@oxy.so/contracts 2.1.0 → 2.2.0

package/dist/types/webauthn.d.ts

@@ -11,18 +11,99 @@
  * create a second, drift-prone definition of a shape we do not own.
  */
 import { z } from 'zod';
+/** A WebAuthn credential id, base64url as the browser reports it. */
+export declare const webauthnCredentialIdSchema: z.ZodString;
 /**
- * `POST /webauthn/register/options` — request registration options. With a bearer
- * token the caller links a passkey to their signed-in account and `username` is
- * ignored; without one it is a prospective signup and `username` is the desired
- * (not-yet-created) handle.
+ * A WebAuthn assertion by one of the account's EXISTING passkeys over a server
+ * challenge — the fresh use of the factor the account already has (linking
+ * Commons to a passkey account, deleting a passkey account). The API verifies
+ * it with `@simplewebauthn/server`; this only bounds its shape.
+ */
+export declare const webauthnAssertionResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    rawId: z.ZodString;
+    type: z.ZodLiteral<"public-key">;
+    response: z.ZodObject<{
+        clientDataJSON: z.ZodString;
+        authenticatorData: z.ZodString;
+        signature: z.ZodString;
+        userHandle: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        clientDataJSON: z.ZodString;
+        authenticatorData: z.ZodString;
+        signature: z.ZodString;
+        userHandle: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        clientDataJSON: z.ZodString;
+        authenticatorData: z.ZodString;
+        signature: z.ZodString;
+        userHandle: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>;
+    clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    authenticatorAttachment: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    id: z.ZodString;
+    rawId: z.ZodString;
+    type: z.ZodLiteral<"public-key">;
+    response: z.ZodObject<{
+        clientDataJSON: z.ZodString;
+        authenticatorData: z.ZodString;
+        signature: z.ZodString;
+        userHandle: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        clientDataJSON: z.ZodString;
+        authenticatorData: z.ZodString;
+        signature: z.ZodString;
+        userHandle: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        clientDataJSON: z.ZodString;
+        authenticatorData: z.ZodString;
+        signature: z.ZodString;
+        userHandle: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>;
+    clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    authenticatorAttachment: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    id: z.ZodString;
+    rawId: z.ZodString;
+    type: z.ZodLiteral<"public-key">;
+    response: z.ZodObject<{
+        clientDataJSON: z.ZodString;
+        authenticatorData: z.ZodString;
+        signature: z.ZodString;
+        userHandle: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        clientDataJSON: z.ZodString;
+        authenticatorData: z.ZodString;
+        signature: z.ZodString;
+        userHandle: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        clientDataJSON: z.ZodString;
+        authenticatorData: z.ZodString;
+        signature: z.ZodString;
+        userHandle: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>;
+    clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    authenticatorAttachment: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+export type WebauthnAssertionResponse = z.infer<typeof webauthnAssertionResponseSchema>;
+/**
+ * `POST /webauthn/register/options` — request registration options. Three flows:
+ *
+ * - a bearer: the caller adds a passkey to their signed-in account;
+ * - `recoveryTicket` (no bearer): a new passkey for the account a recovery code
+ *   was confirmed for (`POST /auth/email/verify/confirm`, purpose `recovery`);
+ * - `username` (no bearer): a prospective sign-up; the handle is not created yet.
  */
 export declare const webauthnRegisterOptionsRequestSchema: z.ZodObject<{
     username: z.ZodOptional<z.ZodString>;
+    recoveryTicket: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     username?: string | undefined;
+    recoveryTicket?: string | undefined;
 }, {
     username?: string | undefined;
+    recoveryTicket?: string | undefined;
 }>;
 export type WebauthnRegisterOptionsRequest = z.infer<typeof webauthnRegisterOptionsRequestSchema>;
 /**
@@ -42,227 +123,34 @@ export type WebauthnLoginOptionsRequest = z.infer<typeof webauthnLoginOptionsReq
 /**
  * `POST /webauthn/register/verify` — the outer envelope. The browser
  * `RegistrationResponseJSON` travels alongside these fields under `response` and
- * is validated by `@simplewebauthn/server`, not here. `username` is required only
- * for the prospective-signup branch (no bearer); the linking branch ignores it.
