@game-infra/api-schemas-core 0.0.0 → 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Igor Savin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,6 +1,6 @@
 # @game-infra/api-schemas-core
 
-Generic service API contract: valibot schemas plus [toad-contracts](https://github.com/kibertoad/toad-contracts) `defineApiContract` definitions for auth, savegame, game-entity CRUD, admin backup, feedback, and heartbeat. This is the base contract every game backend and frontend shares; the event-editor, balance, file-storage, and progress-tracker contracts build on it.
+Generic service API contract: valibot schemas plus [toad-contracts](https://github.com/kibertoad/toad-contracts) `defineApiContract` definitions for auth, service tokens, savegame, game-entity CRUD, admin backup, feedback, and heartbeat. This is the base contract every game backend and frontend shares; the event-editor, balance, file-storage, and progress-tracker contracts build on it.
 
 Published to npm. Also consumable as sibling source (`exports` points at `src/`).
 
@@ -44,6 +44,36 @@ const { getApiUrl } = createApiUrlResolver({ productionUrl: "https://api.example
 getApiUrl(window.location.hostname); // dev URL on localhost, prod otherwise
 ```
 
+### Service tokens
+
+`serviceTokenCreateContract`, `serviceTokenListContract`, `serviceTokenRevokeContract`, `serviceTokenValidateContract`, and `serviceTokenPurgeContract` cover the credentials scripts and backend services present to game-infra APIs. The token appears in exactly one response — the one that creates it:
+
+```ts
+import { serviceTokenCreateContract, ServiceTokenValidation } from "@game-infra/api-schemas-core";
+import { sendByApiContract } from "@toad-contracts/frontend-http-client";
+
+const created = await sendByApiContract(client, serviceTokenCreateContract, {
+  body: { name: "nightly-import", ttlSeconds: ServiceTokenValidation.DEFAULT_TTL_SECONDS },
+});
+created.token; // shown once; the issuer never stores it
+```
+
+`ServiceTokenSchema` is what the issuer does store: id, owner, claims, issue time, expiry, revocation time. That is enough to revoke a token and nothing more, which is why revocation has to be checked with `serviceTokenValidateContract` rather than inferred from a signature.
+
+### Account administration
+
+`userListContract`, `userCreateContract`, `userUpdateContract`, and `userDeleteContract` serve `/users` on identity-service, for accounts holding the `admin` claim. `UserAccountSchema` never carries the password hash; `hasPassword` says whether the account has one that can match at login. Claims are lowercase tokens (`UserAdminValidation.CLAIM_PATTERN`), because every consumer compares them byte for byte:
+
+```ts
+import { userUpdateContract } from "@game-infra/api-schemas-core";
+import { sendByApiContract } from "@toad-contracts/frontend-http-client";
+
+await sendByApiContract(client, userUpdateContract, {
+  pathParams: { userId: "42" },
+  body: { claims: ["admin"], password: "new-secret" },
+});
+```
+
 ## Extension points
 
 - **Entity types**: `entityType` is a plain `string()`. The old `EntityTypes` enum (spell/item/persona/secret) was dropped; games re-tighten it via their own config/validation.

package/dist/auth.d.ts

@@ -7,13 +7,25 @@ export declare const AuthValidation: {
     readonly MAX_PASSWORD_LENGTH: 128;
     readonly MIN_USERNAME_LENGTH: 3;
     readonly MAX_USERNAME_LENGTH: 64;
+    /**
+     * Usernames may not contain `@` or whitespace.
+     *
+     * Login takes a single `identifier` matched against both usernames and
+     * emails, so the two namespaces have to stay disjoint. Otherwise registering
+     * the username `victim@example.com` makes that account a second candidate for
+     * the victim's own email, and which row wins is not the victim's to decide.
+     */
+    readonly USERNAME_PATTERN: RegExp;
 };
 /**
  * Registration request schema
+ *
+ * @deprecated identity-service no longer accepts self-registration; use
+ * `CreateUserRequestSchema` with `userCreateContract`.
  */
 export declare const RegisterRequestSchema: import("valibot").ObjectSchema<{
     readonly email: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").EmailAction<string, undefined>]>;
-    readonly username: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 3, undefined>, import("valibot").MaxLengthAction<string, 64, undefined>]>;
+    readonly username: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 3, undefined>, import("valibot").MaxLengthAction<string, 64, undefined>, import("valibot").RegexAction<string, "Username may not contain @ or whitespace">]>;
     readonly password: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 6, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>]>;
 }, undefined>;
 export type RegisterRequest = InferOutput<typeof RegisterRequestSchema>;
@@ -27,6 +39,9 @@ export declare const AuthResponseFieldsSchema: {
 };
 /**
  * Registration response schema
+ *
+ * @deprecated identity-service no longer accepts self-registration; use
+ * `UserResponseSchema` with `userCreateContract`.
