@oxy.so/contracts 2.2.0 → 4.0.0

package/dist/types/externalIdentity.d.ts

@@ -1,22 +1,28 @@
 import { z } from 'zod';
+/**
+ * How Oxy observed an external account. `instagram-graph` is Meta's Graph API
+ * Business Discovery, a fallback transport for Business/Creator Instagram
+ * accounts when the ActivityPub bridge is unavailable.
+ */
+export declare const externalIdentityProtocolSchema: z.ZodEnum<["activitypub", "atproto", "instagram-graph"]>;
 export declare const externalIdentityReferenceSchema: z.ZodObject<{
     canonicalAcct: z.ZodString;
     network: z.ZodString;
-    protocol: z.ZodEnum<["activitypub", "atproto"]>;
+    protocol: z.ZodEnum<["activitypub", "atproto", "instagram-graph"]>;
     actorUri: z.ZodString;
     transportAcct: z.ZodString;
     sourceUserId: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     canonicalAcct: string;
     network: string;
-    protocol: "activitypub" | "atproto";
+    protocol: "activitypub" | "atproto" | "instagram-graph";
     actorUri: string;
     transportAcct: string;
     sourceUserId: string;
 }, {
     canonicalAcct: string;
     network: string;
-    protocol: "activitypub" | "atproto";
+    protocol: "activitypub" | "atproto" | "instagram-graph";
     actorUri: string;
     transportAcct: string;
     sourceUserId: string;
@@ -25,24 +31,24 @@ export declare const resolveExternalIdentityRequestSchema: z.ZodEffects<z.ZodObj
     actorUri: z.ZodOptional<z.ZodString>;
     handle: z.ZodOptional<z.ZodString>;
     transportAcct: z.ZodOptional<z.ZodString>;
-    protocol: z.ZodOptional<z.ZodEnum<["activitypub", "atproto"]>>;
+    protocol: z.ZodOptional<z.ZodEnum<["activitypub", "atproto", "instagram-graph"]>>;
 }, "strip", z.ZodTypeAny, {
-    protocol?: "activitypub" | "atproto" | undefined;
+    protocol?: "activitypub" | "atproto" | "instagram-graph" | undefined;
     actorUri?: string | undefined;
     transportAcct?: string | undefined;
     handle?: string | undefined;
 }, {
-    protocol?: "activitypub" | "atproto" | undefined;
+    protocol?: "activitypub" | "atproto" | "instagram-graph" | undefined;
     actorUri?: string | undefined;
     transportAcct?: string | undefined;
     handle?: string | undefined;
 }>, {
-    protocol?: "activitypub" | "atproto" | undefined;
+    protocol?: "activitypub" | "atproto" | "instagram-graph" | undefined;
     actorUri?: string | undefined;
     transportAcct?: string | undefined;
     handle?: string | undefined;
 }, {
-    protocol?: "activitypub" | "atproto" | undefined;
+    protocol?: "activitypub" | "atproto" | "instagram-graph" | undefined;
     actorUri?: string | undefined;
     transportAcct?: string | undefined;
     handle?: string | undefined;
@@ -75,21 +81,21 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         externalIdentities: z.ZodArray<z.ZodObject<{
             canonicalAcct: z.ZodString;
             network: z.ZodString;
-            protocol: z.ZodEnum<["activitypub", "atproto"]>;
+            protocol: z.ZodEnum<["activitypub", "atproto", "instagram-graph"]>;
             actorUri: z.ZodString;
             transportAcct: z.ZodString;
             sourceUserId: z.ZodString;
         }, "strip", z.ZodTypeAny, {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
         }, {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
@@ -122,21 +128,21 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         externalIdentities: z.ZodArray<z.ZodObject<{
             canonicalAcct: z.ZodString;
             network: z.ZodString;
-            protocol: z.ZodEnum<["activitypub", "atproto"]>;
+            protocol: z.ZodEnum<["activitypub", "atproto", "instagram-graph"]>;
             actorUri: z.ZodString;
             transportAcct: z.ZodString;
             sourceUserId: z.ZodString;
         }, "strip", z.ZodTypeAny, {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
         }, {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
@@ -169,21 +175,21 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         externalIdentities: z.ZodArray<z.ZodObject<{
             canonicalAcct: z.ZodString;
             network: z.ZodString;
-            protocol: z.ZodEnum<["activitypub", "atproto"]>;
+            protocol: z.ZodEnum<["activitypub", "atproto", "instagram-graph"]>;
             actorUri: z.ZodString;
             transportAcct: z.ZodString;
             sourceUserId: z.ZodString;
