@oxy.so/contracts 2.1.0 → 3.0.0

package/dist/types/userResponse.d.ts

@@ -969,6 +969,7 @@ export declare const currentUserResponseSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     data: {
         name: UserNameResponse;
+        email?: string | undefined;
         kind?: "bot" | "personal" | "organization" | "project" | "channel" | undefined;
         username?: string | undefined;
         avatar?: string | null | undefined;
@@ -980,7 +981,6 @@ export declare const currentUserResponseSchema: z.ZodObject<{
         did?: string | undefined;
         verifiedDomains?: import("./identity").VerifiedDomain[] | undefined;
         _id?: string | undefined;
-        email?: string | undefined;
         phone?: string | undefined;
         address?: string | undefined;
         birthday?: string | undefined;
@@ -995,6 +995,7 @@ export declare const currentUserResponseSchema: z.ZodObject<{
 }, {
     data: {
         name: UserNameResponse;
+        email?: string | undefined;
         kind?: "bot" | "personal" | "organization" | "project" | "channel" | undefined;
         username?: string | undefined;
         avatar?: string | null | undefined;
@@ -1006,7 +1007,6 @@ export declare const currentUserResponseSchema: z.ZodObject<{
         did?: string | undefined;
         verifiedDomains?: import("./identity").VerifiedDomain[] | undefined;
         _id?: string | undefined;
-        email?: string | undefined;
         phone?: string | undefined;
         address?: string | undefined;
         birthday?: string | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/contracts",
-  "version": "2.1.0",
+  "version": "3.0.0",
   "description": "OxyHQ API contracts — single source of truth for request/response Zod schemas and inferred types, shared by the backend and the client SDKs",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/dist/cjs/identityMove.js

@@ -1,156 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.identityMoveStateSchema = exports.identityMoveReceiptRequestSchema = exports.identityMoveSealRequestSchema = exports.identityMoveRevealRequestSchema = exports.identityMoveJoinRequestSchema = exports.identityMoveCreateResponseSchema = exports.identityMoveCreateRequestSchema = exports.IDENTITY_MOVE_QR_PREFIX = exports.IDENTITY_MOVE_STATUSES = exports.identityMoveEphemeralKeySchema = exports.identityMoveIdSchema = exports.IDENTITY_MOVE_TTL_MS = void 0;
-exports.buildMoveCommitmentInput = buildMoveCommitmentInput;
-exports.buildMoveSasInput = buildMoveSasInput;
-exports.buildMoveCiphertextDigestInput = buildMoveCiphertextDigestInput;
-exports.buildMoveSealPayload = buildMoveSealPayload;
-exports.buildMoveReceiptMessage = buildMoveReceiptMessage;
-/**
- * Identity move contract — give a web root to Commons (add it, or keep it only in
- * Commons; ADR 0024 D6).
- *
- * The web (holding the root) shows a QR carrying only a move id; Commons scans.
- * The relay in between must not be able to take the root, so:
- *
- *  1. `POST /identity/move { initiatorCommitment }` — the web publishes only
- *     `H(initiatorKey, nonce)`, never the key.
- *  2. `POST /identity/move/:moveId/join { responderEphemeralPublicKey }` —
- *     Commons, having read the commitment first, joins with its own key.
- *  3. `POST /identity/move/:moveId/reveal` — only then does the web reveal its
- *     key and nonce; Commons checks them against the commitment it read.
- *  4. Both screens show a 6-digit code over `(moveId, both keys, commitment)`;
- *     the person confirms on the web that they match.
- *  5. `POST /identity/move/:moveId/seal` — the web seals the phrase entropy under
- *     `HKDF(ECDH(both keys), moveId)`, authorized by a one-use root proof over the
- *     exact sealed bytes.
- *  6. `POST /identity/move/:moveId/receipt` — Commons stores the root, reads it
- *     back from its keychain, and signs a receipt over the move, the root, both
- *     keys and the digest of the ciphertext it opened. The server verifies it; the
- *     web verifies it again from what IT sealed before removing anything.
- *
- * Why the commitment: without it the relay sees both keys before committing to
- * anything and can grind a substituted key until the two codes agree (~10⁶
- * tries, seconds). With it, the relay must fix the key it shows Commons before
- * learning Commons' key, and the key it shows the web before the web reveals.
- *
- * The server holds a commitment, two ephemeral public keys, an opaque ciphertext
- * and a receipt — nothing that decrypts the ciphertext.
- *
- * Platform-agnostic — zod only, ESM-safe (no `require()`).
