@oxy.so/contracts 4.16.0 → 4.17.0

package/dist/esm/client/identityProof.js

@@ -0,0 +1,104 @@
+/**
+ * The identity-proof message format, without Zod. Schemas: `../identityProof.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+export const IDENTITY_PROOF_VERSION = 2;
+export const IDENTITY_PROOF_DOMAIN = 'oxy-identity-proof';
+/** The audience every API-verified identity proof names. */
+export const IDENTITY_PROOF_AUDIENCE = 'oxy-api/identity';
+/** How long a proof challenge lives: one interactive ceremony. */
+export const IDENTITY_PROOF_CHALLENGE_TTL_MS = 5 * 60 * 1000;
+/**
+ * Everything a root proof may authorize. A challenge is minted for exactly one
+ * action and spent only by a proof for that action.
+ */
+export const IDENTITY_PROOF_ACTIONS = {
+    /**
+     * Link Commons' root to an account that has none (`POST /auth/link`).
+     * The account becomes self-custodied and its email is deleted
+     * (ADR 0029 D3).
+     */
+    link: 'link_identity',
+};
+export const IDENTITY_PROOF_ACTION_VALUES = Object.values(IDENTITY_PROOF_ACTIONS);
+export const HEX_DIGEST = /^[0-9a-f]{64}$/;
+export const ROOT_KEY = /^04[0-9a-f]{128}$/;
+export const CHALLENGE = /^[0-9a-f]{64}$/;
+/**
+ * Canonical JSON: object keys sorted by UTF-16 code unit, no whitespace,
+ * `undefined` members omitted, arrays in order. Numbers must be finite. This is
+ * the ONLY serializer for anything digested into a proof.
+ */
+export function canonicalJson(value) {
+    if (value === null)
+        return 'null';
+    switch (typeof value) {
+        case 'string':
+        case 'boolean':
+            return JSON.stringify(value);
+        case 'number':
+            if (!Number.isFinite(value))
+                throw new Error('canonicalJson: non-finite number');
+            return JSON.stringify(value);
+        case 'object': {
+            if (Array.isArray(value)) {
+                return `[${value.map((entry) => (entry === undefined ? 'null' : canonicalJson(entry))).join(',')}]`;
+            }
+            const record = value;
+            const keys = Object.keys(record)
+                .filter((key) => record[key] !== undefined)
+                .sort();
+            return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(',')}}`;
+        }
+        default:
+            throw new Error(`canonicalJson: unsupported ${typeof value}`);
+    }
+}
+/**
+ * The exact bytes a root signs. Throws on a malformed claim rather than signing
+ * (or verifying) something ambiguous.
+ */
+export function buildIdentityProofMessage(claims) {
+    if (!IDENTITY_PROOF_ACTION_VALUES.includes(claims.action))
+        throw new Error('identity proof: unknown action');
+    if (!claims.subject || !claims.actor)
+        throw new Error('identity proof: subject and actor are required');
+    if (!ROOT_KEY.test(claims.rootPublicKey))
+        throw new Error('identity proof: rootPublicKey must be canonical');
+    if (claims.payloadDigest !== null && !HEX_DIGEST.test(claims.payloadDigest)) {
+        throw new Error('identity proof: payloadDigest must be a lowercase SHA-256 hex digest');
+    }
+    if (claims.expectedRevision !== null &&
+        (!Number.isSafeInteger(claims.expectedRevision) || claims.expectedRevision < 0)) {
+        throw new Error('identity proof: expectedRevision must be a non-negative integer');
+    }
+    if (!CHALLENGE.test(claims.challenge))
+        throw new Error('identity proof: challenge must be 64 lowercase hex characters');
+    if (!Number.isSafeInteger(claims.expiresAt) || claims.expiresAt <= 0)
+        throw new Error('identity proof: expiresAt must be unix milliseconds');
+    return canonicalJson({
+        v: IDENTITY_PROOF_VERSION,
+        domain: IDENTITY_PROOF_DOMAIN,
+        action: claims.action,
+        subject: claims.subject,
+        actor: claims.actor,
+        rootPublicKey: claims.rootPublicKey,
+        payloadDigest: claims.payloadDigest,
+        expectedRevision: claims.expectedRevision,
+        audience: claims.audience,
+        challenge: claims.challenge,
+        expiresAt: claims.expiresAt,
+    });
+}
+/**
+ * Stable error codes the root routes answer with (`error.code` in the API error
+ * body). Clients map these through their localization, never the English message.
+ */
+export const IDENTITY_ERROR_CODES = {
+    proofInvalid: 'IDENTITY_PROOF_INVALID',
+    rootAlreadyLinked: 'IDENTITY_ROOT_ALREADY_LINKED',
+    rootLinkedElsewhere: 'IDENTITY_ROOT_LINKED_ELSEWHERE',
+    freshFactorRequired: 'IDENTITY_FRESH_FACTOR_REQUIRED',
+    notPersonal: 'IDENTITY_NOT_PERSONAL_ACCOUNT',
+};

