@oxy.so/contracts 1.2.0 → 1.4.0

package/dist/cjs/identity.js

@@ -15,8 +15,9 @@
  *  - DID = `did:web:oxy.so:u:<userId>` — anchored on the stable account id, NOT
  *    the keypair. The keypair is a *verification method* that maps 1:1 to the
  *    existing `authMethods[]`. Custodial (password-only) users get a DID
- *    controlled solely by Oxy (`OXY_DID`); creating a Commons key upgrades them
- *    to self-sovereign (`controller = [userDid, OXY_DID]`); fully reversible.
+ *    controlled solely by Oxy (`OXY_DID`); linking a root makes them
+ *    self-sovereign (`controller = [userDid]`, ADR 0024 D9). A root is never
+ *    unlinked back into a custodial account.
  *  - Verification methods use the secp256k1 `EcdsaSecp256k1VerificationKey2019`
  *    type with `publicKeyHex` for now (a `Multikey`/`publicKeyMultibase` form may
  *    be added later — see the plan's open risks).

package/dist/cjs/identityMove.js

@@ -1,37 +1,46 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.identityMoveStateSchema = exports.identityMoveReceiptRequestSchema = exports.identityMoveSealRequestSchema = exports.identityMoveJoinRequestSchema = exports.identityMoveCreateResponseSchema = exports.identityMoveCreateRequestSchema = exports.IDENTITY_MOVE_QR_PREFIX = exports.IDENTITY_MOVE_STATUSES = exports.identityMoveEphemeralKeySchema = exports.identityMoveIdSchema = exports.IDENTITY_MOVE_TTL_MS = void 0;
+exports.identityMoveStateSchema = exports.identityMoveReceiptRequestSchema = exports.identityMoveSealRequestSchema = exports.identityMoveRevealRequestSchema = exports.identityMoveJoinRequestSchema = exports.identityMoveCreateResponseSchema = exports.identityMoveCreateRequestSchema = exports.IDENTITY_MOVE_QR_PREFIX = exports.IDENTITY_MOVE_STATUSES = exports.identityMoveEphemeralKeySchema = exports.identityMoveIdSchema = exports.IDENTITY_MOVE_TTL_MS = void 0;
+exports.buildMoveCommitmentInput = buildMoveCommitmentInput;
+exports.buildMoveSasInput = buildMoveSasInput;
+exports.buildMoveCiphertextDigestInput = buildMoveCiphertextDigestInput;
+exports.buildMoveSealPayload = buildMoveSealPayload;
+exports.buildMoveReceiptMessage = buildMoveReceiptMessage;
 /**
- * Identity move contract — take a web identity INTO Commons (a MOVE, not a copy).
+ * Identity move contract — give a web root to Commons (add it, or keep it only in
+ * Commons; ADR 0024 D6).
  *
- * Design: `docs/superpowers/specs/2026-09-15-one-identity-two-carriers-design.md` §5.
+ * The web (holding the root) shows a QR carrying only a move id; Commons scans.
+ * The relay in between must not be able to take the root, so:
  *
- * Flow (the web — the OLD carrier — shows the QR; Commons — the NEW carrier —
- * scans it):
- *  1. `id.oxy.so` generates an ephemeral secp256k1 pair and calls
- *     `POST /identity/move { initiatorEphemeralPublicKey }` (bearer) →
- *     `{ moveId, expiresAt }`. The QR carries `moveId` only.
- *  2. Commons scans, generates its own ephemeral pair, and calls
- *     `POST /identity/move/:moveId/join { responderEphemeralPublicKey }` (no
- *     bearer — Commons has no identity yet).
- *  3. Both sides derive the same 6-digit SAS from the move id and BOTH ephemeral
- *     keys and show it. The person confirms on the web that they match. A relay
- *     that substituted either key produces two different codes.
- *  4. The web seals the BIP-39 entropy under
- *     `HKDF(ECDH(initiatorEph, responderEph), moveId, 'oxy-identity-move-v1')` and
- *     calls `POST /identity/move/:moveId/seal` (bearer + identity-key proof).
- *  5. Commons decrypts, imports the identity, and posts a RECEIPT: a signature by
- *     the identity key over `{ action:'identity_move_received', moveId, timestamp }`
- *     (`POST /identity/move/:moveId/receipt`). The server checks it against the
- *     account's key; the WEB verifies it again locally before destroying its copy,
- *     so not even the server can fake a completed move.
