@haatlabs-core/auth-contracts 0.0.0-stage → 0.11.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Haatlabs
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,16 @@
-# Temporary Holding Version
+# @haatlabs-core/auth-contracts
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The request and response schemas of sign-in and API keys, shared by an app's API and its
+web pages: roles and their rank, the sign-in code's length and lifetime, and the `me`
+response. An app adds its own `me` fields:
+
+    import { meResponseSchema } from '@haatlabs-core/auth-contracts';
+    export const MeResponseSchema = meResponseSchema({ features: AccountFeaturesSchema });
+
+`zod` is a peer: the app's own copy is used.
+
+## Install
+
+    pnpm add @haatlabs-core/auth-contracts
+
+It leaves one package to your app, so the app holds one copy: `zod`.

package/dist/api-keys.d.ts

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+export declare const CreateApiKeyRequestSchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+export type CreateApiKeyRequest = z.infer<typeof CreateApiKeyRequestSchema>;
+export declare const ApiKeySchema: z.ZodObject<{
+    id: z.ZodUUID;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    lastUsedAt: z.ZodNullable<z.ZodISODateTime>;
+    revokedAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type ApiKey = z.infer<typeof ApiKeySchema>;
+/** The full key is returned exactly once, at creation. */
+export declare const CreateApiKeyResponseSchema: z.ZodObject<{
+    apiKey: z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        prefix: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        lastUsedAt: z.ZodNullable<z.ZodISODateTime>;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>;
+    key: z.ZodString;
+}, z.core.$strip>;
+export type CreateApiKeyResponse = z.infer<typeof CreateApiKeyResponseSchema>;
+export declare const ApiKeyListResponseSchema: z.ZodObject<{
+    apiKeys: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        prefix: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        lastUsedAt: z.ZodNullable<z.ZodISODateTime>;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ApiKeyListResponse = z.infer<typeof ApiKeyListResponseSchema>;

package/dist/api-keys.js

@@ -0,0 +1,14 @@
+import { z } from 'zod';
+export const CreateApiKeyRequestSchema = z.object({ name: z.string().trim().min(1).max(80) });
+export const ApiKeySchema = z.object({
+    id: z.uuid(),
+    name: z.string(),
+    prefix: z.string(),
+    createdAt: z.iso.datetime(),
+    lastUsedAt: z.iso.datetime().nullable(),
+    revokedAt: z.iso.datetime().nullable(),
+});
+/** The full key is returned exactly once, at creation. */
+export const CreateApiKeyResponseSchema = z.object({ apiKey: ApiKeySchema, key: z.string() });
+export const ApiKeyListResponseSchema = z.object({ apiKeys: z.array(ApiKeySchema) });
+//# sourceMappingURL=api-keys.js.map

