@oxy.so/contracts 2.2.0 → 4.0.0

package/dist/types/signIn.d.ts

@@ -0,0 +1,717 @@
+/**
+ * Signing in: an email code or link, an optional password,
+ * and an optional authenticator app (TOTP) as a second factor.
+ *
+ * Every Oxy app runs these from its own account dialog (official apps and
+ * auth.oxy.so only; third parties sign in through OAuth on auth.oxy.so):
+ *
+ * 1. `POST /auth/signin/email/start` with a username or email. One email
+ *    carries a 6-digit code AND a one-use link to auth.oxy.so; the answer is the
+ *    same whether or not the account exists. The dialog keeps the
+ *    `requestSecret` it is given: only it can collect the session.
+ * 2. Either the code (`POST /auth/signin/email/confirm`), or the link opened in
+ *    the SAME browser (`POST /auth/signin/email/link` from auth.oxy.so, proving
+ *    the browser's shared device) followed by the dialog's
+ *    `POST /auth/signin/email/collect`.
+ * 3. Or a password (`POST /auth/signin/password`), when the account set one.
+ * 4. When the account has an authenticator, every first factor answers a
+ *    one-use second-factor challenge instead of a session, and
+ *    `POST /auth/signin/second-factor` takes the TOTP (or a backup code).
+ *
+ * `POST /auth/signup` creates an account from a username and an email confirmed
+ * with `POST /auth/email/verify/{start,confirm}` (purpose `signup`).
+ *
+ * Every body that ends in a session may carry `device`, the proof of the
+ * browser's shared device (ADR 0029 D2), so the account lands on it.
+ */
+import { z } from 'zod';
+import type { LoginResult } from './deviceBoot';
+/** How long the link in a sign-in email can be opened. */
+export declare const EMAIL_SIGNIN_LINK_TTL_MS: number;
+/** How long a second-factor challenge can be answered. */
+export declare const SIGNIN_SECOND_FACTOR_TTL_MS: number;
+/** Wrong second-factor codes one challenge accepts. */
+export declare const SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = 5;
+/** Shortest password Oxy accepts when one is set. */
+export declare const PASSWORD_MIN_LENGTH = 10;
+/** Longest password Oxy accepts (characters). */
+export declare const PASSWORD_MAX_LENGTH = 256;
+/** Digits in an authenticator code. */
+export declare const TOTP_DIGITS = 6;
+/** Seconds each authenticator code lasts. */
+export declare const TOTP_PERIOD_SECONDS = 30;
+/** Backup codes issued when an authenticator is enabled or they are regenerated. */
+export declare const TOTP_BACKUP_CODE_COUNT = 10;
+/**
+ * The long sign-in code: ten characters of Crockford base32 without the
+ * look-alikes (no 0, O, 1, I, L, U), shown as `XXXXX-XXXXX`. An account whose
+ * sign-in codes were guessed at too often today (the per-account ceiling) is
+ * sent this instead of 6 digits for the rest of the day, so its owner can still
+ * type a code while guessing one is infeasible.
+ */
+export declare const EMAIL_SIGNIN_LONG_CODE_ALPHABET = "23456789ABCDEFGHJKMNPQRSTVWXYZ";
+export declare const EMAIL_SIGNIN_LONG_CODE_LENGTH = 10;
+/**
+ * Normalise a typed sign-in code: 6 digits stay as they are; a long code is
+ * upper-cased with its dash and spaces removed. Anything else is returned
+ * trimmed (and will simply be wrong).
+ */
+export declare function normalizeEmailSignInCode(code: string): string;
+/** A username or an email. */
+export declare const signInIdentifierSchema: z.ZodString;
+/** A password as typed. Its policy applies only when one is set. */
+export declare const passwordInputSchema: z.ZodString;
+/** A new password. */
+export declare const newPasswordSchema: z.ZodString;
+/**
+ * An authenticator code (6 digits) or a backup code (10 characters, with or
+ * without its dash). Normalised server-side.
