@oxy.so/contracts 1.5.0 → 2.1.0

package/dist/types/oauth.d.ts

@@ -106,10 +106,10 @@ export declare const mcpOAuthClientApplicationSchema: z.ZodObject<{
     type: "system" | "internal" | "first_party" | "third_party";
     name: string;
     id: string;
-    clientId: string;
     isOfficial: boolean;
     isInternal: boolean;
     scopes: string[];
+    clientId: string;
     description?: string | undefined;
     icon?: string | undefined;
     websiteUrl?: string | undefined;
@@ -120,10 +120,10 @@ export declare const mcpOAuthClientApplicationSchema: z.ZodObject<{
     type: "system" | "internal" | "first_party" | "third_party";
     name: string;
     id: string;
-    clientId: string;
     isOfficial: boolean;
     isInternal: boolean;
     scopes: string[];
+    clientId: string;
     description?: string | undefined;
     icon?: string | undefined;
     websiteUrl?: string | undefined;
@@ -215,10 +215,10 @@ export declare const mcpOAuthConsentContextSchema: z.ZodObject<{
         type: "system" | "internal" | "first_party" | "third_party";
         name: string;
         id: string;
-        clientId: string;
         isOfficial: boolean;
         isInternal: boolean;
         scopes: string[];
+        clientId: string;
         description?: string | undefined;
         icon?: string | undefined;
         websiteUrl?: string | undefined;
@@ -229,10 +229,10 @@ export declare const mcpOAuthConsentContextSchema: z.ZodObject<{
         type: "system" | "internal" | "first_party" | "third_party";
         name: string;
         id: string;
-        clientId: string;
         isOfficial: boolean;
         isInternal: boolean;
         scopes: string[];
+        clientId: string;
         description?: string | undefined;
         icon?: string | undefined;
         websiteUrl?: string | undefined;
@@ -423,10 +423,10 @@ export declare const mcpOAuthConsentContextSchema: z.ZodObject<{
         type: "system" | "internal" | "first_party" | "third_party";
         name: string;
         id: string;
-        clientId: string;
         isOfficial: boolean;
         isInternal: boolean;
         scopes: string[];
+        clientId: string;
         description?: string | undefined;
         icon?: string | undefined;
         websiteUrl?: string | undefined;
@@ -471,10 +471,10 @@ export declare const mcpOAuthConsentContextSchema: z.ZodObject<{
         type: "system" | "internal" | "first_party" | "third_party";
         name: string;
         id: string;
-        clientId: string;
         isOfficial: boolean;
         isInternal: boolean;
         scopes: string[];
+        clientId: string;
         description?: string | undefined;
         icon?: string | undefined;
         websiteUrl?: string | undefined;
@@ -510,10 +510,10 @@ export declare const mcpOAuthClientInfoResponseSchema: z.ZodObject<{
         type: "system" | "internal" | "first_party" | "third_party";
         name: string;
         id: string;
-        clientId: string;
         isOfficial: boolean;
         isInternal: boolean;
         scopes: string[];
+        clientId: string;
         description?: string | undefined;
         icon?: string | undefined;
         websiteUrl?: string | undefined;
@@ -524,10 +524,10 @@ export declare const mcpOAuthClientInfoResponseSchema: z.ZodObject<{
         type: "system" | "internal" | "first_party" | "third_party";
         name: string;
         id: string;
-        clientId: string;
         isOfficial: boolean;
         isInternal: boolean;
         scopes: string[];
+        clientId: string;
         description?: string | undefined;
         icon?: string | undefined;
         websiteUrl?: string | undefined;
@@ -540,10 +540,10 @@ export declare const mcpOAuthClientInfoResponseSchema: z.ZodObject<{
         type: "system" | "internal" | "first_party" | "third_party";
         name: string;
         id: string;
-        clientId: string;
         isOfficial: boolean;
         isInternal: boolean;
         scopes: string[];
+        clientId: string;
         description?: string | undefined;
         icon?: string | undefined;
         websiteUrl?: string | undefined;
@@ -556,10 +556,10 @@ export declare const mcpOAuthClientInfoResponseSchema: z.ZodObject<{
         type: "system" | "internal" | "first_party" | "third_party";
         name: string;
         id: string;
-        clientId: string;
         isOfficial: boolean;
         isInternal: boolean;
         scopes: string[];
+        clientId: string;
         description?: string | undefined;
         icon?: string | undefined;
         websiteUrl?: string | undefined;
