@getpara/shared 1.29.0 → 1.31.0

package/dist/esm/schemas/permissionsV2UserParameters.js

@@ -0,0 +1,82 @@
+import { z } from 'zod';
+const templateRevisionFields = {
+    policyVersion: z.string().min(1),
+    policyHash: z.string().min(1),
+    expectedRevision: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+};
+export const permissionsV2UserParameterSaveSchema = z
+    .object({
+    ...templateRevisionFields,
+    values: z.record(z.string()),
+})
+    .strict();
+export const permissionsV2UserParameterResetSchema = z.object(templateRevisionFields).strict();
+const storedRevision = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+const provenance = z.enum(['default', 'personal']);
+const parameterDescriptor = z
+    .object({
+    id: z.string().min(1),
+    label: z.string().min(1),
+    defaultValue: z.string(),
+    fact: z.string().min(1),
+    asset: z.string().optional(),
+    window: z.string().optional(),
+})
+    .strict();
+const viewFields = {
+    userId: z.string().min(1),
+    partnerId: z.string().min(1),
+    appId: z.string().min(1),
+    policyId: z.string().min(1),
+    policyVersion: z.string().min(1),
+    policyHash: z.string().min(1),
+    parameters: z.array(parameterDescriptor),
+};
+export const permissionsV2UserParameterReadyViewSchema = z.union([
+    z
+        .object({
+        ...viewFields,
+        status: z.literal('ready'),
+        revision: z.literal(0),
+        provenance: z.literal('default'),
+        values: z.record(z.string()),
+    })
+        .strict(),
+    z
+        .object({
+        ...viewFields,
+        status: z.literal('ready'),
+        revision: storedRevision,
+        provenance,
+        values: z.record(z.string()),
+        configurationHash: z.string().min(1),
+    })
+        .strict(),
+]);
+export const permissionsV2UserParameterViewSchema = z.union([
+    permissionsV2UserParameterReadyViewSchema,
+    z
+        .object({
+        ...viewFields,
+        status: z.literal('needs_confirmation'),
+        revision: storedRevision,
+        provenance,
+        previousValues: z.record(z.string()),
+    })
+        .strict(),
+]);
+export const permissionsV2UserParameterHistorySchema = z
+    .object({
+    revisions: z.array(z
+        .object({
+        policyVersion: z.string().min(1),
+        policyHash: z.string().min(1),
+        revision: storedRevision,
+        provenance,
+        values: z.record(z.string()),
+        changedAt: z.string().datetime(),
+    })
+        .strict()),
+    nextBeforeRevision: storedRevision.optional(),
+})
+    .strict();

package/dist/esm/types/authFactor.js

@@ -1,11 +1,9 @@
 /**
- * Auth factors are the ways an account authenticates: the identity-bearing
- * FIRST factors (email, phone, OAuth, external wallet) plus, going forward,
- * SECOND factors. This is the correct "authentication factor" model.
+ * Auth factors are the ways an account authenticates: the identity-bearing FIRST factors (email, phone,
+ * OAuth, external wallet) plus, going forward, SECOND factors.
  *
- * NOTE: distinct from the legacy `AuthMethod` enum (PASSWORD/PASSKEY/PIN/
- * BASIC_LOGIN), which describes the legacy credential/unlock methods and is
- * being retired with the enclave migration. Existing passkeys/PINs/passwords/
+ * NOTE: distinct from the legacy `AuthMethod` enum (PASSWORD/PASSKEY/PIN/BASIC_LOGIN) — legacy
+ * credential/unlock methods being retired with the enclave migration. Existing passkeys/PINs/passwords/
  * TOTP are NEVER represented here — they stay in their own tables and age out.
  */
 export const AUTH_FACTOR_TYPES = [
@@ -20,6 +18,10 @@ export const AUTH_FACTOR_TYPES = [
 ];
 /** Which factor in the authentication sequence this is. */
 export const AUTH_FACTOR_TIERS = ['FIRST', 'SECOND'];
-export const AUTH_FACTOR_STATUSES = ['PENDING', 'VERIFIED', 'REVOKED'];
+// PENDING = a login credential mid-proof (email/phone first-write before its OTP) — reserved. VERIFIED = a
+// proven login credential. UNVERIFIED = a linking HINT: an OAuth vouched for this email but the owner never
+// proved it, so it is NOT a login credential (can't log in) and several may coexist across accounts — powers
+// only the needs_link linking UI. REVOKED = unlinked. (ENG-7075)
+export const AUTH_FACTOR_STATUSES = ['PENDING', 'VERIFIED', 'UNVERIFIED', 'REVOKED'];
 /** How this factor came to be attached to the account (drives migration/audit). */
 export const AUTH_FACTOR_PROVENANCES = ['SIGNUP', 'EXPLICIT_LINK', 'IMPLICIT_MERGE_LEGACY', 'MIGRATION'];

