@oxy.so/contracts 4.16.0 → 4.21.0

package/dist/esm/reputation.js

@@ -41,6 +41,7 @@
 import { z } from 'zod';
 import { userNameSchema } from './userResponse.js';
 import { reputationConductSchema, reputationContextualInfluenceSchema, reputationContributionSchema, reputationPersonhoodSchema, reputationReportingSchema, reputationReviewingSchema, } from './moderationReputation.js';
+export { isFullReputationBalance } from './client/reputation.js';
 /* -------------------------------------------------------------------------- */
 /*  Closed value sets                                                         */
 /* -------------------------------------------------------------------------- */
@@ -170,38 +171,6 @@ export const reputationBalanceSchema = z.object({
     reviewing: reputationReviewingSchema.optional(),
     contextualInfluence: reputationContextualInfluenceSchema.optional(),
 });
-/**
- * The fields the full {@link ReputationBalance} carries beyond the public
- * {@link ReputationBalanceSummary} that the API sends ALL-OR-NOTHING. The
- * runtime discriminant between the two views.
- *
- * The V2 blocks (`conduct`, `contribution`, …) are deliberately NOT listed:
- * they are optional on the wire, so requiring them here would make a balance
- * from a server that predates them fail to narrow, hiding the whole private
- * view. Read a V2 block by checking that block.
- */
-const FULL_BALANCE_FIELDS = [
-    'positive',
-    'negative',
-    'breakdown',
-    'influence',
-    'reliability',
-    'recalculatedAt',
-    'updatedAt',
-];
-/**
- * Whether a balance came back as the SUBJECT view, and so carries the
- * breakdown / influence / reliability blocks.
- *
- * Checks every extra field rather than one representative: the point of the
- * guard is that the caller then dereferences those blocks, so a partial payload
- * must not narrow.
- *
- * @param balance - A balance from `getReputationBalance`.
- */
-export function isFullReputationBalance(balance) {
-    return FULL_BALANCE_FIELDS.every((field) => field in balance);
-}
 export const reputationRuleSchema = z.object({
     actionType: z.string(),
     points: z.number(),

package/dist/esm/safety.js

@@ -1,4 +1,12 @@
 import { z } from 'zod';
+import { accountActorChainSchema } from './accountSubject.js';
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// its vocabularies are re-exported here so the root entry is unchanged.
+import { PURCHASE_APPROVAL_STATUSES, SAFETY_POLICY_VERSION, SUPERVISED_ACTIONS, SUPERVISION_CONSENT_VERSION, SUPERVISION_INVITATION_STATUSES, SUPERVISION_STATUSES, } from './client/safety.js';
+import { ORGANIZATION_TYPES } from './organizations.js';
+import { reauthProofSchema } from './signIn.js';
+import { userResponseSchema } from './userResponse.js';
+export { PURCHASE_APPROVAL_STATUSES, SAFETY_POLICY_VERSION, SUPERVISED_ACTIONS, SUPERVISION_CONSENT_VERSION, SUPERVISION_INVITATION_STATUSES, SUPERVISION_STATUSES, };
 /** The requester is authenticated by the bearer; applications cannot submit viewer IDs. */
 export const profileAccessInputSchema = z
     .object({ subjectAccountId: z.string().min(1).max(128) })
@@ -10,3 +18,418 @@ export const profileAccessDecisionSchema = z
     policyVersion: z.literal('1'),
 })
     .strict();
+export const SAFETY_DECISION_REASONS = [
+    'allowed',
+    'owner',
+    'public',
+    'private',
+    'blocked',
+    'unavailable',
+    'unsupported_consumer',
+    'contact_not_approved',
+    'mature_content',
+    'unrated_content',
+    'approval_required',
+];
+const accountId = z.string().min(1).max(128);
+const resourceId = z.string().trim().min(1).max(256);
+const uniqueIds = (max, min = 1) => z
+    .array(accountId)
