@oxy.so/contracts 4.15.0 → 4.17.0

package/dist/cjs/signIn.js

@@ -1,8 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SIGN_IN_ERROR_CODES = exports.totpBackupCodesResponseSchema = exports.totpReauthRequestSchema = exports.totpConfirmRequestSchema = exports.totpEnrollResponseSchema = exports.signInMethodsSchema = exports.passwordSetRequestSchema = exports.emailReauthProofSchema = exports.reauthProofSchema = exports.reauthEmailStartRequestSchema = exports.REAUTH_ACTIONS = exports.emailSignInPendingSchema = exports.secondFactorRequiredSchema = exports.signUpRequestSchema = exports.secondFactorSignInRequestSchema = exports.passwordSignInRequestSchema = exports.emailSignInLinkResponseSchema = exports.emailSignInLinkRequestSchema = exports.emailSignInCollectRequestSchema = exports.emailSignInConfirmRequestSchema = exports.emailSignInCodeSchema = exports.emailSignInStartResponseSchema = exports.emailSignInStartRequestSchema = exports.secondFactorCodeSchema = exports.newPasswordSchema = exports.passwordInputSchema = exports.signInIdentifierSchema = exports.EMAIL_SIGNIN_LONG_CODE_LENGTH = exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET = exports.TOTP_BACKUP_CODE_COUNT = exports.TOTP_PERIOD_SECONDS = exports.TOTP_DIGITS = exports.PASSWORD_MAX_LENGTH = exports.PASSWORD_MIN_LENGTH = exports.SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = exports.SIGNIN_SECOND_FACTOR_TTL_MS = exports.EMAIL_SIGNIN_LINK_TTL_MS = void 0;
-exports.normalizeEmailSignInCode = normalizeEmailSignInCode;
-exports.isSecondFactorRequired = isSecondFactorRequired;
+exports.totpBackupCodesResponseSchema = exports.totpReauthRequestSchema = exports.totpConfirmRequestSchema = exports.totpEnrollResponseSchema = exports.signInMethodsSchema = exports.passwordSetRequestSchema = exports.emailReauthProofSchema = exports.reauthProofSchema = exports.reauthEmailStartRequestSchema = exports.emailSignInChooseRequestSchema = exports.emailSignInChooseAccountSchema = exports.emailSignInAccountOptionSchema = exports.emailSignInPendingSchema = exports.secondFactorRequiredSchema = exports.signUpRequestSchema = exports.secondFactorSignInRequestSchema = exports.passwordSignInRequestSchema = exports.emailSignInLinkResponseSchema = exports.emailSignInLinkRequestSchema = exports.emailSignInCollectRequestSchema = exports.emailSignInConfirmRequestSchema = exports.emailSignInCodeSchema = exports.emailSignInStartResponseSchema = exports.emailSignInStartRequestSchema = exports.secondFactorCodeSchema = exports.newPasswordSchema = exports.passwordInputSchema = exports.signInIdentifierSchema = exports.SIGN_IN_ERROR_CODES = exports.REAUTH_ACTIONS = exports.isEmailSignInChooseAccount = exports.isSecondFactorRequired = exports.EMAIL_ACCOUNTS_MAX = exports.EMAIL_SIGNIN_CHOICE_TTL_MS = exports.normalizeEmailSignInCode = exports.EMAIL_SIGNIN_LONG_CODE_LENGTH = exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET = exports.TOTP_BACKUP_CODE_COUNT = exports.TOTP_PERIOD_SECONDS = exports.TOTP_DIGITS = exports.PASSWORD_MAX_LENGTH = exports.PASSWORD_MIN_LENGTH = exports.SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = exports.SIGNIN_SECOND_FACTOR_TTL_MS = exports.EMAIL_SIGNIN_LINK_TTL_MS = void 0;
 /**
  * Signing in: an email code or link, an optional password,
  * and an optional authenticator app (TOTP) as a second factor.
@@ -23,6 +21,11 @@ exports.isSecondFactorRequired = isSecondFactorRequired;
  *    one-use second-factor challenge instead of a session, and
  *    `POST /auth/signin/second-factor` takes the TOTP (or a backup code).
  *
+ * An email may hold several accounts (up to `EMAIL_ACCOUNTS_MAX`). Signing in
+ * with the email, once the code or the link proves it, answers the accounts to
+ * choose from when there are several, and `POST /auth/signin/email/choose`
+ * names one. A username always names one account.
