@oxy.so/contracts 4.16.0 → 4.17.0

package/dist/cjs/client/products.js

@@ -0,0 +1,153 @@
+"use strict";
+/**
+ * Product access, plans, checkout and subscription checks, without Zod.
+ * Schemas: `../products/*.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.productSubscriptionCancellationResultCheck = exports.cancelProductSubscriptionCheck = exports.subscriptionCreditGrantsResponseCheck = exports.productSubscriptionsResponseCheck = exports.personalPlanCheckoutResultCheck = exports.personalPlanCheckoutRequestCheck = exports.personalPlanCatalogueCheck = exports.subjectProductAccessCheck = exports.subjectProductAccessQueryCheck = void 0;
+const check_1 = require("./check");
+const identifier = (0, check_1.string)((0, check_1.minLength)(1), (0, check_1.maxLength)(160));
+const displayName = (0, check_1.string)((0, check_1.minLength)(1), (0, check_1.maxLength)(100));
+const count = (0, check_1.number)(check_1.int, check_1.nonnegative, check_1.safe);
+const version = (0, check_1.number)(check_1.int, check_1.positive, check_1.safe);
+const oxyAccountId = (0, check_1.branded)((0, check_1.string)((0, check_1.minLength)(1), (0, check_1.maxLength)(64)));
+const actionKey = (0, check_1.string)((0, check_1.minLength)(8), (0, check_1.maxLength)(160), (0, check_1.pattern)(/^[a-zA-Z0-9_-]+$/));
+const combination = (0, check_1.oneOf)(['maximum', 'sum', 'exclusive']);
+const origin = (0, check_1.oneOf)(['individual', 'bundle']);
+const period = (message) => (0, check_1.refine)((0, check_1.strictObject)({ start: (0, check_1.string)(check_1.datetime), end: (0, check_1.string)(check_1.datetime) }), (value) => Date.parse(value.end) > Date.parse(value.start), message);
+const productBenefit = (0, check_1.discriminatedUnion)('kind', {
+    capability: (0, check_1.strictObject)({ kind: (0, check_1.literal)('capability'), productId: identifier, key: identifier }),
+    quota: (0, check_1.strictObject)({
+        kind: (0, check_1.literal)('quota'),
+        productId: identifier,
+        key: identifier,
+        unit: identifier,
+        included: count,
+        combination,
+    }),
+});
+exports.subjectProductAccessQueryCheck = (0, check_1.exact)()((0, check_1.strictObject)({
+    schemaVersion: (0, check_1.literal)(1),
+    subjectAccountId: oxyAccountId,
+    productId: identifier,
+}));
+exports.subjectProductAccessCheck = (0, check_1.exact)()((0, check_1.strictObject)({
+    schemaVersion: (0, check_1.literal)(1),
+    subjectAccountId: oxyAccountId,
+    productId: identifier,
+    evaluatedAt: (0, check_1.string)(check_1.datetime),
+    capabilities: (0, check_1.array)((0, check_1.strictObject)({ key: identifier, grantIds: (0, check_1.array)(identifier) })),
+    quotas: (0, check_1.array)((0, check_1.strictObject)({
+        key: identifier,
+        unit: identifier,
+        included: count,
+        combination,
+        grantIds: (0, check_1.array)(identifier),
+    })),
+    conflicts: (0, check_1.array)((0, check_1.strictObject)({
+        key: identifier,
+        reason: (0, check_1.oneOf)([
+            'combination_mismatch',
+            'unit_mismatch',
+            'exclusive_overlap',
+            'unsafe_total',
+        ]),
+        grantIds: (0, check_1.array)(identifier),
+    })),
+}));
+exports.personalPlanCatalogueCheck = (0, check_1.exact)()((0, check_1.refine)((0, check_1.strictObject)({
+    schemaVersion: (0, check_1.literal)(1),
+    state: (0, check_1.oneOf)(['unconfigured', 'configured']),
+    purchase: (0, check_1.literal)('unavailable'),
+    plans: (0, check_1.array)((0, check_1.strictObject)({
+        offerId: identifier,
+        offerVersion: version,
+        displayName,
+        audience: (0, check_1.literal)('personal'),
+        kind: (0, check_1.literal)('oxy_one'),
+        price: (0, check_1.optional)((0, check_1.strictObject)({
+            currency: (0, check_1.string)((0, check_1.pattern)(/^[A-Z]{3}$/)),
+            amountMinorUnits: version,
+            interval: (0, check_1.literal)('month'),
+            trial: (0, check_1.literal)('none'),
+            taxTreatment: (0, check_1.literal)('inclusive'),
+            merchantTotal: (0, check_1.literal)('final'),
+        })),
+        benefits: (0, check_1.array)((0, check_1.strictObject)({ displayName, benefit: productBenefit })),
+    })),
+}), (value) => (value.state === 'unconfigured') === (value.plans.length === 0), 'Catalogue state must match published plans'));
+exports.personalPlanCheckoutRequestCheck = (0, check_1.exact)()((0, check_1.strictObject)({
+    expectedSubjectAccountId: oxyAccountId,
+    offerId: identifier,
+    offerVersion: version,
+    idempotencyKey: actionKey,
+}));
+exports.personalPlanCheckoutResultCheck = (0, check_1.exact)()((0, check_1.discriminatedUnion)('state', {
+    unconfigured: (0, check_1.strictObject)({
+        state: (0, check_1.literal)('unconfigured'),
+        reason: (0, check_1.oneOf)(['provider_unconfigured', 'offer_unconfigured', 'price_unconfigured']),
+    }),
+    pending: (0, check_1.strictObject)({
+        state: (0, check_1.literal)('pending'),