+    .min(min)
+    .max(max)
+    .refine((ids) => new Set(ids).size === ids.length, 'Account IDs must be unique');
+export const safetyDecisionSchema = z
+    .object({
+    allowed: z.boolean(),
+    reason: z.enum(SAFETY_DECISION_REASONS),
+    policyVersion: z.literal(SAFETY_POLICY_VERSION),
+})
+    .strict();
+export const profileAccessBatchInputSchema = z
+    .object({ subjectAccountIds: uniqueIds(100) })
+    .strict();
+export const profileAccessBatchResponseSchema = z
+    .object({
+    items: z
+        .array(z
+        .object({
+        subjectAccountId: accountId,
+        decision: safetyDecisionSchema,
+    })
+        .strict())
+        .max(100),
+})
+    .strict();
+export const MESSAGE_ACCESS_MAX_RESOURCES = 100;
+export const MESSAGE_ACCESS_MAX_PARTICIPANTS = 1024;
+export const MESSAGE_ACCESS_MAX_SUPERVISED_PARTICIPANTS = 256;
+export const MESSAGE_ACCESS_MAX_PARTICIPANT_SLOTS = 4096;
+/** Leaves room for the original requester proof in a 512 KiB request. */
+export const MESSAGE_ACCESS_MAX_INPUT_BYTES = 448 * 1024;
+export const messageAccessInputSchema = z
+    .object({ participantAccountIds: uniqueIds(MESSAGE_ACCESS_MAX_PARTICIPANTS), resourceId })
+    .strict();
+export const contactAccessInputSchema = z.object({ targetAccountIds: uniqueIds(1000) }).strict();
+export const contactAccessResponseSchema = z
+    .object({
+    items: z
+        .array(z
+        .object({
+        targetAccountId: accountId,
+        decision: safetyDecisionSchema,
+    })
+        .strict())
+        .max(1000),
+})
+    .strict();
+export const CONTENT_CLASSIFICATIONS = ['general', 'mature', 'unrated'];
+export const contentAccessInputSchema = z
+    .object({
+    resourceId,
+    classification: z.enum(CONTENT_CLASSIFICATIONS),
+    authorAccountId: accountId.optional(),
+    audience: z.enum(['public', 'private', 'followers']).optional(),
+    applicationAudienceAllowed: z.boolean().optional(),
+    applicationResourceGrant: z.boolean().optional(),
+    operation: z.enum(['read', 'manage_own']).optional(),
+})
+    .strict()
+    .refine((item) => !item.audience ||
+    item.audience === 'public' ||
+    (!!item.authorAccountId && item.applicationAudienceAllowed !== undefined), 'Nonpublic content requires its authoritative author and application audience decision')
+    .refine((item) => item.operation !== 'manage_own' || !!item.authorAccountId, 'Own management requires its authoritative author');
+export const publicationPolicySchema = z
+    .object({
+    publicationAllowed: z.boolean(),
+    requiredAudience: z.literal('private').nullable(),
+    collaborationAllowed: z.boolean(),
+    federationAllowed: z.boolean(),
+    policyVersion: z.literal(SAFETY_POLICY_VERSION),
+})
+    .strict();
+export const publicationPoliciesInputSchema = z
+    .object({
+    authorAccountIds: z
+        .array(accountId)
+        .min(1)
+        .max(100)
+        .refine((ids) => new Set(ids).size === ids.length, 'Author IDs must be unique'),
+})
+    .strict();
+export const publicationPoliciesResponseSchema = z
+    .object({
+    items: z
+        .array(z.object({ authorAccountId: accountId, policy: publicationPolicySchema }).strict())
+        .max(100),
+})
+    .strict();
+export const contentAccessBatchInputSchema = z
+    .object({
+    items: z
+        .array(contentAccessInputSchema)
+        .min(1)
+        .max(100)
+        .refine((items) => new Set(items.map((item) => item.resourceId)).size === items.length, 'Resource IDs must be unique'),
+})
+    .strict();
+export const contentAccessBatchResponseSchema = z
+    .object({
+    items: z
+        .array(z
+        .object({
+        resourceId,