  */
 export declare const RegisterResponseSchema: import("valibot").ObjectSchema<{
     readonly success: import("valibot").BooleanSchema<undefined>;
@@ -89,4 +104,38 @@ export declare const ValidateServiceTokenResponseSchema: import("valibot").Objec
     valid: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
 }, undefined>;
 export type ValidateServiceTokenResponse = InferOutput<typeof ValidateServiceTokenResponseSchema>;
+/**
+ * Identity-service readiness response.
+ *
+ * Individual checks are added as optional keys, and stay optional. A consumer
+ * upgrades this package before the service it polls is redeployed — that gap is
+ * a rollout, not a fault — and a required key would turn readiness into a parse
+ * error for the duration, exactly when someone is watching it to decide whether
+ * the rollout worked. `failedChecks` is the field to act on either way.
+ *
+ * @example
+ * ```ts
+ * import { IdentityReadinessResponseSchema } from '@game-infra/api-schemas-core'
+ * ```
+ */
+export declare const IdentityReadinessResponseSchema: import("valibot").ObjectSchema<{
+    readonly success: import("valibot").BooleanSchema<undefined>;
+    readonly checks: import("valibot").ObjectSchema<{
+        readonly jwtSecret: import("valibot").BooleanSchema<undefined>;
+        readonly usersTable: import("valibot").BooleanSchema<undefined>;
+        /** Absent from a deployment predating service tokens. */
+        readonly serviceTokensTable: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
+    }, undefined>;
+    readonly failedChecks: import("valibot").ArraySchema<import("valibot").UnionSchema<[import("valibot").LiteralSchema<"jwtSecret", undefined>, import("valibot").LiteralSchema<"usersTable", undefined>, import("valibot").LiteralSchema<"serviceTokensTable", undefined>], undefined>, undefined>;
+}, undefined>;
+/**
+ * Inferred identity-service readiness response.
+ *
+ * @example
+ * ```ts
+ * import type { IdentityReadinessResponse } from '@game-infra/api-schemas-core'
+ * const ready: IdentityReadinessResponse['success'] = true
+ * ```
+ */
+export type IdentityReadinessResponse = InferOutput<typeof IdentityReadinessResponseSchema>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAUjB,MAAM,SAAS,CAAC;AAGjB;;GAEG;AACH,eAAO,MAAM,cAAc;aACzB,mBAAmB,EAAE,CAAC;aACtB,mBAAmB,EAAE,GAAG;aACxB,mBAAmB,EAAE,CAAC;aACtB,mBAAmB,EAAE,EAAE;CACf,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;aAYhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,wBAAwB;IACnC,KAAK;IACL,MAAM;IACN,QAAQ;CACT,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;aAAwD,CAAC;AAE5F,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;aAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;;aAAwD,CAAC;AAEzF,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,0BAA0B;;aAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;aAItC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,kCAAkC;;;;;aAE7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,WAAW,CAAC,OAAO,kCAAkC,CAAC,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAcjB,MAAM,SAAS,CAAC;AAIjB;;GAEG;AACH,eAAO,MAAM,cAAc;aACzB,mBAAmB,EAAE,CAAC;aACtB,mBAAmB,EAAE,GAAG;aACxB,mBAAmB,EAAE,CAAC;aACtB,mBAAmB,EAAE,EAAE;IACvB;;;;;;;OAOG;aACH,gBAAgB;CACR,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;aAahC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,wBAAwB;IACnC,KAAK;IACL,MAAM;IACN,QAAQ;CACT,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;;;aAAwD,CAAC;AAE5F,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;aAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;;aAAwD,CAAC;AAEzF,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,0BAA0B;;aAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;aAItC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,kCAAkC;;;;;aAE7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,WAAW,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAElG;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,+BAA+B;;;;;QAKxC,yDAAyD;;;;aAM3D,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAC"}

package/dist/auth.js

@@ -1,4 +1,4 @@
-import { boolean, email, maxLength, minLength, number, object, optional, pipe, string, } from "valibot";
+import { boolean, array, literal, email, maxLength, minLength, number, object, optional, pipe, regex, string, union, } from "valibot";
 import { createSuccessResponseSchema } from "./common.js";
 /**
  * Validation constants - single source of truth for both FE and BE
@@ -8,13 +8,25 @@ export const AuthValidation = {
     MAX_PASSWORD_LENGTH: 128,
     MIN_USERNAME_LENGTH: 3,
     MAX_USERNAME_LENGTH: 64,
+    /**
+     * Usernames may not contain `@` or whitespace.
