@ofidj/contracts 3.6.22 → 3.6.24

package/CHANGELOG.md

@@ -1,5 +1,21 @@
+## Sandbox build isolation
+
+- Compile contracts without ambient consumer test globals so nested checkouts build consistently under API and Angular workspaces.
+
 # Changelog
 
+- Add typed OIDC, organization/member/group/access and external-provider capability contracts.
+
+- Correct owner user-list payloads and expose closing-app status.
+
+- Add app groups, handler readiness and automatic erasure retry receipt contracts.
+
+- Connect generated app data export/erasure, durable retry state and scoped completion receipts.
+
+- Add shared-account password recovery and email verification integration.
+
+- Local scenario: include Fidj in privacy, distinguish platform membership, and connect Alex’s personal and Studio Notes owner journeys.
+
 All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
@@ -7,6 +23,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Local validation milestone (3.6.24)
+
+- Add app identity to consent responses and typed personal-app, export and erasure payloads.
+
 ## [3.6.22] - 2026-05-28
 
 ### Changed

package/README.md

@@ -32,3 +32,23 @@ npm run build          # Compile TypeScript
 npm run bp:style:fix   # Lint + format
 npm run bp:bump        # Version bump + git tag
 ```
+
+## Account lifecycle
+
+`FidjApiResetPasswordRequest` and `FidjApiVerifyEmailRequest` describe the one-use password reset and explicit email confirmation payloads. Recovery operates on the shared account; consent and erasure remain scoped to each app.
+
+App-data rights responses include optional `applicationData`, connection status and user-scoped `FidjApiPrivacyReceipt` records. App data and Fidj data have independent pending/completed outcomes.
+
+
+The development contracts include `FidjApiGroup`, owner group writes with an optimistic `version`, per-user group relationships, handler readiness, and erasure receipt retry/needs-attention states. Group member IDs identify app contracts, not global users.
+
+Authenticated `PUT /me` password changes require `{currentPassword, password}`. They apply the same password limits as reset, revoke existing sessions, and invalidate outstanding reset links. Sign in again after success. Name-only updates do not change credentials.
+
+
+Owner details include `deletionPending`. Owner user-list contracts now describe the actual limited profile/role objects and per-app consent summary, replacing the old string-only declarations. This is a coordinated development-contract correction.
+
+## Identity and tenant beta
+
+`FidjApiOidcConfiguration`, `FidjApiOrganization`, `FidjApiOrganizationAccess`, `FidjOrganizationMember`, `FidjOrganizationGroup` and `FidjApiExternalProvider` describe the coordinated identity expansion. Organization members identify app contracts; roles and suspension are tenant-scoped. External capability flags distinguish linking/revoking a Fidj grant from provider-account deletion, which is unsupported.
+
+App-session details may include authoritative `subject`, `username` and `appId` for an OIDC access token. Shared-account deletion now requires the principal session and `{confirm: 'delete-account'}`. Ordinary app sessions cannot change the global profile or enumerate other memberships.