+        intentId: identifier,
+        checkoutUrl: (0, check_1.optional)((0, check_1.string)(check_1.url, (0, check_1.startsWith)('https://'))),
+    }),
+    closed: (0, check_1.strictObject)({ state: (0, check_1.literal)('closed'), intentId: identifier }),
+    fulfilled: (0, check_1.strictObject)({ state: (0, check_1.literal)('fulfilled'), intentId: identifier }),
+}));
+const billingPeriod = period('Period end must follow start');
+exports.productSubscriptionsResponseCheck = (0, check_1.exact)()((0, check_1.strictObject)({
+    subscriptions: (0, check_1.array)((0, check_1.strictObject)({
+        sourceId: identifier,
+        status: (0, check_1.oneOf)([
+            'active',
+            'trialing',
+            'past_due',
+            'unpaid',
+            'canceled',
+            'paused',
+            'incomplete',
+            'incomplete_expired',
+        ]),
+        period: billingPeriod,
+        cancelAtPeriodEnd: check_1.boolean,
+        canCancel: check_1.boolean,
+        offers: (0, check_1.array)((0, check_1.strictObject)({
+            segmentId: identifier,
+            offerId: identifier,
+            offerVersion: version,
+            displayName,
+            origin,
+            period: billingPeriod,
+            current: check_1.boolean,
+            products: (0, check_1.array)((0, check_1.strictObject)({ id: identifier, displayName })),
+        })),
+    })),
+}));
+exports.subscriptionCreditGrantsResponseCheck = (0, check_1.exact)()((0, check_1.strictObject)({
+    grants: (0, check_1.array)((0, check_1.refine)((0, check_1.strictObject)({
+        id: identifier,
+        invoiceId: identifier,
+        origin: (0, check_1.oneOf)([
+            'subscription_payment',
+            'subscription_proration',
+            'subscription_promotional_grant',
+        ]),
+        period: billingPeriod,
+        granted: count,
+        consumed: count,
+        clawed: count,
+        remaining: count,
+        promotionId: (0, check_1.nullable)(identifier),
+        createdAt: (0, check_1.string)(check_1.datetime),
+    }), (value) => BigInt(value.consumed) + BigInt(value.clawed) + BigInt(value.remaining) ===
+        BigInt(value.granted), 'Grant conservation differs')),
+}));
+exports.cancelProductSubscriptionCheck = (0, check_1.exact)()((0, check_1.strictObject)({
+    sourceId: identifier,
+    actionId: (0, check_1.optional)(actionKey),
+    expectedSubjectAccountId: (0, check_1.optional)(oxyAccountId),
+}));
+exports.productSubscriptionCancellationResultCheck = (0, check_1.exact)()((0, check_1.union)((0, check_1.strictObject)({ sourceId: identifier, cancelAtPeriodEnd: (0, check_1.literal)(true) }), (0, check_1.strictObject)({ sourceId: identifier, reconciliationPending: (0, check_1.literal)(true) })));

package/dist/cjs/client/recommendations.js

@@ -0,0 +1,33 @@
+"use strict";
+/**
+ * The recommendation-request check, without Zod. Schemas: `../recommendations.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recommendationRequestCheck = void 0;
+const check_1 = require("./check");
+const id = (0, check_1.string)(check_1.trim, (0, check_1.minLength)(1));
+const weight = (0, check_1.optional)((0, check_1.number)((0, check_1.atLeast)(0), (0, check_1.atMost)(10)));
+exports.recommendationRequestCheck = (0, check_1.exact)()((0, check_1.object)({
+    clientId: (0, check_1.optional)((0, check_1.string)(check_1.trim, (0, check_1.minLength)(1))),
+    limit: (0, check_1.optional)((0, check_1.number)(check_1.int, (0, check_1.atLeast)(1), (0, check_1.atMost)(100))),
+    offset: (0, check_1.optional)((0, check_1.number)(check_1.int, (0, check_1.atLeast)(0))),
+    excludeTypes: (0, check_1.optional)((0, check_1.array)((0, check_1.oneOf)(['federated', 'agent', 'automated']))),
+    excludeIds: (0, check_1.optional)((0, check_1.array)(id, (0, check_1.maxItems)(500))),
+    boosts: (0, check_1.optional)((0, check_1.array)((0, check_1.object)({
+        userIds: (0, check_1.array)(id, (0, check_1.minItems)(1), (0, check_1.maxItems)(200)),
+        weight: (0, check_1.number)((0, check_1.atLeast)(-5), (0, check_1.atMost)(5)),
+        reason: (0, check_1.optional)((0, check_1.string)(check_1.trim, (0, check_1.maxLength)(120))),
+    }), (0, check_1.maxItems)(50))),
+    signalWeights: (0, check_1.optional)((0, check_1.object)({
+        graph: weight,
+        completeness: weight,
+        verified: weight,
+        curation: weight,
+        interest: weight,
+        appBoost: weight,
+        repCandidate: weight,
+        affinity: weight,
+    })),
+}));

package/dist/cjs/client/reputation.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * The reputation view guard, without Zod. Schemas: `../reputation.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FULL_BALANCE_FIELDS = void 0;
+exports.isFullReputationBalance = isFullReputationBalance;
+/**
+ * The fields the full {@link ReputationBalance} carries beyond the public
+ * {@link ReputationBalanceSummary} that the API sends ALL-OR-NOTHING. The
+ * runtime discriminant between the two views.
