@oxy.so/contracts 2.2.0 → 4.0.0

package/dist/types/userResponse.d.ts

@@ -970,8 +970,8 @@ export declare const currentUserResponseSchema: z.ZodObject<{
     data: {
         name: UserNameResponse;
         email?: string | undefined;
-        username?: string | undefined;
         kind?: "bot" | "personal" | "organization" | "project" | "channel" | undefined;
+        username?: string | undefined;
         avatar?: string | null | undefined;
         color?: string | null | undefined;
         accountCategories?: ("security" | "news" | "politics" | "business" | "startup" | "finance" | "crypto" | "marketplace" | "retail" | "real_estate" | "agency" | "landlord" | "cooperative" | "architecture" | "technology" | "software" | "ai" | "automation" | "science" | "education" | "books" | "health" | "fitness" | "sports" | "gaming" | "music" | "film" | "podcast" | "art" | "photography" | "comedy" | "food" | "travel" | "fashion" | "home_garden" | "diy" | "automotive" | "animals" | "family" | "nonprofit" | "government" | "community" | "activism" | "environment" | "religion" | "other")[] | undefined;
@@ -996,8 +996,8 @@ export declare const currentUserResponseSchema: z.ZodObject<{
     data: {
         name: UserNameResponse;
         email?: string | undefined;
-        username?: string | undefined;
         kind?: "bot" | "personal" | "organization" | "project" | "channel" | undefined;
+        username?: string | undefined;
         avatar?: string | null | undefined;
         color?: string | null | undefined;
         accountCategories?: ("security" | "news" | "politics" | "business" | "startup" | "finance" | "crypto" | "marketplace" | "retail" | "real_estate" | "agency" | "landlord" | "cooperative" | "architecture" | "technology" | "software" | "ai" | "automation" | "science" | "education" | "books" | "health" | "fitness" | "sports" | "gaming" | "music" | "film" | "podcast" | "art" | "photography" | "comedy" | "food" | "travel" | "fashion" | "home_garden" | "diy" | "automotive" | "animals" | "family" | "nonprofit" | "government" | "community" | "activism" | "environment" | "religion" | "other")[] | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/contracts",
-  "version": "2.2.0",
+  "version": "4.0.0",
   "description": "OxyHQ API contracts — single source of truth for request/response Zod schemas and inferred types, shared by the backend and the client SDKs",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/dist/cjs/webauthn.js

@@ -1,114 +0,0 @@
-"use strict";
-/**
- * WebAuthn / passkey ceremony contracts (Fase B/b1).
- *
- * These schemas describe ONLY the outer Oxy envelope that wraps a WebAuthn
- * ceremony request — the username the client is registering/authenticating as,
- * plus non-authoritative device metadata. The browser
- * `RegistrationResponseJSON` / `AuthenticationResponseJSON` payloads are NOT
- * mirrored here: they are validated by `@simplewebauthn/server` inside the route
- * (`verifyRegistrationResponse` / `verifyAuthenticationResponse`), which is the
- * single source of truth for their structure. Re-encoding them in Zod would just
- * create a second, drift-prone definition of a shape we do not own.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.webauthnAssertionResponseSchema = exports.webauthnCredentialIdSchema = void 0;
-const zod_1 = require("zod");
-const accountEmail_1 = require("./accountEmail");
-/** A WebAuthn credential id, base64url as the browser reports it. */
-exports.webauthnCredentialIdSchema = zod_1.z
-    .string()
-    .trim()
-    .min(16)
-    .max(1024)
-    .regex(/^[A-Za-z0-9_-]+$/, 'credentialId must be base64url');
-/**
- * A WebAuthn assertion by one of the account's EXISTING passkeys over a server
- * challenge — the fresh use of the factor the account already has (linking
- * Commons to a passkey account, deleting a passkey account). The API verifies
- * it with `@simplewebauthn/server`; this only bounds its shape.
