@oxy.so/contracts 4.16.0 → 4.21.0

package/dist/esm/client/sessionStatus.js

@@ -0,0 +1,20 @@
+/**
+ * The public-application check, without Zod. Schemas: `../sessionStatus.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { array, boolean, exact, object, oneOf, optional, string } from './check.js';
+export const publicApplicationCheck = exact()(object({
+    id: string(),
+    name: string(),
+    description: optional(string()),
+    icon: optional(string()),
+    websiteUrl: optional(string()),
+    privacyPolicyUrl: optional(string()),
+    termsUrl: optional(string()),
+    type: oneOf(['first_party', 'third_party', 'internal', 'system']),
+    isOfficial: boolean,
+    isInternal: boolean,
+    scopes: array(string()),
+    developerName: optional(string()),
+}));

package/dist/esm/client/signIn.js

@@ -0,0 +1,153 @@
+/**
+ * Sign-in constants, guards and response checks, without Zod. Schemas: `../signIn.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { EMAIL_CODE_LENGTH, emailTicketCheck } from './accountEmail.js';
+import { array, boolean, exact, exactItems, int, literal, maxItems, maxLength, minItems, minLength, nonnegative, number, object, optional, pattern, positive, refine, startsWith, strictObject, string, trim, } from './check.js';
+/** How long the link in a sign-in email can be opened. */
+export const EMAIL_SIGNIN_LINK_TTL_MS = 15 * 60 * 1000;
+/** How long a second-factor challenge can be answered. */
+export const SIGNIN_SECOND_FACTOR_TTL_MS = 5 * 60 * 1000;
+/** Wrong second-factor codes one challenge accepts. */
+export const SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = 5;
+/** Shortest password Oxy accepts when one is set. */
+export const PASSWORD_MIN_LENGTH = 10;
+/** Longest password Oxy accepts (characters). */
+export const PASSWORD_MAX_LENGTH = 256;
+/** Digits in an authenticator code. */
+export const TOTP_DIGITS = 6;
+/** Seconds each authenticator code lasts. */
+export const TOTP_PERIOD_SECONDS = 30;
+/** Backup codes issued when an authenticator is enabled or they are regenerated. */
+export const TOTP_BACKUP_CODE_COUNT = 10;
+/**
+ * The long sign-in code: ten characters of Crockford base32 without the
+ * look-alikes (no 0, O, 1, I, L, U), shown as `XXXXX-XXXXX`. An account whose
+ * sign-in codes were guessed at too often today (the per-account ceiling) is
+ * sent this instead of 6 digits for the rest of the day, so its owner can still
+ * type a code while guessing one is infeasible.
+ */
+export const EMAIL_SIGNIN_LONG_CODE_ALPHABET = '23456789ABCDEFGHJKMNPQRSTVWXYZ';
+export const EMAIL_SIGNIN_LONG_CODE_LENGTH = 10;
+/**
+ * Normalise a typed sign-in code: 6 digits stay as they are; a long code is
+ * upper-cased with its dash and spaces removed. Anything else is returned
+ * trimmed (and will simply be wrong).
+ */
+export function normalizeEmailSignInCode(code) {
+    const compact = code.trim().replace(/[\s-]/g, '').toUpperCase();
+    return compact;
+}
+/**
+ * How long, once the email is proven, the person has to choose which of its
+ * accounts signs in.
+ */
+export const EMAIL_SIGNIN_CHOICE_TTL_MS = 5 * 60 * 1000;
+/** Most accounts one email can hold; sign-up refuses another past it. */
+export const EMAIL_ACCOUNTS_MAX = 20;
+/** Narrow a {@link SignInStepResult}. */
+export function isSecondFactorRequired(result) {
+    return result.secondFactorRequired === true;
+}
+/** Narrow an {@link EmailSignInStepResult}. */
+export function isEmailSignInChooseAccount(result) {
+    return result.chooseAccount === true;
+}
+/**
+ * What a re-verification email code confirms. The code is bound to it: a code
+ * asked for one change never authorises another, and the email names it.
+ */
+export const REAUTH_ACTIONS = [
+    'change_password',
+    'totp',
+    'link_commons',
+    'delete_account',
+    'credentials_manage',
+    'supervision',
+    'supervision_purchase',
+];
+/**
+ * Stable error codes (`error.code` in the API error body). Clients map these
+ * through their localization, never the English message.
+ */
+export const SIGN_IN_ERROR_CODES = {
+    /** Wrong identifier or password — never says which. */