+     *
+     * Login takes a single `identifier` matched against both usernames and
+     * emails, so the two namespaces have to stay disjoint. Otherwise registering
+     * the username `victim@example.com` makes that account a second candidate for
+     * the victim's own email, and which row wins is not the victim's to decide.
+     */
+    USERNAME_PATTERN: /^[^\s@]+$/,
 };
 /**
  * Registration request schema
+ *
+ * @deprecated identity-service no longer accepts self-registration; use
+ * `CreateUserRequestSchema` with `userCreateContract`.
  */
 export const RegisterRequestSchema = object({
     email: pipe(string(), email()),
-    username: pipe(string(), minLength(AuthValidation.MIN_USERNAME_LENGTH), maxLength(AuthValidation.MAX_USERNAME_LENGTH)),
+    username: pipe(string(), minLength(AuthValidation.MIN_USERNAME_LENGTH), maxLength(AuthValidation.MAX_USERNAME_LENGTH), regex(AuthValidation.USERNAME_PATTERN, "Username may not contain @ or whitespace")),
     password: pipe(string(), minLength(AuthValidation.MIN_PASSWORD_LENGTH), maxLength(AuthValidation.MAX_PASSWORD_LENGTH)),
 });
 /**
@@ -27,6 +39,9 @@ export const AuthResponseFieldsSchema = {
 };
 /**
  * Registration response schema
+ *
+ * @deprecated identity-service no longer accepts self-registration; use
+ * `UserResponseSchema` with `userCreateContract`.
  */
 export const RegisterResponseSchema = createSuccessResponseSchema(AuthResponseFieldsSchema);
 /**
@@ -63,4 +78,28 @@ export const ValidateTokenResponseSchema = createSuccessResponseSchema({
 export const ValidateServiceTokenResponseSchema = createSuccessResponseSchema({
     valid: optional(boolean()),
 });
+/**
+ * Identity-service readiness response.
+ *
+ * Individual checks are added as optional keys, and stay optional. A consumer
+ * upgrades this package before the service it polls is redeployed — that gap is
+ * a rollout, not a fault — and a required key would turn readiness into a parse
+ * error for the duration, exactly when someone is watching it to decide whether
+ * the rollout worked. `failedChecks` is the field to act on either way.
+ *
+ * @example
+ * ```ts
+ * import { IdentityReadinessResponseSchema } from '@game-infra/api-schemas-core'
+ * ```
+ */
+export const IdentityReadinessResponseSchema = object({
+    success: boolean(),
+    checks: object({
+        jwtSecret: boolean(),
+        usersTable: boolean(),
+        /** Absent from a deployment predating service tokens. */
+        serviceTokensTable: optional(boolean()),
+    }),
+    failedChecks: array(union([literal("jwtSecret"), literal("usersTable"), literal("serviceTokensTable")])),
+});
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,OAAO,EACP,KAAK,EACL,SAAS,EACT,SAAS,EACT,MAAM,EACN,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,MAAM,GACP,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,GAAG;IACxB,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,EAAE;CACf,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;IAC1C,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;IAC9B,QAAQ,EAAE,IAAI,CACZ,MAAM,EAAE,EACR,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAC7C,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAC9C;IACD,QAAQ,EAAE,IAAI,CACZ,MAAM,EAAE,EACR,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAC7C,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAC9C;CACF,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC,wBAAwB,CAAC,CAAC;AAI5F;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;IACvC,UAAU,EAAE,MAAM,EAAE,EAAE,oBAAoB;IAC1C,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,wBAAwB,CAAC,CAAC;AAIzF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;IAC/C,KAAK,EAAE,MAAM,EAAE;CAChB,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;IACrE,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,2BAA2B,CAAC;IAC5E,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;CAC3B,CAAC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,OAAO,EACP,KAAK,EACL,OAAO,EACP,KAAK,EACL,SAAS,EACT,SAAS,EACT,MAAM,EACN,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,KAAK,EACL,MAAM,EACN,KAAK,GACN,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,GAAG;IACxB,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,EAAE;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,WAAW;CACrB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;IAC1C,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;IAC9B,QAAQ,EAAE,IAAI,CACZ,MAAM,EAAE,EACR,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAC7C,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAC7C,KAAK,CAAC,cAAc,CAAC,gBAAgB,EAAE,0CAA0C,CAAC,CACnF;IACD,QAAQ,EAAE,IAAI,CACZ,MAAM,EAAE,EACR,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAC7C,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAC9C;CACF,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC,wBAAwB,CAAC,CAAC;AAI5F;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;IACvC,UAAU,EAAE,MAAM,EAAE,EAAE,oBAAoB;IAC1C,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,wBAAwB,CAAC,CAAC;AAIzF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;IAC/C,KAAK,EAAE,MAAM,EAAE;CAChB,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;IACrE,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,2BAA2B,CAAC;IAC5E,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;IACpD,OAAO,EAAE,OAAO,EAAE;IAClB,MAAM,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,OAAO,EAAE;QACpB,UAAU,EAAE,OAAO,EAAE;QACrB,yDAAyD;QACzD,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;KACxC,CAAC;IACF,YAAY,EAAE,KAAK,CACjB,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CACpF;CACF,CAAC,CAAC"}

