@oxy.so/contracts 5.0.0 → 5.1.0

package/dist/cjs/client/accountEmail.js

@@ -13,8 +13,10 @@ const check_1 = require("./check");
  * - `reauth`: a signed-in person proving it is them before a sensitive step
  *   (`POST /users/me/reauth/email`): a password, an authenticator, deleting the
  *   account, linking Commons.
+ * - `email_change`: a signed-in account proving the NEW address it moves to
+ *   (`POST /users/me/email/verify/start`); bound to the account and that address.
  */
-exports.EMAIL_VERIFICATION_PURPOSES = ['signup', 'signin', 'reauth'];
+exports.EMAIL_VERIFICATION_PURPOSES = ['signup', 'signin', 'reauth', 'email_change'];
 /** Digits in a code. */
 exports.EMAIL_CODE_LENGTH = 6;
 /** How long a code can be confirmed. */

package/dist/cjs/client/signIn.js

@@ -66,6 +66,7 @@ function isEmailSignInChooseAccount(result) {
  */
 exports.REAUTH_ACTIONS = [
     'change_password',
+    'change_email',
     'totp',
     'link_commons',
     'delete_account',
@@ -108,6 +109,12 @@ exports.SIGN_IN_ERROR_CODES = {
     usernameTaken: 'USERNAME_TAKEN',
     /** The email already holds `EMAIL_ACCOUNTS_MAX` accounts: no sign-up adds another. */
     emailAccountsFull: 'EMAIL_ACCOUNTS_FULL',
+    /** Removing the one way in left (the email when there is no password, or the reverse). */
+    lastSignInMethod: 'LAST_SIGN_IN_METHOD',
+    /** Removing the email needs a password set, and is confirmed with it. */
+    passwordRequired: 'PASSWORD_REQUIRED',
+    /** The new email is the one the account already has. */
+    emailUnchanged: 'EMAIL_UNCHANGED',
 };
 /* -------------------------------------------------------------------------- */
 /*  Checks                                                                    */

package/dist/cjs/identityLink.js

@@ -68,9 +68,7 @@ exports.identityLinkProofRequestSchema = zod_1.z
     .strict();
 /**
  * `POST /identity/link/:linkId/complete` — the account's own confirmation: a
- * code just sent to its email for this link (`reauth`, plus its authenticator
- * code when it has one).
+ * code just sent to its email for this link, or its password when it has no
+ * email (`reauth`, plus its authenticator code when it has one).
  */
-exports.identityLinkCompleteRequestSchema = zod_1.z
-    .object({ reauth: signIn_1.emailReauthProofSchema })
-    .strict();
+exports.identityLinkCompleteRequestSchema = zod_1.z.object({ reauth: signIn_1.reauthProofSchema }).strict();

package/dist/cjs/index.js

@@ -31,14 +31,14 @@ exports.MODERATION_ATTRIBUTIONS = exports.MODERATION_FINDING_SCOPES = exports.MO
 exports.deviceBackgroundCredentialResponseSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.applicationModerationTrustSchema = exports.reputationContextualInfluenceSchema = exports.reputationReviewingSchema = exports.reputationReportingSchema = exports.reputationConductSchema = exports.reputationContributionSchema = exports.reputationPersonhoodSchema = exports.identityBindingSchema = exports.registerIdentityBindingSchema = exports.reverseModerationEffectResultSchema = exports.applyModerationDecisionResultSchema = exports.moderationEffectSchema = exports.reverseModerationEffectSchema = exports.finalizeModerationDecisionSchema = exports.moderationDecisionEventSchema = exports.moderationPolicyVersionsSchema = exports.moderationDecisionEventSubjectSchema = exports.moderationFindingSchema = exports.applicationModerationStandingSchema = exports.identityBindingStatusSchema = exports.identityBindingTypeSchema = exports.personhoodStatusSchema = exports.contributionTierSchema = exports.conductStandingSchema = exports.conductStrikeStatusSchema = exports.moderationEffectSkipReasonSchema = exports.moderationEffectStatusSchema = exports.moderationEffectTypeSchema = exports.moderationDecisionStatusSchema = exports.moderationAttributionSchema = exports.moderationFindingScopeSchema = exports.moderationSeveritySchema = exports.APPLICATION_MODERATION_STANDINGS = exports.IDENTITY_BINDING_STATUSES = exports.IDENTITY_BINDING_TYPES = exports.PERSONHOOD_STATUSES = exports.CONTRIBUTION_TIERS = exports.CONDUCT_STANDINGS = exports.CONDUCT_STRIKE_STATUSES = exports.MODERATION_EFFECT_SKIP_REASONS = exports.MODERATION_EFFECT_STATUSES = exports.MODERATION_EFFECT_TYPES = exports.MODERATION_DECISION_STATUSES = void 0;