package/dist/esm/client/index.js

@@ -0,0 +1,37 @@
+/**
+ * `@oxy.so/contracts/client` — the contracts without Zod, for client bundles.
+ *
+ * The root entry is the contract: Zod schemas the API parses with, and the
+ * types inferred from them. Zod's runtime is ~120 KB of JavaScript, evaluated
+ * at startup, that a client only needed to answer "does this response have
+ * the shape its type promises". This entry answers that with small structural
+ * checks (`*Check`, used through {@link checkContract} / {@link parseContract}),
+ * and carries the constants and pure helpers clients use, so an app or SDK
+ * that imports only from here ships no Zod at all.
+ *
+ * Every check is the twin of one schema in the root entry: it is tied to the
+ * schema's type at compile time (`exact` in `./check.ts`) and to its runtime
+ * behaviour by `__tests__/clientChecks.parity.test.ts`. Types are not repeated
+ * here; import them from `@oxy.so/contracts` with `import type`.
+ */
+export { ContractCheckError, checkContract, formatCheckPath, parseContract, } from './check.js';
+export { ACCOUNT_CATEGORY_IDS, ACCOUNT_CATEGORY_KINDS, ACCOUNT_KINDS, CHILD_ACCOUNT_KINDS, MAX_ACCOUNT_CATEGORIES, RETIRED_ACCOUNT_CATEGORY_IDS, SELECTABLE_ACCOUNT_CATEGORY_IDS, isAccountKind, isDelegatedActAsEligibleKind, isOperatorSwitchTargetKind, isSelectableAccountCategoryId, kindAcceptsAccountCategories, newlyAddedRetiredCategories, } from './accountGraph.js';
+export { EMAIL_CODE_LENGTH, EMAIL_CODE_MAX_ATTEMPTS, EMAIL_CODE_TTL_MS, EMAIL_TICKET_TTL_MS, EMAIL_VERIFICATION_ERROR_CODES, EMAIL_VERIFICATION_PURPOSES, emailAddressCheck, emailTicketCheck, emailVerificationConfirmResponseCheck, emailVerificationStartResponseCheck, } from './accountEmail.js';
+export { ACCOUNT_AUTH_METHODS, AGENT_PROOF_ACTIONS, AGENT_PROOF_AUDIENCE, AGENT_PROOF_TTL_MS, agentChallengeRequestCheck, agentKeyListResponseCheck, agentKeyOperationChallengeCheck, agentKeyOperationCheck, agentKeyOperationResultCheck, agentProofClaimsCheck, agentVerifyRequestCheck, executeAgentKeyOperationCheck, } from './agentKeys.js';
+export { isLoopbackOrigin } from '../capabilityBindings.js';
+export { loginResultCheck } from './deviceBoot.js';
+export { externalIdentityReferenceCheck } from './externalIdentity.js';
+export { signedRecordEnvelopeCheck } from './identity.js';
+export { deviceActivateResponseCheck, deviceDirectoryCheck, deviceDirectorySyncCheck, } from './deviceDirectory.js';
+export { SESSION_ACCOUNTS_CHANGED_EVENT, activeTokenCheck, deviceBackgroundCredentialResponseCheck, deviceJoinCodeResponseCheck, deviceJoinResponseCheck, deviceRegisterResponseCheck, deviceSessionStateCheck, deviceSessionSyncCheck, deviceTokenMintResponseCheck, sessionAccountsChangedEventCheck, } from './deviceSession.js';