+ */
+export declare const secondFactorCodeSchema: z.ZodString;
+/** `POST /auth/signin/email/start` */
+export declare const emailSignInStartRequestSchema: z.ZodObject<{
+    identifier: z.ZodString;
+    /** The requester's device: the email's link approves only in this browser. */
+    device: z.ZodOptional<z.ZodObject<{
+        deviceId: z.ZodString;
+        deviceSecret: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        deviceId: string;
+        deviceSecret: string;
+    }, {
+        deviceId: string;
+        deviceSecret: string;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    identifier: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+}, {
+    identifier: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+}>;
+export type EmailSignInStartRequest = z.infer<typeof emailSignInStartRequestSchema>;
+export interface EmailSignInStartResponse {
+    /** Names the request. Returned whether or not an email was sent. */
+    requestId: string;
+    /** Only the caller holds it; confirming or collecting needs it. Keep it in memory. */
+    requestSecret: string;
+    /** Unix milliseconds after which the code is refused. */
+    expiresAt: number;
+    /**
+     * Present ONLY when the request proved a device this account is already on
+     * and no email could be sent right now (too many were): try again later.
+     * Every other caller gets the ordinary answer whatever happened.
+     */
+    retryLater?: true;
+}
+export declare const emailSignInStartResponseSchema: z.ZodType<EmailSignInStartResponse>;
+/**
+ * The code from a sign-in email: 6 digits, or — for an account whose codes
+ * were guessed at too often today — the 10-character long code
+ * (`EMAIL_SIGNIN_LONG_CODE_ALPHABET`, with or without its dash, any case). The
+ * UI must accept BOTH in one field: the email says which was sent, and the
+ * start response is the same either way (it says nothing about the account).
+ */
+export declare const emailSignInCodeSchema: z.ZodEffects<z.ZodString, string, string>;
+/** `POST /auth/signin/email/confirm` — the code from the email. */
+export declare const emailSignInConfirmRequestSchema: z.ZodObject<{
+    deviceName: z.ZodOptional<z.ZodString>;
+    deviceFingerprint: z.ZodOptional<z.ZodString>;
+    device: z.ZodOptional<z.ZodObject<{
+        deviceId: z.ZodString;
+        deviceSecret: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        deviceId: string;
+        deviceSecret: string;
+    }, {
+        deviceId: string;
+        deviceSecret: string;
+    }>>;
+    requestId: z.ZodString;
+    requestSecret: z.ZodString;
+    code: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    code: string;
+    requestId: string;
+    requestSecret: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}, {
+    code: string;
+    requestId: string;
+    requestSecret: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}>;
+export type EmailSignInConfirmRequest = z.infer<typeof emailSignInConfirmRequestSchema>;
+/** `POST /auth/signin/email/collect` — the dialog asks whether its link was opened. */
+export declare const emailSignInCollectRequestSchema: z.ZodObject<{
+    deviceName: z.ZodOptional<z.ZodString>;
+    deviceFingerprint: z.ZodOptional<z.ZodString>;
+    device: z.ZodOptional<z.ZodObject<{
+        deviceId: z.ZodString;
+        deviceSecret: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        deviceId: string;
+        deviceSecret: string;
+    }, {
+        deviceId: string;
+        deviceSecret: string;
+    }>>;
+    requestId: z.ZodString;
+    requestSecret: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    requestId: string;
+    requestSecret: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}, {
+    requestId: string;
+    requestSecret: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}>;
+export type EmailSignInCollectRequest = z.infer<typeof emailSignInCollectRequestSchema>;
+/**
+ * `POST /auth/signin/email/link` — auth.oxy.so, where the email's link lands.
+ * It proves auth.oxy.so's own credential for the browser's device; the request
+ * is approved only when that is the device that asked.