+ * is validated by `@simplewebauthn/server`, not here.
+ *
+ * - Sign-up (no bearer, ADR 0029 D3): `username`, the recovery `email` and the
+ *   `emailTicket` its code was confirmed with. The account is created with the
+ *   passkey and that verified email, and no key.
+ * - Recovery (no bearer): `recoveryTicket`; the passkey is added to its account
+ *   and a session minted.
+ * - A bearer: the passkey is added to the signed-in account.
  */
 export declare const webauthnRegisterVerifyRequestSchema: z.ZodObject<{
     deviceName: z.ZodOptional<z.ZodString>;
     deviceFingerprint: z.ZodOptional<z.ZodString>;
     username: z.ZodOptional<z.ZodString>;
-    /**
-     * Sign-up only (ADR 0024 D4): the account's root, created on the holder BEFORE
-     * this request — sealed under the passkey being registered — and a root proof
-     * (`enroll_identity`) whose challenge is the registration challenge. The
-     * account, passkey, root and envelope are then created in one transaction.
-     */
-    identity: z.ZodOptional<z.ZodObject<{
-        envelope: z.ZodEffects<z.ZodObject<{
-            version: z.ZodLiteral<2>;
-            algorithm: z.ZodLiteral<"xchacha20poly1305">;
-            publicKey: z.ZodString;
-            secretKind: z.ZodEnum<["mnemonic-entropy", "raw-private-key"]>;
-            secretNonce: z.ZodString;
-            sealedSecret: z.ZodString;
-            wraps: z.ZodArray<z.ZodObject<{
-                credentialId: z.ZodString;
-                nonce: z.ZodString;
-                wrappedKey: z.ZodString;
-                createdAt: z.ZodString;
-                rpId: z.ZodString;
-                verifiedAt: z.ZodOptional<z.ZodString>;
-            }, "strip", z.ZodTypeAny, {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }, {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }>, "many">;
-        }, "strip", z.ZodTypeAny, {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        }, {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        }>, {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        }, {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        }>;
-        proof: z.ZodObject<{
-            v: z.ZodLiteral<2>;
-            challenge: z.ZodString;
-            expiresAt: z.ZodNumber;
-            signature: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            expiresAt: number;
-            signature: string;
-            v: 2;
-            challenge: string;
-        }, {
-            expiresAt: number;
-            signature: string;
-            v: 2;
-            challenge: string;
-        }>;
-    }, "strip", z.ZodTypeAny, {
-        proof: {
-            expiresAt: number;
-            signature: string;
-            v: 2;
-            challenge: string;
-        };
-        envelope: {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        };
-    }, {
-        proof: {
-            expiresAt: number;
-            signature: string;
-            v: 2;
-            challenge: string;
-        };
-        envelope: {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        };
-    }>>;
+    email: z.ZodOptional<z.ZodString>;
+    emailTicket: z.ZodOptional<z.ZodString>;
+    recoveryTicket: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
+    email?: string | undefined;
     username?: string | undefined;
-    identity?: {
-        proof: {
-            expiresAt: number;
-            signature: string;
-            v: 2;
-            challenge: string;
-        };
-        envelope: {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        };
-    } | undefined;
+    recoveryTicket?: string | undefined;
+    emailTicket?: string | undefined;
     deviceName?: string | undefined;
     deviceFingerprint?: string | undefined;
 }, {
+    email?: string | undefined;
     username?: string | undefined;
-    identity?: {
-        proof: {
-            expiresAt: number;
-            signature: string;
-            v: 2;
-            challenge: string;
-        };
-        envelope: {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        };
-    } | undefined;
+    recoveryTicket?: string | undefined;
+    emailTicket?: string | undefined;
     deviceName?: string | undefined;
     deviceFingerprint?: string | undefined;
 }>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/contracts",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "OxyHQ API contracts — single source of truth for request/response Zod schemas and inferred types, shared by the backend and the client SDKs",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/dist/cjs/identityMove.js

@@ -1,156 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.identityMoveStateSchema = exports.identityMoveReceiptRequestSchema = exports.identityMoveSealRequestSchema = exports.identityMoveRevealRequestSchema = exports.identityMoveJoinRequestSchema = exports.identityMoveCreateResponseSchema = exports.identityMoveCreateRequestSchema = exports.IDENTITY_MOVE_QR_PREFIX = exports.IDENTITY_MOVE_STATUSES = exports.identityMoveEphemeralKeySchema = exports.identityMoveIdSchema = exports.IDENTITY_MOVE_TTL_MS = void 0;
-exports.buildMoveCommitmentInput = buildMoveCommitmentInput;
-exports.buildMoveSasInput = buildMoveSasInput;
-exports.buildMoveCiphertextDigestInput = buildMoveCiphertextDigestInput;
-exports.buildMoveSealPayload = buildMoveSealPayload;
-exports.buildMoveReceiptMessage = buildMoveReceiptMessage;
-/**
- * Identity move contract — give a web root to Commons (add it, or keep it only in
- * Commons; ADR 0024 D6).