+ *
+ * The V2 blocks (`conduct`, `contribution`, …) are deliberately NOT listed:
+ * they are optional on the wire, so requiring them here would make a balance
+ * from a server that predates them fail to narrow, hiding the whole private
+ * view. Read a V2 block by checking that block.
+ */
+exports.FULL_BALANCE_FIELDS = [
+    'positive',
+    'negative',
+    'breakdown',
+    'influence',
+    'reliability',
+    'recalculatedAt',
+    'updatedAt',
+];
+/**
+ * Whether a balance came back as the SUBJECT view, and so carries the
+ * breakdown / influence / reliability blocks.
+ *
+ * Checks every extra field rather than one representative: the point of the
+ * guard is that the caller then dereferences those blocks, so a partial payload
+ * must not narrow.
+ *
+ * @param balance - A balance from `getReputationBalance`.
+ */
+function isFullReputationBalance(balance) {
+    return exports.FULL_BALANCE_FIELDS.every((field) => field in balance);
+}

package/dist/cjs/client/safety.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * Profile-access checks, without Zod. Schemas: `../safety.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.profileAccessDecisionCheck = exports.profileAccessInputCheck = void 0;
+const check_1 = require("./check");
+exports.profileAccessInputCheck = (0, check_1.exact)()((0, check_1.strictObject)({ subjectAccountId: (0, check_1.string)((0, check_1.minLength)(1), (0, check_1.maxLength)(128)) }));
+exports.profileAccessDecisionCheck = (0, check_1.exact)()((0, check_1.strictObject)({
+    allowed: check_1.boolean,
+    reason: (0, check_1.oneOf)(['public', 'owner', 'private', 'blocked', 'unavailable']),
+    policyVersion: (0, check_1.literal)('1'),
+}));

package/dist/cjs/client/sessionStatus.js

@@ -0,0 +1,23 @@
+"use strict";
+/**
+ * The public-application check, without Zod. Schemas: `../sessionStatus.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.publicApplicationCheck = void 0;
+const check_1 = require("./check");
+exports.publicApplicationCheck = (0, check_1.exact)()((0, check_1.object)({
+    id: (0, check_1.string)(),
+    name: (0, check_1.string)(),
+    description: (0, check_1.optional)((0, check_1.string)()),
+    icon: (0, check_1.optional)((0, check_1.string)()),
+    websiteUrl: (0, check_1.optional)((0, check_1.string)()),
+    privacyPolicyUrl: (0, check_1.optional)((0, check_1.string)()),
+    termsUrl: (0, check_1.optional)((0, check_1.string)()),
+    type: (0, check_1.oneOf)(['first_party', 'third_party', 'internal', 'system']),
+    isOfficial: check_1.boolean,
+    isInternal: check_1.boolean,
+    scopes: (0, check_1.array)((0, check_1.string)()),
+    developerName: (0, check_1.optional)((0, check_1.string)()),
+}));

package/dist/cjs/client/signIn.js

@@ -0,0 +1,157 @@
+"use strict";
+/**
+ * Sign-in constants, guards and response checks, without Zod. Schemas: `../signIn.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reauthProofCheck = exports.totpBackupCodesResponseCheck = exports.totpEnrollResponseCheck = exports.signInMethodsCheck = exports.emailSignInChooseAccountCheck = exports.emailSignInPendingCheck = exports.secondFactorRequiredCheck = exports.emailSignInLinkResponseCheck = exports.emailSignInStartResponseCheck = exports.SIGN_IN_ERROR_CODES = exports.REAUTH_ACTIONS = exports.EMAIL_ACCOUNTS_MAX = exports.EMAIL_SIGNIN_CHOICE_TTL_MS = exports.EMAIL_SIGNIN_LONG_CODE_LENGTH = exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET = exports.TOTP_BACKUP_CODE_COUNT = exports.TOTP_PERIOD_SECONDS = exports.TOTP_DIGITS = exports.PASSWORD_MAX_LENGTH = exports.PASSWORD_MIN_LENGTH = exports.SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = exports.SIGNIN_SECOND_FACTOR_TTL_MS = exports.EMAIL_SIGNIN_LINK_TTL_MS = void 0;
