@oxy.so/contracts 2.2.0 → 3.0.0

package/dist/types/accountEmail.d.ts

@@ -1,22 +1,26 @@
 /**
- * Recovery email contracts (ADR 0029 D3).
+ * Email codes and tickets (ADR 0030).
  *
- * A web account is a username, a passkey and a recovery email. The email is
- * proven by a 6-digit code sent to it, and the proof is a short-lived one-use
- * ticket the next step spends:
+ * A web account is a username and an email; a password and an authenticator
+ * app are optional and added later. The email is proven by a 6-digit code sent
+ * to it, and the proof is a short-lived one-use ticket the next step spends:
  *
- * - `signup`: the ticket lets `POST /webauthn/register/verify` create the
- *   account with that email;
- * - `recovery`: the person names their username or email, the code goes to the
- *   account's recovery email, and the ticket lets them register a new passkey
- *   for that account.
+ * - `signup`: the ticket lets `POST /auth/signup` create the account with that
+ *   email. `start` answers the same whether or not the address already has an
+ *   account, so it never tells anyone which emails have an Oxy account.
  *
- * `start` answers the same whether or not an account exists, so neither purpose
- * tells anyone which emails or usernames have an Oxy account. An account with a
- * Commons key has no recovery email: it recovers in Commons.
+ * Signing in by email (`signin`) and re-verifying before a sensitive change
+ * (`reauth`) use the same code, through their own routes (`signIn.ts`).
  */
 import { z } from 'zod';
-export declare const EMAIL_VERIFICATION_PURPOSES: readonly ["signup", "recovery"];
+/**
+ * - `signup`: above.
+ * - `signin`: the code (and link) of an email sign-in (`POST /auth/signin/email/start`).
+ * - `reauth`: a signed-in person proving it is them before a sensitive step
+ *   (`POST /users/me/reauth/email`): a password, an authenticator, deleting the
+ *   account, linking Commons.
+ */
+export declare const EMAIL_VERIFICATION_PURPOSES: readonly ["signup", "signin", "reauth"];
 export type EmailVerificationPurpose = (typeof EMAIL_VERIFICATION_PURPOSES)[number];
 /** Digits in a code. */
 export declare const EMAIL_CODE_LENGTH = 6;
@@ -31,7 +35,7 @@ export declare const emailAddressSchema: z.ZodString;
 /** An opaque one-use ticket (32 random bytes, base64url). */
 export declare const emailTicketSchema: z.ZodString;
 /** `POST /auth/email/verify/start` */
-export declare const emailVerificationStartRequestSchema: z.ZodDiscriminatedUnion<"purpose", [z.ZodObject<{
+export declare const emailVerificationStartRequestSchema: z.ZodObject<{
     purpose: z.ZodLiteral<"signup">;
     email: z.ZodString;
 }, "strict", z.ZodTypeAny, {
@@ -40,17 +44,7 @@ export declare const emailVerificationStartRequestSchema: z.ZodDiscriminatedUnio
 }, {
     purpose: "signup";
     email: string;
-}>, z.ZodObject<{
-    purpose: z.ZodLiteral<"recovery">;
-    /** The account's username, or its recovery email. */
-    identifier: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    purpose: "recovery";
-    identifier: string;
-}, {
-    purpose: "recovery";
-    identifier: string;
-}>]>;
+}>;
 export type EmailVerificationStartRequest = z.infer<typeof emailVerificationStartRequestSchema>;
 export interface EmailVerificationStartResponse {
     /** Names this verification in `confirm`. Returned whether or not a code was sent. */
@@ -75,8 +69,6 @@ export interface EmailVerificationConfirmResponse {
     ticket: string;
     /** Unix milliseconds after which the ticket is refused. */
     expiresAt: number;
-    /** Recovery only: the account the ticket recovers. `null` for sign-up. */
-    username: string | null;
 }
 export declare const emailVerificationConfirmResponseSchema: z.ZodType<EmailVerificationConfirmResponse>;
 /**
@@ -90,7 +82,7 @@ export declare const EMAIL_VERIFICATION_ERROR_CODES: {
     readonly tooManyAttempts: "EMAIL_CODE_TOO_MANY_ATTEMPTS";
     /** The ticket is unknown, expired, spent, or for another email or purpose. */
     readonly ticketInvalid: "EMAIL_TICKET_INVALID";
-    /** A sign-up without a confirmed recovery email. */
+    /** A sign-up without a confirmed email. */
     readonly ticketRequired: "EMAIL_TICKET_REQUIRED";
     /** This server cannot send mail. */
     readonly unavailable: "EMAIL_UNAVAILABLE";

