@oxy.so/contracts 2.2.0 → 4.0.0

package/dist/cjs/reputation.js

@@ -4,9 +4,8 @@
  *
  * SINGLE SOURCE OF TRUTH for the reputation ledger's wire shapes: the closed
  * value sets (`REPUTATION_CATEGORIES`, `TRUST_TIERS`, …), the response entities
- * (`ReputationTransaction`, the two balance views, `ReputationDispute`,
- * `ReputationRule`, the leaderboard entry) and the request bodies the write
- * endpoints accept. The API validates its OUTPUT against these schemas and its
+ * (`ReputationTransaction`, the two balance views, `ReputationRule`, the
+ * leaderboard entry) and the award body. The API validates its OUTPUT against these schemas and its
  * INPUT with the same request schemas the SDK's input types are derived from;
  * `@oxy.so/core`'s reputation mixin imports every type from here rather than
  * declaring its own.
@@ -41,7 +40,7 @@
  * `require()`).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.reverseReputationTransactionSchema = exports.upsertReputationRuleSchema = exports.resolveReputationDisputeSchema = exports.createReputationDisputeSchema = exports.awardReputationSchema = exports.reverseReputationTransactionResultSchema = exports.reputationInfluenceResultSchema = exports.reputationLeaderboardEntrySchema = exports.reputationLeaderboardUserSchema = exports.reputationRuleSchema = exports.reputationDisputeSchema = exports.reputationBalanceSchema = exports.reputationBalanceSummarySchema = exports.reputationReliabilitySchema = exports.reputationInfluenceSchema = exports.reputationBalanceBreakdownSchema = exports.reputationTransactionSchema = exports.reputationInfluenceContextSchema = exports.REPUTATION_INFLUENCE_CONTEXTS = exports.reputationDisputeStatusSchema = exports.REPUTATION_DISPUTE_STATUSES = exports.reputationTargetEntityTypeSchema = exports.REPUTATION_TARGET_ENTITY_TYPES = exports.trustTierSchema = exports.TRUST_TIERS = exports.reputationTransactionStatusSchema = exports.REPUTATION_TRANSACTION_STATUSES = exports.reputationCategorySchema = exports.REPUTATION_CATEGORIES = void 0;
+exports.awardReputationSchema = exports.reputationInfluenceResultSchema = exports.reputationLeaderboardEntrySchema = exports.reputationLeaderboardUserSchema = exports.reputationRulesResponseSchema = exports.reputationRuleSchema = exports.reputationBalanceSchema = exports.reputationBalanceSummarySchema = exports.reputationReliabilitySchema = exports.reputationInfluenceSchema = exports.reputationBalanceBreakdownSchema = exports.reputationTransactionSchema = exports.reputationInfluenceContextSchema = exports.REPUTATION_INFLUENCE_CONTEXTS = exports.reputationTargetEntityTypeSchema = exports.REPUTATION_TARGET_ENTITY_TYPES = exports.trustTierSchema = exports.TRUST_TIERS = exports.reputationTransactionStatusSchema = exports.REPUTATION_TRANSACTION_STATUSES = exports.reputationCategorySchema = exports.REPUTATION_CATEGORIES = void 0;
 exports.isFullReputationBalance = isFullReputationBalance;
 const zod_1 = require("zod");
 const userResponse_1 = require("./userResponse");
@@ -75,15 +74,13 @@ exports.reputationCategorySchema = zod_1.z.enum(exports.REPUTATION_CATEGORIES);
  * Transaction lifecycle status.
  *
  * - `active`   — counts toward the balance.
- * - `disputed` — under dispute; still counts until the dispute resolves.
- * - `reversed` — superseded by a compensating reversal transaction; excluded.
- * - `voided`   — administratively excluded with no compensating entry.
+ * - `reversed` — superseded by a compensating reversal transaction (written
+ *                only by policy-driven code, never by a person); the pair nets
+ *                to zero.