package/dist/backup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAA2C,MAAM,SAAS,CAAC;AAGpF;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;;;;aAO3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;aAKtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;aAEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;aAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;aAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;aAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAA2C,MAAM,SAAS,CAAC;AAIpF;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;;;;aAO3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;aAKtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;aAEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;aAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;aAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;aAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/backup.js.map

@@ -1 +1 @@
-{"version":3,"file":"backup.js","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;IACrC,SAAS,EAAE,MAAM,EAAE;IACnB,QAAQ,EAAE,MAAM,EAAE;IAClB,WAAW,EAAE,MAAM,EAAE;IACrB,IAAI,EAAE,MAAM,EAAE;IACd,SAAS,EAAE,MAAM,EAAE;IACnB,MAAM,EAAE,MAAM,EAAE,EAAE,oCAAoC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;IACrE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC7B,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC5B,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CACzB,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;IACnE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;CAC3C,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;IAC/C,SAAS,EAAE,MAAM,EAAE;IACnB,MAAM,EAAE,MAAM,EAAE,EAAE,oCAAoC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;IACrE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACjC,yBAAyB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC9C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;IACtE,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnC,CAAC,CAAC"}
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;IACrC,SAAS,EAAE,MAAM,EAAE;IACnB,QAAQ,EAAE,MAAM,EAAE;IAClB,WAAW,EAAE,MAAM,EAAE;IACrB,IAAI,EAAE,MAAM,EAAE;IACd,SAAS,EAAE,MAAM,EAAE;IACnB,MAAM,EAAE,MAAM,EAAE,EAAE,oCAAoC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;IACrE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC7B,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC5B,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CACzB,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;IACnE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;CAC3C,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;IAC/C,SAAS,EAAE,MAAM,EAAE;IACnB,MAAM,EAAE,MAAM,EAAE,EAAE,oCAAoC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;IACrE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACjC,yBAAyB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC9C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;IACtE,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnC,CAAC,CAAC"}

package/dist/contracts.d.ts

@@ -17,12 +17,26 @@ import { ContractNoBody } from "@toad-contracts/valibot";
  * // '/games/g1/entities/item/e1'
  * ```
  */
+/**
+ * Self-registration.
+ *
+ * @deprecated identity-service no longer serves `/auth/register`: accounts are
+ * created by an admin with {@link userCreateContract}. Kept so consumers still
+ * typecheck while they drop their sign-up forms; it will be removed in a later
+ * release.
+ *
+ * @example
+ * ```ts
+ * import { userCreateContract } from '@game-infra/api-schemas-core'
+ * userCreateContract.pathResolver({}) // '/users'
+ * ```
+ */
 export declare const authRegisterContract: {
     readonly method: "post";
     readonly pathResolver: () => string;
     readonly requestBodySchema: import("valibot").ObjectSchema<{
         readonly email: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").EmailAction<string, undefined>]>;
-        readonly username: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 3, undefined>, import("valibot").MaxLengthAction<string, 64, undefined>]>;
+        readonly username: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 3, undefined>, import("valibot").MaxLengthAction<string, 64, undefined>, import("valibot").RegexAction<string, "Username may not contain @ or whitespace">]>;
         readonly password: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 6, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>]>;
     }, undefined>;
     readonly responsesByStatusCode: {
@@ -83,6 +97,338 @@ export declare const authValidateServiceTokenContract: {
         }, undefined>;
     };
 };
+/**
+ * Identity-service readiness contract.