+ *
  * `POST /auth/signup` creates an account from a username and an email confirmed
  * with `POST /auth/email/verify/{start,confirm}` (purpose `signup`).
  *
@@ -32,40 +35,27 @@ exports.isSecondFactorRequired = isSecondFactorRequired;
 const zod_1 = require("zod");
 const accountEmail_1 = require("./accountEmail");
 const deviceSession_1 = require("./deviceSession");
-/** How long the link in a sign-in email can be opened. */
-exports.EMAIL_SIGNIN_LINK_TTL_MS = 15 * 60 * 1000;
-/** How long a second-factor challenge can be answered. */
-exports.SIGNIN_SECOND_FACTOR_TTL_MS = 5 * 60 * 1000;
-/** Wrong second-factor codes one challenge accepts. */
-exports.SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = 5;
-/** Shortest password Oxy accepts when one is set. */
-exports.PASSWORD_MIN_LENGTH = 10;
-/** Longest password Oxy accepts (characters). */
-exports.PASSWORD_MAX_LENGTH = 256;
-/** Digits in an authenticator code. */
-exports.TOTP_DIGITS = 6;
-/** Seconds each authenticator code lasts. */
-exports.TOTP_PERIOD_SECONDS = 30;
-/** Backup codes issued when an authenticator is enabled or they are regenerated. */
-exports.TOTP_BACKUP_CODE_COUNT = 10;
-/**
- * The long sign-in code: ten characters of Crockford base32 without the
- * look-alikes (no 0, O, 1, I, L, U), shown as `XXXXX-XXXXX`. An account whose
- * sign-in codes were guessed at too often today (the per-account ceiling) is
- * sent this instead of 6 digits for the rest of the day, so its owner can still
- * type a code while guessing one is infeasible.
- */
-exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET = '23456789ABCDEFGHJKMNPQRSTVWXYZ';
-exports.EMAIL_SIGNIN_LONG_CODE_LENGTH = 10;
-/**
- * Normalise a typed sign-in code: 6 digits stay as they are; a long code is
- * upper-cased with its dash and spaces removed. Anything else is returned
- * trimmed (and will simply be wrong).
- */
-function normalizeEmailSignInCode(code) {
-    const compact = code.trim().replace(/[\s-]/g, '').toUpperCase();
-    return compact;
-}
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// it is re-exported here so the root entry is unchanged.
+const signIn_1 = require("./client/signIn");
+var signIn_2 = require("./client/signIn");
+Object.defineProperty(exports, "EMAIL_SIGNIN_LINK_TTL_MS", { enumerable: true, get: function () { return signIn_2.EMAIL_SIGNIN_LINK_TTL_MS; } });
+Object.defineProperty(exports, "SIGNIN_SECOND_FACTOR_TTL_MS", { enumerable: true, get: function () { return signIn_2.SIGNIN_SECOND_FACTOR_TTL_MS; } });
+Object.defineProperty(exports, "SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS", { enumerable: true, get: function () { return signIn_2.SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS; } });
+Object.defineProperty(exports, "PASSWORD_MIN_LENGTH", { enumerable: true, get: function () { return signIn_2.PASSWORD_MIN_LENGTH; } });
+Object.defineProperty(exports, "PASSWORD_MAX_LENGTH", { enumerable: true, get: function () { return signIn_2.PASSWORD_MAX_LENGTH; } });
+Object.defineProperty(exports, "TOTP_DIGITS", { enumerable: true, get: function () { return signIn_2.TOTP_DIGITS; } });
+Object.defineProperty(exports, "TOTP_PERIOD_SECONDS", { enumerable: true, get: function () { return signIn_2.TOTP_PERIOD_SECONDS; } });
+Object.defineProperty(exports, "TOTP_BACKUP_CODE_COUNT", { enumerable: true, get: function () { return signIn_2.TOTP_BACKUP_CODE_COUNT; } });
+Object.defineProperty(exports, "EMAIL_SIGNIN_LONG_CODE_ALPHABET", { enumerable: true, get: function () { return signIn_2.EMAIL_SIGNIN_LONG_CODE_ALPHABET; } });
+Object.defineProperty(exports, "EMAIL_SIGNIN_LONG_CODE_LENGTH", { enumerable: true, get: function () { return signIn_2.EMAIL_SIGNIN_LONG_CODE_LENGTH; } });
+Object.defineProperty(exports, "normalizeEmailSignInCode", { enumerable: true, get: function () { return signIn_2.normalizeEmailSignInCode; } });