- */
-const zod_1 = require("zod");
-const identityProof_1 = require("./identityProof");
-/** A move lives this long: one interactive handoff. */
-exports.IDENTITY_MOVE_TTL_MS = 5 * 60 * 1000;
-/** 128-bit move id, lowercase hex. */
-exports.identityMoveIdSchema = zod_1.z
-    .string()
-    .trim()
-    .regex(/^[0-9a-f]{32}$/, 'moveId must be 32 lowercase hex characters');
-/** An ephemeral secp256k1 public key, uncompressed lowercase hex. */
-exports.identityMoveEphemeralKeySchema = zod_1.z
-    .string()
-    .trim()
-    .regex(/^04[0-9a-f]{128}$/, 'ephemeral public key must be uncompressed, lowercase hex');
-exports.IDENTITY_MOVE_STATUSES = ['pending', 'joined', 'sealed', 'completed', 'cancelled', 'expired'];
-/** The QR payload Commons scans. Carries the move id only. */
-exports.IDENTITY_MOVE_QR_PREFIX = 'oxycommons://move?id=';
-const hex64 = (label) => zod_1.z.string().trim().regex(/^[0-9a-f]{64}$/, `${label} must be 64 lowercase hex characters`);
-exports.identityMoveCreateRequestSchema = zod_1.z
-    .object({
-    /** `H(initiator ephemeral key, nonce)` — the key itself is revealed only after Commons joins. */
-    initiatorCommitment: hex64('initiatorCommitment'),
-})
-    .strict();
-exports.identityMoveCreateResponseSchema = zod_1.z.object({
-    moveId: exports.identityMoveIdSchema,
-    expiresAt: zod_1.z.string().datetime(),
-});
-exports.identityMoveJoinRequestSchema = zod_1.z.object({
-    responderEphemeralPublicKey: exports.identityMoveEphemeralKeySchema,
-});
-/** After Commons joined: the committed key and its nonce. */
-exports.identityMoveRevealRequestSchema = zod_1.z
-    .object({
-    initiatorEphemeralPublicKey: exports.identityMoveEphemeralKeySchema,
-    commitmentNonce: hex64('commitmentNonce'),
-})
-    .strict();
-exports.identityMoveSealRequestSchema = zod_1.z
-    .object({
-    /** 24-byte XChaCha20-Poly1305 nonce, hex. */
-    nonce: zod_1.z.string().trim().regex(/^[0-9a-f]{48}$/, 'nonce must be 48 lowercase hex characters'),
-    /** The 16–32-byte phrase entropy (12–24 words), tag appended, hex. */
-    ciphertext: zod_1.z
-        .string()
-        .trim()
-        .regex(/^(?:[0-9a-f]{64}|[0-9a-f]{72}|[0-9a-f]{80}|[0-9a-f]{88}|[0-9a-f]{96})$/, 'ciphertext has an unsupported length'),
-    /**
-     * Root proof (`identity_move_seal`), payload `{ moveId, nonce, ciphertext }`,
-     * over a one-use challenge from `POST /identity/proof-challenge`.
-     */
-    proof: identityProof_1.identityProofSchema,
-})
-    .strict();
-exports.identityMoveReceiptRequestSchema = zod_1.z
-    .object({
-    /** Root signature over `buildMoveReceiptMessage(...)`. */
-    signature: zod_1.z.string().trim().min(1).max(512),
-})
-    .strict();
-exports.identityMoveStateSchema = zod_1.z.object({
-    moveId: exports.identityMoveIdSchema,
-    status: zod_1.z.enum(exports.IDENTITY_MOVE_STATUSES),
-    initiatorCommitment: zod_1.z.string(),
-    initiatorCommitmentNonce: zod_1.z.string().nullable(),
-    publicKey: zod_1.z.string().regex(/^04[0-9a-f]{128}$/),
-    initiatorEphemeralPublicKey: exports.identityMoveEphemeralKeySchema.nullable(),
-    responderEphemeralPublicKey: exports.identityMoveEphemeralKeySchema.nullable(),
-    nonce: zod_1.z.string().nullable(),
-    ciphertext: zod_1.z.string().nullable(),
-    receiptSignature: zod_1.z.string().nullable(),
-    expiresAt: zod_1.z.string().datetime(),
-});
-/**
- * The initiator's commitment input, `canonicalJson({ v, purpose, key, nonce })`,
- * which the caller hashes with SHA-256.