+ */
+export declare const emailSignInLinkRequestSchema: z.ZodObject<{
+    token: z.ZodString;
+    device: z.ZodObject<{
+        deviceId: z.ZodString;
+        deviceSecret: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        deviceId: string;
+        deviceSecret: string;
+    }, {
+        deviceId: string;
+        deviceSecret: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    token: string;
+    device: {
+        deviceId: string;
+        deviceSecret: string;
+    };
+}, {
+    token: string;
+    device: {
+        deviceId: string;
+        deviceSecret: string;
+    };
+}>;
+export type EmailSignInLinkRequest = z.infer<typeof emailSignInLinkRequestSchema>;
+export interface EmailSignInLinkResponse {
+    /** The dialog that asked collects the session; the link page never receives one. */
+    approved: true;
+}
+export declare const emailSignInLinkResponseSchema: z.ZodType<EmailSignInLinkResponse>;
+/** `POST /auth/signin/password` */
+export declare const passwordSignInRequestSchema: z.ZodObject<{
+    deviceName: z.ZodOptional<z.ZodString>;
+    deviceFingerprint: z.ZodOptional<z.ZodString>;
+    device: z.ZodOptional<z.ZodObject<{
+        deviceId: z.ZodString;
+        deviceSecret: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        deviceId: string;
+        deviceSecret: string;
+    }, {
+        deviceId: string;
+        deviceSecret: string;
+    }>>;
+    identifier: z.ZodString;
+    password: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    identifier: string;
+    password: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}, {
+    identifier: string;
+    password: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}>;
+export type PasswordSignInRequest = z.infer<typeof passwordSignInRequestSchema>;
+/** `POST /auth/signin/second-factor` */
+export declare const secondFactorSignInRequestSchema: z.ZodObject<{
+    deviceName: z.ZodOptional<z.ZodString>;
+    deviceFingerprint: z.ZodOptional<z.ZodString>;
+    device: z.ZodOptional<z.ZodObject<{
+        deviceId: z.ZodString;
+        deviceSecret: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        deviceId: string;
+        deviceSecret: string;
+    }, {
+        deviceId: string;
+        deviceSecret: string;
+    }>>;
+    challengeId: z.ZodString;
+    code: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    code: string;
+    challengeId: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}, {
+    code: string;
+    challengeId: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}>;
+export type SecondFactorSignInRequest = z.infer<typeof secondFactorSignInRequestSchema>;
+/** `POST /auth/signup` — the account, from a username and a confirmed email. */
+export declare const signUpRequestSchema: z.ZodObject<{
+    deviceName: z.ZodOptional<z.ZodString>;
+    deviceFingerprint: z.ZodOptional<z.ZodString>;
+    device: z.ZodOptional<z.ZodObject<{
+        deviceId: z.ZodString;
+        deviceSecret: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        deviceId: string;
+        deviceSecret: string;
+    }, {
+        deviceId: string;
+        deviceSecret: string;
+    }>>;
+    username: z.ZodString;
+    email: z.ZodString;
+    /** The ticket `POST /auth/email/verify/confirm` (purpose `signup`) returned. */
+    emailTicket: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    email: string;
+    username: string;
+    emailTicket: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}, {
+    email: string;
+    username: string;
+    emailTicket: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}>;
+export type SignUpRequest = z.infer<typeof signUpRequestSchema>;
+/** A first factor passed and the account has an authenticator: no session yet. */
+export interface SecondFactorRequired {
+    secondFactorRequired: true;
+    /** One use, bound to the account and the device that passed the first factor. */
+    challengeId: string;
+    /** Unix milliseconds. */
+    expiresAt: number;
+}
+export declare const secondFactorRequiredSchema: z.ZodType<SecondFactorRequired>;
+/** The dialog's link has not been opened (in the right browser) yet. */
+export interface EmailSignInPending {
+    status: 'pending';
+    expiresAt: number;
+}
+export declare const emailSignInPendingSchema: z.ZodType<EmailSignInPending>;
+/** What a first factor answers: a session, or the second-factor step. */
+export type SignInStepResult = LoginResult | SecondFactorRequired;
+/** Narrow a {@link SignInStepResult}. */
+export declare function isSecondFactorRequired(result: SignInStepResult | EmailSignInPending): result is SecondFactorRequired;
+/**
+ * What a re-verification email code confirms. The code is bound to it: a code
+ * asked for one change never authorises another, and the email names it.