         }, "strip", z.ZodTypeAny, {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
         }, {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
@@ -193,7 +199,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
     externalIdentity: z.ZodObject<{
         canonicalAcct: z.ZodString;
         network: z.ZodString;
-        protocol: z.ZodEnum<["activitypub", "atproto"]>;
+        protocol: z.ZodEnum<["activitypub", "atproto", "instagram-graph"]>;
         actorUri: z.ZodString;
         transportAcct: z.ZodString;
         sourceUserId: z.ZodString;
@@ -203,7 +209,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         userId: string;
         canonicalAcct: string;
         network: string;
-        protocol: "activitypub" | "atproto";
+        protocol: "activitypub" | "atproto" | "instagram-graph";
         actorUri: string;
         transportAcct: string;
         sourceUserId: string;
@@ -211,7 +217,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         userId: string;
         canonicalAcct: string;
         network: string;
-        protocol: "activitypub" | "atproto";
+        protocol: "activitypub" | "atproto" | "instagram-graph";
         actorUri: string;
         transportAcct: string;
         sourceUserId: string;
@@ -219,21 +225,21 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
     externalIdentities: z.ZodArray<z.ZodObject<{
         canonicalAcct: z.ZodString;
         network: z.ZodString;
-        protocol: z.ZodEnum<["activitypub", "atproto"]>;
+        protocol: z.ZodEnum<["activitypub", "atproto", "instagram-graph"]>;
         actorUri: z.ZodString;
         transportAcct: z.ZodString;
         sourceUserId: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         canonicalAcct: string;
         network: string;
-        protocol: "activitypub" | "atproto";
+        protocol: "activitypub" | "atproto" | "instagram-graph";
         actorUri: string;
         transportAcct: string;
         sourceUserId: string;
     }, {
         canonicalAcct: string;
         network: string;
-        protocol: "activitypub" | "atproto";
+        protocol: "activitypub" | "atproto" | "instagram-graph";
         actorUri: string;
         transportAcct: string;
         sourceUserId: string;
@@ -247,7 +253,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         externalIdentities: {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
@@ -278,7 +284,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
     externalIdentities: {
         canonicalAcct: string;
         network: string;
-        protocol: "activitypub" | "atproto";
+        protocol: "activitypub" | "atproto" | "instagram-graph";
         actorUri: string;
         transportAcct: string;
         sourceUserId: string;
@@ -288,7 +294,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         userId: string;
         canonicalAcct: string;
         network: string;
-        protocol: "activitypub" | "atproto";
+        protocol: "activitypub" | "atproto" | "instagram-graph";
         actorUri: string;
         transportAcct: string;
         sourceUserId: string;
@@ -301,7 +307,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         externalIdentities: {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
@@ -332,7 +338,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
     externalIdentities: {
         canonicalAcct: string;
         network: string;
-        protocol: "activitypub" | "atproto";
+        protocol: "activitypub" | "atproto" | "instagram-graph";
         actorUri: string;
         transportAcct: string;
         sourceUserId: string;
@@ -342,7 +348,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         userId: string;
         canonicalAcct: string;
         network: string;
-        protocol: "activitypub" | "atproto";
+        protocol: "activitypub" | "atproto" | "instagram-graph";
         actorUri: string;
         transportAcct: string;
         sourceUserId: string;
@@ -355,7 +361,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         externalIdentities: {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
@@ -386,7 +392,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
     externalIdentities: {
         canonicalAcct: string;
         network: string;
-        protocol: "activitypub" | "atproto";
+        protocol: "activitypub" | "atproto" | "instagram-graph";
