@oxy.so/contracts 2.1.0 → 2.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/.tsbuildinfo +1 -1
- package/dist/cjs/accountEmail.js +83 -0
- package/dist/cjs/identityLink.js +89 -0
- package/dist/cjs/identityProof.js +6 -29
- package/dist/cjs/index.js +35 -49
- package/dist/cjs/webauthn.js +50 -21
- package/dist/esm/.tsbuildinfo +1 -1
- package/dist/esm/accountEmail.js +80 -0
- package/dist/esm/identityLink.js +84 -0
- package/dist/esm/identityProof.js +6 -29
- package/dist/esm/index.js +7 -10
- package/dist/esm/webauthn.js +49 -20
- package/dist/types/.tsbuildinfo +1 -1
- package/dist/types/accountEmail.d.ts +98 -0
- package/dist/types/accountGraph.d.ts +4 -4
- package/dist/types/agency.d.ts +2 -2
- package/dist/types/deviceSession.d.ts +4 -4
- package/dist/types/externalIdentity.d.ts +8 -8
- package/dist/types/identityLink.d.ts +210 -0
- package/dist/types/identityProof.d.ts +15 -42
- package/dist/types/index.d.ts +6 -8
- package/dist/types/inference/accountBilling.d.ts +2 -2
- package/dist/types/inference/embeddings.d.ts +16 -16
- package/dist/types/inference/errors.d.ts +8 -8
- package/dist/types/inference/inbox.d.ts +8 -8
- package/dist/types/inference/providerConnection.d.ts +20 -20
- package/dist/types/inference/request.d.ts +16 -16
- package/dist/types/inference/streamEvents.d.ts +20 -20
- package/dist/types/keyRecovery.d.ts +4 -4
- package/dist/types/sessionStatus.d.ts +2 -2
- package/dist/types/userResponse.d.ts +4 -4
- package/dist/types/webauthn.d.ts +102 -214
- package/package.json +1 -1
- package/dist/cjs/identityMove.js +0 -156
- package/dist/cjs/identityRecovery.js +0 -51
- package/dist/cjs/webIdentityCarrier.js +0 -181
- package/dist/esm/identityMove.js +0 -148
- package/dist/esm/identityRecovery.js +0 -48
- package/dist/esm/webIdentityCarrier.js +0 -178
- package/dist/types/identityMove.d.ts +0 -185
- package/dist/types/identityRecovery.d.ts +0 -246
- package/dist/types/webIdentityCarrier.d.ts +0 -1130
|
@@ -0,0 +1,83 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.EMAIL_VERIFICATION_ERROR_CODES = exports.emailVerificationConfirmResponseSchema = exports.emailVerificationConfirmRequestSchema = exports.emailVerificationStartResponseSchema = exports.emailVerificationStartRequestSchema = exports.emailTicketSchema = exports.emailAddressSchema = exports.EMAIL_TICKET_TTL_MS = exports.EMAIL_CODE_MAX_ATTEMPTS = exports.EMAIL_CODE_TTL_MS = exports.EMAIL_CODE_LENGTH = exports.EMAIL_VERIFICATION_PURPOSES = void 0;
|
|
4
|
+
/**
|
|
5
|
+
* Recovery email contracts (ADR 0029 D3).
|
|
6
|
+
*
|
|
7
|
+
* A web account is a username, a passkey and a recovery email. The email is
|
|
8
|
+
* proven by a 6-digit code sent to it, and the proof is a short-lived one-use
|
|
9
|
+
* ticket the next step spends:
|
|
10
|
+
*
|
|
11
|
+
* - `signup`: the ticket lets `POST /webauthn/register/verify` create the
|
|
12
|
+
* account with that email;
|
|
13
|
+
* - `recovery`: the person names their username or email, the code goes to the
|
|
14
|
+
* account's recovery email, and the ticket lets them register a new passkey
|
|
15
|
+
* for that account.
|
|
16
|
+
*
|
|
17
|
+
* `start` answers the same whether or not an account exists, so neither purpose
|
|
18
|
+
* tells anyone which emails or usernames have an Oxy account. An account with a
|
|
19
|
+
* Commons key has no recovery email: it recovers in Commons.
|
|
20
|
+
*/
|
|
21
|
+
const zod_1 = require("zod");
|
|
22
|
+
exports.EMAIL_VERIFICATION_PURPOSES = ['signup', 'recovery'];
|
|
23
|
+
/** Digits in a code. */
|
|
24
|
+
exports.EMAIL_CODE_LENGTH = 6;
|
|
25
|
+
/** How long a code can be confirmed. */
|
|
26
|
+
exports.EMAIL_CODE_TTL_MS = 10 * 60 * 1000;
|
|
27
|
+
/** Wrong codes before a verification is spent and a new code is needed. */
|
|
28
|
+
exports.EMAIL_CODE_MAX_ATTEMPTS = 5;
|
|
29
|
+
/** How long a confirmed code's ticket can be spent. */
|
|
30
|
+
exports.EMAIL_TICKET_TTL_MS = 15 * 60 * 1000;
|
|
31
|
+
/** An email address as the API stores it: trimmed and lowercase. */
|
|
32
|
+
exports.emailAddressSchema = zod_1.z.string().trim().toLowerCase().min(3).max(254).email();
|
|
33
|
+
/** An opaque one-use ticket (32 random bytes, base64url). */
|
|
34
|
+
exports.emailTicketSchema = zod_1.z
|
|
35
|
+
.string()
|
|
36
|
+
.trim()
|
|
37
|
+
.regex(/^[A-Za-z0-9_-]{43}$/, 'ticket must be 32 bytes of base64url');
|
|
38
|
+
/** `POST /auth/email/verify/start` */
|
|
39
|
+
exports.emailVerificationStartRequestSchema = zod_1.z.discriminatedUnion('purpose', [
|
|
40
|
+
zod_1.z.object({ purpose: zod_1.z.literal('signup'), email: exports.emailAddressSchema }).strict(),
|
|
41
|
+
zod_1.z
|
|
42
|
+
.object({
|
|
43
|
+
purpose: zod_1.z.literal('recovery'),
|
|
44
|
+
/** The account's username, or its recovery email. */
|
|
45
|
+
identifier: zod_1.z.string().trim().min(1).max(254),
|
|
46
|
+
})
|
|
47
|
+
.strict(),
|
|
48
|
+
]);
|
|
49
|
+
exports.emailVerificationStartResponseSchema = zod_1.z.object({
|
|
50
|
+
verificationId: zod_1.z.string().min(1).max(64),
|
|
51
|
+
expiresAt: zod_1.z.number().int().positive(),
|
|
52
|
+
});
|
|
53
|
+
/** `POST /auth/email/verify/confirm` */
|
|
54
|
+
exports.emailVerificationConfirmRequestSchema = zod_1.z
|
|
55
|
+
.object({
|
|
56
|
+
verificationId: zod_1.z.string().trim().min(1).max(64),
|
|
57
|
+
code: zod_1.z
|
|
58
|
+
.string()
|
|
59
|
+
.trim()
|
|
60
|
+
.regex(new RegExp(`^\\d{${exports.EMAIL_CODE_LENGTH}}$`), `code must be ${exports.EMAIL_CODE_LENGTH} digits`),
|
|
61
|
+
})
|
|
62
|
+
.strict();
|
|
63
|
+
exports.emailVerificationConfirmResponseSchema = zod_1.z.object({
|
|
64
|
+
ticket: exports.emailTicketSchema,
|
|
65
|
+
expiresAt: zod_1.z.number().int().positive(),
|
|
66
|
+
username: zod_1.z.string().nullable(),
|
|
67
|
+
});
|
|
68
|
+
/**
|
|
69
|
+
* Stable error codes (`error.code` in the API error body). Clients map these
|
|
70
|
+
* through their localization, never the English message.