+        decision: safetyDecisionSchema,
+    })
+        .strict())
+        .max(100),
+})
+    .strict();
+/** A reviewed background consumer may decide delivery, but never authenticate as the sender. */
+export const deliveryAccessInputSchema = messageAccessInputSchema
+    .extend({ senderAccountId: accountId })
+    .strict();
+/** Count repeated participants across resources too: this bounds both graph and pair evaluations. */
+const messageBatch = (schema) => z
+    .object({ items: z.array(schema).min(1).max(MESSAGE_ACCESS_MAX_RESOURCES) })
+    .strict()
+    .refine((value) => new Set(value.items.map((item) => item.resourceId)).size === value.items.length, 'Resource IDs must be unique')
+    .refine((value) => value.items.reduce((total, item) => total + item.participantAccountIds.length, 0) <=
+    MESSAGE_ACCESS_MAX_PARTICIPANT_SLOTS, 'Participant budget exceeded')
+    .refine((value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <=
+    MESSAGE_ACCESS_MAX_INPUT_BYTES, 'Message batch byte budget exceeded');
+export const messageAccessBatchInputSchema = messageBatch(messageAccessInputSchema);
+export const deliveryAccessBatchInputSchema = messageBatch(deliveryAccessInputSchema);
+export const messageAccessBatchResponseSchema = contentAccessBatchResponseSchema;
+/** Live socket-recipient proof; a request ID correlates the result and never identifies an account. */
+export const messagingSessionsInputSchema = z
+    .object({
+    items: z
+        .array(z
+        .object({
+        requestId: resourceId,
+        accessToken: z.string().min(1).max(16384),
+    })
+        .strict())
+        .min(1)
+        .max(100),
+})
+    .strict()
+    .refine((value) => new Set(value.items.map((item) => item.requestId)).size === value.items.length, 'Request IDs must be unique')
+    .refine((value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= MESSAGE_ACCESS_MAX_INPUT_BYTES, 'Session proof byte budget exceeded');
+export const messagingSessionsResponseSchema = z
+    .object({
+    items: z
+        .array(z.discriminatedUnion('allowed', [
+        z.object({ requestId: resourceId, allowed: z.literal(true), accountId }).strict(),
+        z.object({ requestId: resourceId, allowed: z.literal(false) }).strict(),
+    ]))
+        .max(100),
+})
+    .strict();
+export const safetyRequesterSchema = z.union([
+    z.object({ accessToken: z.string().min(1).max(16384).nullable() }).strict(),
+    z.object({ connectionToken: z.string().min(1).max(16384) }).strict(),
+]);
+export const supervisionSchema = z
+    .object({
+    childAccountId: accountId,
+    guardianAccountId: accountId.nullable(),
+    status: z.enum(SUPERVISION_STATUSES),
+    policyVersion: z.literal(SAFETY_POLICY_VERSION),
+    consentVersion: z.literal(SUPERVISION_CONSENT_VERSION),
+    createdAt: z.string().datetime(),
+})
+    .strict();
+export const supervisionInvitationSchema = z
+    .object({
+    id: accountId,
+    childAccountId: accountId,
+    guardianAccountId: accountId,
+    status: z.enum(SUPERVISION_INVITATION_STATUSES),
+    expiresAt: z.string().datetime(),
+    consentVersion: z.literal(SUPERVISION_CONSENT_VERSION),
+    createdAt: z.string().datetime(),
+})
+    .strict();
+export const supervisionContactSchema = z
+    .object({
+    childAccountId: accountId,
+    contactAccountId: accountId,
+    approvedAt: z.string().datetime(),
+})
+    .strict();
+export const supervisionStateSchema = z
+    .object({
+    self: supervisionSchema.nullable(),
+    children: z.array(supervisionSchema).max(100),
+    invitations: z.array(supervisionInvitationSchema).max(100),
+})
+    .strict();
+export const supervisionContactsResponseSchema = z