- *
- * The web (holding the root) shows a QR carrying only a move id; Commons scans.
- * The relay in between must not be able to take the root, so:
- *
- *  1. `POST /identity/move { initiatorCommitment }` — the web publishes only
- *     `H(initiatorKey, nonce)`, never the key.
- *  2. `POST /identity/move/:moveId/join { responderEphemeralPublicKey }` —
- *     Commons, having read the commitment first, joins with its own key.
- *  3. `POST /identity/move/:moveId/reveal` — only then does the web reveal its
- *     key and nonce; Commons checks them against the commitment it read.
- *  4. Both screens show a 6-digit code over `(moveId, both keys, commitment)`;
- *     the person confirms on the web that they match.
- *  5. `POST /identity/move/:moveId/seal` — the web seals the phrase entropy under
- *     `HKDF(ECDH(both keys), moveId)`, authorized by a one-use root proof over the
- *     exact sealed bytes.
- *  6. `POST /identity/move/:moveId/receipt` — Commons stores the root, reads it
- *     back from its keychain, and signs a receipt over the move, the root, both
- *     keys and the digest of the ciphertext it opened. The server verifies it; the
- *     web verifies it again from what IT sealed before removing anything.
- *
- * Why the commitment: without it the relay sees both keys before committing to
- * anything and can grind a substituted key until the two codes agree (~10⁶
- * tries, seconds). With it, the relay must fix the key it shows Commons before
- * learning Commons' key, and the key it shows the web before the web reveals.
- *
- * The server holds a commitment, two ephemeral public keys, an opaque ciphertext
- * and a receipt — nothing that decrypts the ciphertext.
- *
- * Platform-agnostic — zod only, ESM-safe (no `require()`).