package/dist/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../src/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAG9F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAG9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,142 @@
+import { z } from 'zod';
+export declare const Role: {
+    readonly OWNER: "OWNER";
+    readonly ADMIN: "ADMIN";
+    readonly MEMBER: "MEMBER";
+    readonly VIEWER: "VIEWER";
+};
+export type Role = (typeof Role)[keyof typeof Role];
+export declare const ROLE_RANK: Record<Role, number>;
+/** A platform administrator's sign-in: the only one that still uses a password. */
+export declare const LoginRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    password: z.ZodString;
+}, z.core.$strip>;
+export type LoginRequest = z.infer<typeof LoginRequestSchema>;
+/**
+ * How long a sign-in code is. Eight digits, not six: a code can be guessed at from any
+ * number of addresses, a few guesses for each one sent, and across every account at once.
+ * A hundred million codes keep that hopeless where a million would not.
+ */
+export declare const SIGN_IN_CODE_DIGITS = 8;
+export declare const SIGN_IN_CODE_MINUTES = 10;
+/** Asks for a sign-in code to be sent. Answered the same whether or not the email has an account. */
+export declare const SignInCodeRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+}, z.core.$strict>;
+export type SignInCodeRequest = z.infer<typeof SignInCodeRequestSchema>;
+/**
+ * Signs in with the code that was sent. An email with no account gets one, with an
+ * organization of its own: holding the code proves the address is theirs.
+ */
+export declare const SignInVerifyRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    code: z.ZodString;
+    organizationName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SignInVerifyRequest = z.infer<typeof SignInVerifyRequestSchema>;
+/** The email a store installed from Shopify gives its owner to sign in with. */
+export declare const EmailSignInCodeRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+}, z.core.$strict>;
+export type EmailSignInCodeRequest = z.infer<typeof EmailSignInCodeRequestSchema>;
+/** The same email with the code sent to it, which proves it reaches the person setting it. */
+export declare const EmailSignInRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    code: z.ZodString;
+}, z.core.$strict>;
+export type EmailSignInRequest = z.infer<typeof EmailSignInRequestSchema>;
+export declare const EmailSignInResponseSchema: z.ZodObject<{
+    email: z.ZodNullable<z.ZodString>;
+    dashboardUrl: z.ZodString;
+    canCreate: z.ZodBoolean;
+    suggestedEmail: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type EmailSignInResponse = z.infer<typeof EmailSignInResponseSchema>;
+/**
+ * Who is signed in, as every app answers it. An app adds its own fields with
+ * `meResponseSchema`.
+ */
+export declare const BaseMeResponseSchema: z.ZodObject<{
+    user: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    organization: z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+    }, z.core.$strip>;
+    role: z.ZodEnum<{
+        readonly OWNER: "OWNER";
+        readonly ADMIN: "ADMIN";
+        readonly MEMBER: "MEMBER";
+        readonly VIEWER: "VIEWER";
+    }>;
+    via: z.ZodEnum<{
+        session: "session";
+        embedded: "embedded";
+        api_key: "api_key";
+    }>;
+    csrfToken: z.ZodNullable<z.ZodString>;
+    storeOnly: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type BaseMeResponse = z.infer<typeof BaseMeResponseSchema>;
+/** The shared fields of `me` with the app's own on top. */
+export declare function meResponseSchema<S extends z.ZodRawShape>(extras: S): z.ZodObject<(("user" | "organization" | "role" | "via" | "csrfToken" | "storeOnly") & keyof S extends never ? {
+    user: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    organization: z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+    }, z.core.$strip>;
+    role: z.ZodEnum<{
+        readonly OWNER: "OWNER";
+        readonly ADMIN: "ADMIN";
+        readonly MEMBER: "MEMBER";
+        readonly VIEWER: "VIEWER";
+    }>;
+    via: z.ZodEnum<{
+        session: "session";
+        embedded: "embedded";
+        api_key: "api_key";
+    }>;
+    csrfToken: z.ZodNullable<z.ZodString>;
+    storeOnly: z.ZodDefault<z.ZodBoolean>;
+} & { -readonly [P in keyof S]: S[P]; } : ({
+    user: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    organization: z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+    }, z.core.$strip>;
+    role: z.ZodEnum<{
+        readonly OWNER: "OWNER";
+        readonly ADMIN: "ADMIN";
+        readonly MEMBER: "MEMBER";
+        readonly VIEWER: "VIEWER";
+    }>;
+    via: z.ZodEnum<{
+        session: "session";
+        embedded: "embedded";
+        api_key: "api_key";
+    }>;
+    csrfToken: z.ZodNullable<z.ZodString>;
+    storeOnly: z.ZodDefault<z.ZodBoolean>;
+} extends infer T_1 extends z.core.util.SomeObject ? { [K in keyof T_1 as K extends keyof S ? never : K]: T_1[K]; } : never) & { [K_1 in keyof { -readonly [P in keyof S]: S[P]; }]: { -readonly [P in keyof S]: S[P]; }[K_1]; }) extends infer T ? { [k in keyof T]: T[k]; } : never, z.core.$strip>;
+/** A platform administrator's sign-in. */
+export declare const AdminLoginRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    password: z.ZodString;
+}, z.core.$strip>;
+export type AdminLoginRequest = z.infer<typeof AdminLoginRequestSchema>;
+/** The platform administrator who is signed in. Not a merchant's user. */
+export declare const AdminMeSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    email: z.ZodString;
+    csrfToken: z.ZodString;
+}, z.core.$strip>;
+export type AdminMe = z.infer<typeof AdminMeSchema>;