 exports.updateAssetStatusSchema = exports.updateStatusSchema = exports.updatePlatformSchema = exports.identityRootStatusSchema = exports.identityProofChallengeResponseSchema = exports.identityProofChallengeRequestSchema = exports.identityProofSchema = exports.buildIdentityProofMessage = exports.canonicalJson = exports.IDENTITY_ERROR_CODES = exports.IDENTITY_PROOF_ACTION_VALUES = exports.IDENTITY_PROOF_ACTIONS = exports.IDENTITY_PROOF_CHALLENGE_TTL_MS = exports.IDENTITY_PROOF_AUDIENCE = exports.IDENTITY_PROOF_DOMAIN = exports.IDENTITY_PROOF_VERSION = exports.backupStatusResponseSchema = exports.backupUploadRequestSchema = exports.encryptedBackupEnvelopeSchema = exports.backupLookupIdSchema = exports.rotateKeyCompleteResponseSchema = exports.rotateKeyCompleteRequestSchema = exports.rotateKeyChallengeResponseSchema = exports.loginResultSchema = exports.mcpOAuthConsentResponseSchema = exports.mcpOAuthClientInfoResponseSchema = exports.mcpOAuthConsentContextSchema = exports.mcpOAuthWriteActionSchema = exports.mcpOAuthClientApplicationSchema = exports.oauthAuthorizeCodeResponseSchema = exports.oauthConsentDecisionSchema = exports.deviceDirectorySyncSchema = exports.deviceActivateResponseSchema = exports.deviceActivateRequestSchema = exports.deviceDirectorySchema = exports.devicePrincipalSchema = exports.deviceAccountContextSchema = exports.deviceDirectoryProfileSchema = exports.deviceContextRelationshipSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceJoinResponseSchema = exports.deviceJoinRequestSchema = exports.deviceJoinCodeResponseSchema = exports.deviceJoinCodeRequestSchema = exports.deviceRegisterResponseSchema = exports.deviceProofSchema = exports.deviceBackgroundTokenResponseSchema = exports.deviceBackgroundTokenRequestSchema = void 0;
 exports.emailSignInStartResponseSchema = exports.emailSignInStartRequestSchema = exports.secondFactorCodeSchema = exports.newPasswordSchema = exports.passwordInputSchema = exports.signInIdentifierSchema = exports.SIGN_IN_ERROR_CODES = exports.TOTP_BACKUP_CODE_COUNT = exports.TOTP_PERIOD_SECONDS = exports.TOTP_DIGITS = exports.PASSWORD_MAX_LENGTH = exports.PASSWORD_MIN_LENGTH = exports.SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = exports.SIGNIN_SECOND_FACTOR_TTL_MS = exports.EMAIL_SIGNIN_LINK_TTL_MS = exports.emailVerificationConfirmResponseSchema = exports.emailVerificationConfirmRequestSchema = exports.emailVerificationStartResponseSchema = exports.emailVerificationStartRequestSchema = exports.emailTicketSchema = exports.emailAddressSchema = exports.EMAIL_VERIFICATION_ERROR_CODES = exports.EMAIL_TICKET_TTL_MS = exports.EMAIL_CODE_MAX_ATTEMPTS = exports.EMAIL_CODE_TTL_MS = exports.EMAIL_CODE_LENGTH = exports.EMAIL_VERIFICATION_PURPOSES = exports.updateRolloutPatchSchema = exports.promoteRequestSchema = exports.rollbackToEmbeddedRequestSchema = exports.rollbackRequestSchema = exports.updateListResponseSchema = exports.channelListResponseSchema = exports.channelSchema = exports.rollbackToEmbeddedEntrySchema = exports.createUpdateResponseSchema = exports.updateSchema = exports.createUpdateRequestSchema = exports.updateAssetRefSchema = exports.assetCompleteResponseSchema = exports.assetCompleteResultItemSchema = exports.assetCompleteRequestSchema = exports.assetInitResponseSchema = exports.assetUploadTicketSchema = exports.assetInitRequestSchema = exports.assetInitItemSchema = exports.rolloutPercentSchema = exports.runtimeVersionSchema = exports.channelNameSchema = exports.sha256HexSchema = void 0;
-exports.requestIdSchema = exports.oxyCredentialIdSchema = exports.oxyApplicationIdSchema = exports.delegatedUserIdSchema = exports.oxyAccountIdSchema = exports.INFERENCE_CONTRACT_VERSION = exports.transparencyCheckpointListSchema = exports.transparencyInclusionProofSchema = exports.transparencyCheckpointSchema = exports.transparencyAnchorSchema = exports.transparencyCheckpointSignatureSchema = exports.identityLinkCompleteRequestSchema = exports.identityLinkProofRequestSchema = exports.identityLinkStateSchema = exports.identityLinkCreateResponseSchema = exports.parseIdentityLinkQrPayload = exports.buildIdentityLinkQrPayload = exports.identityLinkIdSchema = exports.IDENTITY_LINK_QR_PREFIX = exports.IDENTITY_LINK_STATUSES = exports.totpBackupCodesResponseSchema = exports.totpReauthRequestSchema = exports.totpConfirmRequestSchema = exports.totpEnrollResponseSchema = exports.signInMethodsSchema = exports.passwordSetRequestSchema = exports.reauthEmailStartRequestSchema = exports.REAUTH_ACTIONS = exports.emailReauthProofSchema = exports.reauthProofSchema = exports.isSecondFactorRequired = exports.signUpRequestSchema = exports.secondFactorRequiredSchema = exports.secondFactorSignInRequestSchema = exports.passwordSignInRequestSchema = exports.isEmailSignInChooseAccount = exports.emailSignInChooseRequestSchema = exports.emailSignInChooseAccountSchema = exports.emailSignInAccountOptionSchema = exports.EMAIL_ACCOUNTS_MAX = exports.EMAIL_SIGNIN_CHOICE_TTL_MS = exports.emailSignInPendingSchema = exports.emailSignInLinkResponseSchema = exports.emailSignInLinkRequestSchema = exports.emailSignInCollectRequestSchema = exports.EMAIL_SIGNIN_LONG_CODE_LENGTH = exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET = exports.normalizeEmailSignInCode = exports.emailSignInCodeSchema = exports.emailSignInConfirmRequestSchema = void 0;