+ *
+ * @example
+ * ```ts
+ * import { identityReadinessContract } from '@game-infra/api-schemas-core'
+ * identityReadinessContract.pathResolver({}) // '/ready'
+ * ```
+ */
+export declare const identityReadinessContract: {
+    readonly method: "get";
+    readonly pathResolver: () => string;
+    readonly responsesByStatusCode: {
+        200: import("valibot").ObjectSchema<{
+            readonly success: import("valibot").BooleanSchema<undefined>;
+            readonly checks: import("valibot").ObjectSchema<{
+                readonly jwtSecret: import("valibot").BooleanSchema<undefined>;
+                readonly usersTable: import("valibot").BooleanSchema<undefined>;
+                readonly serviceTokensTable: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
+            }, undefined>;
+            readonly failedChecks: import("valibot").ArraySchema<import("valibot").UnionSchema<[import("valibot").LiteralSchema<"jwtSecret", undefined>, import("valibot").LiteralSchema<"usersTable", undefined>, import("valibot").LiteralSchema<"serviceTokensTable", undefined>], undefined>, undefined>;
+        }, undefined>;
+        503: import("valibot").ObjectSchema<{
+            readonly success: import("valibot").BooleanSchema<undefined>;
+            readonly checks: import("valibot").ObjectSchema<{
+                readonly jwtSecret: import("valibot").BooleanSchema<undefined>;
+                readonly usersTable: import("valibot").BooleanSchema<undefined>;
+                readonly serviceTokensTable: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
+            }, undefined>;
+            readonly failedChecks: import("valibot").ArraySchema<import("valibot").UnionSchema<[import("valibot").LiteralSchema<"jwtSecret", undefined>, import("valibot").LiteralSchema<"usersTable", undefined>, import("valibot").LiteralSchema<"serviceTokensTable", undefined>], undefined>, undefined>;
+        }, undefined>;
+    };
+};
+/**
+ * Mint a service token for the authenticated account.
+ *
+ * The response is the only place the token ever appears; the issuer keeps a
+ * record of its id, owner, and expiry so it can be revoked, and nothing else.
+ *
+ * @example
+ * ```ts
+ * import { serviceTokenCreateContract } from '@game-infra/api-schemas-core'
+ * serviceTokenCreateContract.pathResolver({}) // '/service-tokens'
+ * ```
+ */
+export declare const serviceTokenCreateContract: {
+    readonly method: "post";
+    readonly pathResolver: () => string;
+    readonly requestBodySchema: import("valibot").ObjectSchema<{
+        readonly name: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 1, "Name is required">, import("valibot").MaxLengthAction<string, 100, undefined>]>;
+        readonly ttlSeconds: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").NumberSchema<undefined>, import("valibot").IntegerAction<number, "TTL must be a whole number of seconds">, import("valibot").MinValueAction<number, number, undefined>, import("valibot").MaxValueAction<number, number, undefined>]>, undefined>;
+        readonly claims: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>, undefined>;
+    }, undefined>;
+    readonly responsesByStatusCode: {
+        200: import("valibot").ObjectSchema<{
+            readonly success: import("valibot").BooleanSchema<undefined>;
+            readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        } & {
+            token: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            serviceToken: import("valibot").OptionalSchema<import("valibot").ObjectSchema<{
+                readonly id: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").RegexAction<string, "Not a service-token id">]>;
+                readonly name: import("valibot").StringSchema<undefined>;
+                readonly userId: import("valibot").NumberSchema<undefined>;
+                readonly username: import("valibot").StringSchema<undefined>;
+                readonly claims: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly createdAt: import("valibot").StringSchema<undefined>;
+                readonly expiresAt: import("valibot").StringSchema<undefined>;
+                readonly revokedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly lastUsedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+};
+/**
+ * List the authenticated account's service tokens, newest first.
+ *
+ * @example
+ * ```ts
+ * import { serviceTokenListContract } from '@game-infra/api-schemas-core'
+ * serviceTokenListContract.pathResolver({}) // '/service-tokens'
+ * ```
+ */
+export declare const serviceTokenListContract: {
+    readonly method: "get";
+    readonly pathResolver: () => string;
+    readonly responsesByStatusCode: {
+        200: import("valibot").ObjectSchema<{
+            readonly success: import("valibot").BooleanSchema<undefined>;
+            readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        } & {
+            serviceTokens: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly id: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").RegexAction<string, "Not a service-token id">]>;
+                readonly name: import("valibot").StringSchema<undefined>;
+                readonly userId: import("valibot").NumberSchema<undefined>;
+                readonly username: import("valibot").StringSchema<undefined>;
+                readonly claims: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly createdAt: import("valibot").StringSchema<undefined>;
+                readonly expiresAt: import("valibot").StringSchema<undefined>;
+                readonly revokedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly lastUsedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+            retentionSeconds: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+};
+/**
+ * Revoke one service token by id.