         actorUri: string;
         transportAcct: string;
         sourceUserId: string;
@@ -396,7 +402,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         userId: string;
         canonicalAcct: string;
         network: string;
-        protocol: "activitypub" | "atproto";
+        protocol: "activitypub" | "atproto" | "instagram-graph";
         actorUri: string;
         transportAcct: string;
         sourceUserId: string;
@@ -409,7 +415,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         externalIdentities: {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
@@ -440,7 +446,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
     externalIdentities: {
         canonicalAcct: string;
         network: string;
-        protocol: "activitypub" | "atproto";
+        protocol: "activitypub" | "atproto" | "instagram-graph";
         actorUri: string;
         transportAcct: string;
         sourceUserId: string;
@@ -450,7 +456,7 @@ export declare const resolveExternalIdentityResponseSchema: z.ZodEffects<z.ZodOb
         userId: string;
         canonicalAcct: string;
         network: string;
-        protocol: "activitypub" | "atproto";
+        protocol: "activitypub" | "atproto" | "instagram-graph";
         actorUri: string;
         transportAcct: string;
         sourceUserId: string;
@@ -470,80 +476,81 @@ export declare const lookupExternalIdentitiesResponseSchema: z.ZodObject<{
         externalIdentities: z.ZodArray<z.ZodObject<{
             canonicalAcct: z.ZodString;
             network: z.ZodString;
-            protocol: z.ZodEnum<["activitypub", "atproto"]>;
+            protocol: z.ZodEnum<["activitypub", "atproto", "instagram-graph"]>;
             actorUri: z.ZodString;
             transportAcct: z.ZodString;
             sourceUserId: z.ZodString;
         }, "strip", z.ZodTypeAny, {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
         }, {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
         }>, "many">;
         redirectedUserIds: z.ZodArray<z.ZodString, "many">;
     }, "strip", z.ZodTypeAny, {
-        identifier: string;
         userId: string | null;
         externalIdentities: {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
         }[];
         redirectedUserIds: string[];
-    }, {
         identifier: string;
+    }, {
         userId: string | null;
         externalIdentities: {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
         }[];
         redirectedUserIds: string[];
+        identifier: string;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     identities: {
-        identifier: string;
         userId: string | null;
         externalIdentities: {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
         }[];
         redirectedUserIds: string[];
+        identifier: string;
     }[];
 }, {
     identities: {
-        identifier: string;
         userId: string | null;
         externalIdentities: {
             canonicalAcct: string;
             network: string;
-            protocol: "activitypub" | "atproto";
+            protocol: "activitypub" | "atproto" | "instagram-graph";
             actorUri: string;
             transportAcct: string;
             sourceUserId: string;
         }[];
         redirectedUserIds: string[];
+        identifier: string;
     }[];
 }>;
+export type ExternalIdentityProtocol = z.infer<typeof externalIdentityProtocolSchema>;
 export type ExternalIdentityReference = z.infer<typeof externalIdentityReferenceSchema>;
 export type ResolveExternalIdentityRequest = z.infer<typeof resolveExternalIdentityRequestSchema>;
 export type ResolveExternalIdentityResponse = z.infer<typeof resolveExternalIdentityResponseSchema>;

package/dist/types/identity.d.ts

@@ -315,18 +315,14 @@ export type DomainVerificationInstructions = z.infer<typeof domainVerificationIn
 /**
  * One linked authentication method. Mirrors a `User.authMethods[]` entry.
  * `verificationMethodId` is present for `identity` methods (a key), linking the
- * auth method to its DID verification-method fragment. For `webauthn` methods
- * `credentialId` identifies the specific passkey (one entry per registered
- * credential) and `name` is its user-facing label; a passkey is NOT a DID
- * verification method, so it carries no `verificationMethodId` (a passkey-only
- * account stays custodial).