+exports.normalizeEmailSignInCode = normalizeEmailSignInCode;
+exports.isSecondFactorRequired = isSecondFactorRequired;
+exports.isEmailSignInChooseAccount = isEmailSignInChooseAccount;
+const accountEmail_1 = require("./accountEmail");
+const check_1 = require("./check");
+/** How long the link in a sign-in email can be opened. */
+exports.EMAIL_SIGNIN_LINK_TTL_MS = 15 * 60 * 1000;
+/** How long a second-factor challenge can be answered. */
+exports.SIGNIN_SECOND_FACTOR_TTL_MS = 5 * 60 * 1000;
+/** Wrong second-factor codes one challenge accepts. */
+exports.SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = 5;
+/** Shortest password Oxy accepts when one is set. */
+exports.PASSWORD_MIN_LENGTH = 10;
+/** Longest password Oxy accepts (characters). */
+exports.PASSWORD_MAX_LENGTH = 256;
+/** Digits in an authenticator code. */
+exports.TOTP_DIGITS = 6;
+/** Seconds each authenticator code lasts. */
+exports.TOTP_PERIOD_SECONDS = 30;
+/** Backup codes issued when an authenticator is enabled or they are regenerated. */
+exports.TOTP_BACKUP_CODE_COUNT = 10;
+/**
+ * The long sign-in code: ten characters of Crockford base32 without the
+ * look-alikes (no 0, O, 1, I, L, U), shown as `XXXXX-XXXXX`. An account whose
+ * sign-in codes were guessed at too often today (the per-account ceiling) is
+ * sent this instead of 6 digits for the rest of the day, so its owner can still
+ * type a code while guessing one is infeasible.
+ */
+exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET = '23456789ABCDEFGHJKMNPQRSTVWXYZ';
+exports.EMAIL_SIGNIN_LONG_CODE_LENGTH = 10;
+/**
+ * Normalise a typed sign-in code: 6 digits stay as they are; a long code is
+ * upper-cased with its dash and spaces removed. Anything else is returned
+ * trimmed (and will simply be wrong).
+ */
+function normalizeEmailSignInCode(code) {
+    const compact = code.trim().replace(/[\s-]/g, '').toUpperCase();
+    return compact;
+}
+/**
+ * How long, once the email is proven, the person has to choose which of its
+ * accounts signs in.
+ */
+exports.EMAIL_SIGNIN_CHOICE_TTL_MS = 5 * 60 * 1000;
+/** Most accounts one email can hold; sign-up refuses another past it. */
+exports.EMAIL_ACCOUNTS_MAX = 20;
+/** Narrow a {@link SignInStepResult}. */
+function isSecondFactorRequired(result) {
+    return result.secondFactorRequired === true;
+}
+/** Narrow an {@link EmailSignInStepResult}. */
+function isEmailSignInChooseAccount(result) {
+    return result.chooseAccount === true;
+}
+/**
+ * What a re-verification email code confirms. The code is bound to it: a code
+ * asked for one change never authorises another, and the email names it.
+ */
+exports.REAUTH_ACTIONS = [
+    'change_password',
+    'totp',
+    'link_commons',
+    'delete_account',
+    'credentials_manage',
+];
+/**
+ * Stable error codes (`error.code` in the API error body). Clients map these
+ * through their localization, never the English message.