+    .object({ items: z.array(supervisionContactSchema).max(1000) })
+    .strict();
+const fingerprint = z.string().regex(/^[a-f0-9]{64}$/);
+const minorUnits = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+export const purchaseApprovalLineSchema = z
+    .object({
+    itemReference: resourceId,
+    title: z.string().trim().min(1).max(300),
+    optionsText: z.string().trim().max(300),
+    merchantAccountId: accountId,
+    quantity: z.number().int().min(1).max(1000000),
+    unitAmountMinor: minorUnits,
+    lineAmountMinor: minorUnits,
+})
+    .strict();
+const purchaseEffectsObject = z
+    .object({
+    operationId: resourceId,
+    resourceId,
+    cartFingerprint: fingerprint,
+    summary: z.string().trim().min(1).max(300),
+    merchantAccountIds: z
+        .array(accountId)
+        .min(1)
+        .max(100)
+        .refine((ids) => new Set(ids).size === ids.length, 'Merchant accounts must be unique')
+        .transform((ids) => [...ids].sort()),
+    lineItems: z.array(purchaseApprovalLineSchema).min(1).max(200),
+    shippingMinor: minorUnits,
+    taxMinor: minorUnits,
+    discountMinor: minorUnits,
+    roundingAdjustmentMinor: z
+        .number()
+        .int()
+        .min(-Number.MAX_SAFE_INTEGER)
+        .max(Number.MAX_SAFE_INTEGER),
+    paymentFingerprint: fingerprint,
+    amountMinor: minorUnits,
+    currency: z.string().regex(/^[A-Z]{3}$/),
+    expiresAt: z.string().datetime(),
+})
+    .strict();
+function validatePurchaseEvidence(value, ctx) {
+    const merchants = new Set(value.merchantAccountIds);
+    const references = new Set();
+    for (const line of value.lineItems) {
+        const key = `${line.merchantAccountId}:${line.itemReference}`;
+        if (!merchants.has(line.merchantAccountId) || references.has(key))
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'Purchase lines must name an included merchant and unique item reference',
+            });
+        references.add(key);
+    }
+    if (merchants.size !== new Set(value.lineItems.map((line) => line.merchantAccountId)).size)
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'Every merchant must have an approval line',
+        });
+    const total = value.lineItems.reduce((sum, line) => sum + BigInt(line.lineAmountMinor), 0n) +
+        BigInt(value.shippingMinor) +
+        BigInt(value.taxMinor) -
+        BigInt(value.discountMinor) +
+        BigInt(value.roundingAdjustmentMinor);
+    if (total < 0n || total > BigInt(Number.MAX_SAFE_INTEGER) || total !== BigInt(value.amountMinor))
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'Approval evidence must equal the exact payment total',
+        });
+    if (Math.abs(value.roundingAdjustmentMinor) >
+        value.lineItems.length + 3 * value.merchantAccountIds.length)
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'Rounding adjustment exceeds the bounded conversion stages',
+        });
+}
+export const purchaseEffectsSchema = purchaseEffectsObject.superRefine(validatePurchaseEvidence);
+const purchaseApprovalFields = {
+    id: accountId,
+    childAccountId: accountId,
+    applicationId: accountId,
+    status: z.enum(PURCHASE_APPROVAL_STATUSES),
+    createdAt: z.string().datetime(),
+    receiptReference: z.string().max(512).nullable(),
+};
+export const purchaseApprovalSchema = purchaseEffectsObject
+    .extend(purchaseApprovalFields)
+    .strict()
+    .superRefine(validatePurchaseEvidence);
+export const purchaseApprovalSummarySchema = purchaseEffectsObject
+    .omit({ lineItems: true })
+    .extend(purchaseApprovalFields)
+    .strict();
+export const purchaseApprovalListSchema = z
+    .object({
+    items: z.array(purchaseApprovalSummarySchema).max(100),