- */
-function buildMoveCommitmentInput(initiatorEphemeralPublicKey, nonce) {
-    return (0, identityProof_1.canonicalJson)({
-        v: 2,
-        purpose: 'oxy-identity-move-initiator-commitment',
-        initiatorEphemeralPublicKey: initiatorEphemeralPublicKey.toLowerCase(),
-        nonce: nonce.toLowerCase(),
-    });
-}
-/** The bytes both sides hash for the 6-digit code. */
-function buildMoveSasInput(input) {
-    return (0, identityProof_1.canonicalJson)({
-        v: 'oxy-identity-transfer-sas-v2',
-        moveId: input.moveId.toLowerCase(),
-        initiator: input.initiatorEphemeralPublicKey.toLowerCase(),
-        responder: input.responderEphemeralPublicKey.toLowerCase(),
-        commitment: input.initiatorCommitment.toLowerCase(),
-    });
-}
-/** The ciphertext digest input the receipt binds: `canonicalJson({ nonce, ciphertext })`. */
-function buildMoveCiphertextDigestInput(sealed) {
-    return (0, identityProof_1.canonicalJson)({ nonce: sealed.nonce.toLowerCase(), ciphertext: sealed.ciphertext.toLowerCase() });
-}
-/** The payload a seal proof digests. */
-function buildMoveSealPayload(moveId, sealed) {
-    return { moveId: moveId.toLowerCase(), nonce: sealed.nonce.toLowerCase(), ciphertext: sealed.ciphertext.toLowerCase() };
-}
-/** The exact bytes a receipt signs. */
-function buildMoveReceiptMessage(input) {
-    return (0, identityProof_1.canonicalJson)({
-        v: 2,
-        domain: 'oxy-identity-move-receipt',
-        moveId: input.moveId.toLowerCase(),
-        rootPublicKey: input.rootPublicKey.toLowerCase(),
-        initiator: input.initiatorEphemeralPublicKey.toLowerCase(),
-        responder: input.responderEphemeralPublicKey.toLowerCase(),
-        ciphertextDigest: input.ciphertextDigest.toLowerCase(),
-    });
-}

package/dist/cjs/identityRecovery.js

@@ -1,51 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.identityRecoveryCompleteRequestSchema = exports.identityRecoveryStartRequestSchema = exports.identityRecoveryChallengeResponseSchema = exports.IDENTITY_RECOVERY_TTL_MS = void 0;
-/**
- * Signed-out recovery contract (ADR 0024 D5) — get an EXISTING account back from
- * its root alone, with no passkey, session or email.
- *
- *  1. `POST /identity/recovery/challenge` → a one-use challenge. It says nothing
- *     about any account.
- *  2. The holder derives the root locally from recovery material (12/24 words or a
- *     raw key) and signs `recover_account_start` over that challenge:
- *     `POST /identity/recovery/start { publicKey, proof }`. Only a valid proof
- *     learns which account the root belongs to; the response carries passkey
- *     registration options for THAT account and a short-lived ticket.
- *  3. The holder creates the passkey, seals the root under it (PRF), and signs
- *     `recover_account_complete` over the registration challenge and the envelope
- *     digest: `POST /identity/recovery/complete`. The passkey, the envelope and a
- *     session are created in one transaction.
- *
- * The recovery material and the root never leave the holder. Platform-agnostic —
- * zod only, ESM-safe.
- */
-const zod_1 = require("zod");
-const identityProof_1 = require("./identityProof");
-const webIdentityCarrier_1 = require("./webIdentityCarrier");
-/** A recovery attempt lives this long between steps. */
-exports.IDENTITY_RECOVERY_TTL_MS = 5 * 60 * 1000;
-exports.identityRecoveryChallengeResponseSchema = zod_1.z.object({
-    challenge: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
-    expiresAt: zod_1.z.number().int().positive(),
-});
-exports.identityRecoveryStartRequestSchema = zod_1.z
-    .object({
-    publicKey: webIdentityCarrier_1.webIdentityPublicKeySchema,
-    /** `recover_account_start`, subject `root:<publicKey>`, actor `anonymous`. */
-    proof: identityProof_1.identityProofSchema,
-})
-    .strict();
-exports.identityRecoveryCompleteRequestSchema = zod_1.z
-    .object({
-    ticket: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
-    /** The browser `RegistrationResponseJSON`, verified by the API's WebAuthn library. */
-    response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
-    /** The root sealed under the new passkey — exactly one wrap, for that credential. */
-    envelope: webIdentityCarrier_1.webIdentityEnvelopeSchema,
-    /** `recover_account_complete`, subject = account id, actor `credential:<id>`, challenge = registration challenge (hex). */
-    proof: identityProof_1.identityProofSchema,
-    deviceName: zod_1.z.string().trim().max(100).optional(),
-    deviceFingerprint: zod_1.z.string().trim().max(512).optional(),
-})
-    .strict();

package/dist/cjs/webIdentityCarrier.js

@@ -1,181 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.webIdentityEnvelopeEstablishSchema = exports.webauthnAssertionResponseSchema = exports.webIdentityEnvelopePutSchema = exports.webIdentityEnvelopeActionSchema = exports.webIdentityEnvelopeProofFieldsSchema = exports.webIdentityEnvelopeResponseSchema = exports.webIdentityHolderSchema = exports.webIdentityEnvelopeUploadSchema = exports.webIdentityEnvelopeSchema = exports.webIdentityWrapSchema = exports.webauthnRpIdSchema = exports.webauthnCredentialIdSchema = exports.webIdentityPublicKeySchema = exports.WEB_IDENTITY_SECRET_KINDS = exports.WEB_IDENTITY_ENVELOPE_VERSION = void 0;
-/**
- * Web identity holder contract — the sealed envelope that lets a browser hold an
- * account's self-custody root without Oxy ever being able to use it (ADR 0024).