+ */
+export declare const REAUTH_ACTIONS: readonly ["change_password", "totp", "link_commons", "delete_account"];
+export type ReauthAction = (typeof REAUTH_ACTIONS)[number];
+/** `POST /users/me/reauth/email` */
+export declare const reauthEmailStartRequestSchema: z.ZodObject<{
+    action: z.ZodEnum<["change_password", "totp", "link_commons", "delete_account"]>;
+}, "strict", z.ZodTypeAny, {
+    action: "change_password" | "totp" | "link_commons" | "delete_account";
+}, {
+    action: "change_password" | "totp" | "link_commons" | "delete_account";
+}>;
+export type ReauthEmailStartRequest = z.infer<typeof reauthEmailStartRequestSchema>;
+/**
+ * A fresh proof that the person, not only their session, is asking: the
+ * current password, or a code just sent to the account's email
+ * (`POST /users/me/reauth/email`) — plus the authenticator code when the
+ * account has one. Carried inside the request it authorises.
+ */
+export declare const reauthProofSchema: z.ZodEffects<z.ZodObject<{
+    password: z.ZodOptional<z.ZodString>;
+    emailCode: z.ZodOptional<z.ZodObject<{
+        verificationId: z.ZodString;
+        code: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        code: string;
+        verificationId: string;
+    }, {
+        code: string;
+        verificationId: string;
+    }>>;
+    /** Required when the account has an authenticator: its code or a backup code. */
+    totpCode: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    password?: string | undefined;
+    emailCode?: {
+        code: string;
+        verificationId: string;
+    } | undefined;
+    totpCode?: string | undefined;
+}, {
+    password?: string | undefined;
+    emailCode?: {
+        code: string;
+        verificationId: string;
+    } | undefined;
+    totpCode?: string | undefined;
+}>, {
+    password?: string | undefined;
+    emailCode?: {
+        code: string;
+        verificationId: string;
+    } | undefined;
+    totpCode?: string | undefined;
+}, {
+    password?: string | undefined;
+    emailCode?: {
+        code: string;
+        verificationId: string;
+    } | undefined;
+    totpCode?: string | undefined;
+}>;
+export type ReauthProof = z.infer<typeof reauthProofSchema>;
+/** A proof by email code only (+ TOTP): deleting an account, linking Commons. */
+export declare const emailReauthProofSchema: z.ZodObject<{
+    emailCode: z.ZodObject<{
+        verificationId: z.ZodString;
+        code: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        code: string;
+        verificationId: string;
+    }, {
+        code: string;
+        verificationId: string;
+    }>;
+    totpCode: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    emailCode: {
+        code: string;
+        verificationId: string;
+    };
+    totpCode?: string | undefined;
+}, {
+    emailCode: {
+        code: string;
+        verificationId: string;
+    };
+    totpCode?: string | undefined;
+}>;
+export type EmailReauthProof = z.infer<typeof emailReauthProofSchema>;
+/** `PUT /users/me/password` — set or change the password. */
+export declare const passwordSetRequestSchema: z.ZodObject<{
+    newPassword: z.ZodString;
+    reauth: z.ZodEffects<z.ZodObject<{
+        password: z.ZodOptional<z.ZodString>;
+        emailCode: z.ZodOptional<z.ZodObject<{
+            verificationId: z.ZodString;
+            code: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            code: string;
+            verificationId: string;
+        }, {
+            code: string;
+            verificationId: string;
+        }>>;
+        /** Required when the account has an authenticator: its code or a backup code. */
+        totpCode: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }>, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }>;
+    /** Sign every other session of the account out. */
+    revokeOtherSessions: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    reauth: {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    };
+    newPassword: string;
+    revokeOtherSessions?: boolean | undefined;
+}, {
+    reauth: {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    };
+    newPassword: string;
+    revokeOtherSessions?: boolean | undefined;
+}>;
+export type PasswordSetRequest = z.infer<typeof passwordSetRequestSchema>;
+/** `GET /users/me/sign-in-methods` */
+export interface SignInMethods {
+    hasEmail: boolean;
+    hasPassword: boolean;
+    totpEnabled: boolean;
+    /** Unused backup codes; 0 without an authenticator. */
+    backupCodesRemaining: number;
+}
+export declare const signInMethodsSchema: z.ZodType<SignInMethods>;