+ *  1. `POST /identity/move { initiatorCommitment }` — the web publishes only
+ *     `H(initiatorKey, nonce)`, never the key.
+ *  2. `POST /identity/move/:moveId/join { responderEphemeralPublicKey }` —
+ *     Commons, having read the commitment first, joins with its own key.
+ *  3. `POST /identity/move/:moveId/reveal` — only then does the web reveal its
+ *     key and nonce; Commons checks them against the commitment it read.
+ *  4. Both screens show a 6-digit code over `(moveId, both keys, commitment)`;
+ *     the person confirms on the web that they match.
+ *  5. `POST /identity/move/:moveId/seal` — the web seals the phrase entropy under
+ *     `HKDF(ECDH(both keys), moveId)`, authorized by a one-use root proof over the
+ *     exact sealed bytes.
+ *  6. `POST /identity/move/:moveId/receipt` — Commons stores the root, reads it
+ *     back from its keychain, and signs a receipt over the move, the root, both
+ *     keys and the digest of the ciphertext it opened. The server verifies it; the
+ *     web verifies it again from what IT sealed before removing anything.
  *
- * The server holds two ephemeral public keys, an opaque ciphertext, and a
- * receipt. It never holds anything that decrypts the ciphertext.
+ * Why the commitment: without it the relay sees both keys before committing to
+ * anything and can grind a substituted key until the two codes agree (~10⁶
+ * tries, seconds). With it, the relay must fix the key it shows Commons before
+ * learning Commons' key, and the key it shows the web before the web reveals.
+ *
+ * The server holds a commitment, two ephemeral public keys, an opaque ciphertext
+ * and a receipt — nothing that decrypts the ciphertext.
  *
  * Platform-agnostic — zod only, ESM-safe (no `require()`).
  */
 const zod_1 = require("zod");
+const identityProof_1 = require("./identityProof");
 /** A move lives this long: one interactive handoff. */
 exports.IDENTITY_MOVE_TTL_MS = 5 * 60 * 1000;
 /** 128-bit move id, lowercase hex. */
@@ -47,9 +56,13 @@ exports.identityMoveEphemeralKeySchema = zod_1.z
 exports.IDENTITY_MOVE_STATUSES = ['pending', 'joined', 'sealed', 'completed', 'cancelled', 'expired'];
 /** The QR payload Commons scans. Carries the move id only. */
 exports.IDENTITY_MOVE_QR_PREFIX = 'oxycommons://move?id=';
-exports.identityMoveCreateRequestSchema = zod_1.z.object({
-    initiatorEphemeralPublicKey: exports.identityMoveEphemeralKeySchema,
-});
+const hex64 = (label) => zod_1.z.string().trim().regex(/^[0-9a-f]{64}$/, `${label} must be 64 lowercase hex characters`);
+exports.identityMoveCreateRequestSchema = zod_1.z
+    .object({
+    /** `H(initiator ephemeral key, nonce)` — the key itself is revealed only after Commons joins. */
+    initiatorCommitment: hex64('initiatorCommitment'),
+})
+    .strict();
 exports.identityMoveCreateResponseSchema = zod_1.z.object({
     moveId: exports.identityMoveIdSchema,
     expiresAt: zod_1.z.string().datetime(),
@@ -57,29 +70,87 @@ exports.identityMoveCreateResponseSchema = zod_1.z.object({
 exports.identityMoveJoinRequestSchema = zod_1.z.object({
     responderEphemeralPublicKey: exports.identityMoveEphemeralKeySchema,
 });
-exports.identityMoveSealRequestSchema = zod_1.z.object({
+/** After Commons joined: the committed key and its nonce. */
+exports.identityMoveRevealRequestSchema = zod_1.z
+    .object({
+    initiatorEphemeralPublicKey: exports.identityMoveEphemeralKeySchema,
+    commitmentNonce: hex64('commitmentNonce'),
+})
+    .strict();
+exports.identityMoveSealRequestSchema = zod_1.z
+    .object({
     /** 24-byte XChaCha20-Poly1305 nonce, hex. */
     nonce: zod_1.z.string().trim().regex(/^[0-9a-f]{48}$/, 'nonce must be 48 lowercase hex characters'),
-    /** The 16-byte entropy, tag appended (32 bytes), hex. */
-    ciphertext: zod_1.z.string().trim().regex(/^[0-9a-f]{64}$/, 'ciphertext must be 64 lowercase hex characters'),
-    /** Identity-key proof over `{ action:'identity_move_seal', moveId, timestamp }`. */
-    signature: zod_1.z.string().trim().min(1).max(512),
-    timestamp: zod_1.z.number().int().positive(),
-});
-exports.identityMoveReceiptRequestSchema = zod_1.z.object({
-    /** Identity-key signature over `{ action:'identity_move_received', moveId, timestamp }`. */
+    /** The 16–32-byte phrase entropy (12–24 words), tag appended, hex. */
+    ciphertext: zod_1.z
+        .string()
+        .trim()
+        .regex(/^(?:[0-9a-f]{64}|[0-9a-f]{72}|[0-9a-f]{80}|[0-9a-f]{88}|[0-9a-f]{96})$/, 'ciphertext has an unsupported length'),
+    /**
+     * Root proof (`identity_move_seal`), payload `{ moveId, nonce, ciphertext }`,
+     * over a one-use challenge from `POST /identity/proof-challenge`.