- */
-const zod_1 = require("zod");
-const identityProof_1 = require("./identityProof");
-/** A move lives this long: one interactive handoff. */
-exports.IDENTITY_MOVE_TTL_MS = 5 * 60 * 1000;
-/** 128-bit move id, lowercase hex. */
-exports.identityMoveIdSchema = zod_1.z
-    .string()
-    .trim()
-    .regex(/^[0-9a-f]{32}$/, 'moveId must be 32 lowercase hex characters');
-/** An ephemeral secp256k1 public key, uncompressed lowercase hex. */
-exports.identityMoveEphemeralKeySchema = zod_1.z
-    .string()
-    .trim()
-    .regex(/^04[0-9a-f]{128}$/, 'ephemeral public key must be uncompressed, lowercase hex');
-exports.IDENTITY_MOVE_STATUSES = ['pending', 'joined', 'sealed', 'completed', 'cancelled', 'expired'];
-/** The QR payload Commons scans. Carries the move id only. */
-exports.IDENTITY_MOVE_QR_PREFIX = 'oxycommons://move?id=';
-const hex64 = (label) => zod_1.z.string().trim().regex(/^[0-9a-f]{64}$/, `${label} must be 64 lowercase hex characters`);
-exports.identityMoveCreateRequestSchema = zod_1.z
-    .object({
-    /** `H(initiator ephemeral key, nonce)` — the key itself is revealed only after Commons joins. */
-    initiatorCommitment: hex64('initiatorCommitment'),
-})
-    .strict();
-exports.identityMoveCreateResponseSchema = zod_1.z.object({
-    moveId: exports.identityMoveIdSchema,
-    expiresAt: zod_1.z.string().datetime(),
-});
-exports.identityMoveJoinRequestSchema = zod_1.z.object({
-    responderEphemeralPublicKey: exports.identityMoveEphemeralKeySchema,
-});
-/** After Commons joined: the committed key and its nonce. */
-exports.identityMoveRevealRequestSchema = zod_1.z
-    .object({
-    initiatorEphemeralPublicKey: exports.identityMoveEphemeralKeySchema,
-    commitmentNonce: hex64('commitmentNonce'),
-})
-    .strict();
-exports.identityMoveSealRequestSchema = zod_1.z
-    .object({
-    /** 24-byte XChaCha20-Poly1305 nonce, hex. */
-    nonce: zod_1.z.string().trim().regex(/^[0-9a-f]{48}$/, 'nonce must be 48 lowercase hex characters'),
-    /** The 16–32-byte phrase entropy (12–24 words), tag appended, hex. */
-    ciphertext: zod_1.z
-        .string()
-        .trim()
-        .regex(/^(?:[0-9a-f]{64}|[0-9a-f]{72}|[0-9a-f]{80}|[0-9a-f]{88}|[0-9a-f]{96})$/, 'ciphertext has an unsupported length'),
-    /**
-     * Root proof (`identity_move_seal`), payload `{ moveId, nonce, ciphertext }`,
-     * over a one-use challenge from `POST /identity/proof-challenge`.
-     */
-    proof: identityProof_1.identityProofSchema,
-})
-    .strict();
-exports.identityMoveReceiptRequestSchema = zod_1.z
-    .object({
-    /** Root signature over `buildMoveReceiptMessage(...)`. */
-    signature: zod_1.z.string().trim().min(1).max(512),
-})
-    .strict();
-exports.identityMoveStateSchema = zod_1.z.object({
-    moveId: exports.identityMoveIdSchema,
-    status: zod_1.z.enum(exports.IDENTITY_MOVE_STATUSES),
-    initiatorCommitment: zod_1.z.string(),
-    initiatorCommitmentNonce: zod_1.z.string().nullable(),
-    publicKey: zod_1.z.string().regex(/^04[0-9a-f]{128}$/),
-    initiatorEphemeralPublicKey: exports.identityMoveEphemeralKeySchema.nullable(),
-    responderEphemeralPublicKey: exports.identityMoveEphemeralKeySchema.nullable(),
-    nonce: zod_1.z.string().nullable(),
-    ciphertext: zod_1.z.string().nullable(),
-    receiptSignature: zod_1.z.string().nullable(),
-    expiresAt: zod_1.z.string().datetime(),
-});
-/**
- * The initiator's commitment input, `canonicalJson({ v, purpose, key, nonce })`,
- * which the caller hashes with SHA-256.