package/dist/auth.js

@@ -0,0 +1,84 @@
+import { z } from 'zod';
+export const Role = { OWNER: 'OWNER', ADMIN: 'ADMIN', MEMBER: 'MEMBER', VIEWER: 'VIEWER' };
+export const ROLE_RANK = { VIEWER: 0, MEMBER: 1, ADMIN: 2, OWNER: 3 };
+const MAX_PASSWORD_LENGTH = 200;
+/** A platform administrator's sign-in: the only one that still uses a password. */
+export const LoginRequestSchema = z.object({
+    email: z
+        .email()
+        .max(320)
+        .transform((value) => value.toLowerCase()),
+    password: z.string().min(1).max(MAX_PASSWORD_LENGTH),
+});
+const email = z
+    .email()
+    .max(320)
+    .transform((value) => value.toLowerCase());
+/**
+ * How long a sign-in code is. Eight digits, not six: a code can be guessed at from any
+ * number of addresses, a few guesses for each one sent, and across every account at once.
+ * A hundred million codes keep that hopeless where a million would not.
+ */
+export const SIGN_IN_CODE_DIGITS = 8;
+export const SIGN_IN_CODE_MINUTES = 10;
+/** Digits only, sent to the email address; it works once and for ten minutes. */
+const code = z
+    .string()
+    .regex(new RegExp(`^\\d{${SIGN_IN_CODE_DIGITS}}$`), `The code is ${SIGN_IN_CODE_DIGITS} digits`);
+/** Asks for a sign-in code to be sent. Answered the same whether or not the email has an account. */
+export const SignInCodeRequestSchema = z.strictObject({ email });
+/**
+ * Signs in with the code that was sent. An email with no account gets one, with an
+ * organization of its own: holding the code proves the address is theirs.
+ */
+export const SignInVerifyRequestSchema = z.strictObject({
+    email,
+    code,
+    /** For a new account: what to call its organization. Left out: the email address. */
+    organizationName: z.string().trim().min(1).max(120).optional(),
+});
+/** The email a store installed from Shopify gives its owner to sign in with. */
+export const EmailSignInCodeRequestSchema = z.strictObject({ email });
+/** The same email with the code sent to it, which proves it reaches the person setting it. */
+export const EmailSignInRequestSchema = z.strictObject({ email, code });
+export const EmailSignInResponseSchema = z.object({
+    /** Null until the store's owner has been given one. */
+    email: z.string().nullable(),
+    /** Where that email signs in. */
+    dashboardUrl: z.string(),
+    /** Whether the person asking may create it: there is none yet and they own the store. */
+    canCreate: z.boolean(),
+    /** The email Shopify has verified for them, to start the form with. */
+    suggestedEmail: z.string().nullable(),
+});
+/**
+ * Who is signed in, as every app answers it. An app adds its own fields with
+ * `meResponseSchema`.
+ */
+export const BaseMeResponseSchema = z.object({
+    user: z.object({ id: z.uuid(), email: z.string().nullable() }).nullable(),
+    organization: z.object({ id: z.uuid(), name: z.string() }),
+    role: z.enum(Role),
+    via: z.enum(['session', 'embedded', 'api_key']),
+    csrfToken: z.string().nullable(),
+    /**
+     * Inside Shopify admin, for a store connected from a dashboard account: only the store is
+     * reachable, not what is the whole organization's, and `organization.name` is the
+     * store's. A server from before says nothing: false.
+     */
+    storeOnly: z.boolean().default(false),
+});
+/** The shared fields of `me` with the app's own on top. */
+export function meResponseSchema(extras) {
+    return BaseMeResponseSchema.extend(extras);
+}
+/** A platform administrator's sign-in. */
+export const AdminLoginRequestSchema = LoginRequestSchema;
+/** The platform administrator who is signed in. Not a merchant's user. */
+export const AdminMeSchema = z.object({
+    id: z.uuid(),
+    email: z.string(),
+    /** Sent back in a header with every request that changes something. */
+    csrfToken: z.string(),
+});
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAW,CAAC;AAEpG,MAAM,CAAC,MAAM,SAAS,GAAyB,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAE5F,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC;SACL,KAAK,EAAE;SACP,GAAG,CAAC,GAAG,CAAC;SACR,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;CACrD,CAAC,CAAC;AAGH,MAAM,KAAK,GAAG,CAAC;KACZ,KAAK,EAAE;KACP,GAAG,CAAC,GAAG,CAAC;KACR,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AAC7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,iFAAiF;AACjF,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,EAAE;KACR,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,mBAAmB,IAAI,CAAC,EAAE,eAAe,mBAAmB,SAAS,CAAC,CAAC;AAEnG,qGAAqG;AACrG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAGjE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,KAAK;IACL,IAAI;IACJ,qFAAqF;IACrF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC;AAGH,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAGtE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAGxE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,uDAAuD;IACvD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,iCAAiC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,yFAAyF;IACzF,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,uEAAuE;IACvE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1D,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAClB,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACtC,CAAC,CAAC;AAGH,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB,CAA0B,MAAS;IACjE,OAAO,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,0CAA0C;AAC1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAG1D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,uEAAuE;IACvE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC"}