+    nextCursor: z.string().nullable(),
+})
+    .strict();
+export const reservePurchaseSchema = purchaseEffectsObject
+    .extend({ approvalId: accountId })
+    .strict()
+    .superRefine(validatePurchaseEvidence);
+export const confirmPurchaseSchema = z
+    .object({
+    approvalId: accountId,
+    operationId: resourceId,
+    receiptReference: z.string().trim().min(1).max(512),
+})
+    .strict();
+export const cancelPurchaseSchema = confirmPurchaseSchema.omit({ receiptReference: true });
+export const SAFETY_ERROR_CODES = [
+    'bad_request',
+    'validation_failed',
+    'unauthorized',
+    'forbidden',
+    'not_found',
+    'conflict',
+    'reauth_required',
+    'limit_reached',
+    'service_unavailable',
+    'rate_limited',
+];
+export const safetyErrorSchema = z
+    .object({ error: z.object({ code: z.enum(SAFETY_ERROR_CODES), message: z.string() }).strict() })
+    .strict();
+export const supervisionInviteInputSchema = z
+    .object({
+    guardianAccountId: accountId,
+    consentVersion: z.literal(SUPERVISION_CONSENT_VERSION),
+    reauth: reauthProofSchema,
+})
+    .strict();
+export const supervisionAcceptInputSchema = z
+    .object({ consentVersion: z.literal(SUPERVISION_CONSENT_VERSION), reauth: reauthProofSchema })
+    .strict();
+export const supervisionContactInputSchema = z
+    .object({ childAccountId: accountId, contactAccountId: accountId, reauth: reauthProofSchema })
+    .strict();
+export const supervisionReviewInputSchema = z
+    .object({
+    childAccountId: accountId,
+    action: z.enum(['end', 'transfer']),
+    guardianAccountId: accountId.optional(),
+    evidenceReference: z.string().trim().min(1).max(2048),
+    reauth: reauthProofSchema,
+})
+    .strict();
+export const purchaseReviewInputSchema = z
+    .object({ decision: z.enum(['approved', 'rejected']), reauth: reauthProofSchema })
+    .strict();
+export const safetySessionInputSchema = z
+    .object({
+    sessionId: accountId,
+    accessToken: z.string().min(1).max(16384),
+    action: z.enum(SUPERVISED_ACTIONS),
+})
+    .strict();
+export const safetySessionValidationSchema = z
+    .object({
+    valid: z.literal(true),
+    sessionId: accountId,
+    expiresAt: z.string().datetime(),
+    lastActivity: z.string().datetime(),
+    user: userResponseSchema,
+    actor: accountActorChainSchema,
+})
+    .strict();
+/** Minimal identity for the authenticated account's supervision management, never profile details. */
+export const safetyPersonSchema = z
+    .object({ accountId, username: z.string().nullable(), displayName: z.string().nullable() })
+    .strict();
+export const safetyPeopleInputSchema = z.union([
+    z.object({ query: z.string().trim().min(2).max(100) }).strict(),
+    z.object({ accountIds: uniqueIds(100) }).strict(),
+]);
+export const safetyPeopleResponseSchema = z
+    .object({ items: z.array(safetyPersonSchema).max(100) })
+    .strict();
+/** Existing public employer identity only; never directory content or management authority. */
+export const safetyOrganizationIdentitySchema = z
+    .object({
+    accountId,
+    username: z.string().nullable(),
+    name: z.string(),
+    organizationType: z.enum(ORGANIZATION_TYPES),
+})
+    .strict();
+export const safetyOrganizationsInputSchema = z.union([
+    z
+        .object({
+        query: z.string().trim().min(1).max(100),
+        limit: z.number().int().min(1).max(20).optional(),
+    })
+        .strict(),
+    z.object({ ids: uniqueIds(100) }).strict(),
+]);
+export const safetyOrganizationsResponseSchema = z
+    .object({
+    items: z
+        .array(z
+        .object({ requestedAccountId: accountId, organization: safetyOrganizationIdentitySchema })