package/bpInfo.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.bpInfo = void 0;
-exports.bpInfo = { version: 'v3.6.22' };
+exports.bpInfo = { version: 'v3.6.24' };
 //# sourceMappingURL=bpInfo.js.map

package/fidj-api/FidjApiAccountRecovery.d.ts

@@ -0,0 +1,7 @@
+export interface FidjApiResetPasswordRequest {
+    token: string;
+    password: string;
+}
+export interface FidjApiVerifyEmailRequest {
+    token: string;
+}

package/fidj-api/FidjApiAccountRecovery.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=FidjApiAccountRecovery.js.map

package/fidj-api/FidjApiAccountRecovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FidjApiAccountRecovery.js","sourceRoot":"","sources":["../../src/fidj-api/FidjApiAccountRecovery.ts"],"names":[],"mappings":""}

package/fidj-api/FidjApiAppsDetailsResponse.d.ts

@@ -5,11 +5,18 @@ export interface FidjApiAppsDetailsResponse {
         owner: string;
         title: string;
         description?: string;
-        rolesByDefault: string[];
-        rolesAvailable: string[];
-        homes?: string[];
-        githubs?: string[];
-        endpoints?: string[];
+        deletionPending?: boolean;
+        rolesByDefault: {
+            type: string;
+            description?: string;
+        }[];
+        rolesAvailable: {
+            type: string;
+            description?: string;
+        }[];
+        homes?: FidjApiAppUrl[];
+        githubs?: FidjApiAppUrl[];
+        endpoints?: FidjApiAppUrl[];
         urls?: FidjApiAppUrl[];
         tti_hours?: number;
         salt?: string;

package/fidj-api/FidjApiAppsMeDetailsResponse.d.ts

@@ -1,4 +1,12 @@
 export interface FidjApiAppsMeDetailsResponse {
+    subject?: string;
+    username?: string;
+    appId?: string;
+    groups?: {
+        id: string;
+        name: string;
+        roles: string[];
+    }[];
     roles: {
         type: string;
         description?: string;

package/fidj-api/FidjApiAppsUsersResponse.d.ts

@@ -1,7 +1,27 @@
 export interface FidjApiAppsUsersResponse {
     users: {
-        owner: string;
-        roles: string[];
+        _id: string;
+        owner: {
+            _id: string;
+            name: string;
+            username: string;
+            poc?: {
+                email?: string;
+            };
+            emailVerified?: boolean;
+        };
+        roles: {
+            _id?: string;
+            type: string;
+            description?: string;
+        }[];
         endDate?: string;
+        deletionPending?: boolean;
+        consent?: {
+            terms: boolean;
+            analytics: boolean;
+            communications: boolean;
+            optionalData: boolean;
+        } | null;
     }[];
 }

package/fidj-api/FidjApiConsentsResponse.d.ts

@@ -1,4 +1,5 @@
 export interface FidjApiConsentsResponse {
+    appId?: string;
     terms: boolean;
     termsVersion?: string;
     termsAcceptedAt?: string;

package/fidj-api/FidjApiGroups.d.ts

@@ -0,0 +1,16 @@
+export interface FidjApiGroup {
+    id: string;
+    name: string;
+    roles: string[];
+    members: string[];
+    version: number;
+}
+export interface FidjApiGroupsResponse {
+    groups: FidjApiGroup[];
+}
+export interface FidjApiGroupWriteRequest {
+    name: string;
+    roles: string[];
+    members: string[];
+    version?: number;
+}

package/fidj-api/FidjApiGroups.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=FidjApiGroups.js.map

package/fidj-api/FidjApiGroups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FidjApiGroups.js","sourceRoot":"","sources":["../../src/fidj-api/FidjApiGroups.ts"],"names":[],"mappings":""}

package/fidj-api/FidjApiPrivacyResponse.d.ts

@@ -0,0 +1,68 @@