package/dist/cjs/api-keys.d.ts

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+export declare const CreateApiKeyRequestSchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+export type CreateApiKeyRequest = z.infer<typeof CreateApiKeyRequestSchema>;
+export declare const ApiKeySchema: z.ZodObject<{
+    id: z.ZodUUID;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    lastUsedAt: z.ZodNullable<z.ZodISODateTime>;
+    revokedAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type ApiKey = z.infer<typeof ApiKeySchema>;
+/** The full key is returned exactly once, at creation. */
+export declare const CreateApiKeyResponseSchema: z.ZodObject<{
+    apiKey: z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        prefix: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        lastUsedAt: z.ZodNullable<z.ZodISODateTime>;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>;
+    key: z.ZodString;
+}, z.core.$strip>;
+export type CreateApiKeyResponse = z.infer<typeof CreateApiKeyResponseSchema>;
+export declare const ApiKeyListResponseSchema: z.ZodObject<{
+    apiKeys: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        prefix: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        lastUsedAt: z.ZodNullable<z.ZodISODateTime>;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ApiKeyListResponse = z.infer<typeof ApiKeyListResponseSchema>;

package/dist/cjs/api-keys.js

@@ -0,0 +1,44 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var api_keys_exports = {};
+__export(api_keys_exports, {
+  ApiKeyListResponseSchema: () => ApiKeyListResponseSchema,
+  ApiKeySchema: () => ApiKeySchema,
+  CreateApiKeyRequestSchema: () => CreateApiKeyRequestSchema,
+  CreateApiKeyResponseSchema: () => CreateApiKeyResponseSchema
+});
+module.exports = __toCommonJS(api_keys_exports);
+var import_zod = require("zod");
+const CreateApiKeyRequestSchema = import_zod.z.object({ name: import_zod.z.string().trim().min(1).max(80) });
+const ApiKeySchema = import_zod.z.object({
+  id: import_zod.z.uuid(),
+  name: import_zod.z.string(),
+  prefix: import_zod.z.string(),
+  createdAt: import_zod.z.iso.datetime(),
+  lastUsedAt: import_zod.z.iso.datetime().nullable(),
+  revokedAt: import_zod.z.iso.datetime().nullable()
+});
+const CreateApiKeyResponseSchema = import_zod.z.object({ apiKey: ApiKeySchema, key: import_zod.z.string() });
+const ApiKeyListResponseSchema = import_zod.z.object({ apiKeys: import_zod.z.array(ApiKeySchema) });
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ApiKeyListResponseSchema,
+  ApiKeySchema,
+  CreateApiKeyRequestSchema,
+  CreateApiKeyResponseSchema
+});