- *
- * A root is a BIP-39 phrase (12–24 words) whose seed's first 32 bytes are the
- * secp256k1 key — exactly the Commons derivation — or, for a few imported
- * identities, a raw private key that never had a phrase. On the web it travels as:
- *
- *   secret ── XChaCha20-Poly1305 under a random DEK ──▶ sealedSecret
- *   DEK    ── XChaCha20-Poly1305 under KEK_i ──▶ wraps[i]
- *   KEK_i = HKDF(PRF output of passkey i)
- *
- * The server stores the envelope and can open NONE of it: the PRF output never
- * leaves the user's authenticator, and the secret is never uploaded. The AEAD
- * associated data binds the secret to the root's public key and kind, and each
- * wrap to its credential and RP ID, so a re-labelled or transplanted envelope
- * fails to open instead of decrypting into the wrong identity.
- *
- * Platform-agnostic — zod only, ESM-safe (no `require()`).
- */
-const zod_1 = require("zod");
-const identityProof_1 = require("./identityProof");
-/** The envelope scheme. A scheme change is a new literal, never a mutation. */
-exports.WEB_IDENTITY_ENVELOPE_VERSION = 2;
-/**
- * What an envelope seals. A raw-key identity stays a raw-key identity:
- * nothing ever derives or displays a phrase for it.
- */
-exports.WEB_IDENTITY_SECRET_KINDS = ['mnemonic-entropy', 'raw-private-key'];
-const hex = (bytes, label) => zod_1.z
-    .string()
-    .trim()
-    .regex(new RegExp(`^[0-9a-fA-F]{${bytes * 2}}$`), `${label} must be ${bytes * 2} hex characters`);
-/**
- * The identity's secp256k1 public key in Oxy's canonical form: uncompressed SEC1
- * (`04` + 64 bytes), lowercase hex — what `KeyManager.derivePublicKey` produces
- * and `users.public_key` stores.
- */
-exports.webIdentityPublicKeySchema = zod_1.z
-    .string()
-    .trim()
-    .regex(/^04[0-9a-f]{128}$/, 'publicKey must be an uncompressed, lowercase secp256k1 key (130 hex characters)');
-/** A WebAuthn credential id, base64url as the browser reports it. */
-exports.webauthnCredentialIdSchema = zod_1.z
-    .string()
-    .trim()
-    .min(16)
-    .max(1024)
-    .regex(/^[A-Za-z0-9_-]+$/, 'credentialId must be base64url');
-/** A WebAuthn RP ID: a bare registrable host name, lowercase. */
-exports.webauthnRpIdSchema = zod_1.z
-    .string()
-    .trim()
-    .min(1)
-    .max(253)
-    .regex(/^(localhost|[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+)$/, 'rpId must be a lowercase host name');
-/** One passkey's wrap of the envelope's data key. */
-exports.webIdentityWrapSchema = zod_1.z.object({
-    credentialId: exports.webauthnCredentialIdSchema,
-    /** 24-byte XChaCha20-Poly1305 nonce. */
-    nonce: hex(24, 'nonce'),
-    /** The 32-byte DEK sealed under this passkey's KEK, with the 16-byte tag appended (48 bytes). */
-    wrappedKey: hex(48, 'wrappedKey'),
-    createdAt: zod_1.z.string().datetime(),
-    /** The RP ID the passkey was created under, asserted explicitly by every later ceremony (ADR 0024 D2). */
-    rpId: exports.webauthnRpIdSchema,
-    /**
-     * When this passkey's PRF output was shown to open the envelope. A wrap is a
-     * root HOLDER only once this is set; a login passkey never is by default.