|
|
71
|
+
*/
|
|
72
|
+
exports.EMAIL_VERIFICATION_ERROR_CODES = {
|
|
73
|
+
/** The code is wrong, or its verification expired or was spent. */
|
|
74
|
+
codeInvalid: 'EMAIL_CODE_INVALID',
|
|
75
|
+
/** Too many wrong codes: request a new one. */
|
|
76
|
+
tooManyAttempts: 'EMAIL_CODE_TOO_MANY_ATTEMPTS',
|
|
77
|
+
/** The ticket is unknown, expired, spent, or for another email or purpose. */
|
|
78
|
+
ticketInvalid: 'EMAIL_TICKET_INVALID',
|
|
79
|
+
/** A sign-up without a confirmed recovery email. */
|
|
80
|
+
ticketRequired: 'EMAIL_TICKET_REQUIRED',
|
|
81
|
+
/** This server cannot send mail. */
|
|
82
|
+
unavailable: 'EMAIL_UNAVAILABLE',
|
|
83
|
+
};
|
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.identityLinkCompleteRequestSchema = exports.identityLinkOptionsRequestSchema = exports.identityLinkProofRequestSchema = exports.identityLinkStateSchema = exports.identityLinkCreateResponseSchema = exports.identityLinkIdSchema = exports.IDENTITY_LINK_QR_PREFIX = exports.IDENTITY_LINK_STATUSES = void 0;
|
|
4
|
+
exports.buildIdentityLinkQrPayload = buildIdentityLinkQrPayload;
|
|
5
|
+
exports.parseIdentityLinkQrPayload = parseIdentityLinkQrPayload;
|
|
6
|
+
/**
|
|
7
|
+
* Linking Commons to a passkey account (ADR 0029 D3) — the two-device relay.
|
|
8
|
+
*
|
|
9
|
+
* A passkey account links a Commons root once, and becomes self-custodied: its
|
|
10
|
+
* recovery email is deleted and its phrase in Commons is how it gets back in.
|
|
11
|
+
* The authority is the same as `POST /auth/link` (ADR 0024 D8): a root proof
|
|
12
|
+
* (`link_identity`) by the key Commons holds, and a fresh assertion by one of
|
|
13
|
+
* the account's passkeys over the SAME one-use challenge. Only the transport is
|
|
14
|
+
* new, because the two factors live on two devices:
|
|
15
|
+
*
|
|
16
|
+
* 1. auth.oxy.so (signed in) opens a link request → `{ linkId, challenge }`,
|
|
17
|
+
* shown as a QR (`oxycommons://link?id=…&c=…`).
|
|
18
|
+
* 2. Commons scans it, reads the request (the account's id and username),
|
|
19
|
+
* signs the root proof over the challenge and posts it with its key.
|
|
20
|
+
* 3. Both screens show the same 6-digit code, derived from the link id and
|
|
21
|
+
* that key (`deriveIdentityLinkCode` in `@oxy.so/core`); the person checks
|
|
22
|
+
* they match, so a photographed QR cannot slip another key in.
|
|
23
|
+
* 4. auth.oxy.so asserts the passkey over the challenge and completes: the
|
|
24
|
+
* account gains the root, loses the email, and Commons signs in with it.
|
|
25
|
+
*
|
|
26
|
+
* The server stores only the challenge's hash; the challenge travels in the QR.
|
|
27
|
+
*/
|
|
28
|
+
const zod_1 = require("zod");
|
|
29
|
+
const identityProof_1 = require("./identityProof");
|
|
30
|
+
const webauthn_1 = require("./webauthn");
|
|
31
|
+
exports.IDENTITY_LINK_STATUSES = ['pending', 'signed', 'completed', 'cancelled'];
|
|
32
|
+
/** The scheme and host Commons routes a link QR to. */
|
|
33
|
+
exports.IDENTITY_LINK_QR_PREFIX = 'oxycommons://link';
|
|
34
|
+
const LINK_ID = /^[0-9a-f]{32}$/;
|
|
35
|
+
const CHALLENGE = /^[0-9a-f]{64}$/;
|
|
36
|
+
exports.identityLinkIdSchema = zod_1.z.string().trim().regex(LINK_ID, 'linkId must be 32 lowercase hex characters');
|
|
37
|
+
/** The QR auth.oxy.so shows: the request's id and the challenge Commons signs. */
|
|
38
|
+
function buildIdentityLinkQrPayload(linkId, challenge) {
|
|
39
|
+
return `${exports.IDENTITY_LINK_QR_PREFIX}?id=${linkId}&c=${challenge}`;
|
|
40
|
+
}
|
|
41
|
+
/** The request a scanned code names, or `null` for anything that is not a link QR. */
|
|
42
|
+
function parseIdentityLinkQrPayload(raw) {
|
|
43
|
+
const value = raw.trim();
|
|
44
|
+
if (!value.startsWith(`${exports.IDENTITY_LINK_QR_PREFIX}?`))
|
|
45
|
+
return null;
|
|
46
|
+
// Parsed by hand: React Native's `URLSearchParams` does not implement `get`.
|
|
47
|
+
const params = new Map();
|
|
48
|
+
for (const pair of value.slice(exports.IDENTITY_LINK_QR_PREFIX.length + 1).split('&')) {
|
|
49
|
+
const separator = pair.indexOf('=');
|
|
50
|
+
if (separator > 0)
|
|
51
|
+
params.set(pair.slice(0, separator), pair.slice(separator + 1));
|
|
52
|
+
}
|
|
53
|
+
const linkId = params.get('id') ?? '';
|
|
54
|
+
const challenge = params.get('c') ?? '';
|
|
55
|
+
if (!LINK_ID.test(linkId) || !CHALLENGE.test(challenge))
|
|
56
|
+
return null;
|
|
57
|
+
return { linkId, challenge };
|
|
58
|
+
}
|
|
59
|
+
exports.identityLinkCreateResponseSchema = zod_1.z.object({
|
|
60
|
+
linkId: exports.identityLinkIdSchema,
|
|
61
|
+
challenge: zod_1.z.string().regex(CHALLENGE),
|
|
62
|
+
expiresAt: zod_1.z.number().int().positive(),
|
|
63
|
+
qrPayload: zod_1.z.string().startsWith(exports.IDENTITY_LINK_QR_PREFIX),
|
|
64
|
+
});
|
|
65
|
+
exports.identityLinkStateSchema = zod_1.z.object({
|
|
66
|
+
status: zod_1.z.enum(exports.IDENTITY_LINK_STATUSES),
|
|
67
|
+
userId: zod_1.z.string().min(1),
|
|
68
|
+
username: zod_1.z.string().nullable(),
|
|
69
|
+
publicKey: zod_1.z.string().nullable(),
|
|
70
|
+
audience: zod_1.z.string().min(1),
|
|
71
|
+
expiresAt: zod_1.z.number().int().positive(),
|
|
72
|
+
});
|
|
73
|
+
/** `POST /identity/link/:linkId/proof` — from Commons, no bearer. */
|
|
74
|
+
exports.identityLinkProofRequestSchema = zod_1.z
|
|
75
|
+
.object({
|
|
76
|
+
publicKey: zod_1.z
|
|
77
|
+
.string()
|
|
78
|
+
.trim()
|
|
79
|
+
.toLowerCase()
|
|
80
|
+
.regex(/^04[0-9a-f]{128}$/, 'publicKey must be an uncompressed secp256k1 key'),
|
|
81
|
+
proof: identityProof_1.identityProofSchema,
|
|
82
|
+
})
|
|
83
|
+
.strict();
|
|
84
|
+
/** `POST /identity/link/:linkId/options` — WebAuthn request options over the challenge. */
|
|
85
|
+
exports.identityLinkOptionsRequestSchema = zod_1.z
|
|
86
|
+
.object({ challenge: zod_1.z.string().trim().regex(CHALLENGE, 'challenge must be 64 lowercase hex characters') })
|
|
87
|
+
.strict();
|
|
88
|
+
/** `POST /identity/link/:linkId/complete` — the passkey assertion over the challenge. */
|
|
89
|
+
exports.identityLinkCompleteRequestSchema = zod_1.z.object({ assertion: webauthn_1.webauthnAssertionResponseSchema }).strict();
|
|
@@ -32,26 +32,12 @@ exports.IDENTITY_PROOF_CHALLENGE_TTL_MS = 5 * 60 * 1000;
|
|
|
32
32
|
* action and spent only by a proof for that action.