+ *
+ * @example
+ * ```ts
+ * import { serviceTokenRevokeContract } from '@game-infra/api-schemas-core'
+ * serviceTokenRevokeContract.pathResolver({ tokenId: 'st_0123456789abcdef0123456789abcdef' })
+ * // '/service-tokens/st_0123456789abcdef0123456789abcdef'
+ * ```
+ */
+export declare const serviceTokenRevokeContract: {
+    readonly method: "delete";
+    readonly requestPathParamsSchema: import("valibot").ObjectSchema<{
+        readonly tokenId: import("valibot").StringSchema<undefined>;
+    }, undefined> & import("@toad-contracts/valibot").StandardObjectKeysV1<unknown, unknown>;
+    readonly pathResolver: ({ tokenId }: {
+        tokenId: string;
+    }) => string;
+    readonly responsesByStatusCode: {
+        200: import("valibot").ObjectSchema<{
+            readonly success: import("valibot").BooleanSchema<undefined>;
+            readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        } & {
+            serviceToken: import("valibot").OptionalSchema<import("valibot").ObjectSchema<{
+                readonly id: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").RegexAction<string, "Not a service-token id">]>;
+                readonly name: import("valibot").StringSchema<undefined>;
+                readonly userId: import("valibot").NumberSchema<undefined>;
+                readonly username: import("valibot").StringSchema<undefined>;
+                readonly claims: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly createdAt: import("valibot").StringSchema<undefined>;
+                readonly expiresAt: import("valibot").StringSchema<undefined>;
+                readonly revokedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly lastUsedAt: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+};
+/**
+ * Check a service token's signature, expiry, and revocation state.
+ *
+ * `/auth/validate` cannot answer this: a signature proves only that the token
+ * was minted with this secret, and a revoked token keeps its signature.
+ *
+ * @example
+ * ```ts
+ * import { serviceTokenValidateContract } from '@game-infra/api-schemas-core'
+ * serviceTokenValidateContract.pathResolver({}) // '/service-tokens/validate'
+ * ```
+ */
+export declare const serviceTokenValidateContract: {
+    readonly method: "post";
+    readonly pathResolver: () => string;
+    readonly requestBodySchema: import("valibot").ObjectSchema<{
+        readonly token: import("valibot").StringSchema<undefined>;
+    }, undefined>;
+    readonly responsesByStatusCode: {
+        200: import("valibot").ObjectSchema<{
+            readonly success: import("valibot").BooleanSchema<undefined>;
+            readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        } & {
+            valid: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
+            reason: import("valibot").OptionalSchema<import("valibot").UnionSchema<[import("valibot").LiteralSchema<"invalid", undefined>, import("valibot").LiteralSchema<"expired", undefined>, import("valibot").LiteralSchema<"revoked", undefined>, import("valibot").LiteralSchema<"unknown", undefined>, import("valibot").LiteralSchema<"wrongTokenType", undefined>], undefined>, undefined>;
+            tokenId: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            userId: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            username: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            claims: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>, undefined>;
+            expiresAt: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+};
+/**
+ * Delete token records that have expired past the retention window.
+ *
+ * Runs on a schedule too; the endpoint exists so an operator or the console can
+ * ask for it without waiting for the next cron tick.
+ *
+ * @example
+ * ```ts
+ * import { serviceTokenPurgeContract } from '@game-infra/api-schemas-core'
+ * serviceTokenPurgeContract.pathResolver({}) // '/service-tokens/purge'
+ * ```
+ */
+export declare const serviceTokenPurgeContract: {
+    readonly method: "post";
+    readonly pathResolver: () => string;
+    readonly requestBodySchema: typeof ContractNoBody;
+    readonly responsesByStatusCode: {
+        200: import("valibot").ObjectSchema<{
+            readonly success: import("valibot").BooleanSchema<undefined>;
+            readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        } & {
+            purged: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            retentionSeconds: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+};
+/**
+ * List every account. Requires the `admin` claim.
