@oxy.so/contracts 2.1.0 → 3.0.0

package/dist/types/identityRecovery.d.ts

@@ -1,246 +0,0 @@
-/**
- * Signed-out recovery contract (ADR 0024 D5) — get an EXISTING account back from
- * its root alone, with no passkey, session or email.
- *
- *  1. `POST /identity/recovery/challenge` → a one-use challenge. It says nothing
- *     about any account.
- *  2. The holder derives the root locally from recovery material (12/24 words or a
- *     raw key) and signs `recover_account_start` over that challenge:
- *     `POST /identity/recovery/start { publicKey, proof }`. Only a valid proof
- *     learns which account the root belongs to; the response carries passkey
- *     registration options for THAT account and a short-lived ticket.
- *  3. The holder creates the passkey, seals the root under it (PRF), and signs
- *     `recover_account_complete` over the registration challenge and the envelope
- *     digest: `POST /identity/recovery/complete`. The passkey, the envelope and a
- *     session are created in one transaction.
- *
- * The recovery material and the root never leave the holder. Platform-agnostic —
- * zod only, ESM-safe.
- */
-import { z } from 'zod';
-/** A recovery attempt lives this long between steps. */
-export declare const IDENTITY_RECOVERY_TTL_MS: number;
-export interface IdentityRecoveryChallengeResponse {
-    /** 32 bytes, lowercase hex. */
-    challenge: string;
-    /** Unix milliseconds. */
-    expiresAt: number;
-}
-export declare const identityRecoveryChallengeResponseSchema: z.ZodType<IdentityRecoveryChallengeResponse>;
-export declare const identityRecoveryStartRequestSchema: z.ZodObject<{
-    publicKey: z.ZodString;
-    /** `recover_account_start`, subject `root:<publicKey>`, actor `anonymous`. */
-    proof: z.ZodObject<{
-        v: z.ZodLiteral<2>;
-        challenge: z.ZodString;
-        expiresAt: z.ZodNumber;
-        signature: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        expiresAt: number;
-        signature: string;
-        v: 2;
-        challenge: string;
-    }, {
-        expiresAt: number;
-        signature: string;
-        v: 2;
-        challenge: string;
-    }>;
-}, "strict", z.ZodTypeAny, {
-    publicKey: string;
-    proof: {
-        expiresAt: number;
-        signature: string;
-        v: 2;
-        challenge: string;
-    };
-}, {
-    publicKey: string;
-    proof: {
-        expiresAt: number;
-        signature: string;
-        v: 2;
-        challenge: string;
-    };
-}>;
-export type IdentityRecoveryStartRequest = z.infer<typeof identityRecoveryStartRequestSchema>;
-export interface IdentityRecoveryStartResponse {
-    /** Opaque, one-use; presented once to `complete`. */
-    ticket: string;
-    accountId: string;
-    username: string | null;
-    /** `PublicKeyCredentialCreationOptionsJSON` for the account's new passkey. */
-    registrationOptions: Record<string, unknown>;
-    /** Unix milliseconds. */
-    expiresAt: number;
-}
-export declare const identityRecoveryCompleteRequestSchema: z.ZodObject<{
-    ticket: z.ZodString;
-    /** The browser `RegistrationResponseJSON`, verified by the API's WebAuthn library. */
-    response: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    /** The root sealed under the new passkey — exactly one wrap, for that credential. */
-    envelope: z.ZodEffects<z.ZodObject<{
-        version: z.ZodLiteral<2>;
-        algorithm: z.ZodLiteral<"xchacha20poly1305">;
-        publicKey: z.ZodString;
-        secretKind: z.ZodEnum<["mnemonic-entropy", "raw-private-key"]>;
-        secretNonce: z.ZodString;
-        sealedSecret: z.ZodString;
-        wraps: z.ZodArray<z.ZodObject<{
-            credentialId: z.ZodString;
-            nonce: z.ZodString;
-            wrappedKey: z.ZodString;
-            createdAt: z.ZodString;
-            rpId: z.ZodString;
-            verifiedAt: z.ZodOptional<z.ZodString>;
-        }, "strip", z.ZodTypeAny, {
-            credentialId: string;
-            createdAt: string;
-            nonce: string;
-            wrappedKey: string;
-            rpId: string;
-            verifiedAt?: string | undefined;
-        }, {
-            credentialId: string;
-            createdAt: string;