|
|
33
33
|
*/
|
|
34
34
|
exports.IDENTITY_PROOF_ACTIONS = {
|
|
35
|
-
/**
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
phraseConfirmed: 'web_envelope_phrase_confirmed',
|
|
41
|
-
/** Record that the recovery material re-derived the root. */
|
|
42
|
-
recoveryVerified: 'web_envelope_recovery_verified',
|
|
43
|
-
/** Remove the web holder. */
|
|
44
|
-
delete: 'web_envelope_delete',
|
|
45
|
-
/** Link a keyless account's first root without a web envelope (`POST /auth/link`). */
|
|
35
|
+
/**
|
|
36
|
+
* Link Commons' root to a passkey account that has none (`POST /auth/link`).
|
|
37
|
+
* The account becomes self-custodied and its recovery email is deleted
|
|
38
|
+
* (ADR 0029 D3).
|
|
39
|
+
*/
|
|
46
40
|
link: 'link_identity',
|
|
47
|
-
/** Create a personal account together with its root (passkey sign-up). */
|
|
48
|
-
enroll: 'enroll_identity',
|
|
49
|
-
/** Prove the root to start signed-out recovery. */
|
|
50
|
-
recoverStart: 'recover_account_start',
|
|
51
|
-
/** Bind the new passkey and envelope when completing signed-out recovery. */
|
|
52
|
-
recoverComplete: 'recover_account_complete',
|
|
53
|
-
/** Seal the root for the Commons device that joined a move (payload: move id + sealed bytes). */
|
|
54
|
-
moveSeal: 'identity_move_seal',
|
|
55
41
|
};
|
|
56
42
|
exports.IDENTITY_PROOF_ACTION_VALUES = Object.values(exports.IDENTITY_PROOF_ACTIONS);
|
|
57
43
|
const HEX_DIGEST = /^[0-9a-f]{64}$/;
|
|
@@ -144,21 +130,12 @@ exports.identityProofChallengeResponseSchema = zod_1.z.object({
|
|
|
144
130
|
*/
|
|
145
131
|
exports.IDENTITY_ERROR_CODES = {
|
|
146
132
|
proofInvalid: 'IDENTITY_PROOF_INVALID',
|
|
147
|
-
revisionConflict: 'IDENTITY_ENVELOPE_REVISION_CONFLICT',
|
|
148
133
|
rootAlreadyLinked: 'IDENTITY_ROOT_ALREADY_LINKED',
|
|
149
134
|
rootLinkedElsewhere: 'IDENTITY_ROOT_LINKED_ELSEWHERE',
|
|
150
|
-
noRoot: 'IDENTITY_NO_ROOT',
|
|
151
135
|
freshFactorRequired: 'IDENTITY_FRESH_FACTOR_REQUIRED',
|
|
152
|
-
lastWebHolder: 'IDENTITY_LAST_WEB_HOLDER',
|
|
153
|
-
enrollmentRequired: 'IDENTITY_ENROLLMENT_REQUIRED',
|
|
154
|
-
enrollmentInvalid: 'IDENTITY_ENROLLMENT_INVALID',
|
|
155
136
|
notPersonal: 'IDENTITY_NOT_PERSONAL_ACCOUNT',
|
|
156
|
-
recoveryFailed: 'IDENTITY_RECOVERY_FAILED',
|
|
157
137
|
};
|
|
158
138
|
exports.identityRootStatusSchema = zod_1.z.object({
|
|
159
139
|
rootLinked: zod_1.z.boolean(),
|
|
160
|
-
|
|
161
|
-
hasPhrase: zod_1.z.boolean().nullable(),
|
|
162
|
-
phraseConfirmedAt: zod_1.z.string().datetime().nullable(),
|
|
163
|
-
recoveryVerifiedAt: zod_1.z.string().datetime().nullable(),
|
|
140
|
+
recoveryEmail: zod_1.z.string().nullable(),
|
|
164
141
|
});
|
package/dist/cjs/index.js
CHANGED
|
@@ -29,13 +29,13 @@ exports.OXY_USER_INVALIDATION_CHANNEL = exports.inboxEmailPushDataSchema = expor
|
|
|
29
29
|
exports.vouchResultSchema = exports.personhoodStatusResultSchema = exports.personhoodBreakdownSchema = exports.personhoodVouchRecordSchema = exports.validationVoteResultSchema = exports.validationRequestSummarySchema = exports.validationOpenResultSchema = exports.validationOpenRequestSchema = exports.validationVerdictRecordSchema = exports.realLifeAttestationResultSchema = exports.realLifeAttestationRecordSchema = exports.signedPublicCardSchema = exports.publicCardSchema = exports.logPageResponseSchema = exports.chainHeadResponseSchema = exports.oxySignedRecordTypeSchema = exports.exportBundleSchema = exports.exportFinancialSectionSchema = exports.exportUsageReservationSchema = exports.exportLedgerEntrySchema = exports.exportUsageReceiptSchema = exports.exportAttestationSchema = exports.authMethodsResponseSchema = exports.authMethodEntrySchema = exports.domainVerificationInstructionsSchema = exports.resourceDomainOwnershipResponseSchema = exports.resourceDomainOwnershipRequestSchema = exports.domainVerificationRequestSchema = exports.verifiedDomainSchema = exports.signedRecordEnvelopeSchema = exports.didDocumentSchema = exports.didServiceSchema = exports.verificationMethodSchema = exports.appAffinityEventsIngestSchema = exports.appAffinityEventSchema = exports.appAffinityEventTypeSchema = exports.appUserSignalIngestSchema = exports.appInterestInputSchema = exports.appEndorsementInputSchema = exports.recommendationResponseSchema = exports.recommendationItemSchema = exports.recommendationCountSchema = exports.recommendationRequestSchema = exports.recommendationSignalWeightsSchema = exports.recommendationBoostSchema = exports.recommendationExcludeTypeSchema = exports.oxyUserInvalidationEventSchema = exports.isPublishedOxyUserChangeReason = exports.OXY_PUBLISHED_USER_CHANGE_REASONS = exports.OXY_USER_CHANGE_REASONS = void 0;
|
|
30
30
|
exports.moderationSeveritySchema = exports.APPLICATION_MODERATION_STANDINGS = exports.IDENTITY_BINDING_STATUSES = exports.IDENTITY_BINDING_TYPES = exports.PERSONHOOD_STATUSES = exports.CONTRIBUTION_TIERS = exports.CONDUCT_STANDINGS = exports.CONDUCT_STRIKE_STATUSES = exports.MODERATION_EFFECT_SKIP_REASONS = exports.MODERATION_EFFECT_STATUSES = exports.MODERATION_EFFECT_TYPES = exports.MODERATION_DECISION_STATUSES = exports.MODERATION_ATTRIBUTIONS = exports.MODERATION_FINDING_SCOPES = exports.MODERATION_SEVERITIES = exports.isFullReputationBalance = exports.reverseReputationTransactionSchema = exports.upsertReputationRuleSchema = exports.resolveReputationDisputeSchema = exports.createReputationDisputeSchema = exports.awardReputationSchema = exports.reverseReputationTransactionResultSchema = exports.reputationInfluenceResultSchema = exports.reputationLeaderboardEntrySchema = exports.reputationLeaderboardUserSchema = exports.reputationRuleSchema = exports.reputationDisputeSchema = exports.reputationBalanceSchema = exports.reputationBalanceSummarySchema = exports.reputationReliabilitySchema = exports.reputationInfluenceSchema = exports.reputationBalanceBreakdownSchema = exports.reputationTransactionSchema = exports.reputationInfluenceContextSchema = exports.reputationDisputeStatusSchema = exports.reputationTargetEntityTypeSchema = exports.trustTierSchema = exports.reputationTransactionStatusSchema = exports.reputationCategorySchema = exports.REPUTATION_INFLUENCE_CONTEXTS = exports.REPUTATION_DISPUTE_STATUSES = exports.REPUTATION_TARGET_ENTITY_TYPES = exports.TRUST_TIERS = exports.REPUTATION_TRANSACTION_STATUSES = exports.REPUTATION_CATEGORIES = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = void 0;
|
|
31
31
|