@@ -590,10 +590,10 @@ export declare const mcpOAuthConsentResponseSchema: z.ZodObject<{
             type: "system" | "internal" | "first_party" | "third_party";
             name: string;
             id: string;
-            clientId: string;
             isOfficial: boolean;
             isInternal: boolean;
             scopes: string[];
+            clientId: string;
             description?: string | undefined;
             icon?: string | undefined;
             websiteUrl?: string | undefined;
@@ -604,10 +604,10 @@ export declare const mcpOAuthConsentResponseSchema: z.ZodObject<{
             type: "system" | "internal" | "first_party" | "third_party";
             name: string;
             id: string;
-            clientId: string;
             isOfficial: boolean;
             isInternal: boolean;
             scopes: string[];
+            clientId: string;
             description?: string | undefined;
             icon?: string | undefined;
             websiteUrl?: string | undefined;
@@ -798,10 +798,10 @@ export declare const mcpOAuthConsentResponseSchema: z.ZodObject<{
             type: "system" | "internal" | "first_party" | "third_party";
             name: string;
             id: string;
-            clientId: string;
             isOfficial: boolean;
             isInternal: boolean;
             scopes: string[];
+            clientId: string;
             description?: string | undefined;
             icon?: string | undefined;
             websiteUrl?: string | undefined;
@@ -846,10 +846,10 @@ export declare const mcpOAuthConsentResponseSchema: z.ZodObject<{
             type: "system" | "internal" | "first_party" | "third_party";
             name: string;
             id: string;
-            clientId: string;
             isOfficial: boolean;
             isInternal: boolean;
             scopes: string[];
+            clientId: string;
             description?: string | undefined;
             icon?: string | undefined;
             websiteUrl?: string | undefined;
@@ -896,10 +896,10 @@ export declare const mcpOAuthConsentResponseSchema: z.ZodObject<{
             type: "system" | "internal" | "first_party" | "third_party";
             name: string;
             id: string;
-            clientId: string;
             isOfficial: boolean;
             isInternal: boolean;
             scopes: string[];
+            clientId: string;
             description?: string | undefined;
             icon?: string | undefined;
             websiteUrl?: string | undefined;
@@ -947,10 +947,10 @@ export declare const mcpOAuthConsentResponseSchema: z.ZodObject<{
             type: "system" | "internal" | "first_party" | "third_party";
             name: string;
             id: string;
-            clientId: string;
             isOfficial: boolean;
             isInternal: boolean;
             scopes: string[];
+            clientId: string;
             description?: string | undefined;
             icon?: string | undefined;
             websiteUrl?: string | undefined;

package/dist/types/sessionStatus.d.ts

@@ -180,11 +180,11 @@ export declare const sessionStatusSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     status: string;
     expiresAt?: string | undefined;
-    sessionId?: string | null | undefined;
-    userId?: string | null | undefined;
     publicKey?: string | null | undefined;
-    sessionToken?: string | undefined;
+    userId?: string | null | undefined;
+    sessionId?: string | null | undefined;
     authorized?: boolean | undefined;
+    sessionToken?: string | undefined;
     application?: {
         type: "system" | "internal" | "first_party" | "third_party";
         name: string;
@@ -205,11 +205,11 @@ export declare const sessionStatusSchema: z.ZodObject<{
 }, {
     status: string;
     expiresAt?: string | undefined;
-    sessionId?: string | null | undefined;
-    userId?: string | null | undefined;
     publicKey?: string | null | undefined;
-    sessionToken?: string | undefined;
+    userId?: string | null | undefined;
+    sessionId?: string | null | undefined;
     authorized?: boolean | undefined;
+    sessionToken?: string | undefined;
     application?: {
         type: "system" | "internal" | "first_party" | "third_party";
         name: string;

package/dist/types/userResponse.d.ts

@@ -1335,7 +1335,6 @@ export declare const deviceLinkedSessionSchema: z.ZodObject<{
     }, z.ZodTypeAny, "passthrough">>>>;
 }, "strip", z.ZodTypeAny, {
     sessionId: string;
-    isCurrent?: boolean | undefined;
