@klappay/types 1.0.7 → 1.0.9

package/dist/index.js

@@ -30,6 +30,9 @@ __export(index_exports, {
   CHARGE_EXPIRES_IN_MAX_SECONDS: () => CHARGE_EXPIRES_IN_MAX_SECONDS,
   CHARGE_EXPIRES_IN_MIN_SECONDS: () => CHARGE_EXPIRES_IN_MIN_SECONDS,
   CapabilitiesSchema: () => CapabilitiesSchema,
+  ChangeEmailSchema: () => ChangeEmailSchema,
+  ChangeNameSchema: () => ChangeNameSchema,
+  ChangePasswordSchema: () => ChangePasswordSchema,
   ChargeModeSchema: () => ChargeModeSchema,
   ChargeSchema: () => ChargeSchema,
   ChargeStatusEventSchema: () => ChargeStatusEventSchema,
@@ -38,6 +41,7 @@ __export(index_exports, {
   ChargesDateFieldSchema: () => ChargesDateFieldSchema,
   ChargesMetricFieldSchema: () => ChargesMetricFieldSchema,
   ChargesQueryFieldSchema: () => ChargesQueryFieldSchema,
+  ConfirmEmailChangeSchema: () => ConfirmEmailChangeSchema,
   CreateApiKeySchema: () => CreateApiKeySchema,
   CreateChargeSchema: () => CreateChargeSchema,
   CreateWebhookSchema: () => CreateWebhookSchema,
@@ -49,6 +53,7 @@ __export(index_exports, {
   EnvironmentSchema: () => EnvironmentSchema,
   ErrorPayloadSchema: () => ErrorPayloadSchema,
   ForgotPasswordSchema: () => ForgotPasswordSchema,
+  GetChargeQrCodeQuerySchema: () => GetChargeQrCodeQuerySchema,
   HealthSchema: () => HealthSchema,
   InvitationSchema: () => InvitationSchema,
   InviteUserSchema: () => InviteUserSchema,
@@ -97,6 +102,7 @@ __export(index_exports, {
   SandboxEventTriggerSchema: () => SandboxEventTriggerSchema,
   SandboxTriggerSchema: () => SandboxTriggerSchema,
   SecurityWebhookEventTypeSchema: () => SecurityWebhookEventTypeSchema,
+  SelfUserSchema: () => SelfUserSchema,
   SettlementStatusSchema: () => SettlementStatusSchema,
   SignupSchema: () => SignupSchema,
   SplitDistributionStatusSchema: () => SplitDistributionStatusSchema,
@@ -385,6 +391,12 @@ var ListChargesSchema = import_zod6.z.object({
   isOverpaid: import_zod6.z.enum(["true", "false"]).transform((v) => v === "true").optional()
 }).extend(PaginationQuerySchema.shape);
 var PaginatedChargesSchema = paginatedSchema(ChargeSchema);
+var GetChargeQrCodeQuerySchema = import_zod6.z.object({
+  token: TokenSchema.optional().describe(
+    "Which accepted `(token, network)` pair to encode in the QR \u2014 required if `acceptedPayments` has more than one pair, since there is no single unambiguous default to fall back to. Ignored (and unnecessary) when the charge accepts exactly one pair."
+  ),
+  network: NetworkSchema.optional()
+});
 var ChargeStatusEventSchema = import_zod6.z.object({
   id: import_zod6.z.string(),
   status: ChargeStatusSchema,
@@ -719,9 +731,12 @@ var SecurityWebhookEventTypeSchema = import_zod9.z.enum([
   "auth.suspicious_activity",
   "auth.email_verified",
   "auth.password_reset_requested",
-  "auth.password_reset_completed"
+  "auth.password_reset_completed",
+  "auth.password_changed",
+  "auth.email_change_requested",
+  "auth.email_changed"
 ]).describe(
-  "Account security signals. `auth.suspicious_activity` is a soft heuristic (login from an IP not seen on this account before), not a block \u2014 evaluate it, not enforce against it. `auth.password_reset_requested` only ever dispatches when the requested email actually matches an account (there is nowhere to notify otherwise) \u2014 `POST /v1/auth/forgot-password` itself always returns the same generic response either way, so this event never becomes a second channel for the same enumeration question the endpoint response deliberately avoids answering. `data` per event: `auth.login`: `{ userId, ipAddress }`; `auth.login_failed`: `{ email, ipAddress }`; `auth.suspicious_activity`: `{ userId, ipAddress, previousIpAddress }`; `auth.email_verified`/`auth.password_reset_requested`/`auth.password_reset_completed`: `{ userId, email }`."
+  "Account security signals. `auth.suspicious_activity` is a soft heuristic (login from an IP not seen on this account before), not a block \u2014 evaluate it, not enforce against it. `auth.password_reset_requested` only ever dispatches when the requested email actually matches an account (there is nowhere to notify otherwise) \u2014 `POST /v1/auth/forgot-password` itself always returns the same generic response either way, so this event never becomes a second channel for the same enumeration question the endpoint response deliberately avoids answering. `auth.password_changed` is the self-service counterpart to `auth.password_reset_completed` \u2014 fires from `POST /v1/auth/change-password` (requires the current password) instead of the unauthenticated forgot-password flow. `auth.email_change_requested`/`auth.email_changed` are the request/complete pair for `POST /v1/auth/change-email` \u2192 `POST /v1/auth/confirm-email-change` \u2014 the change only takes effect, and `email_changed` only fires, once the confirmation link sent to the *current* address is used. `data` per event: `auth.login`: `{ userId, ipAddress }`; `auth.login_failed`: `{ email, ipAddress }`; `auth.suspicious_activity`: `{ userId, ipAddress, previousIpAddress }`; `auth.email_verified`/`auth.password_reset_requested`/`auth.password_reset_completed`/`auth.password_changed`: `{ userId, email }`; `auth.email_change_requested`: `{ userId, email, newEmail }`; `auth.email_changed`: `{ userId, previousEmail, newEmail }`."
 );
 var WebhookEventTypeSchema = import_zod9.z.union([
   ChargeWebhookEventTypeSchema,
@@ -907,11 +922,26 @@ var ResetPasswordSchema = import_zod13.z.object({
 var MessageResponseSchema = import_zod13.z.object({
   message: import_zod13.z.string().describe("Human-readable confirmation, safe to show a user directly.")
 });
+var SelfUserSchema = UserSchema.omit({ createdAt: true, role: true });
 var AuthResponseSchema = import_zod13.z.object({
   token: import_zod13.z.string().describe(
     "Session JWT, valid 7 days \u2014 use as `Authorization: Bearer <token>` on every `/v1/organizations/*` request (which nests API keys, members, and invitations \u2014 see `GET /v1/organizations`). This token identifies only you; it carries no organization or role \u2014 every `/v1/organizations/{id}/*` request is authorized fresh against your actual membership in that specific organization. This is a separate credential from an API key: it authenticates a human/dashboard session, not payment operations. Create an API key with it before you can create charges."
   ),
-  user: UserSchema.omit({ createdAt: true, role: true })
+  user: SelfUserSchema
+});
+var ChangeNameSchema = import_zod13.z.object({
+  name: import_zod13.z.string().min(1).max(255).describe("Your display name.")
+});
+var ChangePasswordSchema = import_zod13.z.object({
+  currentPassword: import_zod13.z.string().min(1).max(128),
+  newPassword: import_zod13.z.string().min(8).max(128)
+});
+var ChangeEmailSchema = import_zod13.z.object({
+  currentPassword: import_zod13.z.string().min(1).max(128),
+  newEmail: NormalizedEmailSchema
+});
+var ConfirmEmailChangeSchema = import_zod13.z.object({
+  token: import_zod13.z.string().min(1).describe("The token from the confirmation email sent to your current address.")
 });
 
