@getpara/shared 1.29.0 → 1.31.0

package/dist/cjs/schemas/permissionsV2UserParameters.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.permissionsV2UserParameterHistorySchema = exports.permissionsV2UserParameterViewSchema = exports.permissionsV2UserParameterReadyViewSchema = exports.permissionsV2UserParameterResetSchema = exports.permissionsV2UserParameterSaveSchema = void 0;
+const zod_1 = require("zod");
+const templateRevisionFields = {
+    policyVersion: zod_1.z.string().min(1),
+    policyHash: zod_1.z.string().min(1),
+    expectedRevision: zod_1.z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+};
+exports.permissionsV2UserParameterSaveSchema = zod_1.z
+    .object({
+    ...templateRevisionFields,
+    values: zod_1.z.record(zod_1.z.string()),
+})
+    .strict();
+exports.permissionsV2UserParameterResetSchema = zod_1.z.object(templateRevisionFields).strict();
+const storedRevision = zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+const provenance = zod_1.z.enum(['default', 'personal']);
+const parameterDescriptor = zod_1.z
+    .object({
+    id: zod_1.z.string().min(1),
+    label: zod_1.z.string().min(1),
+    defaultValue: zod_1.z.string(),
+    fact: zod_1.z.string().min(1),
+    asset: zod_1.z.string().optional(),
+    window: zod_1.z.string().optional(),
+})
+    .strict();
+const viewFields = {
+    userId: zod_1.z.string().min(1),
+    partnerId: zod_1.z.string().min(1),
+    appId: zod_1.z.string().min(1),
+    policyId: zod_1.z.string().min(1),
+    policyVersion: zod_1.z.string().min(1),
+    policyHash: zod_1.z.string().min(1),
+    parameters: zod_1.z.array(parameterDescriptor),
+};
+exports.permissionsV2UserParameterReadyViewSchema = zod_1.z.union([
+    zod_1.z
+        .object({
+        ...viewFields,
+        status: zod_1.z.literal('ready'),
+        revision: zod_1.z.literal(0),
+        provenance: zod_1.z.literal('default'),
+        values: zod_1.z.record(zod_1.z.string()),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        ...viewFields,
+        status: zod_1.z.literal('ready'),
+        revision: storedRevision,
+        provenance,
+        values: zod_1.z.record(zod_1.z.string()),
+        configurationHash: zod_1.z.string().min(1),
+    })
+        .strict(),
+]);
+exports.permissionsV2UserParameterViewSchema = zod_1.z.union([
+    exports.permissionsV2UserParameterReadyViewSchema,
+    zod_1.z
+        .object({
+        ...viewFields,
+        status: zod_1.z.literal('needs_confirmation'),
+        revision: storedRevision,
+        provenance,
+        previousValues: zod_1.z.record(zod_1.z.string()),
+    })
+        .strict(),
+]);
+exports.permissionsV2UserParameterHistorySchema = zod_1.z
+    .object({
+    revisions: zod_1.z.array(zod_1.z
+        .object({
+        policyVersion: zod_1.z.string().min(1),
+        policyHash: zod_1.z.string().min(1),
+        revision: storedRevision,
+        provenance,
+        values: zod_1.z.record(zod_1.z.string()),
+        changedAt: zod_1.z.string().datetime(),
+    })
+        .strict()),
+    nextBeforeRevision: storedRevision.optional(),
+})
+    .strict();

package/dist/cjs/types/authFactor.js

@@ -2,13 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AUTH_FACTOR_PROVENANCES = exports.AUTH_FACTOR_STATUSES = exports.AUTH_FACTOR_TIERS = exports.AUTH_FACTOR_TYPES = void 0;
 /**
- * Auth factors are the ways an account authenticates: the identity-bearing
- * FIRST factors (email, phone, OAuth, external wallet) plus, going forward,
- * SECOND factors. This is the correct "authentication factor" model.
+ * Auth factors are the ways an account authenticates: the identity-bearing FIRST factors (email, phone,
+ * OAuth, external wallet) plus, going forward, SECOND factors.
  *
- * NOTE: distinct from the legacy `AuthMethod` enum (PASSWORD/PASSKEY/PIN/
- * BASIC_LOGIN), which describes the legacy credential/unlock methods and is
- * being retired with the enclave migration. Existing passkeys/PINs/passwords/
+ * NOTE: distinct from the legacy `AuthMethod` enum (PASSWORD/PASSKEY/PIN/BASIC_LOGIN) — legacy
+ * credential/unlock methods being retired with the enclave migration. Existing passkeys/PINs/passwords/
  * TOTP are NEVER represented here — they stay in their own tables and age out.
  */
 exports.AUTH_FACTOR_TYPES = [
@@ -23,6 +21,10 @@ exports.AUTH_FACTOR_TYPES = [
 ];
 /** Which factor in the authentication sequence this is. */
 exports.AUTH_FACTOR_TIERS = ['FIRST', 'SECOND'];
-exports.AUTH_FACTOR_STATUSES = ['PENDING', 'VERIFIED', 'REVOKED'];
+// PENDING = a login credential mid-proof (email/phone first-write before its OTP) — reserved. VERIFIED = a
+// proven login credential. UNVERIFIED = a linking HINT: an OAuth vouched for this email but the owner never
+// proved it, so it is NOT a login credential (can't log in) and several may coexist across accounts — powers
+// only the needs_link linking UI. REVOKED = unlinked. (ENG-7075)
+exports.AUTH_FACTOR_STATUSES = ['PENDING', 'VERIFIED', 'UNVERIFIED', 'REVOKED'];
 /** How this factor came to be attached to the account (drives migration/audit). */
 exports.AUTH_FACTOR_PROVENANCES = ['SIGNUP', 'EXPLICIT_LINK', 'IMPLICIT_MERGE_LEGACY', 'MIGRATION'];