+export { IDENTITY_LINK_QR_PREFIX, IDENTITY_LINK_STATUSES, buildIdentityLinkQrPayload, identityLinkCreateResponseCheck, identityLinkStateCheck, parseIdentityLinkQrPayload, } from './identityLink.js';
+export { IDENTITY_ERROR_CODES, IDENTITY_PROOF_ACTIONS, IDENTITY_PROOF_ACTION_VALUES, IDENTITY_PROOF_AUDIENCE, IDENTITY_PROOF_CHALLENGE_TTL_MS, IDENTITY_PROOF_DOMAIN, IDENTITY_PROOF_VERSION, buildIdentityProofMessage, canonicalJson, } from './identityProof.js';
+export { ORGANIZATION_ALIAS_KINDS, ORGANIZATION_CLAIM_DECISIONS, ORGANIZATION_CLAIM_STATUSES, ORGANIZATION_ERROR_CODES, ORGANIZATION_NAME_MAX_LENGTH, ORGANIZATION_STATUSES, ORGANIZATION_TYPES, createOrganizationCheck, organizationBatchCheck, organizationCheck, organizationClaimCheck, organizationClaimDetailCheck, organizationClaimInputCheck, organizationClaimListCheck, organizationClaimReviewCheck, organizationCurationResultCheck, organizationExternalCheck, organizationExternalResolutionCheck, organizationImportBatchResultCheck, organizationListCheck, organizationNameCheck, updateOrganizationCheck, } from './organizations.js';
+export { cancelProductSubscriptionCheck, personalPlanCatalogueCheck, personalPlanCheckoutRequestCheck, personalPlanCheckoutResultCheck, productSubscriptionCancellationResultCheck, productSubscriptionsResponseCheck, subjectProductAccessCheck, subjectProductAccessQueryCheck, subscriptionCreditGrantsResponseCheck, } from './products.js';
+export { recommendationRequestCheck } from './recommendations.js';
+export { isFullReputationBalance } from './reputation.js';
+export { profileAccessDecisionCheck, profileAccessInputCheck } from './safety.js';
+export { publicApplicationCheck } from './sessionStatus.js';
+export { EMAIL_ACCOUNTS_MAX, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_SIGNIN_LINK_TTL_MS, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, REAUTH_ACTIONS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGN_IN_ERROR_CODES, TOTP_BACKUP_CODE_COUNT, TOTP_DIGITS, TOTP_PERIOD_SECONDS, emailSignInChooseAccountCheck, emailSignInLinkResponseCheck, emailSignInPendingCheck, emailSignInStartResponseCheck, isEmailSignInChooseAccount, isSecondFactorRequired, normalizeEmailSignInCode, reauthProofCheck, secondFactorRequiredCheck, signInMethodsCheck, totpBackupCodesResponseCheck, totpEnrollResponseCheck, } from './signIn.js';
+export { BOT_USERNAME_INVALID_MESSAGE, BOT_USERNAME_SUFFIX, NUMERIC_USERNAME_MESSAGE, RESERVED_USERNAMES, RESERVED_USERNAME_MESSAGE, USERNAME_INVALID_MESSAGE, USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, USERNAME_PATTERN_SOURCE, applyBotUsernameSuffix, botUsernameCheck, stripDisallowedUsernameCharacters, usernameCheck, usernameCheckForAccountKind, } from './username.js';
+export { userNameCheck } from './userResponse.js';