+Object.defineProperty(exports, "EMAIL_SIGNIN_CHOICE_TTL_MS", { enumerable: true, get: function () { return signIn_2.EMAIL_SIGNIN_CHOICE_TTL_MS; } });
+Object.defineProperty(exports, "EMAIL_ACCOUNTS_MAX", { enumerable: true, get: function () { return signIn_2.EMAIL_ACCOUNTS_MAX; } });
+Object.defineProperty(exports, "isSecondFactorRequired", { enumerable: true, get: function () { return signIn_2.isSecondFactorRequired; } });
+Object.defineProperty(exports, "isEmailSignInChooseAccount", { enumerable: true, get: function () { return signIn_2.isEmailSignInChooseAccount; } });
+Object.defineProperty(exports, "REAUTH_ACTIONS", { enumerable: true, get: function () { return signIn_2.REAUTH_ACTIONS; } });
+Object.defineProperty(exports, "SIGN_IN_ERROR_CODES", { enumerable: true, get: function () { return signIn_2.SIGN_IN_ERROR_CODES; } });
 const sixDigits = zod_1.z
     .string()
     .trim()
@@ -78,17 +68,17 @@ const opaqueTokenSchema = accountEmail_1.emailTicketSchema;
 /** A username or an email. */
 exports.signInIdentifierSchema = zod_1.z.string().trim().min(1).max(254);
 /** A password as typed. Its policy applies only when one is set. */
-exports.passwordInputSchema = zod_1.z.string().min(1).max(exports.PASSWORD_MAX_LENGTH);
+exports.passwordInputSchema = zod_1.z.string().min(1).max(signIn_1.PASSWORD_MAX_LENGTH);
 /** A new password. */
 exports.newPasswordSchema = zod_1.z
     .string()
-    .min(exports.PASSWORD_MIN_LENGTH, `password must be at least ${exports.PASSWORD_MIN_LENGTH} characters`)
-    .max(exports.PASSWORD_MAX_LENGTH, `password must be at most ${exports.PASSWORD_MAX_LENGTH} characters`);
+    .min(signIn_1.PASSWORD_MIN_LENGTH, `password must be at least ${signIn_1.PASSWORD_MIN_LENGTH} characters`)
+    .max(signIn_1.PASSWORD_MAX_LENGTH, `password must be at most ${signIn_1.PASSWORD_MAX_LENGTH} characters`);
 /**
  * An authenticator code (6 digits) or a backup code (10 characters, with or
  * without its dash). Normalised server-side.
  */
-exports.secondFactorCodeSchema = zod_1.z.string().trim().min(exports.TOTP_DIGITS).max(16);
+exports.secondFactorCodeSchema = zod_1.z.string().trim().min(signIn_1.TOTP_DIGITS).max(16);
 /** The device-session fields every body that ends in a session may carry. */
 const sessionEnvelope = {
     deviceName: zod_1.z.string().trim().min(1).max(120).optional(),
@@ -121,11 +111,11 @@ exports.emailSignInCodeSchema = zod_1.z
     .string()
     .trim()
     .refine((value) => {
-    const code = normalizeEmailSignInCode(value);
+    const code = (0, signIn_1.normalizeEmailSignInCode)(value);
     return (new RegExp(`^\\d{${accountEmail_1.EMAIL_CODE_LENGTH}}$`).test(code) ||
-        new RegExp(`^[${exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET}]{${exports.EMAIL_SIGNIN_LONG_CODE_LENGTH}}$`).test(code));
+        new RegExp(`^[${signIn_1.EMAIL_SIGNIN_LONG_CODE_ALPHABET}]{${signIn_1.EMAIL_SIGNIN_LONG_CODE_LENGTH}}$`).test(code));
 }, {
-    message: `code must be ${accountEmail_1.EMAIL_CODE_LENGTH} digits or the ${exports.EMAIL_SIGNIN_LONG_CODE_LENGTH}-character code from the email`,
+    message: `code must be ${accountEmail_1.EMAIL_CODE_LENGTH} digits or the ${signIn_1.EMAIL_SIGNIN_LONG_CODE_LENGTH}-character code from the email`,
 });
 /** `POST /auth/signin/email/confirm` — the code from the email. */
 exports.emailSignInConfirmRequestSchema = zod_1.z
@@ -193,23 +183,28 @@ exports.emailSignInPendingSchema = zod_1.z.object({
     status: zod_1.z.literal('pending'),
     expiresAt: zod_1.z.number().int().positive(),
 });
-/** Narrow a {@link SignInStepResult}. */
-function isSecondFactorRequired(result) {
-    return result.secondFactorRequired === true;
-}
-/**
- * What a re-verification email code confirms. The code is bound to it: a code
- * asked for one change never authorises another, and the email names it.