exports.deviceActivateResponseSchema = exports.deviceActivateRequestSchema = exports.deviceDirectorySchema = exports.devicePrincipalSchema = exports.deviceAccountContextSchema = exports.deviceDirectoryProfileSchema = exports.deviceContextRelationshipSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceBackgroundTokenResponseSchema = exports.deviceBackgroundTokenRequestSchema = exports.deviceBackgroundCredentialResponseSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.applicationModerationTrustSchema = exports.reputationContextualInfluenceSchema = exports.reputationReviewingSchema = exports.reputationReportingSchema = exports.reputationConductSchema = exports.reputationContributionSchema = exports.reputationPersonhoodSchema = exports.identityBindingSchema = exports.registerIdentityBindingSchema = exports.reverseModerationEffectResultSchema = exports.applyModerationDecisionResultSchema = exports.moderationEffectSchema = exports.reverseModerationEffectSchema = exports.finalizeModerationDecisionSchema = exports.moderationDecisionEventSchema = exports.moderationPolicyVersionsSchema = exports.moderationDecisionEventSubjectSchema = exports.moderationFindingSchema = exports.applicationModerationStandingSchema = exports.identityBindingStatusSchema = exports.identityBindingTypeSchema = exports.personhoodStatusSchema = exports.contributionTierSchema = exports.conductStandingSchema = exports.conductStrikeStatusSchema = exports.moderationEffectSkipReasonSchema = exports.moderationEffectStatusSchema = exports.moderationEffectTypeSchema = exports.moderationDecisionStatusSchema = exports.moderationAttributionSchema = exports.moderationFindingScopeSchema = void 0;
|
|
32
|
-
exports.
|
|
33
|
-
exports.
|
|
34
|
-
exports.
|
|
35
|
-
exports.
|
|
36
|
-
exports.
|
|
37
|
-
exports.
|
|
38
|
-
exports.inboxInferenceStreamEventSchema = exports.inboxThreadSummaryResponseSchema = exports.inboxSmartRepliesResponseSchema = exports.inboxNaturalSearchResponseSchema = exports.inboxInferenceTextResponseSchema = exports.inboxMessageInferenceParamsSchema = exports.inboxNaturalSearchRequestSchema = exports.inboxDailyBriefRequestSchema = exports.inboxComposeRequestSchema = exports.emailAgentContextSchema = exports.emailContextMessageSchema = exports.emailContextMailboxSchema = exports.emailContextAddressSchema = exports.normalizedAppEventSchema = exports.catalogRegistrationSchema = exports.appCapabilityCatalogSchema = exports.catalogEventSchema = exports.catalogToolSchema = exports.auditEventSchema =
|
|
32
|
+
exports.channelListResponseSchema = exports.channelSchema = exports.rollbackToEmbeddedEntrySchema = exports.createUpdateResponseSchema = exports.updateSchema = exports.createUpdateRequestSchema = exports.updateAssetRefSchema = exports.assetCompleteResponseSchema = exports.assetCompleteResultItemSchema = exports.assetCompleteRequestSchema = exports.assetInitResponseSchema = exports.assetUploadTicketSchema = exports.assetInitRequestSchema = exports.assetInitItemSchema = exports.rolloutPercentSchema = exports.runtimeVersionSchema = exports.channelNameSchema = exports.sha256HexSchema = exports.updateAssetStatusSchema = exports.updateStatusSchema = exports.updatePlatformSchema = exports.identityRootStatusSchema = exports.identityProofChallengeResponseSchema = exports.identityProofChallengeRequestSchema = exports.identityProofSchema = exports.buildIdentityProofMessage = exports.canonicalJson = exports.IDENTITY_ERROR_CODES = exports.IDENTITY_PROOF_ACTION_VALUES = exports.IDENTITY_PROOF_ACTIONS = exports.IDENTITY_PROOF_CHALLENGE_TTL_MS = exports.IDENTITY_PROOF_AUDIENCE = exports.IDENTITY_PROOF_DOMAIN = exports.IDENTITY_PROOF_VERSION = exports.backupStatusResponseSchema = exports.backupUploadRequestSchema = exports.encryptedBackupEnvelopeSchema = exports.backupLookupIdSchema = exports.rotateKeyCompleteResponseSchema = exports.rotateKeyCompleteRequestSchema = exports.rotateKeyChallengeResponseSchema = exports.loginResultSchema = exports.mcpOAuthConsentResponseSchema = exports.mcpOAuthClientInfoResponseSchema = exports.mcpOAuthConsentContextSchema = exports.mcpOAuthWriteActionSchema = exports.mcpOAuthClientApplicationSchema = exports.oauthAuthorizeCodeResponseSchema = exports.oauthConsentDecisionSchema = exports.deviceDirectorySyncSchema = void 0;
|
|
33
|
+
exports.inferenceHttpsUrlSchema = exports.inferenceDateSchema = exports.inferenceTimestampSchema = exports.inferenceEnvironmentSchema = exports.idempotencyKeySchema = exports.generationIdSchema = exports.requestIdSchema = exports.oxyCredentialIdSchema = exports.oxyApplicationIdSchema = exports.delegatedUserIdSchema = exports.oxyAccountIdSchema = exports.INFERENCE_CONTRACT_VERSION = exports.transparencyCheckpointListSchema = exports.transparencyInclusionProofSchema = exports.transparencyCheckpointSchema = exports.transparencyAnchorSchema = exports.transparencyCheckpointSignatureSchema = exports.identityLinkCompleteRequestSchema = exports.identityLinkOptionsRequestSchema = exports.identityLinkProofRequestSchema = exports.identityLinkStateSchema = exports.identityLinkCreateResponseSchema = exports.parseIdentityLinkQrPayload = exports.buildIdentityLinkQrPayload = exports.identityLinkIdSchema = exports.IDENTITY_LINK_QR_PREFIX = exports.IDENTITY_LINK_STATUSES = exports.emailVerificationConfirmResponseSchema = exports.emailVerificationConfirmRequestSchema = exports.emailVerificationStartResponseSchema = exports.emailVerificationStartRequestSchema = exports.emailTicketSchema = exports.emailAddressSchema = exports.EMAIL_VERIFICATION_ERROR_CODES = exports.EMAIL_TICKET_TTL_MS = exports.EMAIL_CODE_MAX_ATTEMPTS = exports.EMAIL_CODE_TTL_MS = exports.EMAIL_CODE_LENGTH = exports.EMAIL_VERIFICATION_PURPOSES = exports.webauthnAssertionResponseSchema = exports.webauthnCredentialIdSchema = exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.updateRolloutPatchSchema = exports.promoteRequestSchema = exports.rollbackToEmbeddedRequestSchema = exports.rollbackRequestSchema = exports.updateListResponseSchema = void 0;
|
|
34
|
+
exports.commercialPermissionSchema = exports.availabilityScopeSchema = exports.inferenceDataPolicySchema = exports.modelProvenanceSchema = exports.modelLicenseSchema = exports.modelCapabilitiesSchema = exports.reasoningEffortSchema = exports.inferenceModalitySchema = exports.priceSnapshotSchema = exports.priceVersionSchema = exports.priceVersionStatusSchema = exports.embeddingResponseSchema = exports.embeddingFailureSchema = exports.embeddingSuccessSchema = exports.embeddingUsageSchema = exports.embeddingVectorSchema = exports.inferenceErrorSchema = exports.providerErrorPassthroughSchema = exports.safeErrorTextSchema = exports.upstreamErrorCategorySchema = exports.inferenceErrorCodeSchema = exports.NON_RETRYABLE_INFERENCE_ERROR_CODES = exports.INFERENCE_ERROR_CODES = exports.inferenceAttributionSchema = exports.authenticatedPrincipalSchema = exports.billingPrincipalSchema = exports.inferenceScopeSchema = exports.INFERENCE_SCOPES = exports.unitPriceSchema = exports.usageQuantitySchema = exports.usageSourceSchema = exports.USAGE_SOURCES = exports.usageUnitSchema = exports.USAGE_UNITS = exports.moneySchema = exports.exactDecimalSchema = exports.INFERENCE_MONEY_SCALE = exports.currencyCodeSchema = exports.RESERVED_ALIA_PUBLISHER = exports.inferenceRegionSchema = exports.deploymentIdSchema = exports.inferenceProviderSlugSchema = exports.routingProfileSlugSchema = exports.routingProfileIdSchema = exports.modelReferenceSchema = exports.modelRevisionLabelSchema = exports.modelIdSchema = exports.modelSlugSchema = exports.publisherSlugSchema = exports.sha256DigestSchema = void 0;