     user?: z.objectOutputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -1438,9 +1437,9 @@ export declare const deviceLinkedSessionSchema: z.ZodObject<{
          */
         themePreference: z.ZodOptional<z.ZodType<ThemePreference, z.ZodTypeDef, ThemePreference>>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
+    isCurrent?: boolean | undefined;
 }, {
     sessionId: string;
-    isCurrent?: boolean | undefined;
     user?: z.objectInputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -1543,6 +1542,7 @@ export declare const deviceLinkedSessionSchema: z.ZodObject<{
          */
         themePreference: z.ZodOptional<z.ZodType<ThemePreference, z.ZodTypeDef, ThemePreference>>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
+    isCurrent?: boolean | undefined;
 }>;
 export type DeviceLinkedSessionResponse = z.infer<typeof deviceLinkedSessionSchema>;
 /** Wire shape of `GET /session/device/sessions/:sessionId` (an array). */
@@ -1855,7 +1855,6 @@ export declare const deviceLinkedSessionsResponseSchema: z.ZodArray<z.ZodObject<
     }, z.ZodTypeAny, "passthrough">>>>;
 }, "strip", z.ZodTypeAny, {
     sessionId: string;
-    isCurrent?: boolean | undefined;
     user?: z.objectOutputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -1958,9 +1957,9 @@ export declare const deviceLinkedSessionsResponseSchema: z.ZodArray<z.ZodObject<
          */
         themePreference: z.ZodOptional<z.ZodType<ThemePreference, z.ZodTypeDef, ThemePreference>>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
+    isCurrent?: boolean | undefined;
 }, {
     sessionId: string;
-    isCurrent?: boolean | undefined;
     user?: z.objectInputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -2063,6 +2062,7 @@ export declare const deviceLinkedSessionsResponseSchema: z.ZodArray<z.ZodObject<
          */
         themePreference: z.ZodOptional<z.ZodType<ThemePreference, z.ZodTypeDef, ThemePreference>>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
+    isCurrent?: boolean | undefined;
 }>, "many">;
 export type DeviceLinkedSessionsResponseContract = z.infer<typeof deviceLinkedSessionsResponseSchema>;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/contracts",
-  "version": "1.5.0",
+  "version": "2.1.0",
   "description": "OxyHQ API contracts — single source of truth for request/response Zod schemas and inferred types, shared by the backend and the client SDKs",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/dist/cjs/browserHub.js

@@ -1,215 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.hubAuthorizeResultSchema = exports.hubAuthorizeRequestSchema = exports.hubActivateRequestSchema = exports.hubClaimRequestSchema = exports.hubSessionSchema = exports.browserHubRevokeResponseSchema = exports.browserHubErrorSchema = exports.browserHubResolveResponseSchema = exports.browserHubHandleResponseSchema = exports.browserHubHandleRequestSchema = exports.browserHubHandleSchema = exports.BROWSER_HUB_HANDLE_TTL_MS = exports.BROWSER_HUB_COOKIE_ATTRIBUTES = exports.BROWSER_HUB_COOKIE_NAME = void 0;
-const zod_1 = require("zod");
-const deviceDirectory_1 = require("./deviceDirectory");
-/**
- * The browser DeviceSession hub at `auth.oxy.so` (issue #937, Phase 5, ADR 0003).
- *
- * Two wire surfaces live in this file and they are deliberately different
- * shapes, because they answer to different callers:
- *
- *  - The `browserHub*` schemas below the first divider are the API's
- *    (`api.oxy.so/session/browser-hub/*`), spoken ONLY by the IdP's own
- *    server/edge layer. They carry the raw handle and a bearer, so nothing that
- *    speaks them may run in a browser.
- *  - The `hub*` schemas below the second divider are the EDGE's
- *    (`auth.oxy.so/hub/*`), spoken by the IdP SPA. They carry neither: the
- *    handle stays in an `HttpOnly` cookie the script cannot read, and the
- *    device-wide bearer stays at the edge.
- *
- * That split is the whole point of the phase. A single schema covering both
- * would let a refactor move a credential across the boundary without any type
- * changing shape.
- *
- * ## What is NOT reopened here
- *
- * Relying-party origins remain zero-cookie: they keep `{deviceId,
- * deviceSecret}` + `POST /session/device/token` and set no cookie of any kind.
- * `auth.oxy.so` alone holds a handle, first-party only. There is no
- * refresh-token family and no bootstrap hop.
- */
-/* -------------------------------------------------------------------------- */
-/*  The cookie                                                                */
-/* -------------------------------------------------------------------------- */
-/**
- * The one cookie name, `__Host-` prefixed.