+ */
+exports.SIGN_IN_ERROR_CODES = {
+    /** Wrong identifier or password — never says which. */
+    invalidCredentials: 'SIGNIN_INVALID_CREDENTIALS',
+    /** The request is unknown, expired, spent, or its secret is wrong. */
+    requestInvalid: 'SIGNIN_REQUEST_INVALID',
+    /** The link is unknown, expired or already used. */
+    linkInvalid: 'SIGNIN_LINK_INVALID',
+    /** The link was opened in another browser: type the code in the app instead. */
+    linkOtherDevice: 'SIGNIN_LINK_OTHER_DEVICE',
+    /** The second-factor challenge or its code is wrong, expired or spent. */
+    secondFactorInvalid: 'SECOND_FACTOR_INVALID',
+    /** Too many failures for this account: wait and try again. */
+    locked: 'SIGNIN_LOCKED',
+    /** The step needs a fresh proof (`reauth`). */
+    reauthRequired: 'REAUTH_REQUIRED',
+    /** The fresh proof was wrong. */
+    reauthInvalid: 'REAUTH_INVALID',
+    /** The account has an authenticator: the proof must carry its code. */
+    totpRequired: 'TOTP_REQUIRED',
+    /** Enrolling or confirming an authenticator that is already on. */
+    totpAlreadyEnabled: 'TOTP_ALREADY_ENABLED',
+    /** Disabling, confirming or regenerating codes with no authenticator (or no pending one). */
+    totpNotEnabled: 'TOTP_NOT_ENABLED',
+    /** The code the authenticator showed at enrolment is wrong. */
+    totpCodeInvalid: 'TOTP_CODE_INVALID',
+    /** Only official Oxy apps and auth.oxy.so may sign people in here. */
+    originNotAllowed: 'SIGNIN_ORIGIN_NOT_ALLOWED',
+    /** The username is taken. */
+    usernameTaken: 'USERNAME_TAKEN',
+    /** The email already holds `EMAIL_ACCOUNTS_MAX` accounts: no sign-up adds another. */
+    emailAccountsFull: 'EMAIL_ACCOUNTS_FULL',
+};
+/* -------------------------------------------------------------------------- */
+/*  Checks                                                                    */
+/* -------------------------------------------------------------------------- */
+const expiresAt = (0, check_1.number)(check_1.int, check_1.positive);
+const sixDigits = (0, check_1.string)(check_1.trim, (0, check_1.pattern)(new RegExp(`^\\d{${accountEmail_1.EMAIL_CODE_LENGTH}}$`), `code must be ${accountEmail_1.EMAIL_CODE_LENGTH} digits`));
+const passwordInput = (0, check_1.string)((0, check_1.minLength)(1), (0, check_1.maxLength)(exports.PASSWORD_MAX_LENGTH));
+const secondFactorCode = (0, check_1.string)(check_1.trim, (0, check_1.minLength)(exports.TOTP_DIGITS), (0, check_1.maxLength)(16));
+exports.emailSignInStartResponseCheck = (0, check_1.exact)()((0, check_1.object)({
+    requestId: (0, check_1.string)((0, check_1.minLength)(1), (0, check_1.maxLength)(64)),
+    requestSecret: accountEmail_1.emailTicketCheck,
+    expiresAt,
+    retryLater: (0, check_1.optional)((0, check_1.literal)(true)),
+}));
+exports.emailSignInLinkResponseCheck = (0, check_1.exact)()((0, check_1.object)({ approved: (0, check_1.literal)(true) }));
+exports.secondFactorRequiredCheck = (0, check_1.exact)()((0, check_1.object)({ secondFactorRequired: (0, check_1.literal)(true), challengeId: accountEmail_1.emailTicketCheck, expiresAt }));
+exports.emailSignInPendingCheck = (0, check_1.exact)()((0, check_1.object)({ status: (0, check_1.literal)('pending'), expiresAt }));
+const emailSignInAccountOption = (0, check_1.exact)()((0, check_1.object)({
+    id: (0, check_1.string)((0, check_1.minLength)(1), (0, check_1.maxLength)(64)),
+    username: (0, check_1.optional)((0, check_1.string)((0, check_1.minLength)(1))),
+    displayName: (0, check_1.optional)((0, check_1.string)((0, check_1.minLength)(1))),
+    avatar: (0, check_1.optional)((0, check_1.string)((0, check_1.minLength)(1))),
+}));
+exports.emailSignInChooseAccountCheck = (0, check_1.exact)()((0, check_1.object)({
+    chooseAccount: (0, check_1.literal)(true),
+    accounts: (0, check_1.array)(emailSignInAccountOption, (0, check_1.minItems)(2), (0, check_1.maxItems)(exports.EMAIL_ACCOUNTS_MAX)),
+    expiresAt,
+}));
+exports.signInMethodsCheck = (0, check_1.exact)()((0, check_1.object)({
+    hasEmail: check_1.boolean,
+    hasPassword: check_1.boolean,
+    totpEnabled: check_1.boolean,
+    backupCodesRemaining: (0, check_1.number)(check_1.int, check_1.nonnegative),
+}));
+exports.totpEnrollResponseCheck = (0, check_1.exact)()((0, check_1.object)({
+    secret: (0, check_1.string)((0, check_1.pattern)(/^[A-Z2-7]+$/)),
+    otpauthUri: (0, check_1.string)((0, check_1.startsWith)('otpauth://totp/')),
+}));
+exports.totpBackupCodesResponseCheck = (0, check_1.exact)()((0, check_1.object)({
+    backupCodes: (0, check_1.array)((0, check_1.string)((0, check_1.pattern)(/^[a-z2-9]{5}-[a-z2-9]{5}$/)), (0, check_1.exactItems)(exports.TOTP_BACKUP_CODE_COUNT)),