+ * auth method to its DID verification-method fragment. A key is the only
+ * linked method: an email, a password and an authenticator are sign-in
+ * factors of the account, not DID verification methods.
  */
 export interface AuthMethodEntry {
-    type: 'identity' | 'webauthn';
+    type: 'identity';
     linkedAt: string | Date;
     verificationMethodId?: string;
-    credentialId?: string;
-    name?: string;
 }
 export declare const authMethodEntrySchema: z.ZodType<AuthMethodEntry>;
 /**

package/dist/types/identityLink.d.ts

@@ -1,22 +1,25 @@
 /**
- * Linking Commons to a passkey account (ADR 0029 D3) — the two-device relay.
+ * Linking Commons to an account without a key (ADR 0029 D3) — the two-device
+ * relay.
  *
- * A passkey account links a Commons root once, and becomes self-custodied: its
- * recovery email is deleted and its phrase in Commons is how it gets back in.
- * The authority is the same as `POST /auth/link` (ADR 0024 D8): a root proof
- * (`link_identity`) by the key Commons holds, and a fresh assertion by one of
- * the account's passkeys over the SAME one-use challenge. Only the transport is
- * new, because the two factors live on two devices:
+ * An account without a key links a Commons root once, and becomes
+ * self-custodied: its email is deleted and its phrase in Commons is how it gets
+ * back in. The authority is the same as `POST /auth/link` (ADR 0024 D8): a root
+ * proof (`link_identity`) by the key Commons holds over a one-use challenge,
+ * and the account's own confirmation — a code just sent to its email (plus its
+ * authenticator code when it has one). Only the transport is new, because the
+ * two factors live on two devices:
  *
- *   1. auth.oxy.so (signed in) opens a link request → `{ linkId, challenge }`,
- *      shown as a QR (`oxycommons://link?id=…&c=…`).
+ *   1. The signed-in account (the "Link Commons" panel of `@oxy.so/services`)
+ *      opens a link request → `{ linkId, challenge }`, shown as a QR
+ *      (`oxycommons://link?id=…&c=…`).
  *   2. Commons scans it, reads the request (the account's id and username),
  *      signs the root proof over the challenge and posts it with its key.
  *   3. Both screens show the same 6-digit code, derived from the link id and
  *      that key (`deriveIdentityLinkCode` in `@oxy.so/core`); the person checks
  *      they match, so a photographed QR cannot slip another key in.
- *   4. auth.oxy.so asserts the passkey over the challenge and completes: the
- *      account gains the root, loses the email, and Commons signs in with it.
+ *   4. The panel completes with the email code: the account gains the root,
+ *      loses the email, and Commons signs in with it.
  *
  * The server stores only the challenge's hash; the challenge travels in the QR.
  */
@@ -92,119 +95,52 @@ export declare const identityLinkProofRequestSchema: z.ZodObject<{
     };
 }>;
 export type IdentityLinkProofRequest = z.infer<typeof identityLinkProofRequestSchema>;
-/** `POST /identity/link/:linkId/options` — WebAuthn request options over the challenge. */
-export declare const identityLinkOptionsRequestSchema: z.ZodObject<{
-    challenge: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    challenge: string;
-}, {
-    challenge: string;
-}>;
-export type IdentityLinkOptionsRequest = z.infer<typeof identityLinkOptionsRequestSchema>;
-/** `POST /identity/link/:linkId/complete` — the passkey assertion over the challenge. */
+/**
+ * `POST /identity/link/:linkId/complete` — the account's own confirmation: a
+ * code just sent to its email for this link (`reauth`, plus its authenticator
+ * code when it has one).
