@oxy.so/contracts 4.11.0-oxy-one.0 → 4.12.0

package/dist/cjs/products/plans.js

@@ -4,20 +4,35 @@ exports.personalPlanCatalogueSchema = exports.personalPlanDisplayPriceSchema = v
 const zod_1 = require("zod");
 const access_1 = require("./access");
 /** Approved display terms never identify or activate a billing-provider price. */
-exports.personalPlanDisplayPriceSchema = zod_1.z.object({ currency: zod_1.z.string().regex(/^[A-Z]{3}$/),
-    amountMinorUnits: zod_1.z.number().int().positive().safe(), interval: zod_1.z.literal('month'), trial: zod_1.z.literal('none'), taxTreatment: zod_1.z.literal('inclusive'), merchantTotal: zod_1.z.literal('final') }).strict();
+exports.personalPlanDisplayPriceSchema = zod_1.z
+    .object({
+    currency: zod_1.z.string().regex(/^[A-Z]{3}$/),
+    amountMinorUnits: zod_1.z.number().int().positive().safe(),
+    interval: zod_1.z.literal('month'),
+    trial: zod_1.z.literal('none'),
+    taxTreatment: zod_1.z.literal('inclusive'),
+    merchantTotal: zod_1.z.literal('final'),
+})
+    .strict();
 /** Public discovery is separate from customer access. No provider or owner IDs. */
-exports.personalPlanCatalogueSchema = zod_1.z.object({
+exports.personalPlanCatalogueSchema = zod_1.z
+    .object({
     schemaVersion: zod_1.z.literal(1),
     state: zod_1.z.enum(['unconfigured', 'configured']),
     purchase: zod_1.z.literal('unavailable'),
-    plans: zod_1.z.array(zod_1.z.object({
+    plans: zod_1.z.array(zod_1.z
+        .object({
         offerId: zod_1.z.string().min(1).max(160),
         offerVersion: zod_1.z.number().int().positive().safe(),
         displayName: zod_1.z.string().min(1).max(100),
         audience: zod_1.z.literal('personal'),
         kind: zod_1.z.literal('oxy_one'),
         price: exports.personalPlanDisplayPriceSchema.optional(),
-        benefits: zod_1.z.array(zod_1.z.object({ displayName: zod_1.z.string().min(1).max(100), benefit: access_1.productBenefitSchema }).strict()),
-    }).strict()),
-}).strict().refine(value => (value.state === 'unconfigured') === (value.plans.length === 0), 'Catalogue state must match published plans');
+        benefits: zod_1.z.array(zod_1.z
+            .object({ displayName: zod_1.z.string().min(1).max(100), benefit: access_1.productBenefitSchema })
+            .strict()),
+    })
+        .strict()),
+})
+    .strict()
+    .refine((value) => (value.state === 'unconfigured') === (value.plans.length === 0), 'Catalogue state must match published plans');

package/dist/cjs/recommendations.js

@@ -16,11 +16,7 @@ exports.appAffinityEventsIngestSchema = exports.appAffinityEventSchema = exports
 const zod_1 = require("zod");
 const userResponse_1 = require("./userResponse");
 /** User-type filters a caller may exclude from the recommendation surface. */
-exports.recommendationExcludeTypeSchema = zod_1.z.enum([
-    'federated',
-    'agent',
-    'automated',
-]);
+exports.recommendationExcludeTypeSchema = zod_1.z.enum(['federated', 'agent', 'automated']);
 /**
  * A caller-supplied editorial boost. `userIds` are nudged up (or down, for a
  * negative weight) in the ranking; the optional `reason` is for audit/telemetry
@@ -125,7 +121,9 @@ exports.appUserSignalIngestSchema = zod_1.z
     endorsements: zod_1.z.array(exports.appEndorsementInputSchema).max(500).optional(),
     interests: zod_1.z.array(exports.appInterestInputSchema).max(500).optional(),
 })
-    .refine((value) => (value.endorsements?.length ?? 0) > 0 || (value.interests?.length ?? 0) > 0, { message: 'At least one of endorsements or interests must be non-empty' });
+    .refine((value) => (value.endorsements?.length ?? 0) > 0 || (value.interests?.length ?? 0) > 0, {
+    message: 'At least one of endorsements or interests must be non-empty',
+});
 /**
  * The directed interaction types a consuming app may report between two users.
  * Each type carries a server-side default weight (see the API's

package/dist/cjs/reputation.js

@@ -25,8 +25,8 @@
  *  - **The balance has two views, and the union is the contract.** See
  *    {@link ReputationBalanceView} — the compile-time assertions below are what
  *    stop the private view's fields becoming reachable on a stranger's balance.
- *  - **The closed value sets live here, not beside the mongoose models.** The
- *    API's model enums and the SDK's unions are the same `as const` tuple, so a
+ *  - **The closed value sets live here, not beside the database schema.** The
+ *    API's column enums and the SDK's unions are the same `as const` tuple, so a
  *    seventh category cannot be added on one side only.
  *
  * The response entities are declared as explicit `interface`s with their runtime
@@ -78,10 +78,7 @@ exports.reputationCategorySchema = zod_1.z.enum(exports.REPUTATION_CATEGORIES);
  *                only by policy-driven code, never by a person); the pair nets
  *                to zero.
  */
-exports.REPUTATION_TRANSACTION_STATUSES = [
-    'active',
-    'reversed',
-];
+exports.REPUTATION_TRANSACTION_STATUSES = ['active', 'reversed'];
 exports.reputationTransactionStatusSchema = zod_1.z.enum(exports.REPUTATION_TRANSACTION_STATUSES);
 /**
  * Trust tiers, lowest → highest trust, plus the punitive `restricted`.