package/dist/esm/client/organizations.js

@@ -0,0 +1,111 @@
+/**
+ * Organization vocabularies and checks, without Zod. Schemas: `../organizations.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { array, boolean, datetime, exact, maxItems, maxLength, minLength, nullable, oneOf, optional, pattern, refine, strictObject, string, trim, url, } from './check.js';
+/** Real-world identity classification, independent of account topics and permissions. */
+export const ORGANIZATION_TYPES = [
+    'business',
+    'nonprofit',
+    'public_body',
+    'community',
+    'other',
+];
+export const ORGANIZATION_STATUSES = ['active', 'inactive', 'merged', 'suppressed'];
+export const ORGANIZATION_CLAIM_STATUSES = ['unclaimed', 'claimed'];
+export const ORGANIZATION_ALIAS_KINDS = [
+    'name_variant',
+    'former_name',
+    'localized_name',
+    'marketing_name',
+    'misspelling',
+];
+export const ORGANIZATION_CLAIM_DECISIONS = ['pending', 'approved', 'rejected'];
+export const ORGANIZATION_NAME_MAX_LENGTH = 300;
+export const ORGANIZATION_ERROR_CODES = [
+    'bad_request',
+    'unauthorized',
+    'forbidden',
+    'not_found',
+    'unknown_route',
+    'conflict',
+    'validation_failed',
+    'rate_limited',
+    'internal_error',
+    'service_unavailable',
+];
+/* -------------------------------------------------------------------------- */
+/*  Checks                                                                    */
+/* -------------------------------------------------------------------------- */
+const id = string(minLength(1), maxLength(128));
+const optionalText = (max) => optional(nullable(string(trim, minLength(1), maxLength(max))));
+const evidenceReference = string(trim, minLength(1), maxLength(1000));
+const createdAt = string(datetime);
+const organizationAlias = strictObject({
+    alias: string(trim, minLength(1), maxLength(300)),
+    kind: oneOf(ORGANIZATION_ALIAS_KINDS),
+    language: optional(string(minLength(2), maxLength(35))),
+});
+/** The twin of `organizationNameSchema`. */
+export const organizationNameCheck = refine(string(trim, minLength(1), maxLength(ORGANIZATION_NAME_MAX_LENGTH)), (value) => !/[<>]/.test(value) &&
+    Array.from(value).every((character) => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127), 'Organization name must be plain text');
+const organizationFields = {
+    name: organizationNameCheck,
+    organizationType: oneOf(ORGANIZATION_TYPES),
+    legalName: optionalText(300),
+    websiteUrl: optional(nullable(refine(string(url, maxLength(2048)), (value) => /^https?:\/\//.test(value), 'Use HTTP or HTTPS'))),
+    countryCode: optional(nullable(string(pattern(/^[A-Z]{2}$/)))),
+    aliases: optional(array(organizationAlias, maxItems(100))),
+};
+export const createOrganizationCheck = exact()(strictObject(organizationFields));
+export const updateOrganizationCheck = exact()(strictObject({
+    ...organizationFields,
+    name: optional(organizationNameCheck),
+    organizationType: optional(organizationFields.organizationType),
+}));
+export const organizationCheck = exact()(strictObject({
+    name: organizationNameCheck,
+    organizationType: oneOf(ORGANIZATION_TYPES),
+    legalName: nullable(string()),
+    websiteUrl: nullable(string()),
+    countryCode: nullable(string()),
+    aliases: array(organizationAlias),
+    accountId: id,
+    username: nullable(string()),
+    avatar: nullable(string()),
+    verifiedDomains: array(string()),
+    claimStatus: oneOf(ORGANIZATION_CLAIM_STATUSES),
+    status: oneOf(ORGANIZATION_STATUSES),
+    mergedIntoAccountId: nullable(id),
+    createdAt,
+    updatedAt: string(datetime),
+}));
+export const organizationListCheck = exact()(strictObject({ items: array(organizationCheck), nextCursor: nullable(string()) }));
+export const organizationBatchCheck = exact()(strictObject({
+    items: array(strictObject({ requestedAccountId: id, organization: organizationCheck })),
+    missingIds: array(id),
+}));
+export const organizationClaimInputCheck = exact()(strictObject({ evidenceReference }));
+const organizationClaimFields = {
+    id,
+    accountId: id,
+    claimantUserId: id,
+    status: oneOf(ORGANIZATION_CLAIM_DECISIONS),
+    createdAt,
+};
+export const organizationClaimCheck = exact()(strictObject(organizationClaimFields));
+export const organizationClaimDetailCheck = exact()(strictObject({
+    ...organizationClaimFields,
+    evidenceReference: string(),
+    reviewEvidenceReference: nullable(string()),
+    reviewedAt: nullable(string(datetime)),
+}));
+export const organizationClaimListCheck = exact()(strictObject({ items: array(organizationClaimDetailCheck), nextCursor: nullable(string()) }));
+export const organizationClaimReviewCheck = exact()(strictObject({ decision: oneOf(['approved', 'rejected']), evidenceReference }));
+export const organizationImportBatchResultCheck = exact()(strictObject({
+    items: array(strictObject({ externalId: string(), accountId: id, created: boolean })),
+}));
+export const organizationExternalCheck = exact()(strictObject({ accountId: id, created: boolean }));
+export const organizationExternalResolutionCheck = exact()(strictObject({ accountId: id }));
+export const organizationCurationResultCheck = exact()(strictObject({ accountId: id, status: oneOf(['active', 'inactive', 'suppressed']) }));