+    invalidCredentials: 'SIGNIN_INVALID_CREDENTIALS',
+    /** The request is unknown, expired, spent, or its secret is wrong. */
+    requestInvalid: 'SIGNIN_REQUEST_INVALID',
+    /** The link is unknown, expired or already used. */
+    linkInvalid: 'SIGNIN_LINK_INVALID',
+    /** The link was opened in another browser: type the code in the app instead. */
+    linkOtherDevice: 'SIGNIN_LINK_OTHER_DEVICE',
+    /** The second-factor challenge or its code is wrong, expired or spent. */
+    secondFactorInvalid: 'SECOND_FACTOR_INVALID',
+    /** Too many failures for this account: wait and try again. */
+    locked: 'SIGNIN_LOCKED',
+    /** The step needs a fresh proof (`reauth`). */
+    reauthRequired: 'REAUTH_REQUIRED',
+    /** The fresh proof was wrong. */
+    reauthInvalid: 'REAUTH_INVALID',
+    /** The account has an authenticator: the proof must carry its code. */
+    totpRequired: 'TOTP_REQUIRED',
+    /** Enrolling or confirming an authenticator that is already on. */
+    totpAlreadyEnabled: 'TOTP_ALREADY_ENABLED',
+    /** Disabling, confirming or regenerating codes with no authenticator (or no pending one). */
+    totpNotEnabled: 'TOTP_NOT_ENABLED',
+    /** The code the authenticator showed at enrolment is wrong. */
+    totpCodeInvalid: 'TOTP_CODE_INVALID',
+    /** Only official Oxy apps and auth.oxy.so may sign people in here. */
+    originNotAllowed: 'SIGNIN_ORIGIN_NOT_ALLOWED',
+    /** The username is taken. */
+    usernameTaken: 'USERNAME_TAKEN',
+    /** The email already holds `EMAIL_ACCOUNTS_MAX` accounts: no sign-up adds another. */
+    emailAccountsFull: 'EMAIL_ACCOUNTS_FULL',
+};
+/* -------------------------------------------------------------------------- */
+/*  Checks                                                                    */
+/* -------------------------------------------------------------------------- */
+const expiresAt = number(int, positive);
+const sixDigits = string(trim, pattern(new RegExp(`^\\d{${EMAIL_CODE_LENGTH}}$`), `code must be ${EMAIL_CODE_LENGTH} digits`));
+const passwordInput = string(minLength(1), maxLength(PASSWORD_MAX_LENGTH));
+const secondFactorCode = string(trim, minLength(TOTP_DIGITS), maxLength(16));
+export const emailSignInStartResponseCheck = exact()(object({
+    requestId: string(minLength(1), maxLength(64)),
+    requestSecret: emailTicketCheck,
+    expiresAt,
+    retryLater: optional(literal(true)),
+}));
+export const emailSignInLinkResponseCheck = exact()(object({ approved: literal(true) }));
+export const secondFactorRequiredCheck = exact()(object({ secondFactorRequired: literal(true), challengeId: emailTicketCheck, expiresAt }));
+export const emailSignInPendingCheck = exact()(object({ status: literal('pending'), expiresAt }));
+const emailSignInAccountOption = exact()(object({
+    id: string(minLength(1), maxLength(64)),
+    username: optional(string(minLength(1))),
+    displayName: optional(string(minLength(1))),
+    avatar: optional(string(minLength(1))),
+}));
+export const emailSignInChooseAccountCheck = exact()(object({
+    chooseAccount: literal(true),
+    accounts: array(emailSignInAccountOption, minItems(2), maxItems(EMAIL_ACCOUNTS_MAX)),
+    expiresAt,
+}));
+export const signInMethodsCheck = exact()(object({
+    hasEmail: boolean,
+    hasPassword: boolean,
+    totpEnabled: boolean,
+    backupCodesRemaining: number(int, nonnegative),
+}));
+export const totpEnrollResponseCheck = exact()(object({
+    secret: string(pattern(/^[A-Z2-7]+$/)),
+    otpauthUri: string(startsWith('otpauth://totp/')),
+}));
+export const totpBackupCodesResponseCheck = exact()(object({
+    backupCodes: array(string(pattern(/^[a-z2-9]{5}-[a-z2-9]{5}$/)), exactItems(TOTP_BACKUP_CODE_COUNT)),
+}));
+export const reauthProofCheck = exact()(refine(strictObject({
+    password: optional(passwordInput),
+    emailCode: optional(strictObject({
+        verificationId: string(trim, minLength(1), maxLength(64)),
+        code: sixDigits,
+    })),
+    totpCode: optional(secondFactorCode),
+}), (proof) => proof.password !== undefined || proof.emailCode !== undefined, 'password or emailCode is required'));