  */
 exports.REPUTATION_TRANSACTION_STATUSES = [
     'active',
-    'disputed',
     'reversed',
-    'voided',
 ];
 exports.reputationTransactionStatusSchema = zod_1.z.enum(exports.REPUTATION_TRANSACTION_STATUSES);
 /**
@@ -108,15 +105,6 @@ exports.REPUTATION_TARGET_ENTITY_TYPES = [
     'other',
 ];
 exports.reputationTargetEntityTypeSchema = zod_1.z.enum(exports.REPUTATION_TARGET_ENTITY_TYPES);
-/** Dispute lifecycle status. */
-exports.REPUTATION_DISPUTE_STATUSES = [
-    'open',
-    'accepted',
-    'rejected',
-    'needs_review',
-];
-exports.reputationDisputeStatusSchema = zod_1.z.enum(exports.REPUTATION_DISPUTE_STATUSES);
-/** Influence context selecting which capped weight axis to read. */
 exports.REPUTATION_INFLUENCE_CONTEXTS = [
     'default',
     'report',
@@ -221,26 +209,16 @@ const FULL_BALANCE_FIELDS = [
 function isFullReputationBalance(balance) {
     return FULL_BALANCE_FIELDS.every((field) => field in balance);
 }
-exports.reputationDisputeSchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    transactionId: zod_1.z.string(),
-    userId: zod_1.z.string(),
-    reason: zod_1.z.string(),
-    status: exports.reputationDisputeStatusSchema,
-    evidence: zod_1.z.array(zod_1.z.string()).optional(),
-    resolvedAt: zod_1.z.string().optional(),
-    resolvedByUserId: zod_1.z.string().optional(),
-    createdAt: zod_1.z.string(),
-    updatedAt: zod_1.z.string(),
-});
 exports.reputationRuleSchema = zod_1.z.object({
-    id: zod_1.z.string(),
     actionType: zod_1.z.string(),
     points: zod_1.z.number(),
     category: exports.reputationCategorySchema,
     description: zod_1.z.string(),
     cooldownInMinutes: zod_1.z.number(),
-    isEnabled: zod_1.z.boolean(),
+});
+exports.reputationRulesResponseSchema = zod_1.z.object({
+    version: zod_1.z.number().int(),
+    rules: zod_1.z.array(exports.reputationRuleSchema),
 });
 exports.reputationLeaderboardUserSchema = zod_1.z.object({
     id: zod_1.z.string(),
@@ -260,10 +238,6 @@ exports.reputationInfluenceResultSchema = zod_1.z.object({
     weight: zod_1.z.number(),
     influence: exports.reputationInfluenceSchema,
 });
-exports.reverseReputationTransactionResultSchema = zod_1.z.object({
-    original: exports.reputationTransactionSchema,
-    reversal: exports.reputationTransactionSchema,
-});
 exports.awardReputationSchema = zod_1.z.object({
     userId: zod_1.z.string().trim().min(1),
     actionType: zod_1.z.string().trim().min(1),
@@ -276,22 +250,3 @@ exports.awardReputationSchema = zod_1.z.object({
     reason: zod_1.z.string().trim().max(500).optional(),
     metadata: zod_1.z.record(zod_1.z.unknown()).optional(),
 });
-exports.createReputationDisputeSchema = zod_1.z.object({
-    transactionId: zod_1.z.string().trim().min(1),
-    reason: zod_1.z.string().trim().min(1).max(1000),
-    evidence: zod_1.z.array(zod_1.z.string().trim().min(1)).max(20).optional(),
-});
-exports.resolveReputationDisputeSchema = zod_1.z.object({
-    status: zod_1.z.enum(['accepted', 'rejected']),
-});
-exports.upsertReputationRuleSchema = zod_1.z.object({
-    actionType: zod_1.z.string().trim().min(1),
-    points: zod_1.z.number(),
-    category: exports.reputationCategorySchema,
-    description: zod_1.z.string().trim().min(1).max(500),
-    cooldownInMinutes: zod_1.z.number().int().min(0).default(0),
-    isEnabled: zod_1.z.boolean().default(true),
-});
-exports.reverseReputationTransactionSchema = zod_1.z.object({
-    reason: zod_1.z.string().trim().max(500).optional(),
-});

package/dist/cjs/signIn.js