+        .strict())
+        .max(100),
+    missingIds: z.array(accountId).max(100),
+})
+    .strict();

package/dist/esm/serviceToken.js

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+/** Omitted means the existing grant; an explicit set only narrows that authority. */
+export const serviceTokenScopesSchema = z
+    .array(z.string().trim().min(1).max(128))
+    .min(1)
+    .max(100)
+    .refine((scopes) => new Set(scopes).size === scopes.length, 'Requested scopes must be unique')
+    .transform((scopes) => [...scopes].sort());
+export const serviceTokenOptionsSchema = z
+    .object({ scopes: serviceTokenScopesSchema.optional() })
+    .strict();

package/dist/esm/signIn.js

@@ -32,40 +32,10 @@
 import { z } from 'zod';
 import { EMAIL_CODE_LENGTH, emailAddressSchema, emailTicketSchema } from './accountEmail.js';
 import { deviceProofSchema } from './deviceSession.js';
-/** How long the link in a sign-in email can be opened. */
-export const EMAIL_SIGNIN_LINK_TTL_MS = 15 * 60 * 1000;
-/** How long a second-factor challenge can be answered. */
-export const SIGNIN_SECOND_FACTOR_TTL_MS = 5 * 60 * 1000;
-/** Wrong second-factor codes one challenge accepts. */
-export const SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = 5;
-/** Shortest password Oxy accepts when one is set. */
-export const PASSWORD_MIN_LENGTH = 10;
-/** Longest password Oxy accepts (characters). */
-export const PASSWORD_MAX_LENGTH = 256;
-/** Digits in an authenticator code. */
-export const TOTP_DIGITS = 6;
-/** Seconds each authenticator code lasts. */
-export const TOTP_PERIOD_SECONDS = 30;
-/** Backup codes issued when an authenticator is enabled or they are regenerated. */
-export const TOTP_BACKUP_CODE_COUNT = 10;
-/**
- * The long sign-in code: ten characters of Crockford base32 without the
- * look-alikes (no 0, O, 1, I, L, U), shown as `XXXXX-XXXXX`. An account whose
- * sign-in codes were guessed at too often today (the per-account ceiling) is
- * sent this instead of 6 digits for the rest of the day, so its owner can still
- * type a code while guessing one is infeasible.
- */
-export const EMAIL_SIGNIN_LONG_CODE_ALPHABET = '23456789ABCDEFGHJKMNPQRSTVWXYZ';
-export const EMAIL_SIGNIN_LONG_CODE_LENGTH = 10;
-/**
- * Normalise a typed sign-in code: 6 digits stay as they are; a long code is
- * upper-cased with its dash and spaces removed. Anything else is returned
- * trimmed (and will simply be wrong).
- */
-export function normalizeEmailSignInCode(code) {
-    const compact = code.trim().replace(/[\s-]/g, '').toUpperCase();
-    return compact;
-}
+// The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
+// it is re-exported here so the root entry is unchanged.
+import { PASSWORD_MIN_LENGTH, PASSWORD_MAX_LENGTH, TOTP_DIGITS, TOTP_BACKUP_CODE_COUNT, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, normalizeEmailSignInCode, EMAIL_ACCOUNTS_MAX, REAUTH_ACTIONS, } from './client/signIn.js';
+export { EMAIL_SIGNIN_LINK_TTL_MS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, PASSWORD_MIN_LENGTH, PASSWORD_MAX_LENGTH, TOTP_DIGITS, TOTP_PERIOD_SECONDS, TOTP_BACKUP_CODE_COUNT, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, normalizeEmailSignInCode, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_ACCOUNTS_MAX, isSecondFactorRequired, isEmailSignInChooseAccount, REAUTH_ACTIONS, SIGN_IN_ERROR_CODES, } from './client/signIn.js';
 const sixDigits = z
     .string()
     .trim()
@@ -193,13 +163,6 @@ export const emailSignInPendingSchema = z.object({
     status: z.literal('pending'),
     expiresAt: z.number().int().positive(),
 });
-/**
- * How long, once the email is proven, the person has to choose which of its
- * accounts signs in.