package/dist/esm/client/products.js

@@ -0,0 +1,150 @@
+/**
+ * Product access, plans, checkout and subscription checks, without Zod.
+ * Schemas: `../products/*.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { array, boolean, branded, datetime, discriminatedUnion, exact, int, literal, maxLength, minLength, nonnegative, nullable, number, oneOf, optional, pattern, positive, refine, safe, startsWith, strictObject, string, union, url, } from './check.js';
+const identifier = string(minLength(1), maxLength(160));
+const displayName = string(minLength(1), maxLength(100));
+const count = number(int, nonnegative, safe);
+const version = number(int, positive, safe);
+const oxyAccountId = branded(string(minLength(1), maxLength(64)));
+const actionKey = string(minLength(8), maxLength(160), pattern(/^[a-zA-Z0-9_-]+$/));
+const combination = oneOf(['maximum', 'sum', 'exclusive']);
+const origin = oneOf(['individual', 'bundle']);
+const period = (message) => refine(strictObject({ start: string(datetime), end: string(datetime) }), (value) => Date.parse(value.end) > Date.parse(value.start), message);
+const productBenefit = discriminatedUnion('kind', {
+    capability: strictObject({ kind: literal('capability'), productId: identifier, key: identifier }),
+    quota: strictObject({
+        kind: literal('quota'),
+        productId: identifier,
+        key: identifier,
+        unit: identifier,
+        included: count,
+        combination,
+    }),
+});
+export const subjectProductAccessQueryCheck = exact()(strictObject({
+    schemaVersion: literal(1),
+    subjectAccountId: oxyAccountId,
+    productId: identifier,
+}));
+export const subjectProductAccessCheck = exact()(strictObject({
+    schemaVersion: literal(1),
+    subjectAccountId: oxyAccountId,
+    productId: identifier,
+    evaluatedAt: string(datetime),
+    capabilities: array(strictObject({ key: identifier, grantIds: array(identifier) })),
+    quotas: array(strictObject({
+        key: identifier,
+        unit: identifier,
+        included: count,
+        combination,
+        grantIds: array(identifier),
+    })),
+    conflicts: array(strictObject({
+        key: identifier,
+        reason: oneOf([
+            'combination_mismatch',
+            'unit_mismatch',
+            'exclusive_overlap',
+            'unsafe_total',
+        ]),
+        grantIds: array(identifier),
+    })),
+}));
+export const personalPlanCatalogueCheck = exact()(refine(strictObject({
+    schemaVersion: literal(1),
+    state: oneOf(['unconfigured', 'configured']),
+    purchase: literal('unavailable'),
+    plans: array(strictObject({
+        offerId: identifier,
+        offerVersion: version,
+        displayName,
+        audience: literal('personal'),
+        kind: literal('oxy_one'),
+        price: optional(strictObject({
+            currency: string(pattern(/^[A-Z]{3}$/)),
+            amountMinorUnits: version,
+            interval: literal('month'),
+            trial: literal('none'),
+            taxTreatment: literal('inclusive'),
+            merchantTotal: literal('final'),
+        })),
+        benefits: array(strictObject({ displayName, benefit: productBenefit })),
+    })),
+}), (value) => (value.state === 'unconfigured') === (value.plans.length === 0), 'Catalogue state must match published plans'));
+export const personalPlanCheckoutRequestCheck = exact()(strictObject({
+    expectedSubjectAccountId: oxyAccountId,
+    offerId: identifier,
+    offerVersion: version,
+    idempotencyKey: actionKey,
+}));
+export const personalPlanCheckoutResultCheck = exact()(discriminatedUnion('state', {
+    unconfigured: strictObject({
+        state: literal('unconfigured'),
+        reason: oneOf(['provider_unconfigured', 'offer_unconfigured', 'price_unconfigured']),
+    }),
+    pending: strictObject({
+        state: literal('pending'),
+        intentId: identifier,
+        checkoutUrl: optional(string(url, startsWith('https://'))),
+    }),
+    closed: strictObject({ state: literal('closed'), intentId: identifier }),
+    fulfilled: strictObject({ state: literal('fulfilled'), intentId: identifier }),
+}));
+const billingPeriod = period('Period end must follow start');
+export const productSubscriptionsResponseCheck = exact()(strictObject({
+    subscriptions: array(strictObject({
+        sourceId: identifier,
+        status: oneOf([
+            'active',
+            'trialing',
+            'past_due',
+            'unpaid',
+            'canceled',
+            'paused',
+            'incomplete',
+            'incomplete_expired',
+        ]),
+        period: billingPeriod,
+        cancelAtPeriodEnd: boolean,
+        canCancel: boolean,
+        offers: array(strictObject({
+            segmentId: identifier,
+            offerId: identifier,
+            offerVersion: version,
+            displayName,
+            origin,
+            period: billingPeriod,
+            current: boolean,
+            products: array(strictObject({ id: identifier, displayName })),
+        })),
+    })),
+}));
+export const subscriptionCreditGrantsResponseCheck = exact()(strictObject({
+    grants: array(refine(strictObject({
+        id: identifier,
+        invoiceId: identifier,
+        origin: oneOf([
+            'subscription_payment',
+            'subscription_proration',
+            'subscription_promotional_grant',
+        ]),
+        period: billingPeriod,
+        granted: count,
+        consumed: count,
+        clawed: count,
+        remaining: count,
+        promotionId: nullable(identifier),
+        createdAt: string(datetime),
+    }), (value) => BigInt(value.consumed) + BigInt(value.clawed) + BigInt(value.remaining) ===
+        BigInt(value.granted), 'Grant conservation differs')),
+}));
+export const cancelProductSubscriptionCheck = exact()(strictObject({
+    sourceId: identifier,
+    actionId: optional(actionKey),
+    expectedSubjectAccountId: optional(oxyAccountId),
+}));
+export const productSubscriptionCancellationResultCheck = exact()(union(strictObject({ sourceId: identifier, cancelAtPeriodEnd: literal(true) }), strictObject({ sourceId: identifier, reconciliationPending: literal(true) })));