- */
-exports.REAUTH_ACTIONS = [
-    'change_password',
-    'totp',
-    'link_commons',
-    'delete_account',
-    'credentials_manage',
-];
+exports.emailSignInAccountOptionSchema = zod_1.z.object({
+    id: zod_1.z.string().min(1).max(64),
+    username: zod_1.z.string().min(1).optional(),
+    displayName: zod_1.z.string().min(1).optional(),
+    avatar: zod_1.z.string().min(1).optional(),
+});
+exports.emailSignInChooseAccountSchema = zod_1.z.object({
+    chooseAccount: zod_1.z.literal(true),
+    accounts: zod_1.z.array(exports.emailSignInAccountOptionSchema).min(2).max(signIn_1.EMAIL_ACCOUNTS_MAX),
+    expiresAt: zod_1.z.number().int().positive(),
+});
+/** `POST /auth/signin/email/choose` — the account, from those {@link EmailSignInChooseAccount} listed. */
+exports.emailSignInChooseRequestSchema = zod_1.z
+    .object({
+    requestId: zod_1.z.string().trim().min(1).max(64),
+    requestSecret: opaqueTokenSchema,
+    userId: zod_1.z.string().trim().min(1).max(64),
+    ...sessionEnvelope,
+})
+    .strict();
 /** `POST /users/me/reauth/email` */
-exports.reauthEmailStartRequestSchema = zod_1.z.object({ action: zod_1.z.enum(exports.REAUTH_ACTIONS) }).strict();
+exports.reauthEmailStartRequestSchema = zod_1.z.object({ action: zod_1.z.enum(signIn_1.REAUTH_ACTIONS) }).strict();
 /**
  * A fresh proof that the person, not only their session, is asking: the
  * current password, or a code just sent to the account's email
@@ -270,7 +265,7 @@ exports.totpConfirmRequestSchema = zod_1.z
     code: zod_1.z
         .string()
         .trim()
-        .regex(new RegExp(`^\\d{${exports.TOTP_DIGITS}}$`)),
+        .regex(new RegExp(`^\\d{${signIn_1.TOTP_DIGITS}}$`)),
     reauth: exports.reauthProofSchema,
 })
     .strict();
@@ -279,39 +274,5 @@ exports.totpReauthRequestSchema = zod_1.z.object({ reauth: exports.reauthProofSc
 exports.totpBackupCodesResponseSchema = zod_1.z.object({
     backupCodes: zod_1.z
         .array(zod_1.z.string().regex(/^[a-z2-9]{5}-[a-z2-9]{5}$/))
-        .length(exports.TOTP_BACKUP_CODE_COUNT),
+        .length(signIn_1.TOTP_BACKUP_CODE_COUNT),
 });
-/**
- * Stable error codes (`error.code` in the API error body). Clients map these
- * through their localization, never the English message.