package/dist/cjs/auth.d.ts

@@ -0,0 +1,142 @@
+import { z } from 'zod';
+export declare const Role: {
+    readonly OWNER: "OWNER";
+    readonly ADMIN: "ADMIN";
+    readonly MEMBER: "MEMBER";
+    readonly VIEWER: "VIEWER";
+};
+export type Role = (typeof Role)[keyof typeof Role];
+export declare const ROLE_RANK: Record<Role, number>;
+/** A platform administrator's sign-in: the only one that still uses a password. */
+export declare const LoginRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    password: z.ZodString;
+}, z.core.$strip>;
+export type LoginRequest = z.infer<typeof LoginRequestSchema>;
+/**
+ * How long a sign-in code is. Eight digits, not six: a code can be guessed at from any
+ * number of addresses, a few guesses for each one sent, and across every account at once.
+ * A hundred million codes keep that hopeless where a million would not.
+ */
+export declare const SIGN_IN_CODE_DIGITS = 8;
+export declare const SIGN_IN_CODE_MINUTES = 10;
+/** Asks for a sign-in code to be sent. Answered the same whether or not the email has an account. */
+export declare const SignInCodeRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+}, z.core.$strict>;
+export type SignInCodeRequest = z.infer<typeof SignInCodeRequestSchema>;
+/**
+ * Signs in with the code that was sent. An email with no account gets one, with an
+ * organization of its own: holding the code proves the address is theirs.
+ */
+export declare const SignInVerifyRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    code: z.ZodString;
+    organizationName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SignInVerifyRequest = z.infer<typeof SignInVerifyRequestSchema>;
+/** The email a store installed from Shopify gives its owner to sign in with. */
+export declare const EmailSignInCodeRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+}, z.core.$strict>;
+export type EmailSignInCodeRequest = z.infer<typeof EmailSignInCodeRequestSchema>;
+/** The same email with the code sent to it, which proves it reaches the person setting it. */
+export declare const EmailSignInRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    code: z.ZodString;
+}, z.core.$strict>;
+export type EmailSignInRequest = z.infer<typeof EmailSignInRequestSchema>;
+export declare const EmailSignInResponseSchema: z.ZodObject<{
+    email: z.ZodNullable<z.ZodString>;
+    dashboardUrl: z.ZodString;
+    canCreate: z.ZodBoolean;
+    suggestedEmail: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type EmailSignInResponse = z.infer<typeof EmailSignInResponseSchema>;
+/**
+ * Who is signed in, as every app answers it. An app adds its own fields with
+ * `meResponseSchema`.
+ */
+export declare const BaseMeResponseSchema: z.ZodObject<{
+    user: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    organization: z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+    }, z.core.$strip>;
+    role: z.ZodEnum<{
+        readonly OWNER: "OWNER";
+        readonly ADMIN: "ADMIN";
+        readonly MEMBER: "MEMBER";
+        readonly VIEWER: "VIEWER";
+    }>;
+    via: z.ZodEnum<{
+        session: "session";
+        embedded: "embedded";
+        api_key: "api_key";
+    }>;
+    csrfToken: z.ZodNullable<z.ZodString>;
+    storeOnly: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type BaseMeResponse = z.infer<typeof BaseMeResponseSchema>;
+/** The shared fields of `me` with the app's own on top. */
+export declare function meResponseSchema<S extends z.ZodRawShape>(extras: S): z.ZodObject<(("user" | "organization" | "role" | "via" | "csrfToken" | "storeOnly") & keyof S extends never ? {
+    user: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    organization: z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+    }, z.core.$strip>;
+    role: z.ZodEnum<{
+        readonly OWNER: "OWNER";
+        readonly ADMIN: "ADMIN";
+        readonly MEMBER: "MEMBER";
+        readonly VIEWER: "VIEWER";
+    }>;
+    via: z.ZodEnum<{
+        session: "session";
+        embedded: "embedded";
+        api_key: "api_key";
+    }>;
+    csrfToken: z.ZodNullable<z.ZodString>;
+    storeOnly: z.ZodDefault<z.ZodBoolean>;
+} & { -readonly [P in keyof S]: S[P]; } : ({
+    user: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    organization: z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+    }, z.core.$strip>;
+    role: z.ZodEnum<{
+        readonly OWNER: "OWNER";
+        readonly ADMIN: "ADMIN";
+        readonly MEMBER: "MEMBER";
+        readonly VIEWER: "VIEWER";
+    }>;
+    via: z.ZodEnum<{
+        session: "session";
+        embedded: "embedded";
+        api_key: "api_key";
+    }>;
+    csrfToken: z.ZodNullable<z.ZodString>;
+    storeOnly: z.ZodDefault<z.ZodBoolean>;
+} extends infer T_1 extends z.core.util.SomeObject ? { [K in keyof T_1 as K extends keyof S ? never : K]: T_1[K]; } : never) & { [K_1 in keyof { -readonly [P in keyof S]: S[P]; }]: { -readonly [P in keyof S]: S[P]; }[K_1]; }) extends infer T ? { [k in keyof T]: T[k]; } : never, z.core.$strip>;
+/** A platform administrator's sign-in. */
+export declare const AdminLoginRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    password: z.ZodString;
+}, z.core.$strip>;
+export type AdminLoginRequest = z.infer<typeof AdminLoginRequestSchema>;
+/** The platform administrator who is signed in. Not a merchant's user. */
+export declare const AdminMeSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    email: z.ZodString;
+    csrfToken: z.ZodString;
+}, z.core.$strip>;
+export type AdminMe = z.infer<typeof AdminMeSchema>;