-exports.inferenceModalitySchema = exports.priceSnapshotSchema = exports.priceVersionSchema = exports.priceVersionStatusSchema = exports.embeddingResponseSchema = exports.embeddingFailureSchema = exports.embeddingSuccessSchema = exports.embeddingUsageSchema = exports.embeddingVectorSchema = exports.inferenceErrorSchema = exports.providerErrorPassthroughSchema = exports.safeErrorTextSchema = exports.upstreamErrorCategorySchema = exports.inferenceErrorCodeSchema = exports.NON_RETRYABLE_INFERENCE_ERROR_CODES = exports.INFERENCE_ERROR_CODES = exports.inferenceAttributionSchema = exports.authenticatedPrincipalSchema = exports.billingPrincipalSchema = exports.inferenceScopeSchema = exports.INFERENCE_SCOPES = exports.unitPriceSchema = exports.usageQuantitySchema = exports.usageSourceSchema = exports.USAGE_SOURCES = exports.usageUnitSchema = exports.USAGE_UNITS = exports.moneySchema = exports.exactDecimalSchema = exports.INFERENCE_MONEY_SCALE = exports.currencyCodeSchema = exports.RESERVED_ALIA_PUBLISHER = exports.inferenceFundingTierSchema = exports.inferenceRegionSchema = exports.deploymentIdSchema = exports.inferenceProviderSlugSchema = exports.routingProfileSlugSchema = exports.routingProfileIdSchema = exports.modelReferenceSchema = exports.modelRevisionLabelSchema = exports.modelIdSchema = exports.modelSlugSchema = exports.publisherSlugSchema = exports.sha256DigestSchema = exports.inferenceHttpsUrlSchema = exports.inferenceDateSchema = exports.inferenceTimestampSchema = exports.inferenceEnvironmentSchema = exports.idempotencyKeySchema = exports.generationIdSchema = void 0;
-exports.inferenceToolCallSchema = exports.inferenceContentPartSchema = exports.inferenceContentSourceSchema = exports.modelDocumentationSchema = exports.modelReleaseIngestionResultSchema = exports.modelReleaseIngestionRequestSchema = exports.modelLineDeclarationSchema = exports.modelGpaiDocumentationSchema = exports.modelDownstreamDocumentationSchema = exports.SYSTEMIC_RISK_COMPUTE_THRESHOLD_FLOPS = exports.trainingComputeFlopsSchema = exports.modelSystemicRiskTierSchema = exports.modelDistributionMethodSchema = exports.aliaModelReleaseManifestSchema = exports.aliaReleaseSignatureSchema = exports.aliaReleaseArtifactSchema = exports.authorizedRouteSchema = exports.effectiveSameModelDeployment = exports.routingPolicyReferenceSchema = exports.routingPolicySchema = exports.routingFallbackPolicySchema = exports.routingPolicyScopeSchema = exports.routingTargetSchema = exports.modelCatalogueEntrySchema = exports.catalogueServingProviderSummarySchema = exports.cataloguePublisherSummarySchema = exports.routingProfileSchema = exports.routingProfileCandidateSchema = exports.modelDeploymentSchema = exports.inferenceProviderSchema = exports.modelRevisionSchema = exports.catalogueModelSchema = exports.modelPublisherSchema = exports.modelSafetyMetadataSchema = exports.modelEvaluationResultSchema = exports.modelDeprecationSchema = exports.commercialPermissionSchema = exports.availabilityScopeSchema = exports.inferenceDataPolicySchema = exports.modelProvenanceSchema = exports.modelLicenseSchema = exports.modelCapabilitiesSchema = exports.modelRealtimeCapabilitiesSchema = exports.realtimeSessionTransportSchema = exports.realtimeSessionKindSchema = exports.inferenceApiFormatSchema = exports.modelPowerClassSchema = exports.powerLevelSchema = exports.reasoningEffortSchema = exports.inferenceOutputModalitySchema = void 0;
-exports.realtimeItemTruncateCommandSchema = exports.realtimeItemDeleteCommandSchema = exports.realtimeItemCreateCommandSchema = exports.realtimeSessionUpdateCommandSchema = exports.realtimeResponseParametersSchema = exports.realtimeConversationItemSchema = exports.realtimeContentPartSchema = exports.realtimeSessionRequestSchema = exports.realtimeClientMetadataSchema = exports.realtimeSessionLimitsSchema = exports.realtimeSessionConfigUpdateSchema = exports.realtimeSessionConfigSchema = exports.realtimeTranslationSchema = exports.realtimeInputTranscriptionSchema = exports.realtimeTurnDetectionSchema = exports.realtimeOutputModalitySchema = exports.realtimeAudioFormatSchema = exports.realtimeResponseIdSchema = exports.realtimeItemIdSchema = exports.realtimeCommandIdSchema = exports.MAX_REALTIME_RESUME_WINDOW_MS = exports.MAX_REALTIME_SESSION_AUDIO_BYTES = exports.MAX_REALTIME_SESSION_DURATION_MS = exports.MAX_REALTIME_AUDIO_FRAME_BASE64_LENGTH = exports.inferenceStreamEventSchema = exports.inferenceStreamDoneEventSchema = exports.inferenceFinishReasonSchema = exports.inferenceStreamErrorEventSchema = exports.inferenceStreamRouteSwitchEventSchema = exports.inferenceRouteSwitchReasonSchema = exports.inferenceRouteSwitchDetailSchema = exports.inferenceStreamUsageEventSchema = exports.inferenceStreamToolCallEventSchema = exports.inferenceStreamAudioEventSchema = exports.MAX_INFERENCE_AUDIO_BYTES = exports.inferenceAudioMediaTypeSchema = exports.inferenceStreamDeltaEventSchema = exports.inferenceStreamStartEventSchema = exports.inferenceAudioOutputParametersSchema = exports.inferenceSpeechParametersSchema = exports.inferenceRequestSchema = exports.clientRequestMetadataSchema = exports.responseFormatSchema = exports.toolChoiceSchema = exports.toolDefinitionSchema = exports.inferenceReasoningSchema = exports.samplingParametersSchema = exports.inferenceInputSchema = exports.inferenceMessageSchema = exports.inferenceMessageRoleSchema = void 0;
-exports.kaanaCredentialRotateMutationSchema = exports.kaanaCredentialCreateMutationSchema = exports.kaanaCredentialIdentitySchema = exports.kaanaCredentialOperationActionSchema = exports.kaanaCredentialOperationIdSchema = exports.kaanaCredentialHandleSchema = exports.providerConnectionScopeSchema = exports.usageRefundSchema = exports.usageRefundReasonSchema = exports.usageRefundSubjectSchema = exports.usageReceiptSchema = exports.normalizedUsageReportSchema = exports.inferenceRequestOutcomeSchema = exports.usageReservationSchema = exports.usageReservationStatusSchema = exports.usageReservationRequestSchema = exports.realtimeServerEventSchema = exports.realtimeSessionClosedEventSchema = exports.realtimeSessionCloseReasonSchema = exports.realtimeErrorEventSchema = exports.realtimeResponseDoneEventSchema = exports.realtimeResponseStatusSchema = exports.realtimeToolCallEventSchema = exports.realtimeTextDeltaEventSchema = exports.realtimeTranscriptDoneEventSchema = exports.realtimeTranscriptDeltaEventSchema = exports.realtimeTranscriptSourceSchema = exports.realtimeOutputAudioDoneEventSchema = exports.realtimeOutputAudioDeltaEventSchema = exports.realtimeResponseCreatedEventSchema = exports.realtimeInputAudioClearedEventSchema = exports.realtimeInputAudioCommittedEventSchema = exports.realtimeSpeechStoppedEventSchema = exports.realtimeSpeechStartedEventSchema = exports.realtimeItemTruncatedEventSchema = exports.realtimeItemDeletedEventSchema = exports.realtimeItemDoneEventSchema = exports.realtimeItemAddedEventSchema = exports.realtimeCommandAcceptedEventSchema = exports.realtimeSessionResumedEventSchema = exports.realtimeSessionUpdatedEventSchema = exports.realtimeSessionCreatedEventSchema = exports.realtimeClientCommandSchema = exports.realtimeSessionCloseCommandSchema = exports.realtimeSessionResumeCommandSchema = exports.realtimeResponseCancelCommandSchema = exports.realtimeResponseCreateCommandSchema = exports.realtimeInputAudioClearCommandSchema = exports.realtimeInputAudioCommitCommandSchema = exports.realtimeInputAudioAppendCommandSchema = void 0;
-exports.payAsYouGoEntitlementSchema = exports.productPlanSchema = exports.planAllowanceSchema = exports.LIVE_PRODUCT_PLAN_STATUSES = exports.productPlanStatusSchema = exports.PRODUCT_PLAN_STATUSES = exports.reconciliationReportSchema = exports.reconciliationRunSchema = exports.reconciliationDiscrepancySchema = exports.reconciliationRunStatusSchema = exports.RECONCILIATION_RUN_STATUSES = exports.reconciliationDiscrepancyKindSchema = exports.RECONCILIATION_DISCREPANCY_KINDS = exports.autoRechargeAttemptSchema = exports.autoRechargeStatusSchema = exports.AUTO_RECHARGE_STATUSES = exports.externalPaymentSchema = exports.externalPaymentKindSchema = exports.EXTERNAL_PAYMENT_KINDS = exports.externalPaymentProviderSchema = exports.EXTERNAL_PAYMENT_PROVIDERS = exports.billingInvoiceSchema = exports.billingInvoiceStatusSchema = exports.BILLING_INVOICE_STATUSES = exports.accountBillingStateSchema = exports.billingProfileSchema = exports.autoRechargeSchema = exports.billingProfileStatusSchema = exports.BILLING_PROFILE_STATUSES = exports.billingModeSchema = exports.BILLING_MODES = exports.providerConnectionSchema = exports.providerConnectionStatusSchema = exports.providerConnectionValidationSchema = exports.providerCredentialCustodyStateSchema = exports.providerCredentialValidationDeploymentSchema = exports.providerCredentialValidationOperationSchema = exports.kaanaCredentialValidationOutcomeSchema = exports.kaanaCredentialValidationFailureCodeSchema = exports.kaanaCredentialValidationOutcomeStateSchema = exports.kaanaCredentialValidationTaskSchema = exports.kaanaCredentialOutcomeSchema = exports.kaanaCredentialConflictOutcomeSchema = exports.kaanaCredentialAppliedOutcomeSchema = exports.kaanaCredentialOutcomeRequestSchema = exports.kaanaCredentialRevokeOutcomeRequestSchema = exports.kaanaCredentialRotateOutcomeRequestSchema = exports.kaanaCredentialCreateOutcomeRequestSchema = exports.kaanaCredentialMutationSchema = exports.kaanaCredentialRevokeMutationSchema = void 0;