- */
-exports.SIGN_IN_ERROR_CODES = {
-    /** Wrong identifier or password — never says which. */
-    invalidCredentials: 'SIGNIN_INVALID_CREDENTIALS',
-    /** The request is unknown, expired, spent, or its secret is wrong. */
-    requestInvalid: 'SIGNIN_REQUEST_INVALID',
-    /** The link is unknown, expired or already used. */
-    linkInvalid: 'SIGNIN_LINK_INVALID',
-    /** The link was opened in another browser: type the code in the app instead. */
-    linkOtherDevice: 'SIGNIN_LINK_OTHER_DEVICE',
-    /** The second-factor challenge or its code is wrong, expired or spent. */
-    secondFactorInvalid: 'SECOND_FACTOR_INVALID',
-    /** Too many failures for this account: wait and try again. */
-    locked: 'SIGNIN_LOCKED',
-    /** The step needs a fresh proof (`reauth`). */
-    reauthRequired: 'REAUTH_REQUIRED',
-    /** The fresh proof was wrong. */
-    reauthInvalid: 'REAUTH_INVALID',
-    /** The account has an authenticator: the proof must carry its code. */
-    totpRequired: 'TOTP_REQUIRED',
-    /** Enrolling or confirming an authenticator that is already on. */
-    totpAlreadyEnabled: 'TOTP_ALREADY_ENABLED',
-    /** Disabling, confirming or regenerating codes with no authenticator (or no pending one). */
-    totpNotEnabled: 'TOTP_NOT_ENABLED',
-    /** The code the authenticator showed at enrolment is wrong. */
-    totpCodeInvalid: 'TOTP_CODE_INVALID',
-    /** Only official Oxy apps and auth.oxy.so may sign people in here. */
-    originNotAllowed: 'SIGNIN_ORIGIN_NOT_ALLOWED',
-    /** The username is taken. */
-    usernameTaken: 'USERNAME_TAKEN',
-};

package/dist/cjs/userResponse.js

@@ -246,10 +246,6 @@ exports.userResponseSchema = zod_1.z
      * so it is present on the current-user DTO (`GET /users/me`,
      * `GET /session/user/:sessionId`) and absent until the user sets it.
      */
-    userPreferences: zod_1.z
-        .object({ displayCurrency: zod_1.z.enum(['USD', 'EUR', 'FAIR']).optional() })
-        .catchall(zod_1.z.unknown())
-        .optional(),
     themePreference: exports.themePreferenceSchema.optional(),
     personalization: zod_1.z
         .object({
@@ -310,10 +306,7 @@ exports.userProfileUpdateSchema = zod_1.z
     languages: zod_1.z.array(zod_1.z.string()).optional(),
     accountExpiresAfterInactivityDays: zod_1.z.number().nullable().optional(),
     notificationPreferences: zod_1.z.record(zod_1.z.unknown()).optional(),
-    userPreferences: zod_1.z
-        .object({ displayCurrency: zod_1.z.enum(['USD', 'EUR', 'FAIR']).optional() })
-        .catchall(zod_1.z.unknown())
-        .optional(),
+    userPreferences: zod_1.z.record(zod_1.z.unknown()).optional(),
     privacySettings: zod_1.z.record(zod_1.z.unknown()).optional(),
     /**
      * Portable theme preference. Written through the same `PUT /users/me`

package/dist/cjs/username.js

@@ -100,106 +100,25 @@
  * knows what is taken, and it must not pretend to.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.botUsernameSchema = exports.BOT_USERNAME_INVALID_MESSAGE = exports.BOT_USERNAME_SUFFIX = exports.usernameSchema = exports.USERNAME_PATTERN_SOURCE = exports.NUMERIC_USERNAME_MESSAGE = exports.RESERVED_USERNAME_MESSAGE = exports.RESERVED_USERNAMES = exports.USERNAME_INVALID_MESSAGE = exports.USERNAME_MAX_LENGTH = exports.USERNAME_MIN_LENGTH = void 0;
+exports.botUsernameSchema = exports.usernameSchema = exports.applyBotUsernameSuffix = exports.BOT_USERNAME_INVALID_MESSAGE = exports.BOT_USERNAME_SUFFIX = exports.stripDisallowedUsernameCharacters = exports.USERNAME_PATTERN_SOURCE = exports.NUMERIC_USERNAME_MESSAGE = exports.RESERVED_USERNAME_MESSAGE = exports.RESERVED_USERNAMES = exports.USERNAME_INVALID_MESSAGE = exports.USERNAME_MAX_LENGTH = exports.USERNAME_MIN_LENGTH = void 0;
 exports.isValidUsername = isValidUsername;
-exports.stripDisallowedUsernameCharacters = stripDisallowedUsernameCharacters;
 exports.usernameSchemaForAccountKind = usernameSchemaForAccountKind;
-exports.applyBotUsernameSuffix = applyBotUsernameSuffix;
 const zod_1 = require("zod");
-/** Shortest storable handle. `oxy` sets the floor. */
-exports.USERNAME_MIN_LENGTH = 3;
-/** Longest storable handle, and the `maxLength` an input field should carry. */
-exports.USERNAME_MAX_LENGTH = 30;
-/** The 400 / inline-validation copy for every path that rejects a handle. */
-exports.USERNAME_INVALID_MESSAGE = 'Username must be 3-30 characters, use only letters, numbers, hyphens and underscores, ' +
-    'start and end with a letter or number, and never repeat a separator';
-/**
- * Exact-match handles nobody may newly claim, regardless of account kind.