package/dist/cjs/auth.js

@@ -0,0 +1,106 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var auth_exports = {};
+__export(auth_exports, {
+  AdminLoginRequestSchema: () => AdminLoginRequestSchema,
+  AdminMeSchema: () => AdminMeSchema,
+  BaseMeResponseSchema: () => BaseMeResponseSchema,
+  EmailSignInCodeRequestSchema: () => EmailSignInCodeRequestSchema,
+  EmailSignInRequestSchema: () => EmailSignInRequestSchema,
+  EmailSignInResponseSchema: () => EmailSignInResponseSchema,
+  LoginRequestSchema: () => LoginRequestSchema,
+  ROLE_RANK: () => ROLE_RANK,
+  Role: () => Role,
+  SIGN_IN_CODE_DIGITS: () => SIGN_IN_CODE_DIGITS,
+  SIGN_IN_CODE_MINUTES: () => SIGN_IN_CODE_MINUTES,
+  SignInCodeRequestSchema: () => SignInCodeRequestSchema,
+  SignInVerifyRequestSchema: () => SignInVerifyRequestSchema,
+  meResponseSchema: () => meResponseSchema
+});
+module.exports = __toCommonJS(auth_exports);
+var import_zod = require("zod");
+const Role = { OWNER: "OWNER", ADMIN: "ADMIN", MEMBER: "MEMBER", VIEWER: "VIEWER" };
+const ROLE_RANK = { VIEWER: 0, MEMBER: 1, ADMIN: 2, OWNER: 3 };
+const MAX_PASSWORD_LENGTH = 200;
+const LoginRequestSchema = import_zod.z.object({
+  email: import_zod.z.email().max(320).transform((value) => value.toLowerCase()),
+  password: import_zod.z.string().min(1).max(MAX_PASSWORD_LENGTH)
+});
+const email = import_zod.z.email().max(320).transform((value) => value.toLowerCase());
+const SIGN_IN_CODE_DIGITS = 8;
+const SIGN_IN_CODE_MINUTES = 10;
+const code = import_zod.z.string().regex(new RegExp(`^\\d{${SIGN_IN_CODE_DIGITS}}$`), `The code is ${SIGN_IN_CODE_DIGITS} digits`);
+const SignInCodeRequestSchema = import_zod.z.strictObject({ email });
+const SignInVerifyRequestSchema = import_zod.z.strictObject({
+  email,
+  code,
+  /** For a new account: what to call its organization. Left out: the email address. */
+  organizationName: import_zod.z.string().trim().min(1).max(120).optional()
+});
+const EmailSignInCodeRequestSchema = import_zod.z.strictObject({ email });
+const EmailSignInRequestSchema = import_zod.z.strictObject({ email, code });
+const EmailSignInResponseSchema = import_zod.z.object({
+  /** Null until the store's owner has been given one. */
+  email: import_zod.z.string().nullable(),
+  /** Where that email signs in. */
+  dashboardUrl: import_zod.z.string(),
+  /** Whether the person asking may create it: there is none yet and they own the store. */
+  canCreate: import_zod.z.boolean(),
+  /** The email Shopify has verified for them, to start the form with. */
+  suggestedEmail: import_zod.z.string().nullable()
+});
+const BaseMeResponseSchema = import_zod.z.object({
+  user: import_zod.z.object({ id: import_zod.z.uuid(), email: import_zod.z.string().nullable() }).nullable(),
+  organization: import_zod.z.object({ id: import_zod.z.uuid(), name: import_zod.z.string() }),
+  role: import_zod.z.enum(Role),
+  via: import_zod.z.enum(["session", "embedded", "api_key"]),
+  csrfToken: import_zod.z.string().nullable(),
+  /**
+   * Inside Shopify admin, for a store connected from a dashboard account: only the store is
+   * reachable, not what is the whole organization's, and `organization.name` is the
+   * store's. A server from before says nothing: false.
+   */
+  storeOnly: import_zod.z.boolean().default(false)
+});
+function meResponseSchema(extras) {
+  return BaseMeResponseSchema.extend(extras);
+}
+const AdminLoginRequestSchema = LoginRequestSchema;
+const AdminMeSchema = import_zod.z.object({
+  id: import_zod.z.uuid(),
+  email: import_zod.z.string(),
+  /** Sent back in a header with every request that changes something. */
+  csrfToken: import_zod.z.string()
+});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AdminLoginRequestSchema,
+  AdminMeSchema,
+  BaseMeResponseSchema,
+  EmailSignInCodeRequestSchema,
+  EmailSignInRequestSchema,
+  EmailSignInResponseSchema,
+  LoginRequestSchema,
+  ROLE_RANK,
+  Role,
+  SIGN_IN_CODE_DIGITS,
+  SIGN_IN_CODE_MINUTES,
+  SignInCodeRequestSchema,
+  SignInVerifyRequestSchema,
+  meResponseSchema
+});