+ */
 export declare const identityLinkCompleteRequestSchema: z.ZodObject<{
-    assertion: z.ZodObject<{
-        id: z.ZodString;
-        rawId: z.ZodString;
-        type: z.ZodLiteral<"public-key">;
-        response: z.ZodObject<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, z.ZodTypeAny, "passthrough">>;
-        clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        authenticatorAttachment: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        id: z.ZodString;
-        rawId: z.ZodString;
-        type: z.ZodLiteral<"public-key">;
-        response: z.ZodObject<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, z.ZodTypeAny, "passthrough">>;
-        clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        authenticatorAttachment: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        id: z.ZodString;
-        rawId: z.ZodString;
-        type: z.ZodLiteral<"public-key">;
-        response: z.ZodObject<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-            clientDataJSON: z.ZodString;
-            authenticatorData: z.ZodString;
-            signature: z.ZodString;
-            userHandle: z.ZodOptional<z.ZodString>;
-        }, z.ZodTypeAny, "passthrough">>;
-        clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        authenticatorAttachment: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>;
+    reauth: z.ZodObject<{
+        emailCode: z.ZodObject<{
+            verificationId: z.ZodString;
+            code: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            code: string;
+            verificationId: string;
+        }, {
+            code: string;
+            verificationId: string;
+        }>;
+        totpCode: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        emailCode: {
+            code: string;
+            verificationId: string;
+        };
+        totpCode?: string | undefined;
+    }, {
+        emailCode: {
+            code: string;
+            verificationId: string;
+        };
+        totpCode?: string | undefined;
+    }>;
 }, "strict", z.ZodTypeAny, {
-    assertion: {
-        type: "public-key";
-        id: string;
-        rawId: string;
-        response: {
-            signature: string;
-            clientDataJSON: string;
-            authenticatorData: string;
-            userHandle?: string | undefined;
-        } & {
-            [k: string]: unknown;
+    reauth: {
+        emailCode: {
+            code: string;
+            verificationId: string;
         };
-        clientExtensionResults?: Record<string, unknown> | undefined;
-        authenticatorAttachment?: string | undefined;
-    } & {
-        [k: string]: unknown;
+        totpCode?: string | undefined;
     };
 }, {
-    assertion: {
-        type: "public-key";
-        id: string;
-        rawId: string;
-        response: {
-            signature: string;
-            clientDataJSON: string;
-            authenticatorData: string;
-            userHandle?: string | undefined;
-        } & {
-            [k: string]: unknown;
+    reauth: {
+        emailCode: {
+            code: string;
+            verificationId: string;
         };
-        clientExtensionResults?: Record<string, unknown> | undefined;
-        authenticatorAttachment?: string | undefined;
-    } & {
-        [k: string]: unknown;
+        totpCode?: string | undefined;
     };
 }>;
 export type IdentityLinkCompleteRequest = z.infer<typeof identityLinkCompleteRequestSchema>;

package/dist/types/identityProof.d.ts

@@ -28,8 +28,8 @@ export declare const IDENTITY_PROOF_CHALLENGE_TTL_MS: number;
  */
 export declare const IDENTITY_PROOF_ACTIONS: {
     /**
-     * Link Commons' root to a passkey account that has none (`POST /auth/link`).
-     * The account becomes self-custodied and its recovery email is deleted
+     * Link Commons' root to an account that has none (`POST /auth/link`).
+     * The account becomes self-custodied and its email is deleted
      * (ADR 0029 D3).
      */
     readonly link: "link_identity";
@@ -123,7 +123,7 @@ export type IdentityErrorCode = (typeof IDENTITY_ERROR_CODES)[keyof typeof IDENT
 export interface IdentityRootStatus {
     /** Whether Commons' root is linked: the account is self-custodied. */
     rootLinked: boolean;
-    /** The recovery email of a passkey account; `null` once Commons is linked. */
+    /** The email of an account without a key; `null` once Commons is linked. */
     recoveryEmail: string | null;
 }
 export declare const identityRootStatusSchema: z.ZodType<IdentityRootStatus>;