-            nonce: string;
-            wrappedKey: string;
-            rpId: string;
-            verifiedAt?: string | undefined;
-        }>, "many">;
-    }, "strip", z.ZodTypeAny, {
-        version: 2;
-        publicKey: string;
-        algorithm: "xchacha20poly1305";
-        secretKind: "mnemonic-entropy" | "raw-private-key";
-        secretNonce: string;
-        sealedSecret: string;
-        wraps: {
-            credentialId: string;
-            createdAt: string;
-            nonce: string;
-            wrappedKey: string;
-            rpId: string;
-            verifiedAt?: string | undefined;
-        }[];
-    }, {
-        version: 2;
-        publicKey: string;
-        algorithm: "xchacha20poly1305";
-        secretKind: "mnemonic-entropy" | "raw-private-key";
-        secretNonce: string;
-        sealedSecret: string;
-        wraps: {
-            credentialId: string;
-            createdAt: string;
-            nonce: string;
-            wrappedKey: string;
-            rpId: string;
-            verifiedAt?: string | undefined;
-        }[];
-    }>, {
-        version: 2;
-        publicKey: string;
-        algorithm: "xchacha20poly1305";
-        secretKind: "mnemonic-entropy" | "raw-private-key";
-        secretNonce: string;
-        sealedSecret: string;
-        wraps: {
-            credentialId: string;
-            createdAt: string;
-            nonce: string;
-            wrappedKey: string;
-            rpId: string;
-            verifiedAt?: string | undefined;
-        }[];
-    }, {
-        version: 2;
-        publicKey: string;
-        algorithm: "xchacha20poly1305";
-        secretKind: "mnemonic-entropy" | "raw-private-key";
-        secretNonce: string;
-        sealedSecret: string;
-        wraps: {
-            credentialId: string;
-            createdAt: string;
-            nonce: string;
-            wrappedKey: string;
-            rpId: string;
-            verifiedAt?: string | undefined;
-        }[];
-    }>;
-    /** `recover_account_complete`, subject = account id, actor `credential:<id>`, challenge = registration challenge (hex). */
-    proof: z.ZodObject<{
-        v: z.ZodLiteral<2>;
-        challenge: z.ZodString;
-        expiresAt: z.ZodNumber;
-        signature: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        expiresAt: number;
-        signature: string;
-        v: 2;
-        challenge: string;
-    }, {
-        expiresAt: number;
-        signature: string;
-        v: 2;
-        challenge: string;
-    }>;
-    deviceName: z.ZodOptional<z.ZodString>;
-    deviceFingerprint: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    proof: {
-        expiresAt: number;
-        signature: string;
-        v: 2;
-        challenge: string;
-    };
-    envelope: {
-        version: 2;
-        publicKey: string;
-        algorithm: "xchacha20poly1305";
-        secretKind: "mnemonic-entropy" | "raw-private-key";
-        secretNonce: string;
-        sealedSecret: string;
-        wraps: {
-            credentialId: string;
-            createdAt: string;
-            nonce: string;
-            wrappedKey: string;
-            rpId: string;
-            verifiedAt?: string | undefined;
-        }[];
-    };
-    response: Record<string, unknown>;
-    ticket: string;
-    deviceName?: string | undefined;
-    deviceFingerprint?: string | undefined;
-}, {
-    proof: {
-        expiresAt: number;
-        signature: string;
-        v: 2;
-        challenge: string;
-    };
-    envelope: {
-        version: 2;
-        publicKey: string;
-        algorithm: "xchacha20poly1305";
-        secretKind: "mnemonic-entropy" | "raw-private-key";
-        secretNonce: string;
-        sealedSecret: string;
-        wraps: {
-            credentialId: string;
-            createdAt: string;
-            nonce: string;
-            wrappedKey: string;
-            rpId: string;
-            verifiedAt?: string | undefined;
-        }[];
-    };
-    response: Record<string, unknown>;
-    ticket: string;
-    deviceName?: string | undefined;
-    deviceFingerprint?: string | undefined;
-}>;
-export type IdentityRecoveryCompleteRequest = z.infer<typeof identityRecoveryCompleteRequestSchema>;