- */
-exports.webauthnAssertionResponseSchema = zod_1.z
-    .object({
-    id: exports.webauthnCredentialIdSchema,
-    rawId: zod_1.z.string().min(1).max(2048),
-    type: zod_1.z.literal('public-key'),
-    response: zod_1.z
-        .object({
-        clientDataJSON: zod_1.z.string().min(1).max(8192),
-        authenticatorData: zod_1.z.string().min(1).max(8192),
-        signature: zod_1.z.string().min(1).max(2048),
-        userHandle: zod_1.z.string().max(2048).optional(),
-    })
-        .passthrough(),
-    clientExtensionResults: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
-    authenticatorAttachment: zod_1.z.string().optional(),
-})
-    .passthrough();
-/**
- * Device-session options shared by every first-party sign-in body
- * (`deviceName`/`deviceFingerprint`). Mirrors what
- * `sessionCreateOptionsFromBody` reads in the API so a WebAuthn login/verify can
- * name its resulting session exactly like `/auth/login` or `/auth/verify`.
- *
- * There is deliberately no `deviceId` here. `createSession` treats an explicit
- * device id as authoritative — `deviceId > stableDeviceKey > UA/IP > random` —
- * and stamps it verbatim, so on an UNAUTHENTICATED sign-in body it is a caller
- * naming somebody else's device and having a session, and then a device secret,
- * minted against it. The legitimate callers that pin a device id are
- * server-side and already authorized (the account-switch route threading the
- * operator's own central device id); they pass it to `createSession` directly
- * and never through a request body.
- */
-const deviceSessionEnvelope = {
-    deviceName: zod_1.z.string().trim().min(1).max(120).optional(),
-    deviceFingerprint: zod_1.z.string().trim().min(1).max(256).optional(),
-};
-/**
- * `POST /webauthn/register/options` — request registration options. Three flows:
- *
- * - a bearer: the caller adds a passkey to their signed-in account;
- * - `recoveryTicket` (no bearer): a new passkey for the account a recovery code
- *   was confirmed for (`POST /auth/email/verify/confirm`, purpose `recovery`);
- * - `username` (no bearer): a prospective sign-up; the handle is not created yet.
- */
-exports.webauthnRegisterOptionsRequestSchema = zod_1.z.object({
-    username: zod_1.z.string().trim().min(1).max(60).optional(),
-    recoveryTicket: accountEmail_1.emailTicketSchema.optional(),
-});
-/**
- * `POST /webauthn/login/options` — request authentication options. When
- * `username` is present the server scopes `allowCredentials` to that user's
- * passkeys (username-first); when omitted it returns an empty allow-list for the
- * usernameless / discoverable-credential flow (the default).
- */
-exports.webauthnLoginOptionsRequestSchema = zod_1.z.object({
-    username: zod_1.z.string().trim().min(1).max(60).optional(),
-});
-/**
- * `POST /webauthn/register/verify` — the outer envelope. The browser
- * `RegistrationResponseJSON` travels alongside these fields under `response` and
- * is validated by `@simplewebauthn/server`, not here.
- *
- * - Sign-up (no bearer, ADR 0029 D3): `username`, the recovery `email` and the
- *   `emailTicket` its code was confirmed with. The account is created with the
- *   passkey and that verified email, and no key.
- * - Recovery (no bearer): `recoveryTicket`; the passkey is added to its account
- *   and a session minted.
- * - A bearer: the passkey is added to the signed-in account.
- */
-exports.webauthnRegisterVerifyRequestSchema = zod_1.z.object({
-    username: zod_1.z.string().trim().min(1).max(60).optional(),
-    email: accountEmail_1.emailAddressSchema.optional(),
-    emailTicket: accountEmail_1.emailTicketSchema.optional(),
-    recoveryTicket: accountEmail_1.emailTicketSchema.optional(),
-    ...deviceSessionEnvelope,
-});
-/**
- * `POST /webauthn/login/verify` — the outer envelope. The browser
- * `AuthenticationResponseJSON` travels alongside these fields under `response`
- * and is validated by `@simplewebauthn/server`, not here.
- */
-exports.webauthnLoginVerifyRequestSchema = zod_1.z.object({
-    ...deviceSessionEnvelope,
-});

package/dist/esm/webauthn.js

@@ -1,111 +0,0 @@
-/**
- * WebAuthn / passkey ceremony contracts (Fase B/b1).