+ *
+ * @example
+ * ```ts
+ * import { userListContract } from '@game-infra/api-schemas-core'
+ * userListContract.pathResolver({}) // '/users'
+ * ```
+ */
+export declare const userListContract: {
+    readonly method: "get";
+    readonly pathResolver: () => string;
+    readonly responsesByStatusCode: {
+        200: import("valibot").ObjectSchema<{
+            readonly success: import("valibot").BooleanSchema<undefined>;
+            readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        } & {
+            users: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly id: import("valibot").NumberSchema<undefined>;
+                readonly username: import("valibot").StringSchema<undefined>;
+                readonly email: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly claims: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly hasPassword: import("valibot").BooleanSchema<undefined>;
+                readonly createdAt: import("valibot").StringSchema<undefined>;
+                readonly updatedAt: import("valibot").StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+        }, undefined>;
+    };
+};
+/**
+ * Create an account, optionally with claims. Requires the `admin` claim.
+ *
+ * @example
+ * ```ts
+ * import { userCreateContract } from '@game-infra/api-schemas-core'
+ * userCreateContract.pathResolver({}) // '/users'
+ * ```
+ */
+export declare const userCreateContract: {
+    readonly method: "post";
+    readonly pathResolver: () => string;
+    readonly requestBodySchema: import("valibot").ObjectSchema<{
+        readonly username: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 3, undefined>, import("valibot").MaxLengthAction<string, 64, undefined>, import("valibot").RegexAction<string, "Username may not contain @ or whitespace">]>;
+        readonly email: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").EmailAction<string, undefined>]>, undefined>;
+        readonly password: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 6, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>]>;
+        readonly claims: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").ArraySchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MaxLengthAction<string, 64, undefined>, import("valibot").RegexAction<string, "Claims are lowercase letters, digits, '.', ':', '_' or '-', starting with a letter">]>, undefined>, import("valibot").MaxLengthAction<string[], 32, undefined>]>, undefined>;
+    }, undefined>;
+    readonly responsesByStatusCode: {
+        200: import("valibot").ObjectSchema<{
+            readonly success: import("valibot").BooleanSchema<undefined>;
+            readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        } & {
+            user: import("valibot").OptionalSchema<import("valibot").ObjectSchema<{
+                readonly id: import("valibot").NumberSchema<undefined>;
+                readonly username: import("valibot").StringSchema<undefined>;
+                readonly email: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly claims: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly hasPassword: import("valibot").BooleanSchema<undefined>;
+                readonly createdAt: import("valibot").StringSchema<undefined>;
+                readonly updatedAt: import("valibot").StringSchema<undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+};
+/**
+ * Change an account's username, email, password, or claims. Requires the
+ * `admin` claim.
+ *
+ * @example
+ * ```ts
+ * import { userUpdateContract } from '@game-infra/api-schemas-core'
+ * userUpdateContract.pathResolver({ userId: '42' }) // '/users/42'
+ * ```
+ */
+export declare const userUpdateContract: {
+    readonly method: "patch";
+    readonly requestPathParamsSchema: import("valibot").ObjectSchema<{
+        readonly userId: import("valibot").StringSchema<undefined>;
+    }, undefined> & import("@toad-contracts/valibot").StandardObjectKeysV1<unknown, unknown>;
+    readonly pathResolver: ({ userId }: {
+        userId: string;
+    }) => string;
+    readonly requestBodySchema: import("valibot").ObjectSchema<{
+        readonly username: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 3, undefined>, import("valibot").MaxLengthAction<string, 64, undefined>, import("valibot").RegexAction<string, "Username may not contain @ or whitespace">]>, undefined>;
+        readonly email: import("valibot").OptionalSchema<import("valibot").NullableSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").EmailAction<string, undefined>]>, undefined>, undefined>;
+        readonly password: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 6, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>]>, undefined>;
+        readonly claims: import("valibot").OptionalSchema<import("valibot").SchemaWithPipe<readonly [import("valibot").ArraySchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MaxLengthAction<string, 64, undefined>, import("valibot").RegexAction<string, "Claims are lowercase letters, digits, '.', ':', '_' or '-', starting with a letter">]>, undefined>, import("valibot").MaxLengthAction<string[], 32, undefined>]>, undefined>;
+    }, undefined>;
+    readonly responsesByStatusCode: {
+        200: import("valibot").ObjectSchema<{
+            readonly success: import("valibot").BooleanSchema<undefined>;
+            readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        } & {
+            user: import("valibot").OptionalSchema<import("valibot").ObjectSchema<{
+                readonly id: import("valibot").NumberSchema<undefined>;
+                readonly username: import("valibot").StringSchema<undefined>;
+                readonly email: import("valibot").NullableSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly claims: import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly hasPassword: import("valibot").BooleanSchema<undefined>;
+                readonly createdAt: import("valibot").StringSchema<undefined>;
+                readonly updatedAt: import("valibot").StringSchema<undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+};
+/**
+ * Delete an account and revoke its service tokens. Requires the `admin` claim.