package/dist/types/accountGraph.d.ts

@@ -315,8 +315,8 @@ export declare const createAccountRequestSchema: z.ZodEffects<z.ZodObject<{
      */
     isPrivateAccount: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    username: string;
     kind: "bot" | "organization" | "project" | "channel";
+    username: string;
     parentAccountId?: string | undefined;
     name?: {
         first?: string | undefined;
@@ -330,8 +330,8 @@ export declare const createAccountRequestSchema: z.ZodEffects<z.ZodObject<{
     accountCategories?: ("security" | "news" | "politics" | "business" | "startup" | "finance" | "crypto" | "marketplace" | "retail" | "real_estate" | "agency" | "landlord" | "cooperative" | "architecture" | "technology" | "software" | "ai" | "automation" | "science" | "education" | "books" | "health" | "fitness" | "sports" | "gaming" | "music" | "film" | "podcast" | "art" | "photography" | "comedy" | "food" | "travel" | "fashion" | "home_garden" | "diy" | "automotive" | "animals" | "family" | "nonprofit" | "government" | "community" | "activism" | "environment" | "religion" | "other")[] | undefined;
     isPrivateAccount?: boolean | undefined;
 }, {
-    username: string;
     kind: "bot" | "organization" | "project" | "channel";
+    username: string;
     parentAccountId?: string | undefined;
     name?: {
         first?: string | undefined;
@@ -345,8 +345,8 @@ export declare const createAccountRequestSchema: z.ZodEffects<z.ZodObject<{
     accountCategories?: ("security" | "news" | "politics" | "business" | "startup" | "finance" | "crypto" | "marketplace" | "retail" | "real_estate" | "agency" | "landlord" | "cooperative" | "architecture" | "technology" | "software" | "ai" | "automation" | "science" | "education" | "books" | "health" | "fitness" | "sports" | "gaming" | "music" | "film" | "podcast" | "art" | "photography" | "comedy" | "food" | "travel" | "fashion" | "home_garden" | "diy" | "automotive" | "animals" | "family" | "nonprofit" | "government" | "community" | "activism" | "environment" | "religion" | "other")[] | undefined;
     isPrivateAccount?: boolean | undefined;
 }>, {
-    username: string;
     kind: "bot" | "organization" | "project" | "channel";
+    username: string;
     parentAccountId?: string | undefined;
     name?: {
         first?: string | undefined;
@@ -360,8 +360,8 @@ export declare const createAccountRequestSchema: z.ZodEffects<z.ZodObject<{
     accountCategories?: ("security" | "news" | "politics" | "business" | "startup" | "finance" | "crypto" | "marketplace" | "retail" | "real_estate" | "agency" | "landlord" | "cooperative" | "architecture" | "technology" | "software" | "ai" | "automation" | "science" | "education" | "books" | "health" | "fitness" | "sports" | "gaming" | "music" | "film" | "podcast" | "art" | "photography" | "comedy" | "food" | "travel" | "fashion" | "home_garden" | "diy" | "automotive" | "animals" | "family" | "nonprofit" | "government" | "community" | "activism" | "environment" | "religion" | "other")[] | undefined;
     isPrivateAccount?: boolean | undefined;
 }, {
-    username: string;
     kind: "bot" | "organization" | "project" | "channel";
+    username: string;
     parentAccountId?: string | undefined;
     name?: {
         first?: string | undefined;

package/dist/types/deviceBoot.d.ts

@@ -4,8 +4,8 @@
  * SINGLE SOURCE OF TRUTH for the first-party login result (the session arm). The
  * API validates its OUTPUT against this schema; every consumer (`@oxy.so/core`'s
  * auth mixin) validates its INPUT against the same definition, so producer and
- * consumers cannot drift. Sign-in is passkey (WebAuthn) or Commons handoff —
- * password and 2FA were removed, so the only outcome is a completed session.
+ * consumers cannot drift. This is the session arm every sign-in
+ * ends in (email code or link, password, authenticator, Commons handoff).
  *
  * The device transport is `deviceId` + `deviceSecret` + `POST /session/device/token`
  * (see `deviceSession.ts`). The legacy cookie/bootstrap/refresh-family lanes were