+     */
+    proof: identityProof_1.identityProofSchema,
+})
+    .strict();
+exports.identityMoveReceiptRequestSchema = zod_1.z
+    .object({
+    /** Root signature over `buildMoveReceiptMessage(...)`. */
     signature: zod_1.z.string().trim().min(1).max(512),
-    timestamp: zod_1.z.number().int().positive(),
-});
+})
+    .strict();
 exports.identityMoveStateSchema = zod_1.z.object({
     moveId: exports.identityMoveIdSchema,
     status: zod_1.z.enum(exports.IDENTITY_MOVE_STATUSES),
+    initiatorCommitment: zod_1.z.string(),
+    initiatorCommitmentNonce: zod_1.z.string().nullable(),
     publicKey: zod_1.z.string().regex(/^04[0-9a-f]{128}$/),
-    initiatorEphemeralPublicKey: exports.identityMoveEphemeralKeySchema,
+    initiatorEphemeralPublicKey: exports.identityMoveEphemeralKeySchema.nullable(),
     responderEphemeralPublicKey: exports.identityMoveEphemeralKeySchema.nullable(),
     nonce: zod_1.z.string().nullable(),
     ciphertext: zod_1.z.string().nullable(),
     receiptSignature: zod_1.z.string().nullable(),
-    receiptTimestamp: zod_1.z.number().int().nullable(),
     expiresAt: zod_1.z.string().datetime(),
 });
+/**
+ * The initiator's commitment input, `canonicalJson({ v, purpose, key, nonce })`,
+ * which the caller hashes with SHA-256.
+ */
+function buildMoveCommitmentInput(initiatorEphemeralPublicKey, nonce) {
+    return (0, identityProof_1.canonicalJson)({
+        v: 2,
+        purpose: 'oxy-identity-move-initiator-commitment',
+        initiatorEphemeralPublicKey: initiatorEphemeralPublicKey.toLowerCase(),
+        nonce: nonce.toLowerCase(),
+    });
+}
+/** The bytes both sides hash for the 6-digit code. */
+function buildMoveSasInput(input) {
+    return (0, identityProof_1.canonicalJson)({
+        v: 'oxy-identity-transfer-sas-v2',
+        moveId: input.moveId.toLowerCase(),
+        initiator: input.initiatorEphemeralPublicKey.toLowerCase(),
+        responder: input.responderEphemeralPublicKey.toLowerCase(),
+        commitment: input.initiatorCommitment.toLowerCase(),
+    });
+}
+/** The ciphertext digest input the receipt binds: `canonicalJson({ nonce, ciphertext })`. */
+function buildMoveCiphertextDigestInput(sealed) {
+    return (0, identityProof_1.canonicalJson)({ nonce: sealed.nonce.toLowerCase(), ciphertext: sealed.ciphertext.toLowerCase() });
+}
+/** The payload a seal proof digests. */
+function buildMoveSealPayload(moveId, sealed) {
+    return { moveId: moveId.toLowerCase(), nonce: sealed.nonce.toLowerCase(), ciphertext: sealed.ciphertext.toLowerCase() };
+}
+/** The exact bytes a receipt signs. */
+function buildMoveReceiptMessage(input) {
+    return (0, identityProof_1.canonicalJson)({
+        v: 2,
+        domain: 'oxy-identity-move-receipt',
+        moveId: input.moveId.toLowerCase(),
+        rootPublicKey: input.rootPublicKey.toLowerCase(),
+        initiator: input.initiatorEphemeralPublicKey.toLowerCase(),
+        responder: input.responderEphemeralPublicKey.toLowerCase(),
+        ciphertextDigest: input.ciphertextDigest.toLowerCase(),
+    });
+}

package/dist/cjs/identityProof.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityRootStatusSchema = exports.IDENTITY_ERROR_CODES = exports.identityProofChallengeResponseSchema = exports.identityProofChallengeRequestSchema = exports.identityProofSchema = exports.IDENTITY_PROOF_ACTION_VALUES = exports.IDENTITY_PROOF_ACTIONS = exports.IDENTITY_PROOF_CHALLENGE_TTL_MS = exports.IDENTITY_PROOF_AUDIENCE = exports.IDENTITY_PROOF_DOMAIN = exports.IDENTITY_PROOF_VERSION = void 0;