- */
-function buildMoveCommitmentInput(initiatorEphemeralPublicKey, nonce) {
-    return (0, identityProof_1.canonicalJson)({
-        v: 2,
-        purpose: 'oxy-identity-move-initiator-commitment',
-        initiatorEphemeralPublicKey: initiatorEphemeralPublicKey.toLowerCase(),
-        nonce: nonce.toLowerCase(),
-    });
-}
-/** The bytes both sides hash for the 6-digit code. */
-function buildMoveSasInput(input) {
-    return (0, identityProof_1.canonicalJson)({
-        v: 'oxy-identity-transfer-sas-v2',
-        moveId: input.moveId.toLowerCase(),
-        initiator: input.initiatorEphemeralPublicKey.toLowerCase(),
-        responder: input.responderEphemeralPublicKey.toLowerCase(),
-        commitment: input.initiatorCommitment.toLowerCase(),
-    });
-}
-/** The ciphertext digest input the receipt binds: `canonicalJson({ nonce, ciphertext })`. */
-function buildMoveCiphertextDigestInput(sealed) {
-    return (0, identityProof_1.canonicalJson)({ nonce: sealed.nonce.toLowerCase(), ciphertext: sealed.ciphertext.toLowerCase() });
-}
-/** The payload a seal proof digests. */
-function buildMoveSealPayload(moveId, sealed) {
-    return { moveId: moveId.toLowerCase(), nonce: sealed.nonce.toLowerCase(), ciphertext: sealed.ciphertext.toLowerCase() };
-}
-/** The exact bytes a receipt signs. */
-function buildMoveReceiptMessage(input) {
-    return (0, identityProof_1.canonicalJson)({
-        v: 2,
-        domain: 'oxy-identity-move-receipt',
-        moveId: input.moveId.toLowerCase(),
-        rootPublicKey: input.rootPublicKey.toLowerCase(),
-        initiator: input.initiatorEphemeralPublicKey.toLowerCase(),
-        responder: input.responderEphemeralPublicKey.toLowerCase(),
-        ciphertextDigest: input.ciphertextDigest.toLowerCase(),
-    });
-}

package/dist/cjs/identityRecovery.js

@@ -1,51 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.identityRecoveryCompleteRequestSchema = exports.identityRecoveryStartRequestSchema = exports.identityRecoveryChallengeResponseSchema = exports.IDENTITY_RECOVERY_TTL_MS = void 0;
-/**
- * Signed-out recovery contract (ADR 0024 D5) — get an EXISTING account back from
- * its root alone, with no passkey, session or email.
- *
- *  1. `POST /identity/recovery/challenge` → a one-use challenge. It says nothing
- *     about any account.
- *  2. The holder derives the root locally from recovery material (12/24 words or a
- *     raw key) and signs `recover_account_start` over that challenge:
- *     `POST /identity/recovery/start { publicKey, proof }`. Only a valid proof
- *     learns which account the root belongs to; the response carries passkey
- *     registration options for THAT account and a short-lived ticket.
- *  3. The holder creates the passkey, seals the root under it (PRF), and signs
- *     `recover_account_complete` over the registration challenge and the envelope
- *     digest: `POST /identity/recovery/complete`. The passkey, the envelope and a
- *     session are created in one transaction.
- *
- * The recovery material and the root never leave the holder. Platform-agnostic —
- * zod only, ESM-safe.
- */
-const zod_1 = require("zod");
-const identityProof_1 = require("./identityProof");
-const webIdentityCarrier_1 = require("./webIdentityCarrier");
-/** A recovery attempt lives this long between steps. */
-exports.IDENTITY_RECOVERY_TTL_MS = 5 * 60 * 1000;
-exports.identityRecoveryChallengeResponseSchema = zod_1.z.object({
-    challenge: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
-    expiresAt: zod_1.z.number().int().positive(),
-});
-exports.identityRecoveryStartRequestSchema = zod_1.z
-    .object({
-    publicKey: webIdentityCarrier_1.webIdentityPublicKeySchema,
-    /** `recover_account_start`, subject `root:<publicKey>`, actor `anonymous`. */
-    proof: identityProof_1.identityProofSchema,
-})
-    .strict();
-exports.identityRecoveryCompleteRequestSchema = zod_1.z
-    .object({
-    ticket: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
-    /** The browser `RegistrationResponseJSON`, verified by the API's WebAuthn library. */
-    response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
-    /** The root sealed under the new passkey — exactly one wrap, for that credential. */
-    envelope: webIdentityCarrier_1.webIdentityEnvelopeSchema,
-    /** `recover_account_complete`, subject = account id, actor `credential:<id>`, challenge = registration challenge (hex). */
-    proof: identityProof_1.identityProofSchema,
-    deviceName: zod_1.z.string().trim().max(100).optional(),
-    deviceFingerprint: zod_1.z.string().trim().max(512).optional(),
-})
-    .strict();