package/dist/esm/client/userResponse.js

@@ -0,0 +1,12 @@
+/**
+ * User-response checks, without Zod. Schemas: `../userResponse.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { exact, looseObject, optional, string } from './check.js';
+export const userNameCheck = exact()(looseObject({
+    first: optional(string()),
+    last: optional(string()),
+    full: optional(string()),
+    displayName: optional(string()),
+}));

package/dist/esm/client/username.js

@@ -0,0 +1,167 @@
+/**
+ * The username policy, without Zod. Schemas: `../username.ts`.
+ *
+ * Part of `@oxy.so/contracts/client`: never import `zod` here (see `./check.ts`).
+ */
+import { maxLength, minLength, pattern, refine, string, trim } from './check.js';
+/** Shortest storable handle. `oxy` sets the floor. */
+export const USERNAME_MIN_LENGTH = 3;
+/** Longest storable handle, and the `maxLength` an input field should carry. */
+export const USERNAME_MAX_LENGTH = 30;
+/** The 400 / inline-validation copy for every path that rejects a handle. */
+export const USERNAME_INVALID_MESSAGE = 'Username must be 3-30 characters, use only letters, numbers, hyphens and underscores, ' +
+    'start and end with a letter or number, and never repeat a separator';
+/**
+ * Exact-match handles nobody may newly claim, regardless of account kind.
+ *
+ * This is NOT a namespace tightening like the bot suffix — it is a list of
+ * names withheld from `users_lower_username_key` before anybody asks for
+ * them. Compared against the same normalization the unique index applies
+ * (`lower(btrim(username))`), so `Admin`, ` ADMIN ` and `admin` are the one
+ * name this list means.
+ *
+ * `oxy`, `mention`, `homiio`, `clarity`, `faircoin`, `astro` and `mercaria`
+ * are deliberately NOT here: each already has an `organization`/`project`
+ * row, so the unique index already refuses a second one, and `oxy` is the
+ * name `USERNAME_MIN_LENGTH` is pinned against in
+ * `__tests__/username.test.ts` — listing it would make
+ * `usernameSchema.safeParse('oxy')` fail and falsify that comment. A brand
+ * with no account of its own yet (measured 2026-09-18: Alia, Allo, TNP,
+ * Kaana, Bloom) has no row to protect it, so it is listed until one exists.
+ */
+export const RESERVED_USERNAMES = new Set([
+    // Oxy product lines with no account row of their own yet.
+    'alia',
+    'allo',
+    'tnp',
+    'kaana',
+    'bloom',
+    // System / role words a signup impersonating staff or Oxy itself would reach for.
+    'admin',
+    'administrator',
+    'root',
+    'superadmin',
+    'super',
+    'superuser',
+    'support',
+    'staff',
+    'moderator',
+    'mod',
+    'security',
+    'system',
+    'official',
+    'help',
+    'noreply',
+    'anonymous',
+    'everyone',
+    'owner',
+]);
+/** The 400 / inline-validation copy for a handle on {@link RESERVED_USERNAMES}. */
+export const RESERVED_USERNAME_MESSAGE = 'This username is reserved and cannot be registered';
+/**
+ * {@link RESERVED_USERNAMES}, minus `alia`, checked against each `-`/`_`
+ * separated SEGMENT of a candidate rather than the whole string — so
+ * `official-oxy`, `super-admin` and `team-kaana` are refused the same as the
+ * bare words, without banning every word that merely CONTAINS one as a
+ * substring (`superman`, `modern`, `grassroot`, `homeowner` all stay legal:
+ * none of them separates the reserved word from the rest with `-` or `_`).
+ *
+ * `alia` is excluded because `alia-` is the live internal-cost-centre
+ * namespace: `alia-production-chat` is a minted account and
+ * `alia-research` / `alia-voice` / `alia-evaluations` are pinned as legal
+ * slugs in `__tests__/username.test.ts` and `internalCostCenterSpecs.test.ts`.
+ * Segment-matching `alia` would refuse all four. The bare word `alia` is
+ * still refused — {@link RESERVED_USERNAMES} above catches it exactly.
+ */
+export const RESERVED_USERNAME_SEGMENTS = new Set([...RESERVED_USERNAMES].filter((word) => word !== 'alia'));
+/** The 400 / inline-validation copy for a handle that is only digits. */
+export const NUMERIC_USERNAME_MESSAGE = 'Username cannot be only numbers';
+/**
+ * Alphanumeric runs joined by single separators, as a SOURCE string.
+ *
+ * A string rather than a literal because the OpenAPI docblocks that publish this
+ * rule (`POST /auth/register`, `PUT /users/:userId`) must quote it verbatim, and
+ * `usernamePolicySingleSource.test.ts` compares them against THIS constant. A
+ * published `pattern:` that drifts from the enforced rule is a lie told to every
+ * client that generates from the spec, and it is exactly the kind of copy nobody
+ * notices going stale.
+ *