- *
- * These schemas describe ONLY the outer Oxy envelope that wraps a WebAuthn
- * ceremony request — the username the client is registering/authenticating as,
- * plus non-authoritative device metadata. The browser
- * `RegistrationResponseJSON` / `AuthenticationResponseJSON` payloads are NOT
- * mirrored here: they are validated by `@simplewebauthn/server` inside the route
- * (`verifyRegistrationResponse` / `verifyAuthenticationResponse`), which is the
- * single source of truth for their structure. Re-encoding them in Zod would just
- * create a second, drift-prone definition of a shape we do not own.
- */
-import { z } from 'zod';
-import { emailAddressSchema, emailTicketSchema } from './accountEmail.js';
-/** A WebAuthn credential id, base64url as the browser reports it. */
-export const webauthnCredentialIdSchema = z
-    .string()
-    .trim()
-    .min(16)
-    .max(1024)
-    .regex(/^[A-Za-z0-9_-]+$/, 'credentialId must be base64url');
-/**
- * A WebAuthn assertion by one of the account's EXISTING passkeys over a server
- * challenge — the fresh use of the factor the account already has (linking
- * Commons to a passkey account, deleting a passkey account). The API verifies
- * it with `@simplewebauthn/server`; this only bounds its shape.
- */
-export const webauthnAssertionResponseSchema = z
-    .object({
-    id: webauthnCredentialIdSchema,
-    rawId: z.string().min(1).max(2048),
-    type: z.literal('public-key'),
-    response: z
-        .object({
-        clientDataJSON: z.string().min(1).max(8192),
-        authenticatorData: z.string().min(1).max(8192),
-        signature: z.string().min(1).max(2048),
-        userHandle: z.string().max(2048).optional(),
-    })
-        .passthrough(),
-    clientExtensionResults: z.record(z.string(), z.unknown()).optional(),
-    authenticatorAttachment: z.string().optional(),
-})
-    .passthrough();
-/**
- * Device-session options shared by every first-party sign-in body
- * (`deviceName`/`deviceFingerprint`). Mirrors what
- * `sessionCreateOptionsFromBody` reads in the API so a WebAuthn login/verify can
- * name its resulting session exactly like `/auth/login` or `/auth/verify`.
- *
- * There is deliberately no `deviceId` here. `createSession` treats an explicit
- * device id as authoritative — `deviceId > stableDeviceKey > UA/IP > random` —
- * and stamps it verbatim, so on an UNAUTHENTICATED sign-in body it is a caller
- * naming somebody else's device and having a session, and then a device secret,
- * minted against it. The legitimate callers that pin a device id are
- * server-side and already authorized (the account-switch route threading the
- * operator's own central device id); they pass it to `createSession` directly
- * and never through a request body.
- */
-const deviceSessionEnvelope = {
-    deviceName: z.string().trim().min(1).max(120).optional(),
-    deviceFingerprint: z.string().trim().min(1).max(256).optional(),
-};
-/**
- * `POST /webauthn/register/options` — request registration options. Three flows:
- *
- * - a bearer: the caller adds a passkey to their signed-in account;
- * - `recoveryTicket` (no bearer): a new passkey for the account a recovery code
- *   was confirmed for (`POST /auth/email/verify/confirm`, purpose `recovery`);
- * - `username` (no bearer): a prospective sign-up; the handle is not created yet.
- */
-export const webauthnRegisterOptionsRequestSchema = z.object({
-    username: z.string().trim().min(1).max(60).optional(),
-    recoveryTicket: emailTicketSchema.optional(),
-});
-/**
- * `POST /webauthn/login/options` — request authentication options. When
- * `username` is present the server scopes `allowCredentials` to that user's
- * passkeys (username-first); when omitted it returns an empty allow-list for the
- * usernameless / discoverable-credential flow (the default).
- */
-export const webauthnLoginOptionsRequestSchema = z.object({
-    username: z.string().trim().min(1).max(60).optional(),
-});
-/**
- * `POST /webauthn/register/verify` — the outer envelope. The browser
- * `RegistrationResponseJSON` travels alongside these fields under `response` and
- * is validated by `@simplewebauthn/server`, not here.