- */
-export const EMAIL_SIGNIN_CHOICE_TTL_MS = 5 * 60 * 1000;
-/** Most accounts one email can hold; sign-up refuses another past it. */
-export const EMAIL_ACCOUNTS_MAX = 20;
 export const emailSignInAccountOptionSchema = z.object({
     id: z.string().min(1).max(64),
     username: z.string().min(1).optional(),
@@ -220,25 +183,6 @@ export const emailSignInChooseRequestSchema = z
     ...sessionEnvelope,
 })
     .strict();
-/** Narrow a {@link SignInStepResult}. */
-export function isSecondFactorRequired(result) {
-    return result.secondFactorRequired === true;
-}
-/** Narrow an {@link EmailSignInStepResult}. */
-export function isEmailSignInChooseAccount(result) {
-    return result.chooseAccount === true;
-}
-/**
- * What a re-verification email code confirms. The code is bound to it: a code
- * asked for one change never authorises another, and the email names it.
- */
-export const REAUTH_ACTIONS = [
-    'change_password',
-    'totp',
-    'link_commons',
-    'delete_account',
-    'credentials_manage',
-];
 /** `POST /users/me/reauth/email` */
 export const reauthEmailStartRequestSchema = z.object({ action: z.enum(REAUTH_ACTIONS) }).strict();
 /**
@@ -312,39 +256,3 @@ export const totpBackupCodesResponseSchema = z.object({
         .array(z.string().regex(/^[a-z2-9]{5}-[a-z2-9]{5}$/))
         .length(TOTP_BACKUP_CODE_COUNT),
 });
-/**
- * Stable error codes (`error.code` in the API error body). Clients map these
- * through their localization, never the English message.
- */
-export const SIGN_IN_ERROR_CODES = {
-    /** Wrong identifier or password — never says which. */
-    invalidCredentials: 'SIGNIN_INVALID_CREDENTIALS',
-    /** The request is unknown, expired, spent, or its secret is wrong. */
-    requestInvalid: 'SIGNIN_REQUEST_INVALID',
-    /** The link is unknown, expired or already used. */
-    linkInvalid: 'SIGNIN_LINK_INVALID',
-    /** The link was opened in another browser: type the code in the app instead. */
-    linkOtherDevice: 'SIGNIN_LINK_OTHER_DEVICE',
-    /** The second-factor challenge or its code is wrong, expired or spent. */
-    secondFactorInvalid: 'SECOND_FACTOR_INVALID',
-    /** Too many failures for this account: wait and try again. */
-    locked: 'SIGNIN_LOCKED',
-    /** The step needs a fresh proof (`reauth`). */
-    reauthRequired: 'REAUTH_REQUIRED',
-    /** The fresh proof was wrong. */
-    reauthInvalid: 'REAUTH_INVALID',
-    /** The account has an authenticator: the proof must carry its code. */
-    totpRequired: 'TOTP_REQUIRED',
-    /** Enrolling or confirming an authenticator that is already on. */
-    totpAlreadyEnabled: 'TOTP_ALREADY_ENABLED',
-    /** Disabling, confirming or regenerating codes with no authenticator (or no pending one). */
-    totpNotEnabled: 'TOTP_NOT_ENABLED',
-    /** The code the authenticator showed at enrolment is wrong. */
-    totpCodeInvalid: 'TOTP_CODE_INVALID',
-    /** Only official Oxy apps and auth.oxy.so may sign people in here. */
-    originNotAllowed: 'SIGNIN_ORIGIN_NOT_ALLOWED',
-    /** The username is taken. */
-    usernameTaken: 'USERNAME_TAKEN',
-    /** The email already holds `EMAIL_ACCOUNTS_MAX` accounts: no sign-up adds another. */
-    emailAccountsFull: 'EMAIL_ACCOUNTS_FULL',
-};