+ * Deliberately NOT re-exported from the package barrel: it exists for the
+ * schema below and for that one gate. Anything validating a username uses
+ * {@link usernameSchema}, so there is no second way to ask the question.
+ *
+ * Written as an unambiguous alternation rather than a lookahead: every character
+ * belongs to exactly one branch, so matching is linear and there is no
+ * backtracking to bound. It also carries no `\p{…}` property escape, which
+ * mobile Hermes throws on at runtime — this module is reachable from every React
+ * Native consumer.
+ */
+export const USERNAME_PATTERN_SOURCE = '^[A-Za-z0-9]+(?:[-_][A-Za-z0-9]+)*$';
+export const USERNAME_PATTERN = new RegExp(USERNAME_PATTERN_SOURCE);
+/**
+ * Drop the characters the policy forbids, for an input field that filters
+ * keystrokes.
+ *
+ * This is a TYPING aid and nothing else — the result still has to pass
+ * {@link usernameSchema}, which is what decides. It does not lower-case (case is
+ * preserved, see the header) and it cannot repair a name: a value that is too
+ * short, edge-separated or doubly-separated comes back unchanged and fails
+ * validation with a message, which is the outcome the coercing rules this
+ * replaces used to hide.
+ */
+export function stripDisallowedUsernameCharacters(input) {
+    return input.replace(/[^A-Za-z0-9_-]/g, '');
+}
+/**
+ * The label a bot's handle ends in — the ONE exception the policy carries.
+ *
+ * Lower-case here because it is what a generator appends; the comparison that
+ * enforces it folds case, so `MyBot` satisfies it just as `mybot` does.
+ *
+ * Deliberately NOT re-exported from the package barrel, for the same reason
+ * {@link USERNAME_PATTERN_SOURCE} is not: it exists for the schema and the
+ * generator aid below. A consumer that wants to SAY the rule uses
+ * {@link BOT_USERNAME_INVALID_MESSAGE}, which already quotes it, and one that
+ * wants to APPLY it uses {@link applyBotUsernameSuffix} — so there is no second
+ * way to spell the check.
+ */
+export const BOT_USERNAME_SUFFIX = 'bot';
+/** The 400 / inline-validation copy for a bot handle that carries no label. */
+export const BOT_USERNAME_INVALID_MESSAGE = `A bot account's username must end in "${BOT_USERNAME_SUFFIX}"`;
+/**
+ * Label a proposed bot handle, so a generator PROPOSES something the server will
+ * accept.
+ *
+ * Alia builds an agent's handle from its display name; without this it would
+ * propose `garden-helper` for a bot and be 400ed on submit, which is the same
+ * "suggest, then refuse" defect the minimum length already caused once.
+ *
+ * It appends and never inserts: a separator is the caller's choice, so
+ * `garden-helper` becomes `garden-helperbot` while a caller who typed
+ * `garden-helper-` gets `garden-helper-bot`. It truncates to leave room rather
+ * than overflowing {@link USERNAME_MAX_LENGTH}.
+ *
+ * Like {@link stripDisallowedUsernameCharacters} it is an aid, not a decision: it
+ * cannot repair a handle the base policy refuses, and the result still has to
+ * pass {@link botUsernameSchema}.
+ */
+export function applyBotUsernameSuffix(candidate) {
+    const trimmed = candidate.trim();
+    if (trimmed.toLowerCase().endsWith(BOT_USERNAME_SUFFIX)) {
+        return trimmed;
+    }
+    return trimmed.slice(0, USERNAME_MAX_LENGTH - BOT_USERNAME_SUFFIX.length) + BOT_USERNAME_SUFFIX;
+}
+/* -------------------------------------------------------------------------- */
+/*  Checks                                                                    */
+/* -------------------------------------------------------------------------- */
+/** The username policy as a check — the twin of `usernameSchema`, same messages. */
+export const usernameCheck = refine(refine(refine(string(trim, minLength(USERNAME_MIN_LENGTH, USERNAME_INVALID_MESSAGE), maxLength(USERNAME_MAX_LENGTH, USERNAME_INVALID_MESSAGE), pattern(USERNAME_PATTERN, USERNAME_INVALID_MESSAGE)), (username) => !/^[0-9]+$/.test(username), NUMERIC_USERNAME_MESSAGE), (username) => !RESERVED_USERNAMES.has(username.toLowerCase()), RESERVED_USERNAME_MESSAGE), (username) => !username
+    .split(/[-_]/)
+    .some((segment) => RESERVED_USERNAME_SEGMENTS.has(segment.toLowerCase())), RESERVED_USERNAME_MESSAGE);
+/** A bot's username: the policy plus the `bot` suffix — the twin of `botUsernameSchema`. */
+export const botUsernameCheck = refine(usernameCheck, (username) => username.toLowerCase().endsWith(BOT_USERNAME_SUFFIX), BOT_USERNAME_INVALID_MESSAGE);
+/** The twin of `usernameSchemaForAccountKind`. */
+export function usernameCheckForAccountKind(kind) {
+    return kind === 'bot' ? botUsernameCheck : usernameCheck;
+}