|
|
35
|
+
exports.MAX_INFERENCE_AUDIO_BYTES = exports.inferenceAudioMediaTypeSchema = exports.inferenceStreamDeltaEventSchema = exports.inferenceStreamStartEventSchema = exports.inferenceSpeechParametersSchema = exports.inferenceRequestSchema = exports.clientRequestMetadataSchema = exports.responseFormatSchema = exports.toolChoiceSchema = exports.toolDefinitionSchema = exports.inferenceReasoningSchema = exports.samplingParametersSchema = exports.inferenceInputSchema = exports.inferenceMessageSchema = exports.inferenceMessageRoleSchema = exports.inferenceToolCallSchema = exports.inferenceContentPartSchema = exports.inferenceContentSourceSchema = exports.modelDocumentationSchema = exports.modelReleaseIngestionResultSchema = exports.modelReleaseIngestionRequestSchema = exports.modelLineDeclarationSchema = exports.modelGpaiDocumentationSchema = exports.modelDownstreamDocumentationSchema = exports.SYSTEMIC_RISK_COMPUTE_THRESHOLD_FLOPS = exports.trainingComputeFlopsSchema = exports.modelSystemicRiskTierSchema = exports.modelDistributionMethodSchema = exports.aliaModelReleaseManifestSchema = exports.aliaReleaseSignatureSchema = exports.aliaReleaseArtifactSchema = exports.authorizedRouteSchema = exports.routingPolicyReferenceSchema = exports.routingPolicySchema = exports.routingFallbackPolicySchema = exports.routingPolicyScopeSchema = exports.routingTargetSchema = exports.modelCatalogueEntrySchema = exports.catalogueServingProviderSummarySchema = exports.cataloguePublisherSummarySchema = exports.routingProfileSchema = exports.routingProfileCandidateSchema = exports.modelDeploymentSchema = exports.inferenceProviderSchema = exports.modelRevisionSchema = exports.catalogueModelSchema = exports.modelPublisherSchema = exports.modelSafetyMetadataSchema = exports.modelEvaluationResultSchema = exports.modelDeprecationSchema = void 0;
|
|
36
|
+
exports.autoRechargeSchema = exports.billingProfileStatusSchema = exports.BILLING_PROFILE_STATUSES = exports.billingModeSchema = exports.BILLING_MODES = exports.providerConnectionSchema = exports.providerConnectionStatusSchema = exports.providerConnectionValidationSchema = exports.providerCredentialCustodyStateSchema = exports.providerCredentialValidationDeploymentSchema = exports.providerCredentialValidationOperationSchema = exports.kaanaCredentialValidationOutcomeSchema = exports.kaanaCredentialValidationFailureCodeSchema = exports.kaanaCredentialValidationOutcomeStateSchema = exports.kaanaCredentialValidationTaskSchema = exports.kaanaCredentialOutcomeSchema = exports.kaanaCredentialConflictOutcomeSchema = exports.kaanaCredentialAppliedOutcomeSchema = exports.kaanaCredentialOutcomeRequestSchema = exports.kaanaCredentialRevokeOutcomeRequestSchema = exports.kaanaCredentialRotateOutcomeRequestSchema = exports.kaanaCredentialCreateOutcomeRequestSchema = exports.kaanaCredentialMutationSchema = exports.kaanaCredentialRevokeMutationSchema = exports.kaanaCredentialRotateMutationSchema = exports.kaanaCredentialCreateMutationSchema = exports.kaanaCredentialIdentitySchema = exports.kaanaCredentialOperationActionSchema = exports.kaanaCredentialOperationIdSchema = exports.kaanaCredentialHandleSchema = exports.providerConnectionScopeSchema = exports.usageRefundSchema = exports.usageRefundReasonSchema = exports.usageRefundSubjectSchema = exports.usageReceiptSchema = exports.normalizedUsageReportSchema = exports.inferenceRequestOutcomeSchema = exports.usageReservationSchema = exports.usageReservationStatusSchema = exports.usageReservationRequestSchema = exports.inferenceStreamEventSchema = exports.inferenceStreamDoneEventSchema = exports.inferenceFinishReasonSchema = exports.inferenceStreamErrorEventSchema = exports.inferenceStreamRouteSwitchEventSchema = exports.inferenceRouteSwitchReasonSchema = exports.inferenceRouteSwitchDetailSchema = exports.inferenceStreamUsageEventSchema = exports.inferenceStreamToolCallEventSchema = exports.inferenceStreamAudioEventSchema = void 0;
|
|
37
|
+
exports.auditResultSchema = exports.policyDecisionSchema = exports.capabilityTicketClaimsSchema = exports.automationDefinitionSchema = exports.automationDataFlowSchema = exports.automationActorSelectionSchema = exports.automationTriggerSchema = exports.delegationGrantSchema = exports.capabilityCoordinatorSchema = exports.executionAuthorizationRefSchema = exports.capabilityCatalogBindingSchema = exports.grantLimitSchema = exports.toolGrantOverrideSchema = exports.resourceRefSchema = exports.actorRefSchema = exports.capabilityPackageSchema = exports.autonomyLevelSchema = exports.CAPABILITY_PACKAGES = exports.AUTONOMY_LEVELS = exports.productEntitlementSchema = exports.costCenterSpendSchema = exports.costCenterSchema = exports.costCenterStatusSchema = exports.COST_CENTER_STATUSES = exports.payAsYouGoEntitlementSchema = exports.productPlanSchema = exports.planAllowanceSchema = exports.LIVE_PRODUCT_PLAN_STATUSES = exports.productPlanStatusSchema = exports.PRODUCT_PLAN_STATUSES = exports.reconciliationReportSchema = exports.reconciliationRunSchema = exports.reconciliationDiscrepancySchema = exports.reconciliationRunStatusSchema = exports.RECONCILIATION_RUN_STATUSES = exports.reconciliationDiscrepancyKindSchema = exports.RECONCILIATION_DISCREPANCY_KINDS = exports.autoRechargeAttemptSchema = exports.autoRechargeStatusSchema = exports.AUTO_RECHARGE_STATUSES = exports.externalPaymentSchema = exports.externalPaymentKindSchema = exports.EXTERNAL_PAYMENT_KINDS = exports.externalPaymentProviderSchema = exports.EXTERNAL_PAYMENT_PROVIDERS = exports.billingInvoiceSchema = exports.billingInvoiceStatusSchema = exports.BILLING_INVOICE_STATUSES = exports.accountBillingStateSchema = exports.billingProfileSchema = void 0;
|
|
38
|
+
exports.inboxInferenceStreamEventSchema = exports.inboxThreadSummaryResponseSchema = exports.inboxSmartRepliesResponseSchema = exports.inboxNaturalSearchResponseSchema = exports.inboxInferenceTextResponseSchema = exports.inboxMessageInferenceParamsSchema = exports.inboxNaturalSearchRequestSchema = exports.inboxDailyBriefRequestSchema = exports.inboxComposeRequestSchema = exports.emailAgentContextSchema = exports.emailContextMessageSchema = exports.emailContextMailboxSchema = exports.emailContextAddressSchema = exports.normalizedAppEventSchema = exports.catalogRegistrationSchema = exports.appCapabilityCatalogSchema = exports.catalogEventSchema = exports.catalogToolSchema = exports.auditEventSchema = void 0;
|
|
39
39
|
var accountGraph_1 = require("./accountGraph");
|
|
40
40
|
Object.defineProperty(exports, "ACCOUNT_KINDS", { enumerable: true, get: function () { return accountGraph_1.ACCOUNT_KINDS; } });