+}));
+exports.reauthProofCheck = (0, check_1.exact)()((0, check_1.refine)((0, check_1.strictObject)({
+    password: (0, check_1.optional)(passwordInput),
+    emailCode: (0, check_1.optional)((0, check_1.strictObject)({
+        verificationId: (0, check_1.string)(check_1.trim, (0, check_1.minLength)(1), (0, check_1.maxLength)(64)),
+        code: sixDigits,
+    })),
+    totpCode: (0, check_1.optional)(secondFactorCode),
+}), (proof) => proof.password !== undefined || proof.emailCode !== undefined, 'password or emailCode is required'));

package/dist/cjs/client/userResponse.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * User-response checks, without Zod. Schemas: `../userResponse.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userNameCheck = void 0;
+const check_1 = require("./check");
+exports.userNameCheck = (0, check_1.exact)()((0, check_1.looseObject)({
+    first: (0, check_1.optional)((0, check_1.string)()),
+    last: (0, check_1.optional)((0, check_1.string)()),
+    full: (0, check_1.optional)((0, check_1.string)()),
+    displayName: (0, check_1.optional)((0, check_1.string)()),
+}));

package/dist/cjs/client/username.js

@@ -0,0 +1,173 @@
+"use strict";
+/**
+ * The username policy, without Zod. Schemas: `../username.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.botUsernameCheck = exports.usernameCheck = exports.BOT_USERNAME_INVALID_MESSAGE = exports.BOT_USERNAME_SUFFIX = exports.USERNAME_PATTERN = exports.USERNAME_PATTERN_SOURCE = exports.NUMERIC_USERNAME_MESSAGE = exports.RESERVED_USERNAME_SEGMENTS = exports.RESERVED_USERNAME_MESSAGE = exports.RESERVED_USERNAMES = exports.USERNAME_INVALID_MESSAGE = exports.USERNAME_MAX_LENGTH = exports.USERNAME_MIN_LENGTH = void 0;
+exports.stripDisallowedUsernameCharacters = stripDisallowedUsernameCharacters;
+exports.applyBotUsernameSuffix = applyBotUsernameSuffix;
+exports.usernameCheckForAccountKind = usernameCheckForAccountKind;
+const check_1 = require("./check");
+/** Shortest storable handle. `oxy` sets the floor. */
+exports.USERNAME_MIN_LENGTH = 3;
+/** Longest storable handle, and the `maxLength` an input field should carry. */
+exports.USERNAME_MAX_LENGTH = 30;
+/** The 400 / inline-validation copy for every path that rejects a handle. */
+exports.USERNAME_INVALID_MESSAGE = 'Username must be 3-30 characters, use only letters, numbers, hyphens and underscores, ' +
+    'start and end with a letter or number, and never repeat a separator';
+/**
+ * Exact-match handles nobody may newly claim, regardless of account kind.
+ *
+ * This is NOT a namespace tightening like the bot suffix — it is a list of
+ * names withheld from `users_lower_username_key` before anybody asks for
+ * them. Compared against the same normalization the unique index applies
+ * (`lower(btrim(username))`), so `Admin`, ` ADMIN ` and `admin` are the one
+ * name this list means.
+ *
+ * `oxy`, `mention`, `homiio`, `clarity`, `faircoin`, `astro` and `mercaria`
+ * are deliberately NOT here: each already has an `organization`/`project`
+ * row, so the unique index already refuses a second one, and `oxy` is the
+ * name `USERNAME_MIN_LENGTH` is pinned against in
+ * `__tests__/username.test.ts` — listing it would make
+ * `usernameSchema.safeParse('oxy')` fail and falsify that comment. A brand
+ * with no account of its own yet (measured 2026-09-18: Alia, Allo, TNP,
+ * Kaana, Bloom) has no row to protect it, so it is listed until one exists.
+ */
+exports.RESERVED_USERNAMES = new Set([
+    // Oxy product lines with no account row of their own yet.
+    'alia',
+    'allo',
+    'tnp',
+    'kaana',
+    'bloom',
+    // System / role words a signup impersonating staff or Oxy itself would reach for.
+    'admin',
+    'administrator',
+    'root',
+    'superadmin',
+    'super',
+    'superuser',
+    'support',
+    'staff',
+    'moderator',
+    'mod',
+    'security',
+    'system',
+    'official',
+    'help',
+    'noreply',
+    'anonymous',
+    'everyone',
+    'owner',
+]);
+/** The 400 / inline-validation copy for a handle on {@link RESERVED_USERNAMES}. */
+exports.RESERVED_USERNAME_MESSAGE = 'This username is reserved and cannot be registered';
+/**
+ * {@link RESERVED_USERNAMES}, minus `alia`, checked against each `-`/`_`
+ * separated SEGMENT of a candidate rather than the whole string — so
+ * `official-oxy`, `super-admin` and `team-kaana` are refused the same as the
+ * bare words, without banning every word that merely CONTAINS one as a
+ * substring (`superman`, `modern`, `grassroot`, `homeowner` all stay legal:
+ * none of them separates the reserved word from the rest with `-` or `_`).