package/dist/cjs/extension-keys.d.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+/** A Chrome extension's id: 32 letters a to p. */
+export declare const ExtensionIdSchema: z.ZodString;
+export declare const CreateExtensionKeyRequestSchema: z.ZodObject<{
+    name: z.ZodString;
+    extensionId: z.ZodString;
+}, z.core.$strip>;
+export type CreateExtensionKeyRequest = z.infer<typeof CreateExtensionKeyRequestSchema>;
+/** A key a browser extension acts with, as the person who connected it. */
+export declare const ExtensionKeySchema: z.ZodObject<{
+    id: z.ZodUUID;
+    name: z.ZodString;
+    extensionId: z.ZodString;
+    prefix: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    lastUsedAt: z.ZodNullable<z.ZodISODateTime>;
+    revokedAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type ExtensionKey = z.infer<typeof ExtensionKeySchema>;
+/** The key itself is returned once, here, and never again. */
+export declare const CreateExtensionKeyResponseSchema: z.ZodObject<{
+    extensionKey: z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        extensionId: z.ZodString;
+        prefix: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        lastUsedAt: z.ZodNullable<z.ZodISODateTime>;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>;
+    key: z.ZodString;
+}, z.core.$strip>;
+export type CreateExtensionKeyResponse = z.infer<typeof CreateExtensionKeyResponseSchema>;
+export declare const ExtensionKeyListResponseSchema: z.ZodObject<{
+    extensionKeys: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        extensionId: z.ZodString;
+        prefix: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        lastUsedAt: z.ZodNullable<z.ZodISODateTime>;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ExtensionKeyListResponse = z.infer<typeof ExtensionKeyListResponseSchema>;

package/dist/cjs/extension-keys.js

@@ -0,0 +1,56 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var extension_keys_exports = {};
+__export(extension_keys_exports, {
+  CreateExtensionKeyRequestSchema: () => CreateExtensionKeyRequestSchema,
+  CreateExtensionKeyResponseSchema: () => CreateExtensionKeyResponseSchema,
+  ExtensionIdSchema: () => ExtensionIdSchema,
+  ExtensionKeyListResponseSchema: () => ExtensionKeyListResponseSchema,
+  ExtensionKeySchema: () => ExtensionKeySchema
+});
+module.exports = __toCommonJS(extension_keys_exports);
+var import_zod = require("zod");
+const ExtensionIdSchema = import_zod.z.string().regex(/^[a-p]{32}$/);
+const CreateExtensionKeyRequestSchema = import_zod.z.object({
+  name: import_zod.z.string().trim().min(1).max(80),
+  extensionId: ExtensionIdSchema
+});
+const ExtensionKeySchema = import_zod.z.object({
+  id: import_zod.z.uuid(),
+  name: import_zod.z.string(),
+  extensionId: import_zod.z.string(),
+  prefix: import_zod.z.string(),
+  createdAt: import_zod.z.iso.datetime(),
+  lastUsedAt: import_zod.z.iso.datetime().nullable(),
+  revokedAt: import_zod.z.iso.datetime().nullable()
+});
+const CreateExtensionKeyResponseSchema = import_zod.z.object({
+  extensionKey: ExtensionKeySchema,
+  key: import_zod.z.string()
+});
+const ExtensionKeyListResponseSchema = import_zod.z.object({
+  extensionKeys: import_zod.z.array(ExtensionKeySchema)
+});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CreateExtensionKeyRequestSchema,
+  CreateExtensionKeyResponseSchema,
+  ExtensionIdSchema,
+  ExtensionKeyListResponseSchema,
+  ExtensionKeySchema
+});

package/dist/cjs/index.d.ts

@@ -0,0 +1,3 @@
+export * from './api-keys.js';
+export * from './auth.js';
+export * from './extension-keys.js';

package/dist/cjs/index.js

@@ -0,0 +1,25 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var index_exports = {};
+module.exports = __toCommonJS(index_exports);
+__reExport(index_exports, require("./api-keys.js"), module.exports);
+__reExport(index_exports, require("./auth.js"), module.exports);
+__reExport(index_exports, require("./extension-keys.js"), module.exports);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ...require("./api-keys.js"),
+  ...require("./auth.js"),
+  ...require("./extension-keys.js")
+});