package/dist/cjs/sessionStatus.js

@@ -43,12 +43,7 @@ const zod_1 = require("zod");
  * `packages/api/src/models/Application.ts` (`first_party` | `third_party` |
  * `internal` | `system`).
  */
-exports.applicationTypeSchema = zod_1.z.enum([
-    'first_party',
-    'third_party',
-    'internal',
-    'system',
-]);
+exports.applicationTypeSchema = zod_1.z.enum(['first_party', 'third_party', 'internal', 'system']);
 /**
  * The display-safe public identity of a requesting application, exactly as
  * `serializePublicApplication` emits it. Returned by the API inside

package/dist/cjs/signIn.js

@@ -124,7 +124,9 @@ exports.emailSignInCodeSchema = zod_1.z
     const code = normalizeEmailSignInCode(value);
     return (new RegExp(`^\\d{${accountEmail_1.EMAIL_CODE_LENGTH}}$`).test(code) ||
         new RegExp(`^[${exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET}]{${exports.EMAIL_SIGNIN_LONG_CODE_LENGTH}}$`).test(code));
-}, { message: `code must be ${accountEmail_1.EMAIL_CODE_LENGTH} digits or the ${exports.EMAIL_SIGNIN_LONG_CODE_LENGTH}-character code from the email` });
+}, {
+    message: `code must be ${accountEmail_1.EMAIL_CODE_LENGTH} digits or the ${exports.EMAIL_SIGNIN_LONG_CODE_LENGTH}-character code from the email`,
+});
 /** `POST /auth/signin/email/confirm` — the code from the email. */
 exports.emailSignInConfirmRequestSchema = zod_1.z
     .object({
@@ -199,7 +201,13 @@ function isSecondFactorRequired(result) {
  * What a re-verification email code confirms. The code is bound to it: a code
  * asked for one change never authorises another, and the email names it.
  */
-exports.REAUTH_ACTIONS = ['change_password', 'totp', 'link_commons', 'delete_account', 'credentials_manage'];
+exports.REAUTH_ACTIONS = [
+    'change_password',
+    'totp',
+    'link_commons',
+    'delete_account',
+    'credentials_manage',
+];
 /** `POST /users/me/reauth/email` */
 exports.reauthEmailStartRequestSchema = zod_1.z.object({ action: zod_1.z.enum(exports.REAUTH_ACTIONS) }).strict();
 /**
@@ -259,14 +267,19 @@ exports.totpEnrollResponseSchema = zod_1.z.object({
 /** `POST /users/me/totp/confirm` — the first code from the authenticator turns it on. */
 exports.totpConfirmRequestSchema = zod_1.z
     .object({
-    code: zod_1.z.string().trim().regex(new RegExp(`^\\d{${exports.TOTP_DIGITS}}$`)),
+    code: zod_1.z
+        .string()
+        .trim()
+        .regex(new RegExp(`^\\d{${exports.TOTP_DIGITS}}$`)),
     reauth: exports.reauthProofSchema,
 })
     .strict();
 /** `POST /users/me/totp/disable` and `POST /users/me/totp/backup-codes` */
 exports.totpReauthRequestSchema = zod_1.z.object({ reauth: exports.reauthProofSchema }).strict();
 exports.totpBackupCodesResponseSchema = zod_1.z.object({
-    backupCodes: zod_1.z.array(zod_1.z.string().regex(/^[a-z2-9]{5}-[a-z2-9]{5}$/)).length(exports.TOTP_BACKUP_CODE_COUNT),
+    backupCodes: zod_1.z
+        .array(zod_1.z.string().regex(/^[a-z2-9]{5}-[a-z2-9]{5}$/))
+        .length(exports.TOTP_BACKUP_CODE_COUNT),
 });
 /**
  * Stable error codes (`error.code` in the API error body). Clients map these

package/dist/cjs/transparency.js

@@ -23,7 +23,9 @@ const zod_1 = require("zod");
  * verification failure at a distance.
  */
 /** A SHA-256 digest in the exact form the protocol emits: 64 lowercase hex chars. */
-const hexDigestSchema = zod_1.z.string().regex(/^[0-9a-f]{64}$/, 'Expected a 64-char lowercase hex digest');
+const hexDigestSchema = zod_1.z
+    .string()
+    .regex(/^[0-9a-f]{64}$/, 'Expected a 64-char lowercase hex digest');
 /**
  * One signer's endorsement of a checkpoint's signed fields.
  *