-     */
-    verifiedAt: zod_1.z.string().datetime().optional(),
-});
-/**
- * The sealed identity as it is stored (server copy and local copy alike).
- *
- * `wraps` holds one entry per passkey able to open it; at least one, and a
- * bounded number so an envelope cannot grow without limit.
- */
-exports.webIdentityEnvelopeSchema = zod_1.z
-    .object({
-    version: zod_1.z.literal(exports.WEB_IDENTITY_ENVELOPE_VERSION),
-    algorithm: zod_1.z.literal('xchacha20poly1305'),
-    publicKey: exports.webIdentityPublicKeySchema,
-    secretKind: zod_1.z.enum(exports.WEB_IDENTITY_SECRET_KINDS),
-    /** 24-byte nonce of the secret seal. */
-    secretNonce: hex(24, 'secretNonce'),
-    /**
-     * The sealed secret, tag appended: 16/20/24/28/32 bytes of BIP-39 entropy
-     * (12–24 words) or a 32-byte private key, plus 16.
-     */
-    sealedSecret: zod_1.z
-        .string()
-        .trim()
-        .regex(/^(?:[0-9a-fA-F]{64}|[0-9a-fA-F]{72}|[0-9a-fA-F]{80}|[0-9a-fA-F]{88}|[0-9a-fA-F]{96})$/, 'sealedSecret has an unsupported length'),
-    wraps: zod_1.z.array(exports.webIdentityWrapSchema).min(1).max(10),
-})
-    .refine((envelope) => envelope.secretKind === 'mnemonic-entropy' || envelope.sealedSecret.length === 96, {
-    message: 'a raw private key seals to 48 bytes',
-    path: ['sealedSecret'],
-});
-/**
- * `PUT /identity/web-envelope` — store or replace the caller's envelope.
- *
- * Refused unless `envelope.publicKey` is the identity key already linked to the
- * account: an envelope can only ever carry the account's own identity.
- */
-exports.webIdentityEnvelopeUploadSchema = zod_1.z.object({
-    envelope: exports.webIdentityEnvelopeSchema,
-});
-/** A root holder as the status read reports it — metadata only, nothing that opens anything. */
-exports.webIdentityHolderSchema = zod_1.z.object({
-    credentialId: exports.webauthnCredentialIdSchema,
-    rpId: exports.webauthnRpIdSchema,
-    verifiedAt: zod_1.z.string().datetime().nullable(),
-    createdAt: zod_1.z.string().datetime(),
-});
-/**
- * `GET /identity/web-envelope` — the caller's envelope and the readiness facts
- * ADR 0024 D5 keeps separate. A client decides what to show from these fields
- * WITHOUT decrypting anything.
- */
-exports.webIdentityEnvelopeResponseSchema = zod_1.z.object({
-    envelope: exports.webIdentityEnvelopeSchema.nullable(),
-    /** The revision a write must name as `expectedRevision`; `0` when there is no envelope. */
-    revision: zod_1.z.number().int().nonnegative(),
-    /** Whether the account has a linked root at all (it may live only in Commons). */
-    rootLinked: zod_1.z.boolean(),
-    /** The web wraps, as metadata. */
-    holders: zod_1.z.array(exports.webIdentityHolderSchema),
-    /** When the owner confirmed the recovery material is written down, or `null`. */
-    phraseConfirmedAt: zod_1.z.string().datetime().nullable(),
-    /** When the recovery material was shown to re-derive this root, or `null`. */
-    recoveryVerifiedAt: zod_1.z.string().datetime().nullable(),
-    updatedAt: zod_1.z.string().datetime().nullable(),
-});
-/** A root proof, plus the envelope revision the write expects to replace. */
-exports.webIdentityEnvelopeProofFieldsSchema = zod_1.z.object({
-    proof: identityProof_1.identityProofSchema,
-    expectedRevision: zod_1.z.number().int().nonnegative(),
-});
-/**
- * `POST /identity/web-envelope/phrase-confirmed`, `/recovery-verified` and
- * `DELETE /identity/web-envelope` prove control of the root, not just a bearer.
- */
-exports.webIdentityEnvelopeActionSchema = exports.webIdentityEnvelopeProofFieldsSchema.strict();
-/** `PUT /identity/web-envelope` body. */
-exports.webIdentityEnvelopePutSchema = exports.webIdentityEnvelopeUploadSchema.extend(exports.webIdentityEnvelopeProofFieldsSchema.shape).strict();
-/**
- * A WebAuthn assertion by one of the account's EXISTING passkeys whose
- * `clientDataJSON.challenge` is the proof challenge — the fresh use of the
- * existing factor a keyless account needs before its first root is linked.