@@ -0,0 +1,304 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIGN_IN_ERROR_CODES = exports.totpBackupCodesResponseSchema = exports.totpReauthRequestSchema = exports.totpConfirmRequestSchema = exports.totpEnrollResponseSchema = exports.signInMethodsSchema = exports.passwordSetRequestSchema = exports.emailReauthProofSchema = exports.reauthProofSchema = exports.reauthEmailStartRequestSchema = exports.REAUTH_ACTIONS = exports.emailSignInPendingSchema = exports.secondFactorRequiredSchema = exports.signUpRequestSchema = exports.secondFactorSignInRequestSchema = exports.passwordSignInRequestSchema = exports.emailSignInLinkResponseSchema = exports.emailSignInLinkRequestSchema = exports.emailSignInCollectRequestSchema = exports.emailSignInConfirmRequestSchema = exports.emailSignInCodeSchema = exports.emailSignInStartResponseSchema = exports.emailSignInStartRequestSchema = exports.secondFactorCodeSchema = exports.newPasswordSchema = exports.passwordInputSchema = exports.signInIdentifierSchema = exports.EMAIL_SIGNIN_LONG_CODE_LENGTH = exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET = exports.TOTP_BACKUP_CODE_COUNT = exports.TOTP_PERIOD_SECONDS = exports.TOTP_DIGITS = exports.PASSWORD_MAX_LENGTH = exports.PASSWORD_MIN_LENGTH = exports.SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = exports.SIGNIN_SECOND_FACTOR_TTL_MS = exports.EMAIL_SIGNIN_LINK_TTL_MS = void 0;
+exports.normalizeEmailSignInCode = normalizeEmailSignInCode;
+exports.isSecondFactorRequired = isSecondFactorRequired;
+/**
+ * Signing in: an email code or link, an optional password,
+ * and an optional authenticator app (TOTP) as a second factor.
+ *
+ * Every Oxy app runs these from its own account dialog (official apps and
+ * auth.oxy.so only; third parties sign in through OAuth on auth.oxy.so):
+ *
+ * 1. `POST /auth/signin/email/start` with a username or email. One email
+ *    carries a 6-digit code AND a one-use link to auth.oxy.so; the answer is the
+ *    same whether or not the account exists. The dialog keeps the
+ *    `requestSecret` it is given: only it can collect the session.
+ * 2. Either the code (`POST /auth/signin/email/confirm`), or the link opened in
+ *    the SAME browser (`POST /auth/signin/email/link` from auth.oxy.so, proving
+ *    the browser's shared device) followed by the dialog's
+ *    `POST /auth/signin/email/collect`.
+ * 3. Or a password (`POST /auth/signin/password`), when the account set one.
+ * 4. When the account has an authenticator, every first factor answers a
+ *    one-use second-factor challenge instead of a session, and
+ *    `POST /auth/signin/second-factor` takes the TOTP (or a backup code).
+ *
+ * `POST /auth/signup` creates an account from a username and an email confirmed
+ * with `POST /auth/email/verify/{start,confirm}` (purpose `signup`).
+ *
+ * Every body that ends in a session may carry `device`, the proof of the
+ * browser's shared device (ADR 0029 D2), so the account lands on it.
+ */
+const zod_1 = require("zod");
+const accountEmail_1 = require("./accountEmail");
+const deviceSession_1 = require("./deviceSession");
+/** How long the link in a sign-in email can be opened. */
+exports.EMAIL_SIGNIN_LINK_TTL_MS = 15 * 60 * 1000;
+/** How long a second-factor challenge can be answered. */
+exports.SIGNIN_SECOND_FACTOR_TTL_MS = 5 * 60 * 1000;
+/** Wrong second-factor codes one challenge accepts. */
+exports.SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = 5;
+/** Shortest password Oxy accepts when one is set. */
+exports.PASSWORD_MIN_LENGTH = 10;
+/** Longest password Oxy accepts (characters). */
+exports.PASSWORD_MAX_LENGTH = 256;
+/** Digits in an authenticator code. */
+exports.TOTP_DIGITS = 6;
+/** Seconds each authenticator code lasts. */
+exports.TOTP_PERIOD_SECONDS = 30;
+/** Backup codes issued when an authenticator is enabled or they are regenerated. */
+exports.TOTP_BACKUP_CODE_COUNT = 10;
+/**
+ * The long sign-in code: ten characters of Crockford base32 without the
+ * look-alikes (no 0, O, 1, I, L, U), shown as `XXXXX-XXXXX`. An account whose
+ * sign-in codes were guessed at too often today (the per-account ceiling) is
+ * sent this instead of 6 digits for the rest of the day, so its owner can still
+ * type a code while guessing one is infeasible.