package/dist/esm/deviceSession.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+export { SESSION_ACCOUNTS_CHANGED_EVENT } from './client/deviceSession.js';
 export const sessionAccountSchema = z.object({
     accountId: z.string(),
     sessionId: z.string(),
@@ -58,21 +59,6 @@ export const deviceTokenMintResponseSchema = z.object({
     nextDeviceSecret: z.string(),
     state: deviceSessionStateSchema,
 });
-/* -------------------------------------------------------------------------- */
-/*  Instant cross-app session sync (token-free socket signal)                 */
-/* -------------------------------------------------------------------------- */
-/**
- * Name of the token-free Socket.IO event emitted to room `user:<userId>` on
- * every DeviceSession mutation that changes what is signed in for that user.
- *
- * This is a pure SIGNAL — it carries NO access token, NO deviceSecret and NO
- * account bodies. A client that receives it re-fetches its authenticated
- * session/account state (`GET /session/device/state`, `GET /accounts`). Unlike
- * `session_state` (scoped to `device:<deviceId>`, i.e. a single origin), this
- * reaches ALL of a user's connected sockets across their devices/origins so
- * every Oxy app reflects an add / switch / signout instantly.
- */
-export const SESSION_ACCOUNTS_CHANGED_EVENT = 'session_accounts_changed';
 /**
  * Why the signed-in set changed:
  *  - `login`   — a brand-new session was minted for the user (QR / cross-app authorize)