- */
-exports.webauthnAssertionResponseSchema = zod_1.z
-    .object({
-    id: exports.webauthnCredentialIdSchema,
-    rawId: zod_1.z.string().min(1).max(2048),
-    type: zod_1.z.literal('public-key'),
-    response: zod_1.z
-        .object({
-        clientDataJSON: zod_1.z.string().min(1).max(8192),
-        authenticatorData: zod_1.z.string().min(1).max(8192),
-        signature: zod_1.z.string().min(1).max(2048),
-        userHandle: zod_1.z.string().max(2048).optional(),
-    })
-        .passthrough(),
-    clientExtensionResults: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
-    authenticatorAttachment: zod_1.z.string().optional(),
-})
-    .passthrough();
-/**
- * `POST /identity/web-envelope/establish` body — an account's FIRST root, linked
- * and stored with its envelope in ONE transaction: one root proof
- * (`web_envelope_establish`, digest of the envelope) plus a fresh `assertion` by
- * an existing passkey over the same challenge.
- */
-exports.webIdentityEnvelopeEstablishSchema = exports.webIdentityEnvelopeUploadSchema
-    .extend({ proof: identityProof_1.identityProofSchema, assertion: exports.webauthnAssertionResponseSchema })
-    .strict();

package/dist/cjs/webauthn.js

@@ -1,85 +0,0 @@
-"use strict";
-/**
- * WebAuthn / passkey ceremony contracts (Fase B/b1).
- *
- * These schemas describe ONLY the outer Oxy envelope that wraps a WebAuthn
- * ceremony request — the username the client is registering/authenticating as,
- * plus non-authoritative device metadata. The browser
- * `RegistrationResponseJSON` / `AuthenticationResponseJSON` payloads are NOT
- * mirrored here: they are validated by `@simplewebauthn/server` inside the route
- * (`verifyRegistrationResponse` / `verifyAuthenticationResponse`), which is the
- * single source of truth for their structure. Re-encoding them in Zod would just
- * create a second, drift-prone definition of a shape we do not own.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = void 0;
-const zod_1 = require("zod");
-const identityProof_1 = require("./identityProof");
-const webIdentityCarrier_1 = require("./webIdentityCarrier");
-/**
- * Device-session options shared by every first-party sign-in body
- * (`deviceName`/`deviceFingerprint`). Mirrors what
- * `sessionCreateOptionsFromBody` reads in the API so a WebAuthn login/verify can
- * name its resulting session exactly like `/auth/login` or `/auth/verify`.
- *
- * There is deliberately no `deviceId` here. `createSession` treats an explicit
- * device id as authoritative — `deviceId > stableDeviceKey > UA/IP > random` —
- * and stamps it verbatim, so on an UNAUTHENTICATED sign-in body it is a caller
- * naming somebody else's device and having a session, and then a device secret,
- * minted against it. The legitimate callers that pin a device id are
- * server-side and already authorized (the account-switch route threading the
- * operator's own central device id); they pass it to `createSession` directly
- * and never through a request body.
- */
-const deviceSessionEnvelope = {
-    deviceName: zod_1.z.string().trim().min(1).max(120).optional(),
-    deviceFingerprint: zod_1.z.string().trim().min(1).max(256).optional(),
-};
-/**
- * `POST /webauthn/register/options` — request registration options. With a bearer
- * token the caller links a passkey to their signed-in account and `username` is
- * ignored; without one it is a prospective signup and `username` is the desired
- * (not-yet-created) handle.
- */
-exports.webauthnRegisterOptionsRequestSchema = zod_1.z.object({
-    username: zod_1.z.string().trim().min(1).max(60).optional(),
-});
-/**
- * `POST /webauthn/login/options` — request authentication options. When
- * `username` is present the server scopes `allowCredentials` to that user's
- * passkeys (username-first); when omitted it returns an empty allow-list for the
- * usernameless / discoverable-credential flow (the default).
- */
-exports.webauthnLoginOptionsRequestSchema = zod_1.z.object({
-    username: zod_1.z.string().trim().min(1).max(60).optional(),
-});
-/**
- * `POST /webauthn/register/verify` — the outer envelope. The browser
- * `RegistrationResponseJSON` travels alongside these fields under `response` and
- * is validated by `@simplewebauthn/server`, not here. `username` is required only
- * for the prospective-signup branch (no bearer); the linking branch ignores it.