+ */
+exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET = '23456789ABCDEFGHJKMNPQRSTVWXYZ';
+exports.EMAIL_SIGNIN_LONG_CODE_LENGTH = 10;
+/**
+ * Normalise a typed sign-in code: 6 digits stay as they are; a long code is
+ * upper-cased with its dash and spaces removed. Anything else is returned
+ * trimmed (and will simply be wrong).
+ */
+function normalizeEmailSignInCode(code) {
+    const compact = code.trim().replace(/[\s-]/g, '').toUpperCase();
+    return compact;
+}
+const sixDigits = zod_1.z
+    .string()
+    .trim()
+    .regex(new RegExp(`^\\d{${accountEmail_1.EMAIL_CODE_LENGTH}}$`), `code must be ${accountEmail_1.EMAIL_CODE_LENGTH} digits`);
+/**
+ * 32 random bytes, base64url: a request secret, a link token, a challenge id.
+ * The same shape as an email ticket.
+ */
+const opaqueTokenSchema = accountEmail_1.emailTicketSchema;
+/** A username or an email. */
+exports.signInIdentifierSchema = zod_1.z.string().trim().min(1).max(254);
+/** A password as typed. Its policy applies only when one is set. */
+exports.passwordInputSchema = zod_1.z.string().min(1).max(exports.PASSWORD_MAX_LENGTH);
+/** A new password. */
+exports.newPasswordSchema = zod_1.z
+    .string()
+    .min(exports.PASSWORD_MIN_LENGTH, `password must be at least ${exports.PASSWORD_MIN_LENGTH} characters`)
+    .max(exports.PASSWORD_MAX_LENGTH, `password must be at most ${exports.PASSWORD_MAX_LENGTH} characters`);
+/**
+ * An authenticator code (6 digits) or a backup code (10 characters, with or
+ * without its dash). Normalised server-side.
+ */
+exports.secondFactorCodeSchema = zod_1.z.string().trim().min(exports.TOTP_DIGITS).max(16);
+/** The device-session fields every body that ends in a session may carry. */
+const sessionEnvelope = {
+    deviceName: zod_1.z.string().trim().min(1).max(120).optional(),
+    deviceFingerprint: zod_1.z.string().trim().min(1).max(256).optional(),
+    /** Proof of the browser's shared device; invalid → the session gets its own. */
+    device: deviceSession_1.deviceProofSchema.optional(),
+};
+/** `POST /auth/signin/email/start` */
+exports.emailSignInStartRequestSchema = zod_1.z
+    .object({
+    identifier: exports.signInIdentifierSchema,
+    /** The requester's device: the email's link approves only in this browser. */
+    device: deviceSession_1.deviceProofSchema.optional(),
+})
+    .strict();
+exports.emailSignInStartResponseSchema = zod_1.z.object({
+    requestId: zod_1.z.string().min(1).max(64),
+    requestSecret: opaqueTokenSchema,
+    expiresAt: zod_1.z.number().int().positive(),
+    retryLater: zod_1.z.literal(true).optional(),
+});
+/**
+ * The code from a sign-in email: 6 digits, or — for an account whose codes
+ * were guessed at too often today — the 10-character long code
+ * (`EMAIL_SIGNIN_LONG_CODE_ALPHABET`, with or without its dash, any case). The
+ * UI must accept BOTH in one field: the email says which was sent, and the
+ * start response is the same either way (it says nothing about the account).