package/dist/esm/identityLink.js

@@ -26,37 +26,14 @@
 import { z } from 'zod';
 import { identityProofSchema } from './identityProof.js';
 import { emailReauthProofSchema } from './signIn.js';
-export const IDENTITY_LINK_STATUSES = ['pending', 'signed', 'completed', 'cancelled'];
-/** The scheme and host Commons routes a link QR to. */
-export const IDENTITY_LINK_QR_PREFIX = 'oxycommons://link';
-const LINK_ID = /^[0-9a-f]{32}$/;
-const CHALLENGE = /^[0-9a-f]{64}$/;
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// it is re-exported here so the root entry is unchanged.
+import { IDENTITY_LINK_STATUSES, IDENTITY_LINK_QR_PREFIX, LINK_ID, CHALLENGE, } from './client/identityLink.js';
+export { IDENTITY_LINK_STATUSES, IDENTITY_LINK_QR_PREFIX, buildIdentityLinkQrPayload, parseIdentityLinkQrPayload, } from './client/identityLink.js';
 export const identityLinkIdSchema = z
     .string()
     .trim()
     .regex(LINK_ID, 'linkId must be 32 lowercase hex characters');
-/** The QR auth.oxy.so shows: the request's id and the challenge Commons signs. */
-export function buildIdentityLinkQrPayload(linkId, challenge) {
-    return `${IDENTITY_LINK_QR_PREFIX}?id=${linkId}&c=${challenge}`;
-}
-/** The request a scanned code names, or `null` for anything that is not a link QR. */
-export function parseIdentityLinkQrPayload(raw) {
-    const value = raw.trim();
-    if (!value.startsWith(`${IDENTITY_LINK_QR_PREFIX}?`))
-        return null;
-    // Parsed by hand: React Native's `URLSearchParams` does not implement `get`.
-    const params = new Map();
-    for (const pair of value.slice(IDENTITY_LINK_QR_PREFIX.length + 1).split('&')) {
-        const separator = pair.indexOf('=');
-        if (separator > 0)
-            params.set(pair.slice(0, separator), pair.slice(separator + 1));
-    }
-    const linkId = params.get('id') ?? '';
-    const challenge = params.get('c') ?? '';
-    if (!LINK_ID.test(linkId) || !CHALLENGE.test(challenge))
-        return null;
-    return { linkId, challenge };
-}
 export const identityLinkCreateResponseSchema = z.object({
     linkId: identityLinkIdSchema,
     challenge: z.string().regex(CHALLENGE),