package/dist/types/deviceSession.d.ts

@@ -166,9 +166,10 @@ export type DeviceSessionSync = z.infer<typeof deviceSessionSyncSchema>;
 /**
  * Request body for `POST /session/device/token` — the client presents the
  * `deviceId` it stored first-party plus the opaque `deviceSecret`. NO bearer:
- * possession of the secret IS the proof of device ownership. The server matches
- * `sha256(deviceSecret)` against the device's stored `secretHash` (constant-time)
- * and mints a short access token for the device's active account.
+ * possession of the secret IS the proof of device ownership. The server looks
+ * `sha256(deviceSecret)` up among the device's holder credentials (one per app
+ * or origin that joined the shared DeviceSession) and mints a short access
+ * token for the device's active account.
  *
  * `accountId` pins the mint to ONE account of that device instead of whichever
  * account is currently active. It exists for identity-bound clients (Commons),
@@ -196,8 +197,8 @@ export declare const deviceTokenMintRequestSchema: z.ZodObject<{
  * short access token for the active account, its expiry, the device secret the
  * client must persist (`nextDeviceSecret` — on mint this echoes the presented
  * secret unchanged so concurrent refreshes from multiple origins do not race),
- * and the projected device-session state. Sign-in rotates the secret via
- * `issueDeviceSecret`; mint does not.
+ * and the projected device-session state. Nothing rotates: each sign-in issues
+ * a NEW holder credential and leaves the others valid.
  */
 export declare const deviceTokenMintResponseSchema: z.ZodObject<{
     accessToken: z.ZodString;
@@ -330,12 +331,11 @@ export type SessionAccountsChangedEvent = z.infer<typeof sessionAccountsChangedE
  * derived server-side from it) and consumed afterwards only by native
  * background code, which has no JS runtime to mint a token for itself.
  *
- * Deliberately a SEPARATE credential from the rotating `deviceSecret`: that one
- * rotates on every mint, so background code presenting it would become a second
- * writer of a value the JS runtime depends on, and background code killed
- * mid-rotation would silently sign the user out on the next cold start. Against
- * this credential background code is the sole writer, and it can never rotate
- * anything JS reads.
+ * Deliberately a SEPARATE credential from the holder `deviceSecret`: that one
+ * is device-wide and mints for whichever account is active, while this one is
+ * bound to ONE account and expires, so a widget worker never holds a
+ * credential that reaches every account on the device. Background code is its
+ * sole writer and never touches anything JS reads.
  *
  * The raw `secret` is returned exactly once, at provision time — never stored
  * retrievably, never logged, never re-read. A caller that loses it provisions
@@ -368,10 +368,10 @@ export declare const deviceBackgroundCredentialResponseSchema: z.ZodObject<{
  * native background code with NO bearer and NO cookies: possession of the
  * background `secret` IS the proof, as it is for the device-secret mint.
  *
- * Unlike that mint this one NEVER rotates the presented secret (hence no
- * `next…` field to persist in the response), so background code interrupted
- * anywhere between request and response leaves the credential intact and
- * usable on its next run.
+ * Like that mint this one NEVER rotates the presented secret, and it carries
+ * no `next…` field at all, so background code interrupted anywhere between
+ * request and response leaves the credential intact and usable on its next
+ * run.
  */
 export declare const deviceBackgroundTokenRequestSchema: z.ZodObject<{
     deviceId: z.ZodString;
@@ -409,3 +409,115 @@ export declare const deviceBackgroundTokenResponseSchema: z.ZodObject<{
 export type DeviceBackgroundCredentialResponse = z.infer<typeof deviceBackgroundCredentialResponseSchema>;
 export type DeviceBackgroundTokenRequest = z.infer<typeof deviceBackgroundTokenRequestSchema>;
 export type DeviceBackgroundTokenResponse = z.infer<typeof deviceBackgroundTokenResponseSchema>;
+/**
+ * Proof that the caller holds a device: the `deviceId` it stored first-party and
+ * one of that device's holder secrets. Sent with `POST /session/device/join-code`
+ * and, optionally, with a sign-in (`POST /auth/session/claim`, the email,
+ * password and second-factor sign-ins, `POST /auth/signup`), where
+ * a valid proof puts the new session on THAT device so every app holding it sees
+ * the account. An invalid proof on a sign-in is ignored, never an error.
+ */
+export declare const deviceProofSchema: z.ZodObject<{
+    deviceId: z.ZodString;
+    deviceSecret: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    deviceId: string;
+    deviceSecret: string;
+}, {
+    deviceId: string;
+    deviceSecret: string;
+}>;
+/**
+ * `POST /session/device/register` — auth.oxy.so only. No body. A new, empty
+ * DeviceSession with a server-chosen `deviceId` and ONE holder credential for
+ * auth.oxy.so. The raw secret is returned exactly once.
+ */
+export declare const deviceRegisterResponseSchema: z.ZodObject<{
+    deviceId: z.ZodString;
+    deviceSecret: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    deviceId: string;
+    deviceSecret: string;
+}, {
+    deviceId: string;
+    deviceSecret: string;
+}>;
+/**
+ * `POST /session/device/join-code` — auth.oxy.so only (the bridge window). Proves
+ * auth.oxy.so's device and asks for a one-use code an official app redeems to
+ * join it. The code is bound to the application (`clientId`), its exact
+ * registered `redirectUri` and the app's PKCE challenge, and lives about a
+ * minute.
+ */
+export declare const deviceJoinCodeRequestSchema: z.ZodObject<{
+    deviceId: z.ZodString;
+    deviceSecret: z.ZodString;
+} & {
+    clientId: z.ZodString;
+    redirectUri: z.ZodString;
+    codeChallenge: z.ZodString;
+    codeChallengeMethod: z.ZodLiteral<"S256">;
+}, "strip", z.ZodTypeAny, {
+    deviceId: string;
+    deviceSecret: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    codeChallengeMethod: "S256";
+}, {
+    deviceId: string;
+    deviceSecret: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    codeChallengeMethod: "S256";
+}>;
+export declare const deviceJoinCodeResponseSchema: z.ZodObject<{
+    code: z.ZodString;
+    /** Seconds until the code expires. */
+    expiresIn: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    expiresIn: number;
+}, {
+    code: string;
+    expiresIn: number;
+}>;
+/**
+ * `POST /session/device/join` — called by the app's own origin with the code the
+ * bridge window posted to it and the PKCE verifier only the app holds. Returns a
+ * NEW holder credential for the browser's device; the app then mints through the
+ * ordinary `POST /session/device/token`.
+ */
+export declare const deviceJoinRequestSchema: z.ZodObject<{
+    code: z.ZodString;
+    codeVerifier: z.ZodString;
+    clientId: z.ZodString;
+    redirectUri: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    clientId: string;
+    redirectUri: string;
+    codeVerifier: string;
+}, {
+    code: string;
+    clientId: string;
+    redirectUri: string;
+    codeVerifier: string;
+}>;
+export declare const deviceJoinResponseSchema: z.ZodObject<{
+    deviceId: z.ZodString;
+    deviceSecret: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    deviceId: string;
+    deviceSecret: string;
+}, {
+    deviceId: string;
+    deviceSecret: string;
+}>;
+export type DeviceProof = z.infer<typeof deviceProofSchema>;
+export type DeviceRegisterResponse = z.infer<typeof deviceRegisterResponseSchema>;
+export type DeviceJoinCodeRequest = z.infer<typeof deviceJoinCodeRequestSchema>;
+export type DeviceJoinCodeResponse = z.infer<typeof deviceJoinCodeResponseSchema>;
+export type DeviceJoinRequest = z.infer<typeof deviceJoinRequestSchema>;
+export type DeviceJoinResponse = z.infer<typeof deviceJoinResponseSchema>;