- *
- * This is NOT a namespace tightening like the bot suffix — it is a list of
- * names withheld from `users_lower_username_key` before anybody asks for
- * them. Compared against the same normalization the unique index applies
- * (`lower(btrim(username))`), so `Admin`, ` ADMIN ` and `admin` are the one
- * name this list means.
- *
- * `oxy`, `mention`, `homiio`, `clarity`, `faircoin`, `astro` and `mercaria`
- * are deliberately NOT here: each already has an `organization`/`project`
- * row, so the unique index already refuses a second one, and `oxy` is the
- * name `USERNAME_MIN_LENGTH` is pinned against in
- * `__tests__/username.test.ts` — listing it would make
- * `usernameSchema.safeParse('oxy')` fail and falsify that comment. A brand
- * with no account of its own yet (measured 2026-09-18: Alia, Allo, TNP,
- * Kaana, Bloom) has no row to protect it, so it is listed until one exists.
- */
-exports.RESERVED_USERNAMES = new Set([
-    // Oxy product lines with no account row of their own yet.
-    'alia',
-    'allo',
-    'tnp',
-    'kaana',
-    'bloom',
-    // System / role words a signup impersonating staff or Oxy itself would reach for.
-    'admin',
-    'administrator',
-    'root',
-    'superadmin',
-    'super',
-    'superuser',
-    'support',
-    'staff',
-    'moderator',
-    'mod',
-    'security',
-    'system',
-    'official',
-    'help',
-    'noreply',
-    'anonymous',
-    'everyone',
-    'owner',
-]);
-/** The 400 / inline-validation copy for a handle on {@link RESERVED_USERNAMES}. */
-exports.RESERVED_USERNAME_MESSAGE = 'This username is reserved and cannot be registered';
-/**
- * {@link RESERVED_USERNAMES}, minus `alia`, checked against each `-`/`_`
- * separated SEGMENT of a candidate rather than the whole string — so
- * `official-oxy`, `super-admin` and `team-kaana` are refused the same as the
- * bare words, without banning every word that merely CONTAINS one as a
- * substring (`superman`, `modern`, `grassroot`, `homeowner` all stay legal:
- * none of them separates the reserved word from the rest with `-` or `_`).
- *
- * `alia` is excluded because `alia-` is the live internal-cost-centre
- * namespace: `alia-production-chat` is a minted account and
- * `alia-research` / `alia-voice` / `alia-evaluations` are pinned as legal
- * slugs in `__tests__/username.test.ts` and `internalCostCenterSpecs.test.ts`.
- * Segment-matching `alia` would refuse all four. The bare word `alia` is
- * still refused — {@link RESERVED_USERNAMES} above catches it exactly.
- */
-const RESERVED_USERNAME_SEGMENTS = new Set([...exports.RESERVED_USERNAMES].filter((word) => word !== 'alia'));
-/** The 400 / inline-validation copy for a handle that is only digits. */
-exports.NUMERIC_USERNAME_MESSAGE = 'Username cannot be only numbers';
-/**
- * Alphanumeric runs joined by single separators, as a SOURCE string.
- *
- * A string rather than a literal because the OpenAPI docblocks that publish this
- * rule (`POST /auth/register`, `PUT /users/:userId`) must quote it verbatim, and
- * `usernamePolicySingleSource.test.ts` compares them against THIS constant. A
- * published `pattern:` that drifts from the enforced rule is a lie told to every
- * client that generates from the spec, and it is exactly the kind of copy nobody
- * notices going stale.
- *
- * Deliberately NOT re-exported from the package barrel: it exists for the
- * schema below and for that one gate. Anything validating a username uses
- * {@link usernameSchema}, so there is no second way to ask the question.
- *
- * Written as an unambiguous alternation rather than a lookahead: every character
- * belongs to exactly one branch, so matching is linear and there is no
- * backtracking to bound. It also carries no `\p{…}` property escape, which
- * mobile Hermes throws on at runtime — this module is reachable from every React
- * Native consumer.