+/** `POST /users/me/totp/enroll` — a new secret, not active until confirmed. */
+export interface TotpEnrollResponse {
+    /** Base32, for typing into an authenticator by hand. */
+    secret: string;
+    /** `otpauth://totp/…`, for the QR. */
+    otpauthUri: string;
+}
+export declare const totpEnrollResponseSchema: z.ZodType<TotpEnrollResponse>;
+/** `POST /users/me/totp/confirm` — the first code from the authenticator turns it on. */
+export declare const totpConfirmRequestSchema: z.ZodObject<{
+    code: z.ZodString;
+    reauth: z.ZodEffects<z.ZodObject<{
+        password: z.ZodOptional<z.ZodString>;
+        emailCode: z.ZodOptional<z.ZodObject<{
+            verificationId: z.ZodString;
+            code: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            code: string;
+            verificationId: string;
+        }, {
+            code: string;
+            verificationId: string;
+        }>>;
+        /** Required when the account has an authenticator: its code or a backup code. */
+        totpCode: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }>, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    reauth: {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    };
+    code: string;
+}, {
+    reauth: {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    };
+    code: string;
+}>;
+export type TotpConfirmRequest = z.infer<typeof totpConfirmRequestSchema>;
+/** `POST /users/me/totp/disable` and `POST /users/me/totp/backup-codes` */
+export declare const totpReauthRequestSchema: z.ZodObject<{
+    reauth: z.ZodEffects<z.ZodObject<{
+        password: z.ZodOptional<z.ZodString>;
+        emailCode: z.ZodOptional<z.ZodObject<{
+            verificationId: z.ZodString;
+            code: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            code: string;
+            verificationId: string;
+        }, {
+            code: string;
+            verificationId: string;
+        }>>;
+        /** Required when the account has an authenticator: its code or a backup code. */
+        totpCode: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }>, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    reauth: {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    };
+}, {
+    reauth: {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    };
+}>;
+export type TotpReauthRequest = z.infer<typeof totpReauthRequestSchema>;
+/** Shown once; each works one time. */
+export interface TotpBackupCodesResponse {
+    backupCodes: string[];
+}
+export declare const totpBackupCodesResponseSchema: z.ZodType<TotpBackupCodesResponse>;
+/**
+ * Stable error codes (`error.code` in the API error body). Clients map these
+ * through their localization, never the English message.
+ */
+export declare const SIGN_IN_ERROR_CODES: {
+    /** Wrong identifier or password — never says which. */
+    readonly invalidCredentials: "SIGNIN_INVALID_CREDENTIALS";
+    /** The request is unknown, expired, spent, or its secret is wrong. */
+    readonly requestInvalid: "SIGNIN_REQUEST_INVALID";
+    /** The link is unknown, expired or already used. */
+    readonly linkInvalid: "SIGNIN_LINK_INVALID";
+    /** The link was opened in another browser: type the code in the app instead. */
+    readonly linkOtherDevice: "SIGNIN_LINK_OTHER_DEVICE";
+    /** The second-factor challenge or its code is wrong, expired or spent. */
+    readonly secondFactorInvalid: "SECOND_FACTOR_INVALID";
+    /** Too many failures for this account: wait and try again. */
+    readonly locked: "SIGNIN_LOCKED";
+    /** The step needs a fresh proof (`reauth`). */
+    readonly reauthRequired: "REAUTH_REQUIRED";
+    /** The fresh proof was wrong. */
+    readonly reauthInvalid: "REAUTH_INVALID";
+    /** The account has an authenticator: the proof must carry its code. */
+    readonly totpRequired: "TOTP_REQUIRED";
+    /** Enrolling or confirming an authenticator that is already on. */
+    readonly totpAlreadyEnabled: "TOTP_ALREADY_ENABLED";
+    /** Disabling, confirming or regenerating codes with no authenticator (or no pending one). */
+    readonly totpNotEnabled: "TOTP_NOT_ENABLED";
+    /** The code the authenticator showed at enrolment is wrong. */
+    readonly totpCodeInvalid: "TOTP_CODE_INVALID";
+    /** Only official Oxy apps and auth.oxy.so may sign people in here. */
+    readonly originNotAllowed: "SIGNIN_ORIGIN_NOT_ALLOWED";
+    /** The username is taken. */
+    readonly usernameTaken: "USERNAME_TAKEN";
+};
+export type SignInErrorCode = (typeof SIGN_IN_ERROR_CODES)[keyof typeof SIGN_IN_ERROR_CODES];