- *
- * - Sign-up (no bearer, ADR 0029 D3): `username`, the recovery `email` and the
- *   `emailTicket` its code was confirmed with. The account is created with the
- *   passkey and that verified email, and no key.
- * - Recovery (no bearer): `recoveryTicket`; the passkey is added to its account
- *   and a session minted.
- * - A bearer: the passkey is added to the signed-in account.
- */
-export const webauthnRegisterVerifyRequestSchema = z.object({
-    username: z.string().trim().min(1).max(60).optional(),
-    email: emailAddressSchema.optional(),
-    emailTicket: emailTicketSchema.optional(),
-    recoveryTicket: emailTicketSchema.optional(),
-    ...deviceSessionEnvelope,
-});
-/**
- * `POST /webauthn/login/verify` — the outer envelope. The browser
- * `AuthenticationResponseJSON` travels alongside these fields under `response`
- * and is validated by `@simplewebauthn/server`, not here.
- */
-export const webauthnLoginVerifyRequestSchema = z.object({
-    ...deviceSessionEnvelope,
-});

package/dist/types/webauthn.d.ts

@@ -1,173 +0,0 @@
-/**
- * WebAuthn / passkey ceremony contracts (Fase B/b1).
- *
- * These schemas describe ONLY the outer Oxy envelope that wraps a WebAuthn
- * ceremony request — the username the client is registering/authenticating as,
- * plus non-authoritative device metadata. The browser
- * `RegistrationResponseJSON` / `AuthenticationResponseJSON` payloads are NOT
- * mirrored here: they are validated by `@simplewebauthn/server` inside the route
- * (`verifyRegistrationResponse` / `verifyAuthenticationResponse`), which is the
- * single source of truth for their structure. Re-encoding them in Zod would just
- * create a second, drift-prone definition of a shape we do not own.
- */
-import { z } from 'zod';
-/** A WebAuthn credential id, base64url as the browser reports it. */
-export declare const webauthnCredentialIdSchema: z.ZodString;
-/**
- * A WebAuthn assertion by one of the account's EXISTING passkeys over a server
- * challenge — the fresh use of the factor the account already has (linking
- * Commons to a passkey account, deleting a passkey account). The API verifies
- * it with `@simplewebauthn/server`; this only bounds its shape.
- */
-export declare const webauthnAssertionResponseSchema: z.ZodObject<{
-    id: z.ZodString;
-    rawId: z.ZodString;
-    type: z.ZodLiteral<"public-key">;
-    response: z.ZodObject<{
-        clientDataJSON: z.ZodString;
-        authenticatorData: z.ZodString;
-        signature: z.ZodString;
-        userHandle: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        clientDataJSON: z.ZodString;
-        authenticatorData: z.ZodString;
-        signature: z.ZodString;
-        userHandle: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        clientDataJSON: z.ZodString;
-        authenticatorData: z.ZodString;
-        signature: z.ZodString;
-        userHandle: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>;
-    clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    authenticatorAttachment: z.ZodOptional<z.ZodString>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    id: z.ZodString;
-    rawId: z.ZodString;
-    type: z.ZodLiteral<"public-key">;
-    response: z.ZodObject<{
-        clientDataJSON: z.ZodString;
-        authenticatorData: z.ZodString;
-        signature: z.ZodString;
-        userHandle: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        clientDataJSON: z.ZodString;
-        authenticatorData: z.ZodString;
-        signature: z.ZodString;
-        userHandle: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        clientDataJSON: z.ZodString;
-        authenticatorData: z.ZodString;
-        signature: z.ZodString;
-        userHandle: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>;
-    clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    authenticatorAttachment: z.ZodOptional<z.ZodString>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    id: z.ZodString;
-    rawId: z.ZodString;
-    type: z.ZodLiteral<"public-key">;
-    response: z.ZodObject<{
-        clientDataJSON: z.ZodString;
-        authenticatorData: z.ZodString;
-        signature: z.ZodString;
-        userHandle: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        clientDataJSON: z.ZodString;
-        authenticatorData: z.ZodString;
-        signature: z.ZodString;
-        userHandle: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        clientDataJSON: z.ZodString;
-        authenticatorData: z.ZodString;
-        signature: z.ZodString;
-        userHandle: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>;
-    clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    authenticatorAttachment: z.ZodOptional<z.ZodString>;
-}, z.ZodTypeAny, "passthrough">>;
-export type WebauthnAssertionResponse = z.infer<typeof webauthnAssertionResponseSchema>;
-/**
- * `POST /webauthn/register/options` — request registration options. Three flows:
- *
- * - a bearer: the caller adds a passkey to their signed-in account;
- * - `recoveryTicket` (no bearer): a new passkey for the account a recovery code
- *   was confirmed for (`POST /auth/email/verify/confirm`, purpose `recovery`);
- * - `username` (no bearer): a prospective sign-up; the handle is not created yet.