- */
-exports.USERNAME_PATTERN_SOURCE = '^[A-Za-z0-9]+(?:[-_][A-Za-z0-9]+)*$';
-const USERNAME_PATTERN = new RegExp(exports.USERNAME_PATTERN_SOURCE);
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// it is re-exported here so the root entry is unchanged.
+const username_1 = require("./client/username");
+var username_2 = require("./client/username");
+Object.defineProperty(exports, "USERNAME_MIN_LENGTH", { enumerable: true, get: function () { return username_2.USERNAME_MIN_LENGTH; } });
+Object.defineProperty(exports, "USERNAME_MAX_LENGTH", { enumerable: true, get: function () { return username_2.USERNAME_MAX_LENGTH; } });
+Object.defineProperty(exports, "USERNAME_INVALID_MESSAGE", { enumerable: true, get: function () { return username_2.USERNAME_INVALID_MESSAGE; } });
+Object.defineProperty(exports, "RESERVED_USERNAMES", { enumerable: true, get: function () { return username_2.RESERVED_USERNAMES; } });
+Object.defineProperty(exports, "RESERVED_USERNAME_MESSAGE", { enumerable: true, get: function () { return username_2.RESERVED_USERNAME_MESSAGE; } });
+Object.defineProperty(exports, "NUMERIC_USERNAME_MESSAGE", { enumerable: true, get: function () { return username_2.NUMERIC_USERNAME_MESSAGE; } });
+Object.defineProperty(exports, "USERNAME_PATTERN_SOURCE", { enumerable: true, get: function () { return username_2.USERNAME_PATTERN_SOURCE; } });
+Object.defineProperty(exports, "stripDisallowedUsernameCharacters", { enumerable: true, get: function () { return username_2.stripDisallowedUsernameCharacters; } });
+Object.defineProperty(exports, "BOT_USERNAME_SUFFIX", { enumerable: true, get: function () { return username_2.BOT_USERNAME_SUFFIX; } });
+Object.defineProperty(exports, "BOT_USERNAME_INVALID_MESSAGE", { enumerable: true, get: function () { return username_2.BOT_USERNAME_INVALID_MESSAGE; } });
+Object.defineProperty(exports, "applyBotUsernameSuffix", { enumerable: true, get: function () { return username_2.applyBotUsernameSuffix; } });
 /**
  * The one username policy, as a schema.
  *
@@ -212,14 +131,14 @@ const USERNAME_PATTERN = new RegExp(exports.USERNAME_PATTERN_SOURCE);
 exports.usernameSchema = zod_1.z
     .string()
     .trim()
-    .min(exports.USERNAME_MIN_LENGTH, exports.USERNAME_INVALID_MESSAGE)
-    .max(exports.USERNAME_MAX_LENGTH, exports.USERNAME_INVALID_MESSAGE)
-    .regex(USERNAME_PATTERN, exports.USERNAME_INVALID_MESSAGE)
-    .refine((username) => !/^[0-9]+$/.test(username), exports.NUMERIC_USERNAME_MESSAGE)
-    .refine((username) => !exports.RESERVED_USERNAMES.has(username.toLowerCase()), exports.RESERVED_USERNAME_MESSAGE)
+    .min(username_1.USERNAME_MIN_LENGTH, username_1.USERNAME_INVALID_MESSAGE)
+    .max(username_1.USERNAME_MAX_LENGTH, username_1.USERNAME_INVALID_MESSAGE)
+    .regex(username_1.USERNAME_PATTERN, username_1.USERNAME_INVALID_MESSAGE)
+    .refine((username) => !/^[0-9]+$/.test(username), username_1.NUMERIC_USERNAME_MESSAGE)
+    .refine((username) => !username_1.RESERVED_USERNAMES.has(username.toLowerCase()), username_1.RESERVED_USERNAME_MESSAGE)
     .refine((username) => !username
     .split(/[-_]/)
-    .some((segment) => RESERVED_USERNAME_SEGMENTS.has(segment.toLowerCase())), exports.RESERVED_USERNAME_MESSAGE);
+    .some((segment) => username_1.RESERVED_USERNAME_SEGMENTS.has(segment.toLowerCase())), username_1.RESERVED_USERNAME_MESSAGE);
 /**
  * Whether a candidate handle is storable — the boolean form, for input surfaces
  * that show a message as somebody types rather than throwing.