- *
- * The prefix is not decoration: a browser refuses to store a `__Host-` cookie
- * that carries a `Domain` attribute or a `Path` other than `/`, or that arrives
- * without `Secure`. So the name itself is what makes "bound to `auth.oxy.so`
- * alone, readable by no other `oxy.so` host" enforced by the client rather than
- * merely intended by the server — including against a compromised sibling
- * subdomain, which is the specific attack `Domain=.oxy.so` would have opened.
- */
-exports.BROWSER_HUB_COOKIE_NAME = '__Host-oxy-device';
-/**
- * The exact attribute set the edge sets, in the order it writes them.
- *
- * Held as data rather than as a template string so a test can assert the set
- * rather than a rendered line, and so removing one attribute is a diff to a
- * named constant instead of an edit inside a string literal.
- *
- * `Max-Age` is deliberately NOT in this list — see
- * {@link BROWSER_HUB_HANDLE_TTL_MS}, which the edge appends. Everything here is
- * a SECURITY attribute and none of them is ever conditional.
- */
-exports.BROWSER_HUB_COOKIE_ATTRIBUTES = ['Secure', 'HttpOnly', 'SameSite=Lax', 'Path=/'];
-/**
- * How long a hub handle lives, server-side and in the cookie alike.
- *
- * Thirty days. The cookie's `Max-Age` is derived from this same constant so the
- * two cannot disagree: a cookie outliving its credential produces a browser that
- * believes it is signed in and is refused on every call, and a credential
- * outliving its cookie leaves an un-addressable row alive on the server.
- *
- * A hub handle is NOT a session cookie (one with no `Max-Age`, discarded when
- * the browser closes). It cannot be: the thing it identifies is the browser
- * PROFILE's device session, and a device session that evaporates when the user
- * quits their browser would send them back to a QR scan every morning — the
- * exact failure ADR 0003 exists to remove.
- */
-exports.BROWSER_HUB_HANDLE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
-/* -------------------------------------------------------------------------- */
-/*  api.oxy.so/session/browser-hub/*  —  spoken by the edge, never a browser   */
-/* -------------------------------------------------------------------------- */
-/**
- * The raw handle, as it travels between the edge and the API.
- *
- * An opaque base64url random value and NOTHING else — no token, no user id, no
- * device id, no account id, no serialized state. The server stores only
- * `sha256(handle)`, so a dump of the column cannot address a browser.
- *
- * The minimum length is a floor against an empty or truncated value reaching a
- * hash comparison, not a statement about the entropy: that is fixed by the
- * issuer (`BROWSER_HUB_HANDLE_BYTES` in the API), and a handle is the only
- * credential in this flow, so it is 256 bits.
- */
-exports.browserHubHandleSchema = zod_1.z.string().min(32);
-/** Request body of every handle-presenting API endpoint. */
-exports.browserHubHandleRequestSchema = zod_1.z.object({
-    handle: exports.browserHubHandleSchema,
-});
-/**
- * Response of `POST /session/browser-hub/establish` and `.../rotate`.
- *
- * The raw handle is returned exactly ONCE, to the edge, which puts it straight
- * into the cookie and keeps no copy. It is never logged, never re-readable, and
- * never reaches the browser's script context.
- */
-exports.browserHubHandleResponseSchema = zod_1.z.object({
-    handle: exports.browserHubHandleSchema,
-    expiresAt: zod_1.z.string(),
-});
-/**
- * Response of `POST /session/browser-hub/resolve` — the browser's device
- * session, resolved from the handle alone.
- *
- * Carries a bearer because the edge needs one to run the authorize lane on the
- * browser's behalf. It is the ordinary short-lived access token of the device's
- * active context, and it stops at the edge.
- */
-exports.browserHubResolveResponseSchema = zod_1.z.object({
-    accessToken: zod_1.z.string().min(1),
-    expiresAt: zod_1.z.string(),
-    directory: deviceDirectory_1.deviceDirectorySchema,
-});
-/**
- * Why a handle did not resolve. A CLOSED set, and deliberately coarse.
- *
- *  - `invalid_handle`    — unknown, expired, or revoked. One code for all
- *                          three: distinguishing them would tell a caller
- *                          holding a guessed value whether it ever existed.
- *  - `no_active_session` — the handle is good and the device has nothing live
- *                          to mint for. The credential is NOT revoked; the
- *                          browser re-authenticates and keeps its cookie.