package/dist/types/externalIdentity.d.ts

@@ -491,7 +491,6 @@ export declare const lookupExternalIdentitiesResponseSchema: z.ZodObject<{
         }>, "many">;
         redirectedUserIds: z.ZodArray<z.ZodString, "many">;
     }, "strip", z.ZodTypeAny, {
-        identifier: string;
         userId: string | null;
         externalIdentities: {
             canonicalAcct: string;
@@ -502,8 +501,8 @@ export declare const lookupExternalIdentitiesResponseSchema: z.ZodObject<{
             sourceUserId: string;
         }[];
         redirectedUserIds: string[];
-    }, {
         identifier: string;
+    }, {
         userId: string | null;
         externalIdentities: {
             canonicalAcct: string;
@@ -514,10 +513,10 @@ export declare const lookupExternalIdentitiesResponseSchema: z.ZodObject<{
             sourceUserId: string;
         }[];
         redirectedUserIds: string[];
+        identifier: string;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     identities: {
-        identifier: string;
         userId: string | null;
         externalIdentities: {
             canonicalAcct: string;
@@ -528,10 +527,10 @@ export declare const lookupExternalIdentitiesResponseSchema: z.ZodObject<{
             sourceUserId: string;
         }[];
         redirectedUserIds: string[];
+        identifier: string;
     }[];
 }, {
     identities: {
-        identifier: string;
         userId: string | null;
         externalIdentities: {
             canonicalAcct: string;
@@ -542,6 +541,7 @@ export declare const lookupExternalIdentitiesResponseSchema: z.ZodObject<{
             sourceUserId: string;
         }[];
         redirectedUserIds: string[];
+        identifier: string;
     }[];
 }>;
 export type ExternalIdentityReference = z.infer<typeof externalIdentityReferenceSchema>;