package/dist/cjs/types/authState.js

@@ -1,32 +1,31 @@
 "use strict";
 /**
- * Status-model auth envelope returned by the `/v2/auth` endpoints and consumed
- * by the backend and new SDKs. Clerk-style: a single `status` drives the client,
- * with typed per-status fields. New statuses are added additively; a client that
- * sees a status it doesn't recognize should treat the flow as not-yet-complete
- * (show generic / hand off) rather than erroring (forward-compat).
- *
- * This is the canonical auth contract — new SDKs consume it directly instead of
- * a parallel client mirror. (ENG-6910)
+ * Status-model auth envelope returned by `/v2/auth`, consumed by the backend and new SDKs.
+ * Clerk-style: a single `status` drives the client, with typed per-status fields. Statuses are added
+ * additively; an unrecognized one is treated as not-yet-complete (show generic / hand off), never an
+ * error (forward-compat). The canonical auth contract — new SDKs consume it directly, not a parallel
+ * client mirror. (ENG-6910)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AUTH_FLOW_METHODS = exports.AUTH_STATUSES = void 0;
 /**
- * Flow statuses. Only `needs_verification` and `authenticated` are emitted today;
- * the rest are reserved so the contract is forward-stable and added to as the
- * slices that emit them land (credential setup, cross-method link prompt).
+ * Flow statuses. Only `needs_verification` and `authenticated` are emitted today; the rest are
+ * reserved for forward-stability, emitted as their slices land (credential setup, link prompt).
  */
 exports.AUTH_STATUSES = [
     'needs_verification', // a code was sent; awaiting it
-    'needs_credential', // identity verified, account still needs a credential — reserved, not emitted yet
+    'needs_credential', // first factor proven; the session is withheld until the account's share-gate credential is too (ENG-7075)
     'needs_link', // identifier collides with an account from another method — reserved (cross-method linking)
     'needs_second_factor', // first factor passed; awaiting a login-time MFA challenge (ENG-6906)
     'authenticated', // done; a session has been established
+    'linked', // a factor-link flow (start+continue with intent:'link') attached the proven factor to the session's account (ENG-7075)
+    'needs_step_up', // a factor-link or factor-unlink flow must prove the SESSION's existing account first (ENG-7075)
+    'unlinked', // a factor-unlink flow proved the account and revoked the named factor (ENG-7075)
 ];
 /**
- * First-factor methods the `/v2/auth` flow handles. Email/phone authenticate via a delivered
- * one-time code; external-wallet by signing a SIWE challenge; passkey by a WebAuthn assertion
- * (usernameless — resolved from the credential at `continue`); oauth by a provider redirect
- * (the specific provider rides on the flow; the account is resolved at `continue`). (ENG-6911)
+ * First-factor methods `/v2/auth` handles: email/phone via a delivered one-time code; external-wallet
+ * via a SIWE signature; passkey via a WebAuthn assertion (usernameless — resolved from the credential at
+ * `continue`); oauth via a provider redirect (provider rides on the flow, account resolved at
+ * `continue`). (ENG-6911)
  */
 exports.AUTH_FLOW_METHODS = ['EMAIL', 'PHONE', 'EXTERNAL_WALLET', 'PASSKEY', 'OAUTH'];

package/dist/esm/index.js

@@ -1,6 +1,7 @@
 export * from './types/index.js';
 export * from './types/permissions.js';
 export * from './schemas/permissionsV2.js';
+export * from './schemas/permissionsV2UserParameters.js';
 export * from './utils/index.js';
 import * as transactionTypes from './types/transaction.js';
 export { transactionTypes };