+import { FidjApiConsentsResponse } from './FidjApiConsentsResponse';
+import { FidjApiConsentHistoryEntry } from './FidjApiConsentsHistoryResponse';
+export interface FidjApiPrivacyAppsResponse {
+    requests?: FidjApiPrivacyReceipt[];
+    apps: {
+        id: string;
+        title: string;
+        description?: string;
+        roles: string[];
+        owned: boolean;
+        platform: boolean;
+        deletionPending: boolean;
+        appDataConnected?: boolean;
+        consent: FidjApiConsentsResponse;
+    }[];
+}
+export interface FidjApiPrivacyErasureRequest {
+    confirm: string;
+}
+export interface FidjApiPrivacyErasureResponse {
+    requestId?: string;
+    appData?: 'completed' | 'pending' | 'not_connected';
+    status: 'completed' | 'pending';
+    appId: string;
+    coverage?: string;
+    message?: string;
+}
+export interface FidjApiPrivacyExportResponse {
+    applicationData?: Record<string, unknown>;
+    exportedAt: string;
+    coverage: string;
+    app: {
+        id: string;
+        title: string;
+    };
+    identity: {
+        name: string;
+        email?: string;
+    };
+    membership: {
+        roles: string[];
+        joinedAt?: string;
+        groups?: {
+            name: string;
+            roles: string[];
+        }[];
+    };
+    consent: FidjApiConsentsResponse;
+    history: FidjApiConsentHistoryEntry[];
+}
+export interface FidjApiPrivacyReceipt {
+    appTitle?: string;
+    nextAttemptAt?: string;
+    needsAttention?: boolean;
+    requestId: string;
+    appId: string;
+    status: 'completed' | 'pending';
+    appData: 'completed' | 'pending';
+    fidjData: 'completed' | 'pending';
+    completedAt?: string;
+}
+export interface FidjApiPrivacyReadinessResponse {
+    appId: string;
+    status: 'ready' | 'not_connected' | 'unavailable';
+    checkedAt: string;
+    capabilities: ('export' | 'erase')[];
+    message?: string;
+}

package/fidj-api/FidjApiPrivacyResponse.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=FidjApiPrivacyResponse.js.map

package/fidj-api/FidjApiPrivacyResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FidjApiPrivacyResponse.js","sourceRoot":"","sources":["../../src/fidj-api/FidjApiPrivacyResponse.ts"],"names":[],"mappings":""}

package/fidj-api/FidjApiUsersMeUpdateRequest.d.ts

@@ -1,4 +1,5 @@
 export interface FidjApiUsersMeUpdateRequest {
     password?: string;
+    currentPassword?: string;
     name?: string;
 }

package/fidj-api/identity.d.ts

@@ -0,0 +1,62 @@
+export interface FidjApiOidcConfiguration {
+    clientId: string;
+    redirectUris: string[];
+    enabled: boolean;
+    issuer: string | null;
+    termsUri?: string;
+    privacyUri?: string;
+    termsVersion?: string;
+}
+export type FidjOrganizationRole = 'Owner' | 'Administrator' | 'Editor' | 'Viewer';
+export interface FidjOrganizationMember {
+    contractId: string;
+    roles: FidjOrganizationRole[];
+    status: 'active' | 'suspended';
+}
+export interface FidjOrganizationGroup {
+    id?: string;
+    name: string;
+    roles: Array<'Editor' | 'Viewer'>;
+    members: string[];
+}
+export interface FidjApiOrganization {
+    id: string;
+    name: string;
+    version: number;
+    members: FidjOrganizationMember[];
+    groups: FidjOrganizationGroup[];
+}
+export interface FidjApiOrganizationAccess {
+    organization: {
+        id: string;
+        name: string;
+    };
+    access: {
+        roles: FidjOrganizationRole[];
+        permissions: string[];
+    };
+}
+export interface FidjApiExternalProvider {
+    id: 'google' | 'meta';
+    name: string;
+    connectAvailable: boolean;
+    status: 'connected' | 'disconnect_pending' | 'not_connected' | 'guidance_only';