+ */
+exports.emailSignInCodeSchema = zod_1.z
+    .string()
+    .trim()
+    .refine((value) => {
+    const code = normalizeEmailSignInCode(value);
+    return (new RegExp(`^\\d{${accountEmail_1.EMAIL_CODE_LENGTH}}$`).test(code) ||
+        new RegExp(`^[${exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET}]{${exports.EMAIL_SIGNIN_LONG_CODE_LENGTH}}$`).test(code));
+}, { message: `code must be ${accountEmail_1.EMAIL_CODE_LENGTH} digits or the ${exports.EMAIL_SIGNIN_LONG_CODE_LENGTH}-character code from the email` });
+/** `POST /auth/signin/email/confirm` — the code from the email. */
+exports.emailSignInConfirmRequestSchema = zod_1.z
+    .object({
+    requestId: zod_1.z.string().trim().min(1).max(64),
+    requestSecret: opaqueTokenSchema,
+    code: exports.emailSignInCodeSchema,
+    ...sessionEnvelope,
+})
+    .strict();
+/** `POST /auth/signin/email/collect` — the dialog asks whether its link was opened. */
+exports.emailSignInCollectRequestSchema = zod_1.z
+    .object({
+    requestId: zod_1.z.string().trim().min(1).max(64),
+    requestSecret: opaqueTokenSchema,
+    ...sessionEnvelope,
+})
+    .strict();
+/**
+ * `POST /auth/signin/email/link` — auth.oxy.so, where the email's link lands.
+ * It proves auth.oxy.so's own credential for the browser's device; the request
+ * is approved only when that is the device that asked.
+ */
+exports.emailSignInLinkRequestSchema = zod_1.z
+    .object({
+    token: opaqueTokenSchema,
+    device: deviceSession_1.deviceProofSchema,
+})
+    .strict();
+exports.emailSignInLinkResponseSchema = zod_1.z.object({
+    approved: zod_1.z.literal(true),
+});
+/** `POST /auth/signin/password` */
+exports.passwordSignInRequestSchema = zod_1.z
+    .object({
+    identifier: exports.signInIdentifierSchema,
+    password: exports.passwordInputSchema,
+    ...sessionEnvelope,
+})
+    .strict();
+/** `POST /auth/signin/second-factor` */
+exports.secondFactorSignInRequestSchema = zod_1.z
+    .object({
+    challengeId: opaqueTokenSchema,
+    code: exports.secondFactorCodeSchema,
+    ...sessionEnvelope,
+})
+    .strict();
+/** `POST /auth/signup` — the account, from a username and a confirmed email. */
+exports.signUpRequestSchema = zod_1.z
+    .object({
+    username: zod_1.z.string().trim().min(1).max(60),
+    email: accountEmail_1.emailAddressSchema,
+    /** The ticket `POST /auth/email/verify/confirm` (purpose `signup`) returned. */
+    emailTicket: accountEmail_1.emailTicketSchema,
+    ...sessionEnvelope,
+})
+    .strict();
+exports.secondFactorRequiredSchema = zod_1.z.object({
+    secondFactorRequired: zod_1.z.literal(true),
+    challengeId: opaqueTokenSchema,
+    expiresAt: zod_1.z.number().int().positive(),
+});
+exports.emailSignInPendingSchema = zod_1.z.object({
+    status: zod_1.z.literal('pending'),
+    expiresAt: zod_1.z.number().int().positive(),
+});
+/** Narrow a {@link SignInStepResult}. */
+function isSecondFactorRequired(result) {
+    return result.secondFactorRequired === true;
+}
+/**
+ * What a re-verification email code confirms. The code is bound to it: a code
+ * asked for one change never authorises another, and the email names it.
+ */
+exports.REAUTH_ACTIONS = ['change_password', 'totp', 'link_commons', 'delete_account'];
+/** `POST /users/me/reauth/email` */
+exports.reauthEmailStartRequestSchema = zod_1.z.object({ action: zod_1.z.enum(exports.REAUTH_ACTIONS) }).strict();
+/**
+ * A fresh proof that the person, not only their session, is asking: the
+ * current password, or a code just sent to the account's email
+ * (`POST /users/me/reauth/email`) — plus the authenticator code when the
+ * account has one. Carried inside the request it authorises.