-exports.catalogInvocationPathParameters = exports.normalizedAppEventSchema = exports.catalogRegistrationSchema = exports.appCapabilityCatalogSchema = exports.CATALOG_INTERNAL_TRANSPORTS = exports.catalogFeatureSchema = exports.catalogEventSchema = exports.catalogToolSchema = exports.auditEventSchema = exports.auditResultSchema = exports.policyDecisionSchema = exports.invocationPrincipalSchema = exports.capabilityTicketClaimsSchema = exports.automationDefinitionSchema = exports.automationDataFlowSchema = exports.automationActorSelectionSchema = exports.automationTriggerSchema = exports.agentAvailabilitySchema = exports.applicationAgentSchema = exports.applicationAgentWriteSchema = exports.applicationAgentAvailabilitySchema = exports.APPLICATION_AGENT_AVAILABILITIES = exports.agentRequesterCeilingSchema = exports.agentRequesterCeilingWriteSchema = exports.AGENT_REQUESTER_CEILING_AUTONOMY = exports.delegationGrantSchema = exports.capabilityTicketRequestSchema = exports.capabilityCoordinatorSchema = exports.executionAuthorizationRefSchema = exports.capabilityCatalogBindingSchema = exports.grantLimitSchema = exports.toolGrantOverrideSchema = exports.resourceRefSchema = exports.foregroundExecutionAuthorizationInputSchema = exports.executionActorRefSchema = exports.actorRefSchema = exports.capabilityPackageSchema = exports.autonomyLevelSchema = exports.CAPABILITY_PACKAGES = exports.AUTONOMY_LEVELS = exports.costCenterUsageSchema = exports.providerCostSourceSchema = exports.PROVIDER_COST_SOURCES = exports.inferenceEconomicTreatmentSchema = exports.INFERENCE_ECONOMIC_TREATMENTS = exports.productEntitlementSchema = exports.costCenterSpendSchema = exports.costCenterSchema = exports.costCenterStatusSchema = exports.COST_CENTER_STATUSES = void 0;
-exports.serviceTokenOptionsSchema = exports.serviceTokenScopesSchema = exports.productPlanCatalogueSchema = exports.personalPlanCatalogueSchema = exports.personalPlanDisplayPriceSchema = exports.productSubscriptionCancellationResultSchema = exports.cancelProductSubscriptionSchema = exports.subscriptionCreditGrantsResponseSchema = exports.subscriptionCreditGrantSchema = exports.productSubscriptionsResponseSchema = exports.productSubscriptionSummarySchema = exports.isLoopbackOrigin = exports.inputSatisfiesCapabilityLimits = exports.canonicalCapabilityJson = exports.meteredGenerationSchema = exports.subjectProductAccessSchema = exports.productOfferSegmentSchema = exports.subjectProductGrantSnapshotSchema = exports.productAccessGrantSchema = exports.productSubscriptionSourceSchema = exports.productOfferSchema = exports.productBenefitSchema = exports.subjectProductAccessQuerySchema = exports.productDefinitionSchema = exports.inboxInferenceStreamEventSchema = exports.inboxThreadSummaryResponseSchema = exports.inboxSmartRepliesResponseSchema = exports.inboxNaturalSearchResponseSchema = exports.inboxInferenceTextResponseSchema = exports.inboxMessageInferenceParamsSchema = exports.inboxNaturalSearchRequestSchema = exports.INBOX_DAILY_BRIEF_SECTIONS = exports.inboxDailyBriefResponseSchema = exports.inboxDailyBriefRequestSchema = exports.inboxComposeRequestSchema = exports.emailAgentContextSchema = exports.emailContextMessageSchema = exports.emailContextMailboxSchema = exports.emailContextAddressSchema = exports.resolveCatalogInvocation = exports.matchCatalogInvocation = exports.findOverlappingCatalogInvocations = exports.catalogInvocationTemplatesEquivalent = exports.catalogInvocationsOverlap = void 0;
+exports.oxyApplicationIdSchema = exports.delegatedUserIdSchema = exports.oxyAccountIdSchema = exports.INFERENCE_CONTRACT_VERSION = exports.transparencyCheckpointListSchema = exports.transparencyInclusionProofSchema = exports.transparencyCheckpointSchema = exports.transparencyAnchorSchema = exports.transparencyCheckpointSignatureSchema = exports.identityLinkCompleteRequestSchema = exports.identityLinkProofRequestSchema = exports.identityLinkStateSchema = exports.identityLinkCreateResponseSchema = exports.parseIdentityLinkQrPayload = exports.buildIdentityLinkQrPayload = exports.identityLinkIdSchema = exports.IDENTITY_LINK_QR_PREFIX = exports.IDENTITY_LINK_STATUSES = exports.totpBackupCodesResponseSchema = exports.totpReauthRequestSchema = exports.totpConfirmRequestSchema = exports.totpEnrollResponseSchema = exports.signInMethodsSchema = exports.emailSetRequestSchema = exports.emailChangeStartRequestSchema = exports.signInMethodRemoveRequestSchema = exports.passwordSetRequestSchema = exports.reauthEmailStartRequestSchema = exports.REAUTH_ACTIONS = exports.reauthProofSchema = exports.isSecondFactorRequired = exports.signUpRequestSchema = exports.secondFactorRequiredSchema = exports.secondFactorSignInRequestSchema = exports.passwordSignInRequestSchema = exports.isEmailSignInChooseAccount = exports.emailSignInChooseRequestSchema = exports.emailSignInChooseAccountSchema = exports.emailSignInAccountOptionSchema = exports.EMAIL_ACCOUNTS_MAX = exports.EMAIL_SIGNIN_CHOICE_TTL_MS = exports.emailSignInPendingSchema = exports.emailSignInLinkResponseSchema = exports.emailSignInLinkRequestSchema = exports.emailSignInCollectRequestSchema = exports.EMAIL_SIGNIN_LONG_CODE_LENGTH = exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET = exports.normalizeEmailSignInCode = exports.emailSignInCodeSchema = exports.emailSignInConfirmRequestSchema = void 0;
+exports.priceVersionSchema = exports.priceVersionStatusSchema = exports.embeddingResponseSchema = exports.embeddingFailureSchema = exports.embeddingSuccessSchema = exports.embeddingUsageSchema = exports.embeddingVectorSchema = exports.inferenceErrorSchema = exports.providerErrorPassthroughSchema = exports.safeErrorTextSchema = exports.upstreamErrorCategorySchema = exports.inferenceErrorCodeSchema = exports.NON_RETRYABLE_INFERENCE_ERROR_CODES = exports.INFERENCE_ERROR_CODES = exports.inferenceAttributionSchema = exports.authenticatedPrincipalSchema = exports.billingPrincipalSchema = exports.inferenceScopeSchema = exports.INFERENCE_SCOPES = exports.unitPriceSchema = exports.usageQuantitySchema = exports.usageSourceSchema = exports.USAGE_SOURCES = exports.usageUnitSchema = exports.USAGE_UNITS = exports.moneySchema = exports.exactDecimalSchema = exports.INFERENCE_MONEY_SCALE = exports.currencyCodeSchema = exports.RESERVED_ALIA_PUBLISHER = exports.inferenceFundingTierSchema = exports.inferenceRegionSchema = exports.deploymentIdSchema = exports.inferenceProviderSlugSchema = exports.routingProfileSlugSchema = exports.routingProfileIdSchema = exports.modelReferenceSchema = exports.modelRevisionLabelSchema = exports.modelIdSchema = exports.modelSlugSchema = exports.publisherSlugSchema = exports.sha256DigestSchema = exports.inferenceHttpsUrlSchema = exports.inferenceDateSchema = exports.inferenceTimestampSchema = exports.inferenceEnvironmentSchema = exports.idempotencyKeySchema = exports.generationIdSchema = exports.requestIdSchema = exports.oxyCredentialIdSchema = void 0;
+exports.inferenceContentSourceSchema = exports.modelDocumentationSchema = exports.modelReleaseIngestionResultSchema = exports.modelReleaseIngestionRequestSchema = exports.modelLineDeclarationSchema = exports.modelGpaiDocumentationSchema = exports.modelDownstreamDocumentationSchema = exports.SYSTEMIC_RISK_COMPUTE_THRESHOLD_FLOPS = exports.trainingComputeFlopsSchema = exports.modelSystemicRiskTierSchema = exports.modelDistributionMethodSchema = exports.aliaModelReleaseManifestSchema = exports.aliaReleaseSignatureSchema = exports.aliaReleaseArtifactSchema = exports.authorizedRouteSchema = exports.effectiveSameModelDeployment = exports.routingPolicyReferenceSchema = exports.routingPolicySchema = exports.routingFallbackPolicySchema = exports.routingPolicyScopeSchema = exports.routingTargetSchema = exports.modelCatalogueEntrySchema = exports.catalogueServingProviderSummarySchema = exports.cataloguePublisherSummarySchema = exports.routingProfileSchema = exports.routingProfileCandidateSchema = exports.modelDeploymentSchema = exports.inferenceProviderSchema = exports.modelRevisionSchema = exports.catalogueModelSchema = exports.modelPublisherSchema = exports.modelSafetyMetadataSchema = exports.modelEvaluationResultSchema = exports.modelDeprecationSchema = exports.commercialPermissionSchema = exports.availabilityScopeSchema = exports.inferenceDataPolicySchema = exports.modelProvenanceSchema = exports.modelLicenseSchema = exports.modelCapabilitiesSchema = exports.modelRealtimeCapabilitiesSchema = exports.realtimeSessionTransportSchema = exports.realtimeSessionKindSchema = exports.inferenceApiFormatSchema = exports.modelPowerClassSchema = exports.powerLevelSchema = exports.reasoningEffortSchema = exports.inferenceOutputModalitySchema = exports.inferenceModalitySchema = exports.priceSnapshotSchema = void 0;