+    capabilities: {
+        linkIdentity: boolean;
+        disconnectGrant: boolean;
+        deleteProviderAccount: false;
+    };
+    deleteAccountUrl: string;
+    scope: string;
+}
+export interface FidjApiOrganizationInvitationRequest {
+    email: string;
+    role: "Editor" | "Viewer";
+}
+export interface FidjApiOrganizationInvitationResponse {
+    invitationUrl: string;
+    expiresInDays: number;
+}
+export interface FidjApiDeleteAccountRequest {
+    confirm: "delete-account";
+}

package/fidj-api/identity.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=identity.js.map

package/fidj-api/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/fidj-api/identity.ts"],"names":[],"mappings":""}

package/fidj-api/index.d.ts

@@ -24,3 +24,7 @@ export * from './FidjApiContractsCreateRequest';
 export * from './FidjApiContractsUpdateRequest';
 export * from './FidjApiTokensCreateRequest';
 export * from './FidjApiTokensCreateResponse';
+export * from './FidjApiPrivacyResponse';
+export * from './FidjApiAccountRecovery';
+export * from './FidjApiGroups';
+export * from "./identity";

package/fidj-api/index.js

@@ -47,4 +47,8 @@ __exportStar(require("./FidjApiContractsUpdateRequest"), exports);
 // Tokens
 __exportStar(require("./FidjApiTokensCreateRequest"), exports);
 __exportStar(require("./FidjApiTokensCreateResponse"), exports);
+__exportStar(require("./FidjApiPrivacyResponse"), exports);
+__exportStar(require("./FidjApiAccountRecovery"), exports);
+__exportStar(require("./FidjApiGroups"), exports);
+__exportStar(require("./identity"), exports);
 //# sourceMappingURL=index.js.map

package/fidj-api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/fidj-api/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS;AACT,0DAAwC;AACxC,yDAAuC;AAEvC,OAAO;AACP,6DAA2C;AAC3C,8DAA4C;AAE5C,QAAQ;AACR,8DAA4C;AAC5C,+DAA6C;AAC7C,2DAAyC;AACzC,kEAAgD;AAChD,gEAA8C;AAC9C,8DAA4C;AAE5C,kBAAkB;AAClB,4DAA0C;AAC1C,iEAA+C;AAC/C,mEAAiD;AAEjD,OAAO;AACP,6DAA2C;AAC3C,8DAA4C;AAC5C,8DAA4C;AAC5C,+DAA6C;AAC7C,6DAA2C;AAC3C,6DAA2C;AAC3C,mEAAiD;AACjD,iEAA+C;AAE/C,YAAY;AACZ,iEAA+C;AAC/C,kEAAgD;AAChD,kEAAgD;AAEhD,SAAS;AACT,+DAA6C;AAC7C,gEAA8C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/fidj-api/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS;AACT,0DAAwC;AACxC,yDAAuC;AAEvC,OAAO;AACP,6DAA2C;AAC3C,8DAA4C;AAE5C,QAAQ;AACR,8DAA4C;AAC5C,+DAA6C;AAC7C,2DAAyC;AACzC,kEAAgD;AAChD,gEAA8C;AAC9C,8DAA4C;AAE5C,kBAAkB;AAClB,4DAA0C;AAC1C,iEAA+C;AAC/C,mEAAiD;AAEjD,OAAO;AACP,6DAA2C;AAC3C,8DAA4C;AAC5C,8DAA4C;AAC5C,+DAA6C;AAC7C,6DAA2C;AAC3C,6DAA2C;AAC3C,mEAAiD;AACjD,iEAA+C;AAE/C,YAAY;AACZ,iEAA+C;AAC/C,kEAAgD;AAChD,kEAAgD;AAEhD,SAAS;AACT,+DAA6C;AAC7C,gEAA8C;AAE9C,2DAAyC;AAEzC,2DAAyC;AAEzC,kDAAgC;AAEhC,6CAA2B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ofidj/contracts",
-  "version": "3.6.22",
+  "version": "3.6.24",
   "author": "contact@fidj.ovh",
   "description": "TypeScript API contracts for Fidj services - request/response interfaces for REST endpoints",
   "keywords": [
@@ -23,8 +23,8 @@
   "publishConfig": {
     "access": "public"
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "main": "./index.js",
+  "types": "./index.d.ts",
   "scripts": {
     "bp:_clean": "rm -rf package-lock.json node_modules .gen .logs .nyc_output .logs .output.txt .coverage .angular dist disti www && npm i",
     "bp:bump": "OLD_VERSION=\"v$(node -e \"console.log(require('./package.json').version)\")\" && VERSION=\"$(npm version patch --no-git-tag-version)\" && echo \"export const bpInfo = {version: '$VERSION'};\" > ./src/bpInfo.ts && git tag $OLD_VERSION && git checkout -b $VERSION && git push origin refs/heads/$VERSION:$VERSION --tags && git push --set-upstream origin $VERSION",