|
|
41
41
|
Object.defineProperty(exports, "accountKindSchema", { enumerable: true, get: function () { return accountGraph_1.accountKindSchema; } });
|
|
@@ -299,23 +299,6 @@ Object.defineProperty(exports, "backupLookupIdSchema", { enumerable: true, get:
|
|
|
299
299
|
Object.defineProperty(exports, "encryptedBackupEnvelopeSchema", { enumerable: true, get: function () { return keyRecovery_1.encryptedBackupEnvelopeSchema; } });
|
|
300
300
|
Object.defineProperty(exports, "backupUploadRequestSchema", { enumerable: true, get: function () { return keyRecovery_1.backupUploadRequestSchema; } });
|
|
301
301
|
Object.defineProperty(exports, "backupStatusResponseSchema", { enumerable: true, get: function () { return keyRecovery_1.backupStatusResponseSchema; } });
|
|
302
|
-
var webIdentityCarrier_1 = require("./webIdentityCarrier");
|
|
303
|
-
// Schemas — web identity carrier (one identity, two carriers)
|
|
304
|
-
Object.defineProperty(exports, "WEB_IDENTITY_ENVELOPE_VERSION", { enumerable: true, get: function () { return webIdentityCarrier_1.WEB_IDENTITY_ENVELOPE_VERSION; } });
|
|
305
|
-
Object.defineProperty(exports, "WEB_IDENTITY_SECRET_KINDS", { enumerable: true, get: function () { return webIdentityCarrier_1.WEB_IDENTITY_SECRET_KINDS; } });
|
|
306
|
-
Object.defineProperty(exports, "webIdentityPublicKeySchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webIdentityPublicKeySchema; } });
|
|
307
|
-
Object.defineProperty(exports, "webauthnCredentialIdSchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webauthnCredentialIdSchema; } });
|
|
308
|
-
Object.defineProperty(exports, "webauthnRpIdSchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webauthnRpIdSchema; } });
|
|
309
|
-
Object.defineProperty(exports, "webIdentityWrapSchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webIdentityWrapSchema; } });
|
|
310
|
-
Object.defineProperty(exports, "webIdentityEnvelopeSchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webIdentityEnvelopeSchema; } });
|
|
311
|
-
Object.defineProperty(exports, "webIdentityEnvelopeUploadSchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webIdentityEnvelopeUploadSchema; } });
|
|
312
|
-
Object.defineProperty(exports, "webIdentityHolderSchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webIdentityHolderSchema; } });
|
|
313
|
-
Object.defineProperty(exports, "webIdentityEnvelopeResponseSchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webIdentityEnvelopeResponseSchema; } });
|
|
314
|
-
Object.defineProperty(exports, "webIdentityEnvelopeProofFieldsSchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webIdentityEnvelopeProofFieldsSchema; } });
|
|
315
|
-
Object.defineProperty(exports, "webIdentityEnvelopeActionSchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webIdentityEnvelopeActionSchema; } });
|
|
316
|
-
Object.defineProperty(exports, "webIdentityEnvelopePutSchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webIdentityEnvelopePutSchema; } });
|
|
317
|
-
Object.defineProperty(exports, "webauthnAssertionResponseSchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webauthnAssertionResponseSchema; } });
|
|
318
|
-
Object.defineProperty(exports, "webIdentityEnvelopeEstablishSchema", { enumerable: true, get: function () { return webIdentityCarrier_1.webIdentityEnvelopeEstablishSchema; } });
|
|
319
302
|
var identityProof_1 = require("./identityProof");
|
|
320
303
|
// Identity proofs (ADR 0024 D7) — the one signed format for root operations
|
|
321
304
|
Object.defineProperty(exports, "IDENTITY_PROOF_VERSION", { enumerable: true, get: function () { return identityProof_1.IDENTITY_PROOF_VERSION; } });
|
|
@@ -331,31 +314,6 @@ Object.defineProperty(exports, "identityProofSchema", { enumerable: true, get: f
|
|
|
331
314
|
Object.defineProperty(exports, "identityProofChallengeRequestSchema", { enumerable: true, get: function () { return identityProof_1.identityProofChallengeRequestSchema; } });
|
|
332
315
|
Object.defineProperty(exports, "identityProofChallengeResponseSchema", { enumerable: true, get: function () { return identityProof_1.identityProofChallengeResponseSchema; } });
|
|
333
316
|
Object.defineProperty(exports, "identityRootStatusSchema", { enumerable: true, get: function () { return identityProof_1.identityRootStatusSchema; } });
|
|
334
|
-
var identityRecovery_1 = require("./identityRecovery");
|
|
335
|
-
// Signed-out recovery (ADR 0024 D5)
|
|
336
|
-
Object.defineProperty(exports, "IDENTITY_RECOVERY_TTL_MS", { enumerable: true, get: function () { return identityRecovery_1.IDENTITY_RECOVERY_TTL_MS; } });
|
|
337
|
-
Object.defineProperty(exports, "identityRecoveryChallengeResponseSchema", { enumerable: true, get: function () { return identityRecovery_1.identityRecoveryChallengeResponseSchema; } });
|
|
338
|
-
Object.defineProperty(exports, "identityRecoveryStartRequestSchema", { enumerable: true, get: function () { return identityRecovery_1.identityRecoveryStartRequestSchema; } });
|
|
339
|
-
Object.defineProperty(exports, "identityRecoveryCompleteRequestSchema", { enumerable: true, get: function () { return identityRecovery_1.identityRecoveryCompleteRequestSchema; } });
|
|
340
|
-
var identityMove_1 = require("./identityMove");
|
|
341
|
-
// Schemas — moving a web identity into Commons
|
|
342
|
-
Object.defineProperty(exports, "IDENTITY_MOVE_TTL_MS", { enumerable: true, get: function () { return identityMove_1.IDENTITY_MOVE_TTL_MS; } });
|
|
343
|
-
Object.defineProperty(exports, "IDENTITY_MOVE_STATUSES", { enumerable: true, get: function () { return identityMove_1.IDENTITY_MOVE_STATUSES; } });
|
|
344
|
-
Object.defineProperty(exports, "IDENTITY_MOVE_QR_PREFIX", { enumerable: true, get: function () { return identityMove_1.IDENTITY_MOVE_QR_PREFIX; } });
|
|
345
|
-
Object.defineProperty(exports, "identityMoveRevealRequestSchema", { enumerable: true, get: function () { return identityMove_1.identityMoveRevealRequestSchema; } });
|
|
346
|
-
Object.defineProperty(exports, "buildMoveCommitmentInput", { enumerable: true, get: function () { return identityMove_1.buildMoveCommitmentInput; } });
|
|
347
|
-
Object.defineProperty(exports, "buildMoveSasInput", { enumerable: true, get: function () { return identityMove_1.buildMoveSasInput; } });
|
|
348
|
-
Object.defineProperty(exports, "buildMoveSealPayload", { enumerable: true, get: function () { return identityMove_1.buildMoveSealPayload; } });
|
|
349
|
-
Object.defineProperty(exports, "buildMoveCiphertextDigestInput", { enumerable: true, get: function () { return identityMove_1.buildMoveCiphertextDigestInput; } });
|
|
350
|
-
Object.defineProperty(exports, "buildMoveReceiptMessage", { enumerable: true, get: function () { return identityMove_1.buildMoveReceiptMessage; } });
|
|
351
|
-
Object.defineProperty(exports, "identityMoveIdSchema", { enumerable: true, get: function () { return identityMove_1.identityMoveIdSchema; } });