- */
-export declare const webauthnRegisterOptionsRequestSchema: z.ZodObject<{
-    username: z.ZodOptional<z.ZodString>;
-    recoveryTicket: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    username?: string | undefined;
-    recoveryTicket?: string | undefined;
-}, {
-    username?: string | undefined;
-    recoveryTicket?: string | undefined;
-}>;
-export type WebauthnRegisterOptionsRequest = z.infer<typeof webauthnRegisterOptionsRequestSchema>;
-/**
- * `POST /webauthn/login/options` — request authentication options. When
- * `username` is present the server scopes `allowCredentials` to that user's
- * passkeys (username-first); when omitted it returns an empty allow-list for the
- * usernameless / discoverable-credential flow (the default).
- */
-export declare const webauthnLoginOptionsRequestSchema: z.ZodObject<{
-    username: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    username?: string | undefined;
-}, {
-    username?: string | undefined;
-}>;
-export type WebauthnLoginOptionsRequest = z.infer<typeof webauthnLoginOptionsRequestSchema>;
-/**
- * `POST /webauthn/register/verify` — the outer envelope. The browser
- * `RegistrationResponseJSON` travels alongside these fields under `response` and
- * is validated by `@simplewebauthn/server`, not here.
- *
- * - Sign-up (no bearer, ADR 0029 D3): `username`, the recovery `email` and the
- *   `emailTicket` its code was confirmed with. The account is created with the
- *   passkey and that verified email, and no key.
- * - Recovery (no bearer): `recoveryTicket`; the passkey is added to its account
- *   and a session minted.
- * - A bearer: the passkey is added to the signed-in account.
- */
-export declare const webauthnRegisterVerifyRequestSchema: z.ZodObject<{
-    deviceName: z.ZodOptional<z.ZodString>;
-    deviceFingerprint: z.ZodOptional<z.ZodString>;
-    username: z.ZodOptional<z.ZodString>;
-    email: z.ZodOptional<z.ZodString>;
-    emailTicket: z.ZodOptional<z.ZodString>;
-    recoveryTicket: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    email?: string | undefined;
-    username?: string | undefined;
-    recoveryTicket?: string | undefined;
-    emailTicket?: string | undefined;
-    deviceName?: string | undefined;
-    deviceFingerprint?: string | undefined;
-}, {
-    email?: string | undefined;
-    username?: string | undefined;
-    recoveryTicket?: string | undefined;
-    emailTicket?: string | undefined;
-    deviceName?: string | undefined;
-    deviceFingerprint?: string | undefined;
-}>;
-export type WebauthnRegisterVerifyRequest = z.infer<typeof webauthnRegisterVerifyRequestSchema>;
-/**
- * `POST /webauthn/login/verify` — the outer envelope. The browser
- * `AuthenticationResponseJSON` travels alongside these fields under `response`
- * and is validated by `@simplewebauthn/server`, not here.
- */
-export declare const webauthnLoginVerifyRequestSchema: z.ZodObject<{
-    deviceName: z.ZodOptional<z.ZodString>;
-    deviceFingerprint: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    deviceName?: string | undefined;
-    deviceFingerprint?: string | undefined;
-}, {
-    deviceName?: string | undefined;
-    deviceFingerprint?: string | undefined;
-}>;
-export type WebauthnLoginVerifyRequest = z.infer<typeof webauthnLoginVerifyRequestSchema>;