package/dist/esm/client/recommendations.js

@@ -0,0 +1,30 @@
+/**
+ * The recommendation-request check, without Zod. Schemas: `../recommendations.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { array, atLeast, atMost, exact, int, maxItems, maxLength, minItems, minLength, number, object, oneOf, optional, string, trim, } from './check.js';
+const id = string(trim, minLength(1));
+const weight = optional(number(atLeast(0), atMost(10)));
+export const recommendationRequestCheck = exact()(object({
+    clientId: optional(string(trim, minLength(1))),
+    limit: optional(number(int, atLeast(1), atMost(100))),
+    offset: optional(number(int, atLeast(0))),
+    excludeTypes: optional(array(oneOf(['federated', 'agent', 'automated']))),
+    excludeIds: optional(array(id, maxItems(500))),
+    boosts: optional(array(object({
+        userIds: array(id, minItems(1), maxItems(200)),
+        weight: number(atLeast(-5), atMost(5)),
+        reason: optional(string(trim, maxLength(120))),
+    }), maxItems(50))),
+    signalWeights: optional(object({
+        graph: weight,
+        completeness: weight,
+        verified: weight,
+        curation: weight,
+        interest: weight,
+        appBoost: weight,
+        repCandidate: weight,
+        affinity: weight,
+    })),
+}));

package/dist/esm/client/reputation.js

@@ -0,0 +1,37 @@
+/**
+ * The reputation view guard, without Zod. Schemas: `../reputation.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+/**
+ * The fields the full {@link ReputationBalance} carries beyond the public
+ * {@link ReputationBalanceSummary} that the API sends ALL-OR-NOTHING. The
+ * runtime discriminant between the two views.
+ *
+ * The V2 blocks (`conduct`, `contribution`, …) are deliberately NOT listed:
+ * they are optional on the wire, so requiring them here would make a balance
+ * from a server that predates them fail to narrow, hiding the whole private
+ * view. Read a V2 block by checking that block.
+ */
+export const FULL_BALANCE_FIELDS = [
+    'positive',
+    'negative',
+    'breakdown',
+    'influence',
+    'reliability',
+    'recalculatedAt',
+    'updatedAt',
+];
+/**
+ * Whether a balance came back as the SUBJECT view, and so carries the
+ * breakdown / influence / reliability blocks.
+ *
+ * Checks every extra field rather than one representative: the point of the
+ * guard is that the caller then dereferences those blocks, so a partial payload
+ * must not narrow.
+ *
+ * @param balance - A balance from `getReputationBalance`.
+ */
+export function isFullReputationBalance(balance) {
+    return FULL_BALANCE_FIELDS.every((field) => field in balance);
+}

package/dist/esm/client/safety.js

@@ -0,0 +1,12 @@
+/**
+ * Profile-access checks, without Zod. Schemas: `../safety.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { boolean, exact, literal, maxLength, minLength, oneOf, strictObject, string, } from './check.js';
+export const profileAccessInputCheck = exact()(strictObject({ subjectAccountId: string(minLength(1), maxLength(128)) }));
+export const profileAccessDecisionCheck = exact()(strictObject({
+    allowed: boolean,
+    reason: oneOf(['public', 'owner', 'private', 'blocked', 'unavailable']),
+    policyVersion: literal('1'),
+}));