- */
-exports.webauthnRegisterVerifyRequestSchema = zod_1.z.object({
-    username: zod_1.z.string().trim().min(1).max(60).optional(),
-    /**
-     * Sign-up only (ADR 0024 D4): the account's root, created on the holder BEFORE
-     * this request — sealed under the passkey being registered — and a root proof
-     * (`enroll_identity`) whose challenge is the registration challenge. The
-     * account, passkey, root and envelope are then created in one transaction.
-     */
-    identity: zod_1.z
-        .object({
-        envelope: webIdentityCarrier_1.webIdentityEnvelopeSchema,
-        proof: identityProof_1.identityProofSchema,
-    })
-        .optional(),
-    ...deviceSessionEnvelope,
-});
-/**
- * `POST /webauthn/login/verify` — the outer envelope. The browser
- * `AuthenticationResponseJSON` travels alongside these fields under `response`
- * and is validated by `@simplewebauthn/server`, not here.
- */
-exports.webauthnLoginVerifyRequestSchema = zod_1.z.object({
-    ...deviceSessionEnvelope,
-});

package/dist/esm/identityMove.js

@@ -1,148 +0,0 @@
-/**
- * Identity move contract — give a web root to Commons (add it, or keep it only in
- * Commons; ADR 0024 D6).
- *
- * The web (holding the root) shows a QR carrying only a move id; Commons scans.
- * The relay in between must not be able to take the root, so:
- *
- *  1. `POST /identity/move { initiatorCommitment }` — the web publishes only
- *     `H(initiatorKey, nonce)`, never the key.
- *  2. `POST /identity/move/:moveId/join { responderEphemeralPublicKey }` —
- *     Commons, having read the commitment first, joins with its own key.
- *  3. `POST /identity/move/:moveId/reveal` — only then does the web reveal its
- *     key and nonce; Commons checks them against the commitment it read.
- *  4. Both screens show a 6-digit code over `(moveId, both keys, commitment)`;
- *     the person confirms on the web that they match.
- *  5. `POST /identity/move/:moveId/seal` — the web seals the phrase entropy under
- *     `HKDF(ECDH(both keys), moveId)`, authorized by a one-use root proof over the
- *     exact sealed bytes.
- *  6. `POST /identity/move/:moveId/receipt` — Commons stores the root, reads it
- *     back from its keychain, and signs a receipt over the move, the root, both
- *     keys and the digest of the ciphertext it opened. The server verifies it; the
- *     web verifies it again from what IT sealed before removing anything.
- *
- * Why the commitment: without it the relay sees both keys before committing to
- * anything and can grind a substituted key until the two codes agree (~10⁶
- * tries, seconds). With it, the relay must fix the key it shows Commons before
- * learning Commons' key, and the key it shows the web before the web reveals.
- *
- * The server holds a commitment, two ephemeral public keys, an opaque ciphertext
- * and a receipt — nothing that decrypts the ciphertext.
- *
- * Platform-agnostic — zod only, ESM-safe (no `require()`).
- */
-import { z } from 'zod';
-import { canonicalJson, identityProofSchema } from './identityProof.js';
-/** A move lives this long: one interactive handoff. */
-export const IDENTITY_MOVE_TTL_MS = 5 * 60 * 1000;
-/** 128-bit move id, lowercase hex. */
-export const identityMoveIdSchema = z
-    .string()
-    .trim()
-    .regex(/^[0-9a-f]{32}$/, 'moveId must be 32 lowercase hex characters');
-/** An ephemeral secp256k1 public key, uncompressed lowercase hex. */
-export const identityMoveEphemeralKeySchema = z
-    .string()
-    .trim()
-    .regex(/^04[0-9a-f]{128}$/, 'ephemeral public key must be uncompressed, lowercase hex');
-export const IDENTITY_MOVE_STATUSES = ['pending', 'joined', 'sealed', 'completed', 'cancelled', 'expired'];
-/** The QR payload Commons scans. Carries the move id only. */
-export const IDENTITY_MOVE_QR_PREFIX = 'oxycommons://move?id=';
-const hex64 = (label) => z.string().trim().regex(/^[0-9a-f]{64}$/, `${label} must be 64 lowercase hex characters`);
-export const identityMoveCreateRequestSchema = z
-    .object({