+exports.canonicalJson = canonicalJson;
+exports.buildIdentityProofMessage = buildIdentityProofMessage;
+/**
+ * Identity proof contract — the ONE signed format for operations on a personal root.
+ *
+ * ADR 0024 D7. A proof is a signature by the root key over the canonical bytes
+ * of {@link IdentityProofClaims}. Every field the verifier cares about is IN the
+ * signed bytes, so a signature cannot be moved to another operation, account,
+ * root, payload, revision or audience, and the one-use `challenge` means it
+ * cannot be replayed either (a timestamp window is not replay protection).
+ *
+ * Both sides build the bytes with {@link buildIdentityProofMessage} and hash
+ * payloads with {@link canonicalJson}; neither writes its own JSON template, so
+ * the client and the verifier cannot drift apart.
+ *
+ * Platform-agnostic — zod only, ESM-safe (no `require()`), no hashing here (the
+ * caller hashes `canonicalJson(payload)` with SHA-256 using its platform's
+ * primitive and passes the hex digest in).
+ */
+const zod_1 = require("zod");
+exports.IDENTITY_PROOF_VERSION = 2;
+exports.IDENTITY_PROOF_DOMAIN = 'oxy-identity-proof';
+/** The audience every API-verified identity proof names. */
+exports.IDENTITY_PROOF_AUDIENCE = 'oxy-api/identity';
+/** How long a proof challenge lives: one interactive ceremony. */
+exports.IDENTITY_PROOF_CHALLENGE_TTL_MS = 5 * 60 * 1000;
+/**
+ * Everything a root proof may authorize. A challenge is minted for exactly one
+ * action and spent only by a proof for that action.
+ */
+exports.IDENTITY_PROOF_ACTIONS = {
+    /** A keyless account's FIRST root, stored with its web envelope. */
+    establish: 'web_envelope_establish',
+    /** Replace the web envelope (add or remove a wrap, re-seal). */
+    put: 'web_envelope_put',
+    /** Record that the recovery material is written down. */
+    phraseConfirmed: 'web_envelope_phrase_confirmed',
+    /** Record that the recovery material re-derived the root. */
+    recoveryVerified: 'web_envelope_recovery_verified',
+    /** Remove the web holder. */
+    delete: 'web_envelope_delete',
+    /** Link a keyless account's first root without a web envelope (`POST /auth/link`). */
+    link: 'link_identity',
+    /** Create a personal account together with its root (passkey sign-up). */
+    enroll: 'enroll_identity',
+    /** Prove the root to start signed-out recovery. */
+    recoverStart: 'recover_account_start',
+    /** Bind the new passkey and envelope when completing signed-out recovery. */
+    recoverComplete: 'recover_account_complete',
+    /** Seal the root for the Commons device that joined a move (payload: move id + sealed bytes). */
+    moveSeal: 'identity_move_seal',
+};
+exports.IDENTITY_PROOF_ACTION_VALUES = Object.values(exports.IDENTITY_PROOF_ACTIONS);
+const HEX_DIGEST = /^[0-9a-f]{64}$/;
+const ROOT_KEY = /^04[0-9a-f]{128}$/;
+const CHALLENGE = /^[0-9a-f]{64}$/;
+/**
+ * Canonical JSON: object keys sorted by UTF-16 code unit, no whitespace,
+ * `undefined` members omitted, arrays in order. Numbers must be finite. This is
+ * the ONLY serializer for anything digested into a proof.