package/dist/esm/client/sessionStatus.js

@@ -0,0 +1,20 @@
+/**
+ * The public-application check, without Zod. Schemas: `../sessionStatus.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { array, boolean, exact, object, oneOf, optional, string } from './check.js';
+export const publicApplicationCheck = exact()(object({
+    id: string(),
+    name: string(),
+    description: optional(string()),
+    icon: optional(string()),
+    websiteUrl: optional(string()),
+    privacyPolicyUrl: optional(string()),
+    termsUrl: optional(string()),
+    type: oneOf(['first_party', 'third_party', 'internal', 'system']),
+    isOfficial: boolean,
+    isInternal: boolean,
+    scopes: array(string()),
+    developerName: optional(string()),
+}));

package/dist/esm/client/signIn.js

@@ -0,0 +1,151 @@
+/**
+ * Sign-in constants, guards and response checks, without Zod. Schemas: `../signIn.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { EMAIL_CODE_LENGTH, emailTicketCheck } from './accountEmail.js';
+import { array, boolean, exact, exactItems, int, literal, maxItems, maxLength, minItems, minLength, nonnegative, number, object, optional, pattern, positive, refine, startsWith, strictObject, string, trim, } from './check.js';
+/** How long the link in a sign-in email can be opened. */
+export const EMAIL_SIGNIN_LINK_TTL_MS = 15 * 60 * 1000;
+/** How long a second-factor challenge can be answered. */
+export const SIGNIN_SECOND_FACTOR_TTL_MS = 5 * 60 * 1000;
+/** Wrong second-factor codes one challenge accepts. */
+export const SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = 5;
+/** Shortest password Oxy accepts when one is set. */
+export const PASSWORD_MIN_LENGTH = 10;
+/** Longest password Oxy accepts (characters). */
+export const PASSWORD_MAX_LENGTH = 256;
+/** Digits in an authenticator code. */
+export const TOTP_DIGITS = 6;
+/** Seconds each authenticator code lasts. */
+export const TOTP_PERIOD_SECONDS = 30;
+/** Backup codes issued when an authenticator is enabled or they are regenerated. */
+export const TOTP_BACKUP_CODE_COUNT = 10;
+/**
+ * The long sign-in code: ten characters of Crockford base32 without the
+ * look-alikes (no 0, O, 1, I, L, U), shown as `XXXXX-XXXXX`. An account whose
+ * sign-in codes were guessed at too often today (the per-account ceiling) is
+ * sent this instead of 6 digits for the rest of the day, so its owner can still
+ * type a code while guessing one is infeasible.
+ */
+export const EMAIL_SIGNIN_LONG_CODE_ALPHABET = '23456789ABCDEFGHJKMNPQRSTVWXYZ';
+export const EMAIL_SIGNIN_LONG_CODE_LENGTH = 10;
+/**
+ * Normalise a typed sign-in code: 6 digits stay as they are; a long code is
+ * upper-cased with its dash and spaces removed. Anything else is returned
+ * trimmed (and will simply be wrong).
+ */
+export function normalizeEmailSignInCode(code) {
+    const compact = code.trim().replace(/[\s-]/g, '').toUpperCase();
+    return compact;
+}
+/**
+ * How long, once the email is proven, the person has to choose which of its
+ * accounts signs in.
+ */
+export const EMAIL_SIGNIN_CHOICE_TTL_MS = 5 * 60 * 1000;
+/** Most accounts one email can hold; sign-up refuses another past it. */
+export const EMAIL_ACCOUNTS_MAX = 20;
+/** Narrow a {@link SignInStepResult}. */
+export function isSecondFactorRequired(result) {
+    return result.secondFactorRequired === true;
+}
+/** Narrow an {@link EmailSignInStepResult}. */
+export function isEmailSignInChooseAccount(result) {
+    return result.chooseAccount === true;
+}
+/**
+ * What a re-verification email code confirms. The code is bound to it: a code
+ * asked for one change never authorises another, and the email names it.
+ */
+export const REAUTH_ACTIONS = [
+    'change_password',
+    'totp',
+    'link_commons',
+    'delete_account',
+    'credentials_manage',
+];
+/**
+ * Stable error codes (`error.code` in the API error body). Clients map these
+ * through their localization, never the English message.
+ */
+export const SIGN_IN_ERROR_CODES = {
+    /** Wrong identifier or password — never says which. */
+    invalidCredentials: 'SIGNIN_INVALID_CREDENTIALS',
