@oxy.so/contracts 2.1.0 → 3.0.0

package/dist/types/webauthn.d.ts

@@ -1,285 +0,0 @@
-/**
- * WebAuthn / passkey ceremony contracts (Fase B/b1).
- *
- * These schemas describe ONLY the outer Oxy envelope that wraps a WebAuthn
- * ceremony request — the username the client is registering/authenticating as,
- * plus non-authoritative device metadata. The browser
- * `RegistrationResponseJSON` / `AuthenticationResponseJSON` payloads are NOT
- * mirrored here: they are validated by `@simplewebauthn/server` inside the route
- * (`verifyRegistrationResponse` / `verifyAuthenticationResponse`), which is the
- * single source of truth for their structure. Re-encoding them in Zod would just
- * create a second, drift-prone definition of a shape we do not own.
- */
-import { z } from 'zod';
-/**
- * `POST /webauthn/register/options` — request registration options. With a bearer
- * token the caller links a passkey to their signed-in account and `username` is
- * ignored; without one it is a prospective signup and `username` is the desired
- * (not-yet-created) handle.
- */
-export declare const webauthnRegisterOptionsRequestSchema: z.ZodObject<{
-    username: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    username?: string | undefined;
-}, {
-    username?: string | undefined;
-}>;
-export type WebauthnRegisterOptionsRequest = z.infer<typeof webauthnRegisterOptionsRequestSchema>;
-/**
- * `POST /webauthn/login/options` — request authentication options. When
- * `username` is present the server scopes `allowCredentials` to that user's
- * passkeys (username-first); when omitted it returns an empty allow-list for the
- * usernameless / discoverable-credential flow (the default).
- */
-export declare const webauthnLoginOptionsRequestSchema: z.ZodObject<{
-    username: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    username?: string | undefined;
-}, {
-    username?: string | undefined;
-}>;
-export type WebauthnLoginOptionsRequest = z.infer<typeof webauthnLoginOptionsRequestSchema>;
-/**
- * `POST /webauthn/register/verify` — the outer envelope. The browser
- * `RegistrationResponseJSON` travels alongside these fields under `response` and
- * is validated by `@simplewebauthn/server`, not here. `username` is required only
- * for the prospective-signup branch (no bearer); the linking branch ignores it.
- */
-export declare const webauthnRegisterVerifyRequestSchema: z.ZodObject<{
-    deviceName: z.ZodOptional<z.ZodString>;
-    deviceFingerprint: z.ZodOptional<z.ZodString>;
-    username: z.ZodOptional<z.ZodString>;
-    /**
-     * Sign-up only (ADR 0024 D4): the account's root, created on the holder BEFORE
-     * this request — sealed under the passkey being registered — and a root proof
-     * (`enroll_identity`) whose challenge is the registration challenge. The
-     * account, passkey, root and envelope are then created in one transaction.
-     */
-    identity: z.ZodOptional<z.ZodObject<{
-        envelope: z.ZodEffects<z.ZodObject<{
-            version: z.ZodLiteral<2>;
-            algorithm: z.ZodLiteral<"xchacha20poly1305">;
-            publicKey: z.ZodString;
-            secretKind: z.ZodEnum<["mnemonic-entropy", "raw-private-key"]>;
-            secretNonce: z.ZodString;
-            sealedSecret: z.ZodString;
-            wraps: z.ZodArray<z.ZodObject<{
-                credentialId: z.ZodString;
-                nonce: z.ZodString;
-                wrappedKey: z.ZodString;
-                createdAt: z.ZodString;
-                rpId: z.ZodString;
-                verifiedAt: z.ZodOptional<z.ZodString>;
-            }, "strip", z.ZodTypeAny, {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }, {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }>, "many">;
-        }, "strip", z.ZodTypeAny, {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        }, {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        }>, {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        }, {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        }>;
-        proof: z.ZodObject<{
-            v: z.ZodLiteral<2>;
-            challenge: z.ZodString;
-            expiresAt: z.ZodNumber;
-            signature: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            expiresAt: number;
-            signature: string;
-            v: 2;
-            challenge: string;
-        }, {
-            expiresAt: number;
-            signature: string;
-            v: 2;
-            challenge: string;
-        }>;
-    }, "strip", z.ZodTypeAny, {
-        proof: {
-            expiresAt: number;
-            signature: string;
-            v: 2;
-            challenge: string;
-        };
-        envelope: {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        };
-    }, {
-        proof: {
-            expiresAt: number;
-            signature: string;
-            v: 2;
-            challenge: string;
-        };
-        envelope: {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        };
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    username?: string | undefined;
-    identity?: {
-        proof: {
-            expiresAt: number;
-            signature: string;
-            v: 2;
-            challenge: string;
-        };
-        envelope: {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        };
-    } | undefined;
-    deviceName?: string | undefined;
-    deviceFingerprint?: string | undefined;
-}, {
-    username?: string | undefined;
-    identity?: {
-        proof: {
-            expiresAt: number;
-            signature: string;
-            v: 2;
-            challenge: string;
-        };
-        envelope: {
-            version: 2;
-            publicKey: string;
-            algorithm: "xchacha20poly1305";
-            secretKind: "mnemonic-entropy" | "raw-private-key";
-            secretNonce: string;
-            sealedSecret: string;
-            wraps: {
-                credentialId: string;
-                createdAt: string;
-                nonce: string;
-                wrappedKey: string;
-                rpId: string;
-                verifiedAt?: string | undefined;
-            }[];
-        };
-    } | undefined;
-    deviceName?: string | undefined;
-    deviceFingerprint?: string | undefined;
-}>;
-export type WebauthnRegisterVerifyRequest = z.infer<typeof webauthnRegisterVerifyRequestSchema>;
-/**
- * `POST /webauthn/login/verify` — the outer envelope. The browser
- * `AuthenticationResponseJSON` travels alongside these fields under `response`
- * and is validated by `@simplewebauthn/server`, not here.
- */
-export declare const webauthnLoginVerifyRequestSchema: z.ZodObject<{
-    deviceName: z.ZodOptional<z.ZodString>;
-    deviceFingerprint: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    deviceName?: string | undefined;
-    deviceFingerprint?: string | undefined;
-}, {
-    deviceName?: string | undefined;
-    deviceFingerprint?: string | undefined;
-}>;
-export type WebauthnLoginVerifyRequest = z.infer<typeof webauthnLoginVerifyRequestSchema>;