package/dist/types/identity.d.ts

@@ -315,18 +315,14 @@ export type DomainVerificationInstructions = z.infer<typeof domainVerificationIn
 /**
  * One linked authentication method. Mirrors a `User.authMethods[]` entry.
  * `verificationMethodId` is present for `identity` methods (a key), linking the
- * auth method to its DID verification-method fragment. For `webauthn` methods
- * `credentialId` identifies the specific passkey (one entry per registered
- * credential) and `name` is its user-facing label; a passkey is NOT a DID
- * verification method, so it carries no `verificationMethodId` (a passkey-only
- * account stays custodial).
+ * auth method to its DID verification-method fragment. A key is the only
+ * linked method: an email, a password and an authenticator are sign-in
+ * factors of the account, not DID verification methods.
  */
 export interface AuthMethodEntry {
-    type: 'identity' | 'webauthn';
+    type: 'identity';
     linkedAt: string | Date;
     verificationMethodId?: string;
-    credentialId?: string;
-    name?: string;
 }
 export declare const authMethodEntrySchema: z.ZodType<AuthMethodEntry>;
 /**

package/dist/types/identityLink.d.ts

@@ -1,22 +1,25 @@
 /**
- * Linking Commons to a passkey account (ADR 0029 D3) — the two-device relay.
+ * Linking Commons to an account without a key (ADR 0029 D3) — the two-device
+ * relay.
  *
- * A passkey account links a Commons root once, and becomes self-custodied: its
- * recovery email is deleted and its phrase in Commons is how it gets back in.
- * The authority is the same as `POST /auth/link` (ADR 0024 D8): a root proof
- * (`link_identity`) by the key Commons holds, and a fresh assertion by one of
- * the account's passkeys over the SAME one-use challenge. Only the transport is
- * new, because the two factors live on two devices:
+ * An account without a key links a Commons root once, and becomes
+ * self-custodied: its email is deleted and its phrase in Commons is how it gets
+ * back in. The authority is the same as `POST /auth/link` (ADR 0024 D8): a root
+ * proof (`link_identity`) by the key Commons holds over a one-use challenge,
+ * and the account's own confirmation — a code just sent to its email (plus its
+ * authenticator code when it has one). Only the transport is new, because the
+ * two factors live on two devices:
  *
- *   1. auth.oxy.so (signed in) opens a link request → `{ linkId, challenge }`,
- *      shown as a QR (`oxycommons://link?id=…&c=…`).
+ *   1. The signed-in account (the "Link Commons" panel of `@oxy.so/services`)
+ *      opens a link request → `{ linkId, challenge }`, shown as a QR
+ *      (`oxycommons://link?id=…&c=…`).
  *   2. Commons scans it, reads the request (the account's id and username),
  *      signs the root proof over the challenge and posts it with its key.
  *   3. Both screens show the same 6-digit code, derived from the link id and
  *      that key (`deriveIdentityLinkCode` in `@oxy.so/core`); the person checks
  *      they match, so a photographed QR cannot slip another key in.
- *   4. auth.oxy.so asserts the passkey over the challenge and completes: the
- *      account gains the root, loses the email, and Commons signs in with it.
+ *   4. The panel completes with the email code: the account gains the root,
+ *      loses the email, and Commons signs in with it.
  *
  * The server stores only the challenge's hash; the challenge travels in the QR.
  */
@@ -92,119 +95,52 @@ export declare const identityLinkProofRequestSchema: z.ZodObject<{
     };
 }>;
 export type IdentityLinkProofRequest = z.infer<typeof identityLinkProofRequestSchema>;
-/** `POST /identity/link/:linkId/options` — WebAuthn request options over the challenge. */
-export declare const identityLinkOptionsRequestSchema: z.ZodObject<{
-    challenge: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    challenge: string;
-}, {
-    challenge: string;
-}>;
-export type IdentityLinkOptionsRequest = z.infer<typeof identityLinkOptionsRequestSchema>;
-/** `POST /identity/link/:linkId/complete` — the passkey assertion over the challenge. */
+/**
+ * `POST /identity/link/:linkId/complete` — the account's own confirmation: a
+ * code just sent to its email for this link (`reauth`, plus its authenticator
+ * code when it has one).
+ */
 export declare const identityLinkCompleteRequestSchema: z.ZodObject<{