package/dist/esm/identityProof.js

@@ -16,94 +16,10 @@
  * primitive and passes the hex digest in).
  */
 import { z } from 'zod';
-export const IDENTITY_PROOF_VERSION = 2;
-export const IDENTITY_PROOF_DOMAIN = 'oxy-identity-proof';
-/** The audience every API-verified identity proof names. */
-export const IDENTITY_PROOF_AUDIENCE = 'oxy-api/identity';
-/** How long a proof challenge lives: one interactive ceremony. */
-export const IDENTITY_PROOF_CHALLENGE_TTL_MS = 5 * 60 * 1000;
-/**
- * Everything a root proof may authorize. A challenge is minted for exactly one
- * action and spent only by a proof for that action.
- */
-export const IDENTITY_PROOF_ACTIONS = {
-    /**
-     * Link Commons' root to an account that has none (`POST /auth/link`).
-     * The account becomes self-custodied and its email is deleted
-     * (ADR 0029 D3).
-     */
-    link: 'link_identity',
-};
-export const IDENTITY_PROOF_ACTION_VALUES = Object.values(IDENTITY_PROOF_ACTIONS);
-const HEX_DIGEST = /^[0-9a-f]{64}$/;
-const ROOT_KEY = /^04[0-9a-f]{128}$/;
-const CHALLENGE = /^[0-9a-f]{64}$/;
-/**
- * Canonical JSON: object keys sorted by UTF-16 code unit, no whitespace,
- * `undefined` members omitted, arrays in order. Numbers must be finite. This is
- * the ONLY serializer for anything digested into a proof.
- */
-export function canonicalJson(value) {
-    if (value === null)
-        return 'null';
-    switch (typeof value) {
-        case 'string':
-        case 'boolean':
-            return JSON.stringify(value);
-        case 'number':
-            if (!Number.isFinite(value))
-                throw new Error('canonicalJson: non-finite number');
-            return JSON.stringify(value);
-        case 'object': {
-            if (Array.isArray(value)) {
-                return `[${value.map((entry) => (entry === undefined ? 'null' : canonicalJson(entry))).join(',')}]`;
-            }
-            const record = value;
-            const keys = Object.keys(record)
-                .filter((key) => record[key] !== undefined)
-                .sort();
-            return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(',')}}`;
-        }
-        default:
-            throw new Error(`canonicalJson: unsupported ${typeof value}`);
-    }
-}
-/**
- * The exact bytes a root signs. Throws on a malformed claim rather than signing
- * (or verifying) something ambiguous.
- */
-export function buildIdentityProofMessage(claims) {
-    if (!IDENTITY_PROOF_ACTION_VALUES.includes(claims.action))
-        throw new Error('identity proof: unknown action');
-    if (!claims.subject || !claims.actor)
-        throw new Error('identity proof: subject and actor are required');
-    if (!ROOT_KEY.test(claims.rootPublicKey))
-        throw new Error('identity proof: rootPublicKey must be canonical');
-    if (claims.payloadDigest !== null && !HEX_DIGEST.test(claims.payloadDigest)) {
-        throw new Error('identity proof: payloadDigest must be a lowercase SHA-256 hex digest');
-    }
-    if (claims.expectedRevision !== null &&
-        (!Number.isSafeInteger(claims.expectedRevision) || claims.expectedRevision < 0)) {
-        throw new Error('identity proof: expectedRevision must be a non-negative integer');
-    }
-    if (!CHALLENGE.test(claims.challenge))
-        throw new Error('identity proof: challenge must be 64 lowercase hex characters');
-    if (!Number.isSafeInteger(claims.expiresAt) || claims.expiresAt <= 0)
-        throw new Error('identity proof: expiresAt must be unix milliseconds');
-    return canonicalJson({
-        v: IDENTITY_PROOF_VERSION,
-        domain: IDENTITY_PROOF_DOMAIN,
-        action: claims.action,
-        subject: claims.subject,
-        actor: claims.actor,
-        rootPublicKey: claims.rootPublicKey,
-        payloadDigest: claims.payloadDigest,
-        expectedRevision: claims.expectedRevision,
-        audience: claims.audience,
-        challenge: claims.challenge,
-        expiresAt: claims.expiresAt,
-    });
-}
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// it is re-exported here so the root entry is unchanged.
+import { IDENTITY_PROOF_VERSION, IDENTITY_PROOF_ACTION_VALUES, CHALLENGE, } from './client/identityProof.js';
+export { IDENTITY_PROOF_VERSION, IDENTITY_PROOF_DOMAIN, IDENTITY_PROOF_AUDIENCE, IDENTITY_PROOF_CHALLENGE_TTL_MS, IDENTITY_PROOF_ACTIONS, IDENTITY_PROOF_ACTION_VALUES, canonicalJson, buildIdentityProofMessage, IDENTITY_ERROR_CODES, } from './client/identityProof.js';
 /** The proof as it travels: the signature plus the two claims the verifier cannot derive. */
 export const identityProofSchema = z.object({
     v: z.literal(IDENTITY_PROOF_VERSION),
@@ -120,17 +36,6 @@ export const identityProofChallengeResponseSchema = z.object({
     expiresAt: z.number().int().positive(),
     audience: z.string().min(1),
 });
-/**
- * Stable error codes the root routes answer with (`error.code` in the API error
- * body). Clients map these through their localization, never the English message.
- */
-export const IDENTITY_ERROR_CODES = {
-    proofInvalid: 'IDENTITY_PROOF_INVALID',
-    rootAlreadyLinked: 'IDENTITY_ROOT_ALREADY_LINKED',
-    rootLinkedElsewhere: 'IDENTITY_ROOT_LINKED_ELSEWHERE',
-    freshFactorRequired: 'IDENTITY_FRESH_FACTOR_REQUIRED',
-    notPersonal: 'IDENTITY_NOT_PERSONAL_ACCOUNT',
-};
 export const identityRootStatusSchema = z.object({
     rootLinked: z.boolean(),
     recoveryEmail: z.string().nullable(),