+ *
+ * `alia` is excluded because `alia-` is the live internal-cost-centre
+ * namespace: `alia-production-chat` is a minted account and
+ * `alia-research` / `alia-voice` / `alia-evaluations` are pinned as legal
+ * slugs in `__tests__/username.test.ts` and `internalCostCenterSpecs.test.ts`.
+ * Segment-matching `alia` would refuse all four. The bare word `alia` is
+ * still refused — {@link RESERVED_USERNAMES} above catches it exactly.
+ */
+exports.RESERVED_USERNAME_SEGMENTS = new Set([...exports.RESERVED_USERNAMES].filter((word) => word !== 'alia'));
+/** The 400 / inline-validation copy for a handle that is only digits. */
+exports.NUMERIC_USERNAME_MESSAGE = 'Username cannot be only numbers';
+/**
+ * Alphanumeric runs joined by single separators, as a SOURCE string.
+ *
+ * A string rather than a literal because the OpenAPI docblocks that publish this
+ * rule (`POST /auth/register`, `PUT /users/:userId`) must quote it verbatim, and
+ * `usernamePolicySingleSource.test.ts` compares them against THIS constant. A
+ * published `pattern:` that drifts from the enforced rule is a lie told to every
+ * client that generates from the spec, and it is exactly the kind of copy nobody
+ * notices going stale.
+ *
+ * Deliberately NOT re-exported from the package barrel: it exists for the
+ * schema below and for that one gate. Anything validating a username uses
+ * {@link usernameSchema}, so there is no second way to ask the question.
+ *
+ * Written as an unambiguous alternation rather than a lookahead: every character
+ * belongs to exactly one branch, so matching is linear and there is no
+ * backtracking to bound. It also carries no `\p{…}` property escape, which
+ * mobile Hermes throws on at runtime — this module is reachable from every React
+ * Native consumer.
+ */
+exports.USERNAME_PATTERN_SOURCE = '^[A-Za-z0-9]+(?:[-_][A-Za-z0-9]+)*$';
+exports.USERNAME_PATTERN = new RegExp(exports.USERNAME_PATTERN_SOURCE);
+/**
+ * Drop the characters the policy forbids, for an input field that filters
+ * keystrokes.
+ *
+ * This is a TYPING aid and nothing else — the result still has to pass
+ * {@link usernameSchema}, which is what decides. It does not lower-case (case is
+ * preserved, see the header) and it cannot repair a name: a value that is too
+ * short, edge-separated or doubly-separated comes back unchanged and fails
+ * validation with a message, which is the outcome the coercing rules this
+ * replaces used to hide.
+ */
+function stripDisallowedUsernameCharacters(input) {
+    return input.replace(/[^A-Za-z0-9_-]/g, '');
+}
+/**
+ * The label a bot's handle ends in — the ONE exception the policy carries.
+ *
+ * Lower-case here because it is what a generator appends; the comparison that
+ * enforces it folds case, so `MyBot` satisfies it just as `mybot` does.
+ *
+ * Deliberately NOT re-exported from the package barrel, for the same reason
+ * {@link USERNAME_PATTERN_SOURCE} is not: it exists for the schema and the
+ * generator aid below. A consumer that wants to SAY the rule uses
+ * {@link BOT_USERNAME_INVALID_MESSAGE}, which already quotes it, and one that
+ * wants to APPLY it uses {@link applyBotUsernameSuffix} — so there is no second
+ * way to spell the check.
+ */
+exports.BOT_USERNAME_SUFFIX = 'bot';
+/** The 400 / inline-validation copy for a bot handle that carries no label. */
+exports.BOT_USERNAME_INVALID_MESSAGE = `A bot account's username must end in "${exports.BOT_USERNAME_SUFFIX}"`;
+/**
+ * Label a proposed bot handle, so a generator PROPOSES something the server will
+ * accept.
+ *
+ * Alia builds an agent's handle from its display name; without this it would
+ * propose `garden-helper` for a bot and be 400ed on submit, which is the same
+ * "suggest, then refuse" defect the minimum length already caused once.
+ *
+ * It appends and never inserts: a separator is the caller's choice, so
+ * `garden-helper` becomes `garden-helperbot` while a caller who typed
+ * `garden-helper-` gets `garden-helper-bot`. It truncates to leave room rather
+ * than overflowing {@link USERNAME_MAX_LENGTH}.
+ *
+ * Like {@link stripDisallowedUsernameCharacters} it is an aid, not a decision: it
+ * cannot repair a handle the base policy refuses, and the result still has to
+ * pass {@link botUsernameSchema}.