+ */
+exports.reauthProofSchema = zod_1.z
+    .object({
+    password: exports.passwordInputSchema.optional(),
+    emailCode: zod_1.z
+        .object({
+        verificationId: zod_1.z.string().trim().min(1).max(64),
+        code: sixDigits,
+    })
+        .strict()
+        .optional(),
+    /** Required when the account has an authenticator: its code or a backup code. */
+    totpCode: exports.secondFactorCodeSchema.optional(),
+})
+    .strict()
+    .refine((proof) => proof.password !== undefined || proof.emailCode !== undefined, {
+    message: 'password or emailCode is required',
+});
+/** A proof by email code only (+ TOTP): deleting an account, linking Commons. */
+exports.emailReauthProofSchema = zod_1.z
+    .object({
+    emailCode: zod_1.z
+        .object({
+        verificationId: zod_1.z.string().trim().min(1).max(64),
+        code: sixDigits,
+    })
+        .strict(),
+    totpCode: exports.secondFactorCodeSchema.optional(),
+})
+    .strict();
+/** `PUT /users/me/password` — set or change the password. */
+exports.passwordSetRequestSchema = zod_1.z
+    .object({
+    newPassword: exports.newPasswordSchema,
+    reauth: exports.reauthProofSchema,
+    /** Sign every other session of the account out. */
+    revokeOtherSessions: zod_1.z.boolean().optional(),
+})
+    .strict();
+exports.signInMethodsSchema = zod_1.z.object({
+    hasEmail: zod_1.z.boolean(),
+    hasPassword: zod_1.z.boolean(),
+    totpEnabled: zod_1.z.boolean(),
+    backupCodesRemaining: zod_1.z.number().int().min(0),
+});
+exports.totpEnrollResponseSchema = zod_1.z.object({
+    secret: zod_1.z.string().regex(/^[A-Z2-7]+$/),
+    otpauthUri: zod_1.z.string().startsWith('otpauth://totp/'),
+});
+/** `POST /users/me/totp/confirm` — the first code from the authenticator turns it on. */
+exports.totpConfirmRequestSchema = zod_1.z
+    .object({
+    code: zod_1.z.string().trim().regex(new RegExp(`^\\d{${exports.TOTP_DIGITS}}$`)),
+    reauth: exports.reauthProofSchema,
+})
+    .strict();
+/** `POST /users/me/totp/disable` and `POST /users/me/totp/backup-codes` */
+exports.totpReauthRequestSchema = zod_1.z.object({ reauth: exports.reauthProofSchema }).strict();
+exports.totpBackupCodesResponseSchema = zod_1.z.object({
+    backupCodes: zod_1.z.array(zod_1.z.string().regex(/^[a-z2-9]{5}-[a-z2-9]{5}$/)).length(exports.TOTP_BACKUP_CODE_COUNT),
+});
+/**
+ * Stable error codes (`error.code` in the API error body). Clients map these
+ * through their localization, never the English message.
+ */
+exports.SIGN_IN_ERROR_CODES = {
+    /** Wrong identifier or password — never says which. */
+    invalidCredentials: 'SIGNIN_INVALID_CREDENTIALS',
+    /** The request is unknown, expired, spent, or its secret is wrong. */
+    requestInvalid: 'SIGNIN_REQUEST_INVALID',
+    /** The link is unknown, expired or already used. */
+    linkInvalid: 'SIGNIN_LINK_INVALID',
+    /** The link was opened in another browser: type the code in the app instead. */
+    linkOtherDevice: 'SIGNIN_LINK_OTHER_DEVICE',
+    /** The second-factor challenge or its code is wrong, expired or spent. */
+    secondFactorInvalid: 'SECOND_FACTOR_INVALID',
+    /** Too many failures for this account: wait and try again. */
+    locked: 'SIGNIN_LOCKED',
+    /** The step needs a fresh proof (`reauth`). */
+    reauthRequired: 'REAUTH_REQUIRED',
+    /** The fresh proof was wrong. */
+    reauthInvalid: 'REAUTH_INVALID',
+    /** The account has an authenticator: the proof must carry its code. */
+    totpRequired: 'TOTP_REQUIRED',
+    /** Enrolling or confirming an authenticator that is already on. */
+    totpAlreadyEnabled: 'TOTP_ALREADY_ENABLED',
+    /** Disabling, confirming or regenerating codes with no authenticator (or no pending one). */
+    totpNotEnabled: 'TOTP_NOT_ENABLED',
+    /** The code the authenticator showed at enrolment is wrong. */
+    totpCodeInvalid: 'TOTP_CODE_INVALID',
+    /** Only official Oxy apps and auth.oxy.so may sign people in here. */
+    originNotAllowed: 'SIGNIN_ORIGIN_NOT_ALLOWED',
+    /** The username is taken. */
+    usernameTaken: 'USERNAME_TAKEN',
+};