+ */
+function canonicalJson(value) {
+    if (value === null)
+        return 'null';
+    switch (typeof value) {
+        case 'string':
+        case 'boolean':
+            return JSON.stringify(value);
+        case 'number':
+            if (!Number.isFinite(value))
+                throw new Error('canonicalJson: non-finite number');
+            return JSON.stringify(value);
+        case 'object': {
+            if (Array.isArray(value)) {
+                return `[${value.map((entry) => (entry === undefined ? 'null' : canonicalJson(entry))).join(',')}]`;
+            }
+            const record = value;
+            const keys = Object.keys(record)
+                .filter((key) => record[key] !== undefined)
+                .sort();
+            return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(',')}}`;
+        }
+        default:
+            throw new Error(`canonicalJson: unsupported ${typeof value}`);
+    }
+}
+/**
+ * The exact bytes a root signs. Throws on a malformed claim rather than signing
+ * (or verifying) something ambiguous.
+ */
+function buildIdentityProofMessage(claims) {
+    if (!exports.IDENTITY_PROOF_ACTION_VALUES.includes(claims.action))
+        throw new Error('identity proof: unknown action');
+    if (!claims.subject || !claims.actor)
+        throw new Error('identity proof: subject and actor are required');
+    if (!ROOT_KEY.test(claims.rootPublicKey))
+        throw new Error('identity proof: rootPublicKey must be canonical');
+    if (claims.payloadDigest !== null && !HEX_DIGEST.test(claims.payloadDigest)) {
+        throw new Error('identity proof: payloadDigest must be a lowercase SHA-256 hex digest');
+    }
+    if (claims.expectedRevision !== null && (!Number.isSafeInteger(claims.expectedRevision) || claims.expectedRevision < 0)) {
+        throw new Error('identity proof: expectedRevision must be a non-negative integer');
+    }
+    if (!CHALLENGE.test(claims.challenge))
+        throw new Error('identity proof: challenge must be 64 lowercase hex characters');
+    if (!Number.isSafeInteger(claims.expiresAt) || claims.expiresAt <= 0)
+        throw new Error('identity proof: expiresAt must be unix milliseconds');
+    return canonicalJson({
+        v: exports.IDENTITY_PROOF_VERSION,
+        domain: exports.IDENTITY_PROOF_DOMAIN,
+        action: claims.action,
+        subject: claims.subject,
+        actor: claims.actor,
+        rootPublicKey: claims.rootPublicKey,
+        payloadDigest: claims.payloadDigest,
+        expectedRevision: claims.expectedRevision,
+        audience: claims.audience,
+        challenge: claims.challenge,
+        expiresAt: claims.expiresAt,
+    });
+}
+/** The proof as it travels: the signature plus the two claims the verifier cannot derive. */
+exports.identityProofSchema = zod_1.z.object({
+    v: zod_1.z.literal(exports.IDENTITY_PROOF_VERSION),
+    challenge: zod_1.z.string().trim().regex(CHALLENGE, 'challenge must be 64 lowercase hex characters'),
+    expiresAt: zod_1.z.number().int().positive(),
+    signature: zod_1.z.string().trim().min(1).max(512),
+});
+/** `POST /identity/proof-challenge` */
+exports.identityProofChallengeRequestSchema = zod_1.z.object({
+    action: zod_1.z.enum(exports.IDENTITY_PROOF_ACTION_VALUES),
+});
+exports.identityProofChallengeResponseSchema = zod_1.z.object({
+    challenge: zod_1.z.string().regex(CHALLENGE),
+    expiresAt: zod_1.z.number().int().positive(),
+    audience: zod_1.z.string().min(1),
+});
+/**
+ * Stable error codes the root routes answer with (`error.code` in the API error
+ * body). Clients map these through their localization, never the English message.