+ */
+function applyBotUsernameSuffix(candidate) {
+    const trimmed = candidate.trim();
+    if (trimmed.toLowerCase().endsWith(exports.BOT_USERNAME_SUFFIX)) {
+        return trimmed;
+    }
+    return trimmed.slice(0, exports.USERNAME_MAX_LENGTH - exports.BOT_USERNAME_SUFFIX.length) + exports.BOT_USERNAME_SUFFIX;
+}
+/* -------------------------------------------------------------------------- */
+/*  Checks                                                                    */
+/* -------------------------------------------------------------------------- */
+/** The username policy as a check — the twin of `usernameSchema`, same messages. */
+exports.usernameCheck = (0, check_1.refine)((0, check_1.refine)((0, check_1.refine)((0, check_1.string)(check_1.trim, (0, check_1.minLength)(exports.USERNAME_MIN_LENGTH, exports.USERNAME_INVALID_MESSAGE), (0, check_1.maxLength)(exports.USERNAME_MAX_LENGTH, exports.USERNAME_INVALID_MESSAGE), (0, check_1.pattern)(exports.USERNAME_PATTERN, exports.USERNAME_INVALID_MESSAGE)), (username) => !/^[0-9]+$/.test(username), exports.NUMERIC_USERNAME_MESSAGE), (username) => !exports.RESERVED_USERNAMES.has(username.toLowerCase()), exports.RESERVED_USERNAME_MESSAGE), (username) => !username
+    .split(/[-_]/)
+    .some((segment) => exports.RESERVED_USERNAME_SEGMENTS.has(segment.toLowerCase())), exports.RESERVED_USERNAME_MESSAGE);
+/** A bot's username: the policy plus the `bot` suffix — the twin of `botUsernameSchema`. */
+exports.botUsernameCheck = (0, check_1.refine)(exports.usernameCheck, (username) => username.toLowerCase().endsWith(exports.BOT_USERNAME_SUFFIX), exports.BOT_USERNAME_INVALID_MESSAGE);
+/** The twin of `usernameSchemaForAccountKind`. */
+function usernameCheckForAccountKind(kind) {
+    return kind === 'bot' ? exports.botUsernameCheck : exports.usernameCheck;
+}

package/dist/cjs/deviceSession.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deviceJoinResponseSchema = exports.deviceJoinRequestSchema = exports.deviceJoinCodeResponseSchema = exports.deviceJoinCodeRequestSchema = exports.deviceRegisterResponseSchema = exports.deviceProofSchema = exports.deviceBackgroundTokenResponseSchema = exports.deviceBackgroundTokenRequestSchema = exports.deviceBackgroundCredentialResponseSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = void 0;
+exports.deviceJoinResponseSchema = exports.deviceJoinRequestSchema = exports.deviceJoinCodeResponseSchema = exports.deviceJoinCodeRequestSchema = exports.deviceRegisterResponseSchema = exports.deviceProofSchema = exports.deviceBackgroundTokenResponseSchema = exports.deviceBackgroundTokenRequestSchema = exports.deviceBackgroundCredentialResponseSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = void 0;
 const zod_1 = require("zod");
+var deviceSession_1 = require("./client/deviceSession");
+Object.defineProperty(exports, "SESSION_ACCOUNTS_CHANGED_EVENT", { enumerable: true, get: function () { return deviceSession_1.SESSION_ACCOUNTS_CHANGED_EVENT; } });
 exports.sessionAccountSchema = zod_1.z.object({
     accountId: zod_1.z.string(),
     sessionId: zod_1.z.string(),
@@ -61,21 +63,6 @@ exports.deviceTokenMintResponseSchema = zod_1.z.object({
     nextDeviceSecret: zod_1.z.string(),
     state: exports.deviceSessionStateSchema,
 });
-/* -------------------------------------------------------------------------- */
-/*  Instant cross-app session sync (token-free socket signal)                 */
-/* -------------------------------------------------------------------------- */
-/**
- * Name of the token-free Socket.IO event emitted to room `user:<userId>` on
- * every DeviceSession mutation that changes what is signed in for that user.
- *
- * This is a pure SIGNAL — it carries NO access token, NO deviceSecret and NO
- * account bodies. A client that receives it re-fetches its authenticated
- * session/account state (`GET /session/device/state`, `GET /accounts`). Unlike
- * `session_state` (scoped to `device:<deviceId>`, i.e. a single origin), this
- * reaches ALL of a user's connected sockets across their devices/origins so
- * every Oxy app reflects an add / switch / signout instantly.
- */
-exports.SESSION_ACCOUNTS_CHANGED_EVENT = 'session_accounts_changed';
 /**
  * Why the signed-in set changed:
  *  - `login`   — a brand-new session was minted for the user (QR / cross-app authorize)