|
|
352
|
-
Object.defineProperty(exports, "identityMoveEphemeralKeySchema", { enumerable: true, get: function () { return identityMove_1.identityMoveEphemeralKeySchema; } });
|
|
353
|
-
Object.defineProperty(exports, "identityMoveCreateRequestSchema", { enumerable: true, get: function () { return identityMove_1.identityMoveCreateRequestSchema; } });
|
|
354
|
-
Object.defineProperty(exports, "identityMoveCreateResponseSchema", { enumerable: true, get: function () { return identityMove_1.identityMoveCreateResponseSchema; } });
|
|
355
|
-
Object.defineProperty(exports, "identityMoveJoinRequestSchema", { enumerable: true, get: function () { return identityMove_1.identityMoveJoinRequestSchema; } });
|
|
356
|
-
Object.defineProperty(exports, "identityMoveSealRequestSchema", { enumerable: true, get: function () { return identityMove_1.identityMoveSealRequestSchema; } });
|
|
357
|
-
Object.defineProperty(exports, "identityMoveReceiptRequestSchema", { enumerable: true, get: function () { return identityMove_1.identityMoveReceiptRequestSchema; } });
|
|
358
|
-
Object.defineProperty(exports, "identityMoveStateSchema", { enumerable: true, get: function () { return identityMove_1.identityMoveStateSchema; } });
|
|
359
317
|
var updates_1 = require("./updates");
|
|
360
318
|
// Shared primitives
|
|
361
319
|
Object.defineProperty(exports, "updatePlatformSchema", { enumerable: true, get: function () { return updates_1.updatePlatformSchema; } });
|
|
@@ -394,6 +352,34 @@ Object.defineProperty(exports, "webauthnRegisterOptionsRequestSchema", { enumera
|
|
|
394
352
|
Object.defineProperty(exports, "webauthnLoginOptionsRequestSchema", { enumerable: true, get: function () { return webauthn_1.webauthnLoginOptionsRequestSchema; } });
|
|
395
353
|
Object.defineProperty(exports, "webauthnRegisterVerifyRequestSchema", { enumerable: true, get: function () { return webauthn_1.webauthnRegisterVerifyRequestSchema; } });
|
|
396
354
|
Object.defineProperty(exports, "webauthnLoginVerifyRequestSchema", { enumerable: true, get: function () { return webauthn_1.webauthnLoginVerifyRequestSchema; } });
|
|
355
|
+
Object.defineProperty(exports, "webauthnCredentialIdSchema", { enumerable: true, get: function () { return webauthn_1.webauthnCredentialIdSchema; } });
|
|
356
|
+
Object.defineProperty(exports, "webauthnAssertionResponseSchema", { enumerable: true, get: function () { return webauthn_1.webauthnAssertionResponseSchema; } });
|
|
357
|
+
var accountEmail_1 = require("./accountEmail");
|
|
358
|
+
// Recovery email of a passkey account (ADR 0029 D3)
|
|
359
|
+
Object.defineProperty(exports, "EMAIL_VERIFICATION_PURPOSES", { enumerable: true, get: function () { return accountEmail_1.EMAIL_VERIFICATION_PURPOSES; } });
|
|
360
|
+
Object.defineProperty(exports, "EMAIL_CODE_LENGTH", { enumerable: true, get: function () { return accountEmail_1.EMAIL_CODE_LENGTH; } });
|
|
361
|
+
Object.defineProperty(exports, "EMAIL_CODE_TTL_MS", { enumerable: true, get: function () { return accountEmail_1.EMAIL_CODE_TTL_MS; } });
|
|
362
|
+
Object.defineProperty(exports, "EMAIL_CODE_MAX_ATTEMPTS", { enumerable: true, get: function () { return accountEmail_1.EMAIL_CODE_MAX_ATTEMPTS; } });
|
|
363
|
+
Object.defineProperty(exports, "EMAIL_TICKET_TTL_MS", { enumerable: true, get: function () { return accountEmail_1.EMAIL_TICKET_TTL_MS; } });
|
|
364
|
+
Object.defineProperty(exports, "EMAIL_VERIFICATION_ERROR_CODES", { enumerable: true, get: function () { return accountEmail_1.EMAIL_VERIFICATION_ERROR_CODES; } });
|
|
365
|
+
Object.defineProperty(exports, "emailAddressSchema", { enumerable: true, get: function () { return accountEmail_1.emailAddressSchema; } });
|
|
366
|
+
Object.defineProperty(exports, "emailTicketSchema", { enumerable: true, get: function () { return accountEmail_1.emailTicketSchema; } });
|
|
367
|
+
Object.defineProperty(exports, "emailVerificationStartRequestSchema", { enumerable: true, get: function () { return accountEmail_1.emailVerificationStartRequestSchema; } });
|
|
368
|
+
Object.defineProperty(exports, "emailVerificationStartResponseSchema", { enumerable: true, get: function () { return accountEmail_1.emailVerificationStartResponseSchema; } });
|
|
369
|
+
Object.defineProperty(exports, "emailVerificationConfirmRequestSchema", { enumerable: true, get: function () { return accountEmail_1.emailVerificationConfirmRequestSchema; } });
|
|
370
|
+
Object.defineProperty(exports, "emailVerificationConfirmResponseSchema", { enumerable: true, get: function () { return accountEmail_1.emailVerificationConfirmResponseSchema; } });
|
|
371
|
+
var identityLink_1 = require("./identityLink");
|
|
372
|
+
// Linking Commons to a passkey account (ADR 0029 D3)
|
|
373
|
+
Object.defineProperty(exports, "IDENTITY_LINK_STATUSES", { enumerable: true, get: function () { return identityLink_1.IDENTITY_LINK_STATUSES; } });
|
|
374
|
+
Object.defineProperty(exports, "IDENTITY_LINK_QR_PREFIX", { enumerable: true, get: function () { return identityLink_1.IDENTITY_LINK_QR_PREFIX; } });
|
|
375
|
+
Object.defineProperty(exports, "identityLinkIdSchema", { enumerable: true, get: function () { return identityLink_1.identityLinkIdSchema; } });
|
|
376
|
+
Object.defineProperty(exports, "buildIdentityLinkQrPayload", { enumerable: true, get: function () { return identityLink_1.buildIdentityLinkQrPayload; } });
|
|
377
|
+
Object.defineProperty(exports, "parseIdentityLinkQrPayload", { enumerable: true, get: function () { return identityLink_1.parseIdentityLinkQrPayload; } });
|
|
378
|
+
Object.defineProperty(exports, "identityLinkCreateResponseSchema", { enumerable: true, get: function () { return identityLink_1.identityLinkCreateResponseSchema; } });
|
|
379
|
+
Object.defineProperty(exports, "identityLinkStateSchema", { enumerable: true, get: function () { return identityLink_1.identityLinkStateSchema; } });
|
|
380
|
+
Object.defineProperty(exports, "identityLinkProofRequestSchema", { enumerable: true, get: function () { return identityLink_1.identityLinkProofRequestSchema; } });
|
|
381
|
+
Object.defineProperty(exports, "identityLinkOptionsRequestSchema", { enumerable: true, get: function () { return identityLink_1.identityLinkOptionsRequestSchema; } });
|
|
382
|
+
Object.defineProperty(exports, "identityLinkCompleteRequestSchema", { enumerable: true, get: function () { return identityLink_1.identityLinkCompleteRequestSchema; } });
|
|
397
383
|
var transparency_1 = require("./transparency");
|
|
398
384
|
// Schemas — transparency log (checkpoints + inclusion proofs)
|
|
399
385
|
Object.defineProperty(exports, "transparencyCheckpointSignatureSchema", { enumerable: true, get: function () { return transparency_1.transparencyCheckpointSignatureSchema; } });
|
package/dist/cjs/webauthn.js
CHANGED
|
@@ -12,10 +12,39 @@
|
|
|
12
12
|
* create a second, drift-prone definition of a shape we do not own.