+    /** The request is unknown, expired, spent, or its secret is wrong. */
+    requestInvalid: 'SIGNIN_REQUEST_INVALID',
+    /** The link is unknown, expired or already used. */
+    linkInvalid: 'SIGNIN_LINK_INVALID',
+    /** The link was opened in another browser: type the code in the app instead. */
+    linkOtherDevice: 'SIGNIN_LINK_OTHER_DEVICE',
+    /** The second-factor challenge or its code is wrong, expired or spent. */
+    secondFactorInvalid: 'SECOND_FACTOR_INVALID',
+    /** Too many failures for this account: wait and try again. */
+    locked: 'SIGNIN_LOCKED',
+    /** The step needs a fresh proof (`reauth`). */
+    reauthRequired: 'REAUTH_REQUIRED',
+    /** The fresh proof was wrong. */
+    reauthInvalid: 'REAUTH_INVALID',
+    /** The account has an authenticator: the proof must carry its code. */
+    totpRequired: 'TOTP_REQUIRED',
+    /** Enrolling or confirming an authenticator that is already on. */
+    totpAlreadyEnabled: 'TOTP_ALREADY_ENABLED',
+    /** Disabling, confirming or regenerating codes with no authenticator (or no pending one). */
+    totpNotEnabled: 'TOTP_NOT_ENABLED',
+    /** The code the authenticator showed at enrolment is wrong. */
+    totpCodeInvalid: 'TOTP_CODE_INVALID',
+    /** Only official Oxy apps and auth.oxy.so may sign people in here. */
+    originNotAllowed: 'SIGNIN_ORIGIN_NOT_ALLOWED',
+    /** The username is taken. */
+    usernameTaken: 'USERNAME_TAKEN',
+    /** The email already holds `EMAIL_ACCOUNTS_MAX` accounts: no sign-up adds another. */
+    emailAccountsFull: 'EMAIL_ACCOUNTS_FULL',
+};
+/* -------------------------------------------------------------------------- */
+/*  Checks                                                                    */
+/* -------------------------------------------------------------------------- */
+const expiresAt = number(int, positive);
+const sixDigits = string(trim, pattern(new RegExp(`^\\d{${EMAIL_CODE_LENGTH}}$`), `code must be ${EMAIL_CODE_LENGTH} digits`));
+const passwordInput = string(minLength(1), maxLength(PASSWORD_MAX_LENGTH));
+const secondFactorCode = string(trim, minLength(TOTP_DIGITS), maxLength(16));
+export const emailSignInStartResponseCheck = exact()(object({
+    requestId: string(minLength(1), maxLength(64)),
+    requestSecret: emailTicketCheck,
+    expiresAt,
+    retryLater: optional(literal(true)),
+}));
+export const emailSignInLinkResponseCheck = exact()(object({ approved: literal(true) }));
+export const secondFactorRequiredCheck = exact()(object({ secondFactorRequired: literal(true), challengeId: emailTicketCheck, expiresAt }));
+export const emailSignInPendingCheck = exact()(object({ status: literal('pending'), expiresAt }));
+const emailSignInAccountOption = exact()(object({
+    id: string(minLength(1), maxLength(64)),
+    username: optional(string(minLength(1))),
+    displayName: optional(string(minLength(1))),
+    avatar: optional(string(minLength(1))),
+}));
+export const emailSignInChooseAccountCheck = exact()(object({
+    chooseAccount: literal(true),
+    accounts: array(emailSignInAccountOption, minItems(2), maxItems(EMAIL_ACCOUNTS_MAX)),
+    expiresAt,
+}));
+export const signInMethodsCheck = exact()(object({
+    hasEmail: boolean,
+    hasPassword: boolean,
+    totpEnabled: boolean,
+    backupCodesRemaining: number(int, nonnegative),
+}));
+export const totpEnrollResponseCheck = exact()(object({
+    secret: string(pattern(/^[A-Z2-7]+$/)),
+    otpauthUri: string(startsWith('otpauth://totp/')),
+}));
+export const totpBackupCodesResponseCheck = exact()(object({
+    backupCodes: array(string(pattern(/^[a-z2-9]{5}-[a-z2-9]{5}$/)), exactItems(TOTP_BACKUP_CODE_COUNT)),
+}));
+export const reauthProofCheck = exact()(refine(strictObject({
+    password: optional(passwordInput),
+    emailCode: optional(strictObject({
+        verificationId: string(trim, minLength(1), maxLength(64)),
+        code: sixDigits,
+    })),
+    totpCode: optional(secondFactorCode),
+}), (proof) => proof.password !== undefined || proof.emailCode !== undefined, 'password or emailCode is required'));