 // src/organization.ts
@@ -1105,6 +1135,9 @@ var CapabilitiesSchema = import_zod20.z.object({
   CHARGE_EXPIRES_IN_MAX_SECONDS,
   CHARGE_EXPIRES_IN_MIN_SECONDS,
   CapabilitiesSchema,
+  ChangeEmailSchema,
+  ChangeNameSchema,
+  ChangePasswordSchema,
   ChargeModeSchema,
   ChargeSchema,
   ChargeStatusEventSchema,
@@ -1113,6 +1146,7 @@ var CapabilitiesSchema = import_zod20.z.object({
   ChargesDateFieldSchema,
   ChargesMetricFieldSchema,
   ChargesQueryFieldSchema,
+  ConfirmEmailChangeSchema,
   CreateApiKeySchema,
   CreateChargeSchema,
   CreateWebhookSchema,
@@ -1124,6 +1158,7 @@ var CapabilitiesSchema = import_zod20.z.object({
   EnvironmentSchema,
   ErrorPayloadSchema,
   ForgotPasswordSchema,
+  GetChargeQrCodeQuerySchema,
   HealthSchema,
   InvitationSchema,
   InviteUserSchema,
@@ -1172,6 +1207,7 @@ var CapabilitiesSchema = import_zod20.z.object({
   SandboxEventTriggerSchema,
   SandboxTriggerSchema,
   SecurityWebhookEventTypeSchema,
+  SelfUserSchema,
   SettlementStatusSchema,
   SignupSchema,
   SplitDistributionStatusSchema,