-    assertion: z.ZodObject<{
-        id: z.ZodString;
-        rawId: z.ZodString;
-        type: z.ZodLiteral<"public-key">;
-        response: z.ZodObject<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, z.ZodTypeAny, "passthrough">>;
-        clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        authenticatorAttachment: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        id: z.ZodString;
-        rawId: z.ZodString;
-        type: z.ZodLiteral<"public-key">;
-        response: z.ZodObject<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, z.ZodTypeAny, "passthrough">>;
-        clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        authenticatorAttachment: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        id: z.ZodString;
-        rawId: z.ZodString;
-        type: z.ZodLiteral<"public-key">;
-        response: z.ZodObject<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, z.ZodTypeAny, "passthrough">>;
-        clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        authenticatorAttachment: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>;
+    reauth: z.ZodObject<{
+        emailCode: z.ZodObject<{
+            verificationId: z.ZodString;
+            code: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            code: string;
+            verificationId: string;
+        }, {
+            code: string;
+            verificationId: string;
+        }>;
+        totpCode: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        emailCode: {
+            code: string;
+            verificationId: string;
+        };
+        totpCode?: string | undefined;
+    }, {
+        emailCode: {
+            code: string;
+            verificationId: string;
+        };
+        totpCode?: string | undefined;
+    }>;
 }, "strict", z.ZodTypeAny, {
-    assertion: {
-        type: "public-key";
-        id: string;
-        rawId: string;
-        response: {
-            signature: string;
-            clientDataJSON: string;
-            authenticatorData: string;
-            userHandle?: string | undefined;
-        } & {
-            [k: string]: unknown;
+    reauth: {
+        emailCode: {
+            code: string;
+            verificationId: string;
         };
-        clientExtensionResults?: Record<string, unknown> | undefined;
-        authenticatorAttachment?: string | undefined;
-    } & {
-        [k: string]: unknown;
+        totpCode?: string | undefined;
     };
 }, {
-    assertion: {
-        type: "public-key";
-        id: string;
-        rawId: string;
-        response: {
-            signature: string;
-            clientDataJSON: string;
-            authenticatorData: string;
-            userHandle?: string | undefined;
-        } & {
-            [k: string]: unknown;
+    reauth: {
+        emailCode: {
+            code: string;
+            verificationId: string;
         };
-        clientExtensionResults?: Record<string, unknown> | undefined;
-        authenticatorAttachment?: string | undefined;
-    } & {
-        [k: string]: unknown;
+        totpCode?: string | undefined;
     };
 }>;
 export type IdentityLinkCompleteRequest = z.infer<typeof identityLinkCompleteRequestSchema>;

package/dist/types/identityProof.d.ts

@@ -28,8 +28,8 @@ export declare const IDENTITY_PROOF_CHALLENGE_TTL_MS: number;
  */
 export declare const IDENTITY_PROOF_ACTIONS: {
     /**
-     * Link Commons' root to a passkey account that has none (`POST /auth/link`).
-     * The account becomes self-custodied and its recovery email is deleted
+     * Link Commons' root to an account that has none (`POST /auth/link`).
+     * The account becomes self-custodied and its email is deleted
      * (ADR 0029 D3).
      */
     readonly link: "link_identity";
@@ -123,7 +123,7 @@ export type IdentityErrorCode = (typeof IDENTITY_ERROR_CODES)[keyof typeof IDENT
 export interface IdentityRootStatus {
     /** Whether Commons' root is linked: the account is self-custodied. */
     rootLinked: boolean;
-    /** The recovery email of a passkey account; `null` once Commons is linked. */
+    /** The email of an account without a key; `null` once Commons is linked. */
     recoveryEmail: string | null;
 }
 export declare const identityRootStatusSchema: z.ZodType<IdentityRootStatus>;