+ *
+ * @example
+ * ```ts
+ * import { userDeleteContract } from '@game-infra/api-schemas-core'
+ * userDeleteContract.pathResolver({ userId: '42' }) // '/users/42'
+ * ```
+ */
+export declare const userDeleteContract: {
+    readonly method: "delete";
+    readonly requestPathParamsSchema: import("valibot").ObjectSchema<{
+        readonly userId: import("valibot").StringSchema<undefined>;
+    }, undefined> & import("@toad-contracts/valibot").StandardObjectKeysV1<unknown, unknown>;
+    readonly pathResolver: ({ userId }: {
+        userId: string;
+    }) => string;
+    readonly responsesByStatusCode: {
+        200: import("valibot").ObjectSchema<{
+            readonly success: import("valibot").BooleanSchema<undefined>;
+            readonly error: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        } & {
+            revokedServiceTokens: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+};
 export declare const savegameSaveContract: {
     readonly method: "put";
     readonly requestPathParamsSchema: import("valibot").ObjectSchema<{

package/dist/contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqC,MAAM,yBAAyB,CAAC;AAoC5F;;;;;;;;;;;;;;;;;GAiBG;AAMH,eAAO,MAAM,oBAAoB;;;;;;;;;QAIN,GAAG;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;QAIH,GAAG;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;QAIN,GAAG;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,gCAAgC;;;;QAGlB,GAAG;;;;;;;CAC5B,CAAC;AAWH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;QAMN,GAAG;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;QAKN,GAAG;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;;;QAIX,GAAG;;;;;;;;;;;CAC5B,CAAC;AAYH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;QAKR,GAAG;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;QAMV,GAAG;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;QAKR,GAAG;;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;QAIR,GAAG;;;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;QAIX,GAAG;;;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;QAKV,GAAG;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;QAKZ,GAAG;;;;;;;CAC5B,CAAC;AAMH,eAAO,MAAM,qBAAqB;;;;;QAIP,GAAG;;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;QAGJ,GAAG;;;;;;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;QAIP,GAAG;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;QAIR,GAAG;;;;;;;;;;;;;;CAC5B,CAAC;AAMH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;QAIR,GAAG;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;QAGH,GAAG;;;;;CAC5B,CAAC"}
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqC,MAAM,yBAAyB,CAAC;AAsD5F;;;;;;;;;;;;;;;;;GAiBG;AAMH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;QAIN,GAAG;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;QAIH,GAAG;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;QAIN,GAAG;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,gCAAgC;;;;QAGlB,GAAG;;;;;;;CAC5B,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB;;;;QAIlC,GAAG;;;;;;;;;QACH,GAAG;;;;;;;;;;CAEL,CAAC;AAMH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;QAIZ,GAAG;;;;;;;;;;;;;;;;;;CAC5B,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;QAGV,GAAG;;;;;;;;;;;;;;;;;;CAC5B,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;QAIZ,GAAG;;;;;;;;;;;;;;;;;CAC5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;;;;;;;QAId,GAAG;;;;;;;;;;;;;CAC5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB;;;;;QAIX,GAAG;;;;;;;;CAC5B,CAAC;AAQH;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;;;QAGF,GAAG;;;;;;;;;;;;;;;CAC5B,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;QAIJ,GAAG;;;;;;;;;;;;;;;CAC5B,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;QAKJ,GAAG;;;;;;;;;;;;;;;CAC5B,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;QAIJ,GAAG;;;;;;;CAC5B,CAAC;AAWH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;QAMN,GAAG;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;QAKN,GAAG;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;;;QAIX,GAAG;;;;;;;;;;;CAC5B,CAAC;AAYH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;QAKR,GAAG;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;QAMV,GAAG;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;QAKR,GAAG;;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;QAIR,GAAG;;;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;QAIX,GAAG;;;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;QAKV,GAAG;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;QAKZ,GAAG;;;;;;;CAC5B,CAAC;AAMH,eAAO,MAAM,qBAAqB;;;;;QAIP,GAAG;;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;QAGJ,GAAG;;;;;;;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;QAIP,GAAG;;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;QAIR,GAAG;;;;;;;;;;;;;;CAC5B,CAAC;AAMH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;QAIR,GAAG;;;;;;;CAC5B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;QAGH,GAAG;;;;;CAC5B,CAAC"}