package/dist/esm/index.js

@@ -180,13 +180,14 @@ PRODUCT_PLAN_STATUSES, productPlanStatusSchema, LIVE_PRODUCT_PLAN_STATUSES, plan
 export { 
 // Economic treatment (I09): derived by the server, never sent by a caller.
 INFERENCE_ECONOMIC_TREATMENTS, inferenceEconomicTreatmentSchema, PROVIDER_COST_SOURCES, providerCostSourceSchema, costCenterUsageSchema, } from './inference/economics.js';
-export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, executionActorRefSchema, foregroundExecutionAuthorizationInputSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, capabilityCatalogBindingSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, capabilityTicketRequestSchema, delegationGrantSchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, invocationPrincipalSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency.js';
+export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, executionActorRefSchema, foregroundExecutionAuthorizationInputSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, capabilityCatalogBindingSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, capabilityTicketRequestSchema, delegationGrantSchema, AGENT_REQUESTER_CEILING_AUTONOMY, agentRequesterCeilingWriteSchema, agentRequesterCeilingSchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, invocationPrincipalSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, catalogFeatureSchema, CATALOG_INTERNAL_TRANSPORTS, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency.js';
 export { catalogInvocationPathParameters, catalogInvocationsOverlap, catalogInvocationTemplatesEquivalent, findOverlappingCatalogInvocations, matchCatalogInvocation, resolveCatalogInvocation, } from './capabilityInvocation.js';
 export { emailContextAddressSchema, emailContextMailboxSchema, emailContextMessageSchema, emailAgentContextSchema, } from './emailAgentContext.js';
 export { inboxComposeRequestSchema, inboxDailyBriefRequestSchema, inboxDailyBriefResponseSchema, INBOX_DAILY_BRIEF_SECTIONS, inboxNaturalSearchRequestSchema, inboxMessageInferenceParamsSchema, inboxInferenceTextResponseSchema, inboxNaturalSearchResponseSchema, inboxSmartRepliesResponseSchema, inboxThreadSummaryResponseSchema, inboxInferenceStreamEventSchema, } from './inference/inbox.js';
 export * from './externalIdentity.js';
 export * from './linkedAccounts.js';
 export * from './federationInstanceFetch.js';
+export * from './accountAccess.js';
 export * from './notifications.js';
 export * from './email/messages.js';
 export * from './stickers.js';
@@ -204,3 +205,5 @@ export { personalPlanDisplayPriceSchema, personalPlanCatalogueSchema, } from './
 export * from './products/checkout.js';
 export * from './organizations.js';
 export * from './safety.js';
+export { serviceTokenScopesSchema, serviceTokenOptionsSchema, } from './serviceToken.js';
+export * from './applicationRoles.js';

package/dist/esm/organizations.js

@@ -1,22 +1,8 @@
 import { z } from 'zod';
-/** Real-world identity classification, independent of account topics and permissions. */
-export const ORGANIZATION_TYPES = [
-    'business',
-    'nonprofit',
-    'public_body',
-    'community',
-    'other',
-];
-export const ORGANIZATION_STATUSES = ['active', 'inactive', 'merged', 'suppressed'];
-export const ORGANIZATION_CLAIM_STATUSES = ['unclaimed', 'claimed'];
-export const ORGANIZATION_ALIAS_KINDS = [
-    'name_variant',
-    'former_name',
-    'localized_name',
-    'marketing_name',
-    'misspelling',
-];
-export const ORGANIZATION_CLAIM_DECISIONS = ['pending', 'approved', 'rejected'];
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// it is re-exported here so the root entry is unchanged.
+import { ORGANIZATION_TYPES, ORGANIZATION_STATUSES, ORGANIZATION_CLAIM_STATUSES, ORGANIZATION_ALIAS_KINDS, ORGANIZATION_CLAIM_DECISIONS, ORGANIZATION_NAME_MAX_LENGTH, ORGANIZATION_ERROR_CODES, } from './client/organizations.js';
+export { ORGANIZATION_TYPES, ORGANIZATION_STATUSES, ORGANIZATION_CLAIM_STATUSES, ORGANIZATION_ALIAS_KINDS, ORGANIZATION_CLAIM_DECISIONS, ORGANIZATION_NAME_MAX_LENGTH, ORGANIZATION_ERROR_CODES, } from './client/organizations.js';
 const id = z.string().min(1).max(128);
 const optionalText = (max) => z.string().trim().min(1).max(max).nullable().optional();
 export const organizationAliasSchema = z
@@ -26,7 +12,6 @@ export const organizationAliasSchema = z
     language: z.string().min(2).max(35).optional(),
 })
     .strict();
-export const ORGANIZATION_NAME_MAX_LENGTH = 300;
 export const organizationNameSchema = z
     .string()
     .trim()
@@ -168,18 +153,6 @@ export const organizationMergeSchema = z
     evidenceReference: z.string().trim().min(1).max(1000),
 })
     .strict();
-export const ORGANIZATION_ERROR_CODES = [
-    'bad_request',
-    'unauthorized',
-    'forbidden',
-    'not_found',
-    'unknown_route',
-    'conflict',
-    'validation_failed',
-    'rate_limited',
-    'internal_error',
-    'service_unavailable',
-];
 export const organizationErrorSchema = z
     .object({
     error: z