens (`MOTION_DURATIONS`, `MOTION_EASINGS`, `MOTION_STAGGER`) — ADR-018 |
 
 ```typescript
 import type {
@@ -66,18 +68,19 @@ Some helpers are exposed on a **dedicated subpath**, deliberately kept out of
 the barrel above so they carry no `zod` dependency (import them directly, not
 from the package root):
 
-| Subpath    | Contents                                                                      |
-| ---------- | ----------------------------------------------------------------------------- |
-| `/session` | `getSessionCookieName`, `isValidSessionId` — pure session cookie / id helpers |
+| Subpath    | Contents                                                                                                                                                                  |
+| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `/session` | `getApplicationSessionCookieName` (App-scoped, #3577), `getSessionCookieName` (legacy per-vertical, `@deprecated`), `isValidSessionId` — pure session cookie / id helpers |
+| `/motion`  | Motion tokens — also re-exported from the root barrel (ADR-018)                                                                                                           |
 
 ```typescript
 import {
-  getSessionCookieName,
+  getApplicationSessionCookieName,
   isValidSessionId,
 } from "@gamaro.io/core-types/session";
 ```
 
-All schemas are Zod 4 (`zod@^4.2.0`) and infer their TypeScript types via
+All schemas are Zod 4 (`zod@4.6.5`) and infer their TypeScript types via
 `z.infer<typeof xxxSchema>` — the same `.parse()` / `.safeParse()` API as the
 widget itself.
 

package/dist/geo.d.ts

@@ -1,7 +1,7 @@
 /**
  * Geographic cross-boundary type contracts.
  *
- * Cross-boundary contract shared by the geo package (`@versiq/geo`) and the
+ * Cross-boundary contract shared by the geo module and the
  * app host (`apps/app`). Previously co-located in `apps/app/src/lib/ai/schemas/`
  * by historical happenstance — directions cardinales are not AI-specific, they
  * are pure geographic primitives.

package/dist/geo.js

@@ -1,7 +1,7 @@
 /**
  * Geographic cross-boundary type contracts.
  *
- * Cross-boundary contract shared by the geo package (`@versiq/geo`) and the
+ * Cross-boundary contract shared by the geo module and the
  * app host (`apps/app`). Previously co-located in `apps/app/src/lib/ai/schemas/`
  * by historical happenstance — directions cardinales are not AI-specific, they
  * are pure geographic primitives.

package/dist/motion.d.ts

@@ -1,5 +1,5 @@
 /**
- * Canonical motion tokens for the Versiq widget — the single source of truth
+ * Canonical motion tokens for the Gamaro widget — the single source of truth
  * for animation durations, easing curves and stagger timing across BOTH widget
  * bundles (the vanilla loader in `packages/widget` and the React embed in
  * `apps/app/src/app/widget/embed`).

package/dist/motion.js

@@ -1,5 +1,5 @@
 /**
- * Canonical motion tokens for the Versiq widget — the single source of truth
+ * Canonical motion tokens for the Gamaro widget — the single source of truth
  * for animation durations, easing curves and stagger timing across BOTH widget
  * bundles (the vanilla loader in `packages/widget` and the React embed in
  * `apps/app/src/app/widget/embed`).

package/dist/session.d.ts

@@ -12,10 +12,24 @@
  * without dragging Zod in via the barrel `index.ts`.
  */
 /**
- * Per-vertical session cookie name. Each vertical owns its own cookie to prevent
- * profile-schema conflicts. Any character outside `[a-z0-9-]` (case-insensitive)
- * is sanitized to `_` (each char maps to one `_`, no collapsing), so
- * `real-estate` stays `gamaro_session_real-estate`.
+ * Application-scoped session cookie name — the CURRENT derivation (#3577).
+ *
+ * One cookie per Application: two Applications sharing a domain (and even a
+ * vertical) can no longer share a visitor session, which is what makes the
+ * profile scoping (`buyer_profiles.application_id`) provable
+ * (`apps/app/src/lib/security/session-resolution.ts`). The value is the
+ * Application UUID (`AuthContext.applicationId`), globally unique.
+ */
+export declare function getApplicationSessionCookieName(applicationId: string): string;
+/**
+ * Per-vertical session cookie name — LEGACY (#918 → #3577).
+ *
+ * Kept ONLY to read, re-emit or purge cookies issued before #3577 (verified
+ * hand-off of the visitor profile). Do not use for new cookies. Removal is
+ * coupled with the legacy read-path removal in epic #3154 step 3 (bascule).
+ *
+ * @deprecated Use {@link getApplicationSessionCookieName} for new cookies;
+ * this derivation survives only to read legacy cookies during the transition.
  */
 export declare function getSessionCookieName(verticalId: string): string;
 /**

package/dist/session.js

@@ -12,14 +12,37 @@
  * without dragging Zod in via the barrel `index.ts`.
  */
 /**
- * Per-vertical session cookie name. Each vertical owns its own cookie to prevent
- * profile-schema conflicts. Any character outside `[a-z0-9-]` (case-insensitive)
- * is sanitized to `_` (each char maps to one `_`, no collapsing), so
- * `real-estate` stays `gamaro_session_real-estate`.
+ * Any character outside `[a-z0-9-]` (case-insensitive) is sanitized to `_`
+ * (each char maps to one `_`, no collapsing), so `real-estate` stays
+ * `gamaro_session_real-estate`.
+ */
+function sanitizeCookieId(id) {
+    return id.replace(/[^a-z0-9-]/gi, "_");
+}
+/**
+ * Application-scoped session cookie name — the CURRENT derivation (#3577).
+ *
+ * One cookie per Application: two Applications sharing a domain (and even a
+ * vertical) can no longer share a visitor session, which is what makes the
+ * profile scoping (`buyer_profiles.application_id`) provable
+ * (`apps/app/src/lib/security/session-resolution.ts`). The value is the
+ * Application UUID (`AuthContext.applicationId`), globally unique.
+ */
+export function getApplicationSessionCookieName(applicationId) {
+    return `gamaro_session_${sanitizeCookieId(applicationId)}`;
+}
+/**
+ * Per-vertical session cookie name — LEGACY (#918 → #3577).
+ *
+ * Kept ONLY to read, re-emit or purge cookies issued before #3577 (verified
+ * hand-off of the visitor profile). Do not use for new cookies. Removal is
+ * coupled with the legacy read-path removal in epic #3154 step 3 (bascule).
+ *
+ * @deprecated Use {@link getApplicationSessionCookieName} for new cookies;
+ * this derivation survives only to read legacy cookies during the transition.
  */
 export function getSessionCookieName(verticalId) {
-    const sanitized = verticalId.replace(/[^a-z0-9-]/gi, "_");
-    return `gamaro_session_${sanitized}`;
+    return `gamaro_session_${sanitizeCookieId(verticalId)}`;
 }
 /**
  * Validate the UUID shape of a session id. The length pre-check is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gamaro.io/core-types",
-  "version": "1.0.1",
+  "version": "1.1.1",
   "description": "Cross-workspace TypeScript contracts and Zod schemas consumed by @gamaro.io/widget. Intended as a peer of the widget SDK.",
   "type": "module",
   "main": "./dist/index.js",
@@ -58,7 +58,7 @@
     "zod": "4.6.5"
   },
   "devDependencies": {
-    "@microsoft/api-extractor": "^7.59.2",
+    "@microsoft/api-extractor": "^7.59.3",
     "typescript": "^6.0.3"
   },
   "scripts": {