+ */
+exports.IDENTITY_ERROR_CODES = {
+    proofInvalid: 'IDENTITY_PROOF_INVALID',
+    revisionConflict: 'IDENTITY_ENVELOPE_REVISION_CONFLICT',
+    rootAlreadyLinked: 'IDENTITY_ROOT_ALREADY_LINKED',
+    rootLinkedElsewhere: 'IDENTITY_ROOT_LINKED_ELSEWHERE',
+    noRoot: 'IDENTITY_NO_ROOT',
+    freshFactorRequired: 'IDENTITY_FRESH_FACTOR_REQUIRED',
+    lastWebHolder: 'IDENTITY_LAST_WEB_HOLDER',
+    enrollmentRequired: 'IDENTITY_ENROLLMENT_REQUIRED',
+    enrollmentInvalid: 'IDENTITY_ENROLLMENT_INVALID',
+    notPersonal: 'IDENTITY_NOT_PERSONAL_ACCOUNT',
+    recoveryFailed: 'IDENTITY_RECOVERY_FAILED',
+};
+exports.identityRootStatusSchema = zod_1.z.object({
+    rootLinked: zod_1.z.boolean(),
+    webHolder: zod_1.z.object({ passkeys: zod_1.z.number().int().nonnegative(), verifiedPasskeys: zod_1.z.number().int().nonnegative() }).nullable(),
+    hasPhrase: zod_1.z.boolean().nullable(),
+    phraseConfirmedAt: zod_1.z.string().datetime().nullable(),
+    recoveryVerifiedAt: zod_1.z.string().datetime().nullable(),
+});

package/dist/cjs/identityRecovery.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityRecoveryCompleteRequestSchema = exports.identityRecoveryStartRequestSchema = exports.identityRecoveryChallengeResponseSchema = exports.IDENTITY_RECOVERY_TTL_MS = void 0;
+/**
+ * Signed-out recovery contract (ADR 0024 D5) — get an EXISTING account back from
+ * its root alone, with no passkey, session or email.
+ *
+ *  1. `POST /identity/recovery/challenge` → a one-use challenge. It says nothing
+ *     about any account.
+ *  2. The holder derives the root locally from recovery material (12/24 words or a
+ *     raw key) and signs `recover_account_start` over that challenge:
+ *     `POST /identity/recovery/start { publicKey, proof }`. Only a valid proof
+ *     learns which account the root belongs to; the response carries passkey
+ *     registration options for THAT account and a short-lived ticket.
+ *  3. The holder creates the passkey, seals the root under it (PRF), and signs
+ *     `recover_account_complete` over the registration challenge and the envelope
+ *     digest: `POST /identity/recovery/complete`. The passkey, the envelope and a
+ *     session are created in one transaction.
+ *
+ * The recovery material and the root never leave the holder. Platform-agnostic —
+ * zod only, ESM-safe.
+ */
+const zod_1 = require("zod");
+const identityProof_1 = require("./identityProof");
+const webIdentityCarrier_1 = require("./webIdentityCarrier");
+/** A recovery attempt lives this long between steps. */
+exports.IDENTITY_RECOVERY_TTL_MS = 5 * 60 * 1000;
+exports.identityRecoveryChallengeResponseSchema = zod_1.z.object({
+    challenge: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
+    expiresAt: zod_1.z.number().int().positive(),
+});
+exports.identityRecoveryStartRequestSchema = zod_1.z
+    .object({
+    publicKey: webIdentityCarrier_1.webIdentityPublicKeySchema,
+    /** `recover_account_start`, subject `root:<publicKey>`, actor `anonymous`. */
+    proof: identityProof_1.identityProofSchema,
+})
+    .strict();
+exports.identityRecoveryCompleteRequestSchema = zod_1.z
+    .object({
+    ticket: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
+    /** The browser `RegistrationResponseJSON`, verified by the API's WebAuthn library. */
+    response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+    /** The root sealed under the new passkey — exactly one wrap, for that credential. */
+    envelope: webIdentityCarrier_1.webIdentityEnvelopeSchema,
+    /** `recover_account_complete`, subject = account id, actor `credential:<id>`, challenge = registration challenge (hex). */
+    proof: identityProof_1.identityProofSchema,
+    deviceName: zod_1.z.string().trim().max(100).optional(),
+    deviceFingerprint: zod_1.z.string().trim().max(512).optional(),
+})
+    .strict();