- */
-exports.browserHubErrorSchema = zod_1.z.enum(['invalid_handle', 'no_active_session']);
-/** Response of `POST /session/browser-hub/revoke`. Idempotent by construction. */
-exports.browserHubRevokeResponseSchema = zod_1.z.object({
-    revoked: zod_1.z.boolean(),
-});
-/* -------------------------------------------------------------------------- */
-/*  auth.oxy.so/hub/*  —  spoken by the IdP SPA                                */
-/* -------------------------------------------------------------------------- */
-/**
- * What the SPA is allowed to know about the hub session.
- *
- * `signed_out` covers "no cookie", "cookie present but the handle no longer
- * resolves" and "resolved, but the device has nothing live" — from the script's
- * side those are one state, and collapsing them here is what stops a UI from
- * branching on a distinction it must not act on.
- *
- * `active` carries the DIRECTORY and no credential. A switcher renders from it;
- * nothing in it can be spent against the API. The bearer that produced it never
- * left the edge.
- */
-exports.hubSessionSchema = zod_1.z.discriminatedUnion('status', [
-    zod_1.z.object({ status: zod_1.z.literal('signed_out') }),
-    zod_1.z.object({ status: zod_1.z.literal('active'), directory: deviceDirectory_1.deviceDirectorySchema }),
-]);
-/** Request body of `POST /hub/claim` — the Commons approval lane's handoff. */
-exports.hubClaimRequestSchema = zod_1.z.object({
-    /**
-     * The secret `sessionToken` of an approved `AuthSession`, held only by the
-     * page that created it. The edge spends it server-side: the access token and
-     * device secret the claim yields are consumed to establish the hub and are
-     * then discarded, so neither is ever returned to the script.
-     */
-    sessionToken: zod_1.z.string().min(1),
-});
-/** Request body of `POST /hub/activate` — pick the globally active context. */
-exports.hubActivateRequestSchema = zod_1.z.object({
-    contextId: zod_1.z.string().min(1),
-});
-/**
- * Request body of `POST /hub/authorize` — a later official origin joining.
- *
- * There is no `prompt` field, and that is not an omission. `'none'` is absent
- * from `buildOAuthAuthorizeUrl`'s union in `@oxy.so/core` precisely so a silent
- * loop cannot be rebuilt in one line, and this endpoint would be the second
- * place to rebuild it. A caller that needs a login or consent prompt gets one
- * by not passing `approve`.
- */
-exports.hubAuthorizeRequestSchema = zod_1.z.object({
-    clientId: zod_1.z.string().min(1),
-    redirectUri: zod_1.z.string().url(),
-    state: zod_1.z.string().optional(),
-    codeChallenge: zod_1.z.string().min(1),
-    /** S256 only. `plain` is refused before the request leaves the edge. */
-    codeChallengeMethod: zod_1.z.literal('S256'),
-    scope: zod_1.z.string().optional(),
-    /**
-     * The user's explicit answer on the consent screen.
-     *
-     * Absent or `false` means "tell me whether consent is needed"; the edge then
-     * returns `consent_required` and mints nothing. Only `true` may mint, and only
-     * the consent screen's own button sends it — which is why the decision of
-     * WHETHER consent is required is re-read from the server on both passes rather
-     * than remembered from the first.
-     */
-    approve: zod_1.z.boolean().optional(),
-});
-/**
- * Result of `POST /hub/authorize`.
- *
- * `signed_out` is the honest answer for a browser with no hub session: the SPA
- * runs the ordinary Commons-first authentication and tries again. It is never a
- * redirect the edge performs on the browser's behalf — no automatic chain
- * across Oxy origins, and nothing here can be hidden inside an iframe.
- */
-exports.hubAuthorizeResultSchema = zod_1.z.discriminatedUnion('status', [
-    zod_1.z.object({ status: zod_1.z.literal('signed_out') }),
-    zod_1.z.object({
-        status: zod_1.z.literal('consent_required'),
-        reason: zod_1.z.enum(['new', 'scope_changed']),
-        userConsentScopes: zod_1.z.array(zod_1.z.string()).optional(),
-    }),
-    zod_1.z.object({
-        status: zod_1.z.literal('code'),
-        code: zod_1.z.string().min(1),
-        state: zod_1.z.string().nullable(),
-        redirectUri: zod_1.z.string(),
-        expiresIn: zod_1.z.number().int().positive(),
-    }),
-]);