package/dist/cjs/updates.js

@@ -12,7 +12,7 @@
  * CLI, the console hook) validates its INPUT against the same definitions, so
  * producer and consumers cannot drift.
  *
- * Domain model (mirrors the Mongoose models in `@oxy.so/api`):
+ * Domain model (mirrors the update tables in `@oxy.so/api`):
  *  - A `channel` (e.g. `production`, `preview`, `pr-123`) is a named release
  *    track for one application.
  *  - An `update` is one published bundle for a single `(channel, runtimeVersion,
@@ -156,9 +156,7 @@ exports.createUpdateRequestSchema = zod_1.z.object({
      * `expoClient` (the public expo config) so `Constants.expoConfig` resolves
      * after an OTA update; MAY carry other third-party config.
      */
-    extra: zod_1.z
-        .object({ expoClient: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) })
-        .catchall(zod_1.z.unknown()),
+    extra: zod_1.z.object({ expoClient: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }).catchall(zod_1.z.unknown()),
     /** String→string metadata dict; filtered client-side via manifest filters. */
     metadata: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).optional(),
     /** Initial rollout percentage (default 100 — full rollout). */

package/dist/cjs/userResponse.js

@@ -4,7 +4,20 @@ exports.deviceLinkedSessionsResponseSchema = exports.deviceLinkedSessionSchema =
 exports.resolveUserId = resolveUserId;
 exports.safeParseContract = safeParseContract;
 /** Canonical profile/theme preset identities accepted by Oxy writes. */
-exports.USER_PROFILE_COLOR_PRESETS = ['teal', 'blue', 'green', 'amber', 'red', 'purple', 'pink', 'sky', 'orange', 'mint', 'mono', 'oxy'];
+exports.USER_PROFILE_COLOR_PRESETS = [
+    'teal',
+    'blue',
+    'green',
+    'amber',
+    'red',
+    'purple',
+    'pink',
+    'sky',
+    'orange',
+    'mint',
+    'mono',
+    'oxy',
+];
 /**
  * Canonical API user-response contracts.
  *
@@ -27,10 +40,10 @@ exports.USER_PROFILE_COLOR_PRESETS = ['teal', 'blue', 'green', 'amber', 'red', '
  *    Emits `id` (NOT `_id`), forwards `username` verbatim (may be absent), and
  *    emits `name` as the structured `{ first, last, full, displayName }`
  *    subdocument.
- *  - `packages/api/src/models/User.ts` — `NameSchema` (`first`/`last` default
- *    `''`; `full` and `displayName` are Mongoose VIRTUALS. Formatted API
- *    responses compose both fields, while raw-document responses may omit the
- *    virtuals if the query did not materialise them.
+ *  - `packages/api/src/db/schema/users.ts` — the stored name (`first`/`last`);
+ *    `full` and `displayName` have no column of their own. Formatted API
+ *    responses compose both fields, while raw-document responses may omit
+ *    them.
  *
  * Platform-agnostic — zod only, no react/react-native/expo. ESM-safe (no
  * `require()`).
@@ -127,7 +140,7 @@ exports.dateOfBirthSchema = zod_1.z
  */
 exports.userResponseSchema = zod_1.z
     .object({
-    /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
+    /** The user id as a string. Present on `formatUserResponse` output. */
     id: zod_1.z.string().optional(),
     /** Raw-document id (e.g. `GET /users/me`). Present when `id` is not. */
     _id: zod_1.z.string().optional(),
@@ -227,7 +240,14 @@ exports.userResponseSchema = zod_1.z
      * `GET /session/user/:sessionId`) and absent until the user sets it.
      */
     themePreference: exports.themePreferenceSchema.optional(),
-    personalization: zod_1.z.object({ mentionMono: zod_1.z.object({ allowed: zod_1.z.boolean(), expiresAt: zod_1.z.string().datetime().nullable() }).strict() }).strict().optional(),
+    personalization: zod_1.z
+        .object({
+        mentionMono: zod_1.z
+            .object({ allowed: zod_1.z.boolean(), expiresAt: zod_1.z.string().datetime().nullable() })
+            .strict(),
+    })
+        .strict()
+        .optional(),
 })
     .passthrough();
 exports.userProfileUpdateSchema = zod_1.z

package/dist/cjs/username.js

@@ -217,7 +217,9 @@ exports.usernameSchema = zod_1.z
     .regex(USERNAME_PATTERN, exports.USERNAME_INVALID_MESSAGE)
     .refine((username) => !/^[0-9]+$/.test(username), exports.NUMERIC_USERNAME_MESSAGE)
     .refine((username) => !exports.RESERVED_USERNAMES.has(username.toLowerCase()), exports.RESERVED_USERNAME_MESSAGE)
-    .refine((username) => !username.split(/[-_]/).some((segment) => RESERVED_USERNAME_SEGMENTS.has(segment.toLowerCase())), exports.RESERVED_USERNAME_MESSAGE);
+    .refine((username) => !username
+    .split(/[-_]/)
+    .some((segment) => RESERVED_USERNAME_SEGMENTS.has(segment.toLowerCase())), exports.RESERVED_USERNAME_MESSAGE);
 /**
  * Whether a candidate handle is storable — the boolean form, for input surfaces
  * that show a message as somebody types rather than throwing.