@@ -230,36 +149,6 @@ exports.usernameSchema = zod_1.z
 function isValidUsername(candidate) {
     return exports.usernameSchema.safeParse(candidate).success;
 }
-/**
- * Drop the characters the policy forbids, for an input field that filters
- * keystrokes.
- *
- * This is a TYPING aid and nothing else — the result still has to pass
- * {@link usernameSchema}, which is what decides. It does not lower-case (case is
- * preserved, see the header) and it cannot repair a name: a value that is too
- * short, edge-separated or doubly-separated comes back unchanged and fails
- * validation with a message, which is the outcome the coercing rules this
- * replaces used to hide.
- */
-function stripDisallowedUsernameCharacters(input) {
-    return input.replace(/[^A-Za-z0-9_-]/g, '');
-}
-/**
- * The label a bot's handle ends in — the ONE exception the policy carries.
- *
- * Lower-case here because it is what a generator appends; the comparison that
- * enforces it folds case, so `MyBot` satisfies it just as `mybot` does.
- *
- * Deliberately NOT re-exported from the package barrel, for the same reason
- * {@link USERNAME_PATTERN_SOURCE} is not: it exists for the schema and the
- * generator aid below. A consumer that wants to SAY the rule uses
- * {@link BOT_USERNAME_INVALID_MESSAGE}, which already quotes it, and one that
- * wants to APPLY it uses {@link applyBotUsernameSuffix} — so there is no second
- * way to spell the check.
- */
-exports.BOT_USERNAME_SUFFIX = 'bot';
-/** The 400 / inline-validation copy for a bot handle that carries no label. */
-exports.BOT_USERNAME_INVALID_MESSAGE = `A bot account's username must end in "${exports.BOT_USERNAME_SUFFIX}"`;
 /**
  * The username policy for an account of kind `bot`: everything above, plus a
  * handle that ends in {@link BOT_USERNAME_SUFFIX}.
@@ -317,7 +206,7 @@ exports.BOT_USERNAME_INVALID_MESSAGE = `A bot account's username must end in "${
  * `community-maestro`, `community-pulse`, `garden-helper`, `luna`, `verity`).
  * They go on loading and resolving; only a NEW handle is held to this.
  */
-exports.botUsernameSchema = exports.usernameSchema.refine((username) => username.toLowerCase().endsWith(exports.BOT_USERNAME_SUFFIX), exports.BOT_USERNAME_INVALID_MESSAGE);
+exports.botUsernameSchema = exports.usernameSchema.refine((username) => username.toLowerCase().endsWith(username_1.BOT_USERNAME_SUFFIX), username_1.BOT_USERNAME_INVALID_MESSAGE);
 /**
  * The policy that governs a handle, given the kind of account that will hold it.
  *
@@ -334,27 +223,3 @@ exports.botUsernameSchema = exports.usernameSchema.refine((username) => username
 function usernameSchemaForAccountKind(kind) {
     return kind === 'bot' ? exports.botUsernameSchema : exports.usernameSchema;
 }
-/**
- * Label a proposed bot handle, so a generator PROPOSES something the server will
- * accept.
- *
- * Alia builds an agent's handle from its display name; without this it would
- * propose `garden-helper` for a bot and be 400ed on submit, which is the same
- * "suggest, then refuse" defect the minimum length already caused once.
- *
- * It appends and never inserts: a separator is the caller's choice, so
- * `garden-helper` becomes `garden-helperbot` while a caller who typed
- * `garden-helper-` gets `garden-helper-bot`. It truncates to leave room rather
- * than overflowing {@link USERNAME_MAX_LENGTH}.
- *
- * Like {@link stripDisallowedUsernameCharacters} it is an aid, not a decision: it
- * cannot repair a handle the base policy refuses, and the result still has to
- * pass {@link botUsernameSchema}.
- */
-function applyBotUsernameSuffix(candidate) {
-    const trimmed = candidate.trim();
-    if (trimmed.toLowerCase().endsWith(exports.BOT_USERNAME_SUFFIX)) {
-        return trimmed;
-    }
-    return trimmed.slice(0, exports.USERNAME_MAX_LENGTH - exports.BOT_USERNAME_SUFFIX.length) + exports.BOT_USERNAME_SUFFIX;
-}