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/extension-keys.d.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+/** A Chrome extension's id: 32 letters a to p. */
+export declare const ExtensionIdSchema: z.ZodString;
+export declare const CreateExtensionKeyRequestSchema: z.ZodObject<{
+    name: z.ZodString;
+    extensionId: z.ZodString;
+}, z.core.$strip>;
+export type CreateExtensionKeyRequest = z.infer<typeof CreateExtensionKeyRequestSchema>;
+/** A key a browser extension acts with, as the person who connected it. */
+export declare const ExtensionKeySchema: z.ZodObject<{
+    id: z.ZodUUID;
+    name: z.ZodString;
+    extensionId: z.ZodString;
+    prefix: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    lastUsedAt: z.ZodNullable<z.ZodISODateTime>;
+    revokedAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type ExtensionKey = z.infer<typeof ExtensionKeySchema>;
+/** The key itself is returned once, here, and never again. */
+export declare const CreateExtensionKeyResponseSchema: z.ZodObject<{
+    extensionKey: z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        extensionId: z.ZodString;
+        prefix: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        lastUsedAt: z.ZodNullable<z.ZodISODateTime>;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>;
+    key: z.ZodString;
+}, z.core.$strip>;
+export type CreateExtensionKeyResponse = z.infer<typeof CreateExtensionKeyResponseSchema>;
+export declare const ExtensionKeyListResponseSchema: z.ZodObject<{
+    extensionKeys: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        extensionId: z.ZodString;
+        prefix: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        lastUsedAt: z.ZodNullable<z.ZodISODateTime>;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ExtensionKeyListResponse = z.infer<typeof ExtensionKeyListResponseSchema>;

package/dist/extension-keys.js

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+/** A Chrome extension's id: 32 letters a to p. */
+export const ExtensionIdSchema = z.string().regex(/^[a-p]{32}$/);
+export const CreateExtensionKeyRequestSchema = z.object({
+    name: z.string().trim().min(1).max(80),
+    extensionId: ExtensionIdSchema,
+});
+/** A key a browser extension acts with, as the person who connected it. */
+export const ExtensionKeySchema = z.object({
+    id: z.uuid(),
+    name: z.string(),
+    extensionId: z.string(),
+    prefix: z.string(),
+    createdAt: z.iso.datetime(),
+    lastUsedAt: z.iso.datetime().nullable(),
+    revokedAt: z.iso.datetime().nullable(),
+});
+/** The key itself is returned once, here, and never again. */
+export const CreateExtensionKeyResponseSchema = z.object({
+    extensionKey: ExtensionKeySchema,
+    key: z.string(),
+});
+export const ExtensionKeyListResponseSchema = z.object({
+    extensionKeys: z.array(ExtensionKeySchema),
+});
+//# sourceMappingURL=extension-keys.js.map

package/dist/extension-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-keys.js","sourceRoot":"","sources":["../src/extension-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kDAAkD;AAClD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,WAAW,EAAE,iBAAiB;CAC/B,CAAC,CAAC;AAGH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,kBAAkB;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;CAC3C,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './api-keys.js';
+export * from './auth.js';
+export * from './extension-keys.js';

package/dist/index.js

@@ -0,0 +1,4 @@
+export * from './api-keys.js';
+export * from './auth.js';
+export * from './extension-keys.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC"}

package/package.json

@@ -1,6 +1,53 @@
 {
   "name": "@haatlabs-core/auth-contracts",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.11.0",
+  "description": "Sign-in and API-key request and response schemas shared by an app's API and web pages.",
+  "keywords": [
+    "haatlabs"
+  ],
+  "homepage": "https://haatlabs.shop/docs/packages/auth-contracts/",
+  "license": "Apache-2.0",
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Haatlabs/haatlabs-platform.git",
+    "directory": "packages/auth-contracts"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/index.d.ts",
+        "default": "./dist/cjs/index.js"
+      }
+    }
+  },
+  "peerDependencies": {
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "zod": "^4.6.5",
+    "@haatlabs-core/tsconfig": "0.11.0",
+    "@haatlabs-core/vitest-config": "0.11.0"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && node ../../scripts/build-cjs.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --typecheck",
+    "check:package": "publint --strict && attw --pack . --profile node16"
+  },
+  "platformRegistry": "npm"
+}