|
|
13
13
|
*/
|
|
14
14
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
15
|
-
exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = void 0;
|
|
15
|
+
exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.webauthnAssertionResponseSchema = exports.webauthnCredentialIdSchema = void 0;
|
|
16
16
|
const zod_1 = require("zod");
|
|
17
|
-
const
|
|
18
|
-
|
|
17
|
+
const accountEmail_1 = require("./accountEmail");
|
|
18
|
+
/** A WebAuthn credential id, base64url as the browser reports it. */
|
|
19
|
+
exports.webauthnCredentialIdSchema = zod_1.z
|
|
20
|
+
.string()
|
|
21
|
+
.trim()
|
|
22
|
+
.min(16)
|
|
23
|
+
.max(1024)
|
|
24
|
+
.regex(/^[A-Za-z0-9_-]+$/, 'credentialId must be base64url');
|
|
25
|
+
/**
|
|
26
|
+
* A WebAuthn assertion by one of the account's EXISTING passkeys over a server
|
|
27
|
+
* challenge — the fresh use of the factor the account already has (linking
|
|
28
|
+
* Commons to a passkey account, deleting a passkey account). The API verifies
|
|
29
|
+
* it with `@simplewebauthn/server`; this only bounds its shape.
|
|
30
|
+
*/
|
|
31
|
+
exports.webauthnAssertionResponseSchema = zod_1.z
|
|
32
|
+
.object({
|
|
33
|
+
id: exports.webauthnCredentialIdSchema,
|
|
34
|
+
rawId: zod_1.z.string().min(1).max(2048),
|
|
35
|
+
type: zod_1.z.literal('public-key'),
|
|
36
|
+
response: zod_1.z
|
|
37
|
+
.object({
|
|
38
|
+
clientDataJSON: zod_1.z.string().min(1).max(8192),
|
|
39
|
+
authenticatorData: zod_1.z.string().min(1).max(8192),
|
|
40
|
+
signature: zod_1.z.string().min(1).max(2048),
|
|
41
|
+
userHandle: zod_1.z.string().max(2048).optional(),
|
|
42
|
+
})
|
|
43
|
+
.passthrough(),
|
|
44
|
+
clientExtensionResults: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
|
|
45
|
+
authenticatorAttachment: zod_1.z.string().optional(),
|
|
46
|
+
})
|
|
47
|
+
.passthrough();
|
|
19
48
|
/**
|
|
20
49
|
* Device-session options shared by every first-party sign-in body
|
|
21
50
|
* (`deviceName`/`deviceFingerprint`). Mirrors what
|
|
@@ -36,13 +65,16 @@ const deviceSessionEnvelope = {
|
|
|
36
65
|
deviceFingerprint: zod_1.z.string().trim().min(1).max(256).optional(),
|
|
37
66
|
};
|
|
38
67
|
/**
|
|
39
|
-
* `POST /webauthn/register/options` — request registration options.
|
|
40
|
-
*
|
|
41
|
-
*
|
|
42
|
-
* (
|
|
68
|
+
* `POST /webauthn/register/options` — request registration options. Three flows:
|
|
69
|
+
*
|
|
70
|
+
* - a bearer: the caller adds a passkey to their signed-in account;
|
|
71
|
+
* - `recoveryTicket` (no bearer): a new passkey for the account a recovery code
|
|
72
|
+
* was confirmed for (`POST /auth/email/verify/confirm`, purpose `recovery`);
|
|
73
|
+
* - `username` (no bearer): a prospective sign-up; the handle is not created yet.
|
|
43
74
|
*/
|
|
44
75
|
exports.webauthnRegisterOptionsRequestSchema = zod_1.z.object({
|
|
45
76
|
username: zod_1.z.string().trim().min(1).max(60).optional(),
|
|
77
|
+
recoveryTicket: accountEmail_1.emailTicketSchema.optional(),
|
|
46
78
|
});
|
|
47
79
|
/**
|
|
48
80
|
* `POST /webauthn/login/options` — request authentication options. When
|
|
@@ -56,23 +88,20 @@ exports.webauthnLoginOptionsRequestSchema = zod_1.z.object({
|
|
|
56
88
|
/**
|
|
57
89
|
* `POST /webauthn/register/verify` — the outer envelope. The browser
|
|
58
90
|
* `RegistrationResponseJSON` travels alongside these fields under `response` and
|
|
59
|
-
* is validated by `@simplewebauthn/server`, not here.
|
|
60
|
-
*
|
|
91
|
+
* is validated by `@simplewebauthn/server`, not here.
|
|
92
|
+
*
|
|
93
|
+
* - Sign-up (no bearer, ADR 0029 D3): `username`, the recovery `email` and the
|
|
94
|
+
* `emailTicket` its code was confirmed with. The account is created with the
|
|
95
|
+
* passkey and that verified email, and no key.
|
|
96
|
+
* - Recovery (no bearer): `recoveryTicket`; the passkey is added to its account
|
|
97
|
+
* and a session minted.
|
|
98
|
+
* - A bearer: the passkey is added to the signed-in account.
|
|
61
99
|
*/
|
|
62
100
|
exports.webauthnRegisterVerifyRequestSchema = zod_1.z.object({
|
|
63
101
|
username: zod_1.z.string().trim().min(1).max(60).optional(),
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
* (`enroll_identity`) whose challenge is the registration challenge. The
|
|
68
|
-
* account, passkey, root and envelope are then created in one transaction.
|
|
69
|
-
*/
|
|
70
|
-
identity: zod_1.z
|
|
71
|
-
.object({
|
|
72
|
-
envelope: webIdentityCarrier_1.webIdentityEnvelopeSchema,
|
|
73
|
-
proof: identityProof_1.identityProofSchema,
|
|
74
|
-
})
|
|
75
|
-
.optional(),
|
|
102
|
+
email: accountEmail_1.emailAddressSchema.optional(),
|
|
103
|
+
emailTicket: accountEmail_1.emailTicketSchema.optional(),
|
|
104
|
+
recoveryTicket: accountEmail_1.emailTicketSchema.optional(),
|
|
76
105
|
...deviceSessionEnvelope,
|
|
77
106
|
});
|
|
78
107
|
/**
|