-    /** `H(initiator ephemeral key, nonce)` — the key itself is revealed only after Commons joins. */
-    initiatorCommitment: hex64('initiatorCommitment'),
-})
-    .strict();
-export const identityMoveCreateResponseSchema = z.object({
-    moveId: identityMoveIdSchema,
-    expiresAt: z.string().datetime(),
-});
-export const identityMoveJoinRequestSchema = z.object({
-    responderEphemeralPublicKey: identityMoveEphemeralKeySchema,
-});
-/** After Commons joined: the committed key and its nonce. */
-export const identityMoveRevealRequestSchema = z
-    .object({
-    initiatorEphemeralPublicKey: identityMoveEphemeralKeySchema,
-    commitmentNonce: hex64('commitmentNonce'),
-})
-    .strict();
-export const identityMoveSealRequestSchema = z
-    .object({
-    /** 24-byte XChaCha20-Poly1305 nonce, hex. */
-    nonce: z.string().trim().regex(/^[0-9a-f]{48}$/, 'nonce must be 48 lowercase hex characters'),
-    /** The 16–32-byte phrase entropy (12–24 words), tag appended, hex. */
-    ciphertext: z
-        .string()
-        .trim()
-        .regex(/^(?:[0-9a-f]{64}|[0-9a-f]{72}|[0-9a-f]{80}|[0-9a-f]{88}|[0-9a-f]{96})$/, 'ciphertext has an unsupported length'),
-    /**
-     * Root proof (`identity_move_seal`), payload `{ moveId, nonce, ciphertext }`,
-     * over a one-use challenge from `POST /identity/proof-challenge`.
-     */
-    proof: identityProofSchema,
-})
-    .strict();
-export const identityMoveReceiptRequestSchema = z
-    .object({
-    /** Root signature over `buildMoveReceiptMessage(...)`. */
-    signature: z.string().trim().min(1).max(512),
-})
-    .strict();
-export const identityMoveStateSchema = z.object({
-    moveId: identityMoveIdSchema,
-    status: z.enum(IDENTITY_MOVE_STATUSES),
-    initiatorCommitment: z.string(),
-    initiatorCommitmentNonce: z.string().nullable(),
-    publicKey: z.string().regex(/^04[0-9a-f]{128}$/),
-    initiatorEphemeralPublicKey: identityMoveEphemeralKeySchema.nullable(),
-    responderEphemeralPublicKey: identityMoveEphemeralKeySchema.nullable(),
-    nonce: z.string().nullable(),
-    ciphertext: z.string().nullable(),
-    receiptSignature: z.string().nullable(),
-    expiresAt: z.string().datetime(),
-});
-/**
- * The initiator's commitment input, `canonicalJson({ v, purpose, key, nonce })`,
- * which the caller hashes with SHA-256.
- */
-export function buildMoveCommitmentInput(initiatorEphemeralPublicKey, nonce) {
-    return canonicalJson({
-        v: 2,
-        purpose: 'oxy-identity-move-initiator-commitment',
-        initiatorEphemeralPublicKey: initiatorEphemeralPublicKey.toLowerCase(),
-        nonce: nonce.toLowerCase(),
-    });
-}
-/** The bytes both sides hash for the 6-digit code. */
-export function buildMoveSasInput(input) {
-    return canonicalJson({
-        v: 'oxy-identity-transfer-sas-v2',
-        moveId: input.moveId.toLowerCase(),
-        initiator: input.initiatorEphemeralPublicKey.toLowerCase(),
-        responder: input.responderEphemeralPublicKey.toLowerCase(),
-        commitment: input.initiatorCommitment.toLowerCase(),
-    });
-}
-/** The ciphertext digest input the receipt binds: `canonicalJson({ nonce, ciphertext })`. */
-export function buildMoveCiphertextDigestInput(sealed) {
-    return canonicalJson({ nonce: sealed.nonce.toLowerCase(), ciphertext: sealed.ciphertext.toLowerCase() });
-}
-/** The payload a seal proof digests. */
-export function buildMoveSealPayload(moveId, sealed) {
-    return { moveId: moveId.toLowerCase(), nonce: sealed.nonce.toLowerCase(), ciphertext: sealed.ciphertext.toLowerCase() };
-}
-/** The exact bytes a receipt signs. */
-export function buildMoveReceiptMessage(input) {
-    return canonicalJson({
-        v: 2,
-        domain: 'oxy-identity-move-receipt',
-        moveId: input.moveId.toLowerCase(),
-        rootPublicKey: input.rootPublicKey.toLowerCase(),
-        initiator: input.initiatorEphemeralPublicKey.toLowerCase(),
-        responder: input.responderEphemeralPublicKey.toLowerCase(),
-        ciphertextDigest: input.ciphertextDigest.toLowerCase(),
-    });
-}