package/dist/esm/types/authState.js

@@ -1,29 +1,28 @@
 /**
- * Status-model auth envelope returned by the `/v2/auth` endpoints and consumed
- * by the backend and new SDKs. Clerk-style: a single `status` drives the client,
- * with typed per-status fields. New statuses are added additively; a client that
- * sees a status it doesn't recognize should treat the flow as not-yet-complete
- * (show generic / hand off) rather than erroring (forward-compat).
- *
- * This is the canonical auth contract — new SDKs consume it directly instead of
- * a parallel client mirror. (ENG-6910)
+ * Status-model auth envelope returned by `/v2/auth`, consumed by the backend and new SDKs.
+ * Clerk-style: a single `status` drives the client, with typed per-status fields. Statuses are added
+ * additively; an unrecognized one is treated as not-yet-complete (show generic / hand off), never an
+ * error (forward-compat). The canonical auth contract — new SDKs consume it directly, not a parallel
+ * client mirror. (ENG-6910)
  */
 /**
- * Flow statuses. Only `needs_verification` and `authenticated` are emitted today;
- * the rest are reserved so the contract is forward-stable and added to as the
- * slices that emit them land (credential setup, cross-method link prompt).
+ * Flow statuses. Only `needs_verification` and `authenticated` are emitted today; the rest are
+ * reserved for forward-stability, emitted as their slices land (credential setup, link prompt).
  */
 export const AUTH_STATUSES = [
     'needs_verification', // a code was sent; awaiting it
-    'needs_credential', // identity verified, account still needs a credential — reserved, not emitted yet
+    'needs_credential', // first factor proven; the session is withheld until the account's share-gate credential is too (ENG-7075)
     'needs_link', // identifier collides with an account from another method — reserved (cross-method linking)
     'needs_second_factor', // first factor passed; awaiting a login-time MFA challenge (ENG-6906)
     'authenticated', // done; a session has been established
+    'linked', // a factor-link flow (start+continue with intent:'link') attached the proven factor to the session's account (ENG-7075)
+    'needs_step_up', // a factor-link or factor-unlink flow must prove the SESSION's existing account first (ENG-7075)
+    'unlinked', // a factor-unlink flow proved the account and revoked the named factor (ENG-7075)
 ];
 /**
- * First-factor methods the `/v2/auth` flow handles. Email/phone authenticate via a delivered
- * one-time code; external-wallet by signing a SIWE challenge; passkey by a WebAuthn assertion
- * (usernameless — resolved from the credential at `continue`); oauth by a provider redirect
- * (the specific provider rides on the flow; the account is resolved at `continue`). (ENG-6911)
+ * First-factor methods `/v2/auth` handles: email/phone via a delivered one-time code; external-wallet
+ * via a SIWE signature; passkey via a WebAuthn assertion (usernameless — resolved from the credential at
+ * `continue`); oauth via a provider redirect (provider rides on the flow, account resolved at
+ * `continue`). (ENG-6911)
  */
 export const AUTH_FLOW_METHODS = ['EMAIL', 'PHONE', 'EXTERNAL_WALLET', 'PASSKEY', 'OAUTH'];

package/dist/types/index.d.ts

@@ -1,6 +1,7 @@
 export * from './types/index.js';
 export * from './types/permissions.js';
 export * from './schemas/permissionsV2.js';
+export * from './schemas/permissionsV2UserParameters.js';
 export * from './utils/index.js';
 import * as transactionTypes from './types/transaction.js';
 export { transactionTypes };

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AAEjC,OAAO,KAAK,gBAAgB,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,0CAA0C,CAAC;AACzD,cAAc,kBAAkB,CAAC;AAEjC,OAAO,KAAK,gBAAgB,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,CAAC"}