+exports.realtimeItemCreateCommandSchema = exports.realtimeSessionUpdateCommandSchema = exports.realtimeResponseParametersSchema = exports.realtimeConversationItemSchema = exports.realtimeContentPartSchema = exports.realtimeSessionRequestSchema = exports.realtimeClientMetadataSchema = exports.realtimeSessionLimitsSchema = exports.realtimeSessionConfigUpdateSchema = exports.realtimeSessionConfigSchema = exports.realtimeTranslationSchema = exports.realtimeInputTranscriptionSchema = exports.realtimeTurnDetectionSchema = exports.realtimeOutputModalitySchema = exports.realtimeAudioFormatSchema = exports.realtimeResponseIdSchema = exports.realtimeItemIdSchema = exports.realtimeCommandIdSchema = exports.MAX_REALTIME_RESUME_WINDOW_MS = exports.MAX_REALTIME_SESSION_AUDIO_BYTES = exports.MAX_REALTIME_SESSION_DURATION_MS = exports.MAX_REALTIME_AUDIO_FRAME_BASE64_LENGTH = exports.inferenceStreamEventSchema = exports.inferenceStreamDoneEventSchema = exports.inferenceFinishReasonSchema = exports.inferenceStreamErrorEventSchema = exports.inferenceStreamRouteSwitchEventSchema = exports.inferenceRouteSwitchReasonSchema = exports.inferenceRouteSwitchDetailSchema = exports.inferenceStreamUsageEventSchema = exports.inferenceStreamToolCallEventSchema = exports.inferenceStreamAudioEventSchema = exports.MAX_INFERENCE_AUDIO_BYTES = exports.inferenceAudioMediaTypeSchema = exports.inferenceStreamDeltaEventSchema = exports.inferenceStreamStartEventSchema = exports.inferenceAudioOutputParametersSchema = exports.inferenceSpeechParametersSchema = exports.inferenceRequestSchema = exports.clientRequestMetadataSchema = exports.responseFormatSchema = exports.toolChoiceSchema = exports.toolDefinitionSchema = exports.inferenceReasoningSchema = exports.samplingParametersSchema = exports.inferenceInputSchema = exports.inferenceMessageSchema = exports.inferenceMessageRoleSchema = exports.inferenceToolCallSchema = exports.inferenceContentPartSchema = void 0;
+exports.kaanaCredentialIdentitySchema = exports.kaanaCredentialOperationActionSchema = exports.kaanaCredentialOperationIdSchema = exports.kaanaCredentialHandleSchema = exports.providerConnectionScopeSchema = exports.usageRefundSchema = exports.usageRefundReasonSchema = exports.usageRefundSubjectSchema = exports.usageReceiptSchema = exports.normalizedUsageReportSchema = exports.inferenceRequestOutcomeSchema = exports.usageReservationSchema = exports.usageReservationStatusSchema = exports.usageReservationRequestSchema = exports.realtimeServerEventSchema = exports.realtimeSessionClosedEventSchema = exports.realtimeSessionCloseReasonSchema = exports.realtimeErrorEventSchema = exports.realtimeResponseDoneEventSchema = exports.realtimeResponseStatusSchema = exports.realtimeToolCallEventSchema = exports.realtimeTextDeltaEventSchema = exports.realtimeTranscriptDoneEventSchema = exports.realtimeTranscriptDeltaEventSchema = exports.realtimeTranscriptSourceSchema = exports.realtimeOutputAudioDoneEventSchema = exports.realtimeOutputAudioDeltaEventSchema = exports.realtimeResponseCreatedEventSchema = exports.realtimeInputAudioClearedEventSchema = exports.realtimeInputAudioCommittedEventSchema = exports.realtimeSpeechStoppedEventSchema = exports.realtimeSpeechStartedEventSchema = exports.realtimeItemTruncatedEventSchema = exports.realtimeItemDeletedEventSchema = exports.realtimeItemDoneEventSchema = exports.realtimeItemAddedEventSchema = exports.realtimeCommandAcceptedEventSchema = exports.realtimeSessionResumedEventSchema = exports.realtimeSessionUpdatedEventSchema = exports.realtimeSessionCreatedEventSchema = exports.realtimeClientCommandSchema = exports.realtimeSessionCloseCommandSchema = exports.realtimeSessionResumeCommandSchema = exports.realtimeResponseCancelCommandSchema = exports.realtimeResponseCreateCommandSchema = exports.realtimeInputAudioClearCommandSchema = exports.realtimeInputAudioCommitCommandSchema = exports.realtimeInputAudioAppendCommandSchema = exports.realtimeItemTruncateCommandSchema = exports.realtimeItemDeleteCommandSchema = void 0;
+exports.planAllowanceSchema = exports.LIVE_PRODUCT_PLAN_STATUSES = exports.productPlanStatusSchema = exports.PRODUCT_PLAN_STATUSES = exports.reconciliationReportSchema = exports.reconciliationRunSchema = exports.reconciliationDiscrepancySchema = exports.reconciliationRunStatusSchema = exports.RECONCILIATION_RUN_STATUSES = exports.reconciliationDiscrepancyKindSchema = exports.RECONCILIATION_DISCREPANCY_KINDS = exports.autoRechargeAttemptSchema = exports.autoRechargeStatusSchema = exports.AUTO_RECHARGE_STATUSES = exports.externalPaymentSchema = exports.externalPaymentKindSchema = exports.EXTERNAL_PAYMENT_KINDS = exports.externalPaymentProviderSchema = exports.EXTERNAL_PAYMENT_PROVIDERS = exports.billingInvoiceSchema = exports.billingInvoiceStatusSchema = exports.BILLING_INVOICE_STATUSES = exports.accountBillingStateSchema = exports.billingProfileSchema = exports.autoRechargeSchema = exports.billingProfileStatusSchema = exports.BILLING_PROFILE_STATUSES = exports.billingModeSchema = exports.BILLING_MODES = exports.providerConnectionSchema = exports.providerConnectionStatusSchema = exports.providerConnectionValidationSchema = exports.providerCredentialCustodyStateSchema = exports.providerCredentialValidationDeploymentSchema = exports.providerCredentialValidationOperationSchema = exports.kaanaCredentialValidationOutcomeSchema = exports.kaanaCredentialValidationFailureCodeSchema = exports.kaanaCredentialValidationOutcomeStateSchema = exports.kaanaCredentialValidationTaskSchema = exports.kaanaCredentialOutcomeSchema = exports.kaanaCredentialConflictOutcomeSchema = exports.kaanaCredentialAppliedOutcomeSchema = exports.kaanaCredentialOutcomeRequestSchema = exports.kaanaCredentialRevokeOutcomeRequestSchema = exports.kaanaCredentialRotateOutcomeRequestSchema = exports.kaanaCredentialCreateOutcomeRequestSchema = exports.kaanaCredentialMutationSchema = exports.kaanaCredentialRevokeMutationSchema = exports.kaanaCredentialRotateMutationSchema = exports.kaanaCredentialCreateMutationSchema = void 0;
+exports.catalogRegistrationSchema = exports.appCapabilityCatalogSchema = exports.CATALOG_INTERNAL_TRANSPORTS = exports.catalogFeatureSchema = exports.catalogEventSchema = exports.catalogToolSchema = exports.auditEventSchema = exports.auditResultSchema = exports.policyDecisionSchema = exports.invocationPrincipalSchema = exports.capabilityTicketClaimsSchema = exports.automationDefinitionSchema = exports.automationDataFlowSchema = exports.automationActorSelectionSchema = exports.automationTriggerSchema = exports.agentAvailabilitySchema = exports.applicationAgentSchema = exports.applicationAgentWriteSchema = exports.applicationAgentAvailabilitySchema = exports.APPLICATION_AGENT_AVAILABILITIES = exports.agentRequesterCeilingSchema = exports.agentRequesterCeilingWriteSchema = exports.AGENT_REQUESTER_CEILING_AUTONOMY = exports.delegationGrantSchema = exports.capabilityTicketRequestSchema = exports.capabilityCoordinatorSchema = exports.executionAuthorizationRefSchema = exports.capabilityCatalogBindingSchema = exports.grantLimitSchema = exports.toolGrantOverrideSchema = exports.resourceRefSchema = exports.foregroundExecutionAuthorizationInputSchema = exports.executionActorRefSchema = exports.actorRefSchema = exports.capabilityPackageSchema = exports.autonomyLevelSchema = exports.CAPABILITY_PACKAGES = exports.AUTONOMY_LEVELS = exports.costCenterUsageSchema = exports.providerCostSourceSchema = exports.PROVIDER_COST_SOURCES = exports.inferenceEconomicTreatmentSchema = exports.INFERENCE_ECONOMIC_TREATMENTS = exports.productEntitlementSchema = exports.costCenterSpendSchema = exports.costCenterSchema = exports.costCenterStatusSchema = exports.COST_CENTER_STATUSES = exports.payAsYouGoEntitlementSchema = exports.productPlanSchema = void 0;
+exports.serviceTokenOptionsSchema = exports.serviceTokenScopesSchema = exports.productPlanCatalogueSchema = exports.personalPlanCatalogueSchema = exports.personalPlanDisplayPriceSchema = exports.productSubscriptionCancellationResultSchema = exports.cancelProductSubscriptionSchema = exports.subscriptionCreditGrantsResponseSchema = exports.subscriptionCreditGrantSchema = exports.productSubscriptionsResponseSchema = exports.productSubscriptionSummarySchema = exports.isLoopbackOrigin = exports.inputSatisfiesCapabilityLimits = exports.canonicalCapabilityJson = exports.meteredGenerationSchema = exports.subjectProductAccessSchema = exports.productOfferSegmentSchema = exports.subjectProductGrantSnapshotSchema = exports.productAccessGrantSchema = exports.productSubscriptionSourceSchema = exports.productOfferSchema = exports.productBenefitSchema = exports.subjectProductAccessQuerySchema = exports.productDefinitionSchema = exports.inboxInferenceStreamEventSchema = exports.inboxThreadSummaryResponseSchema = exports.inboxSmartRepliesResponseSchema = exports.inboxNaturalSearchResponseSchema = exports.inboxInferenceTextResponseSchema = exports.inboxMessageInferenceParamsSchema = exports.inboxNaturalSearchRequestSchema = exports.INBOX_DAILY_BRIEF_SECTIONS = exports.inboxDailyBriefResponseSchema = exports.inboxDailyBriefRequestSchema = exports.inboxComposeRequestSchema = exports.emailAgentContextSchema = exports.emailContextMessageSchema = exports.emailContextMailboxSchema = exports.emailContextAddressSchema = exports.resolveCatalogInvocation = exports.matchCatalogInvocation = exports.findOverlappingCatalogInvocations = exports.catalogInvocationTemplatesEquivalent = exports.catalogInvocationsOverlap = exports.catalogInvocationPathParameters = exports.normalizedAppEventSchema = void 0;
 var accountGraph_1 = require("./accountGraph");
 Object.defineProperty(exports, "ACCOUNT_KINDS", { enumerable: true, get: function () { return accountGraph_1.ACCOUNT_KINDS; } });
 Object.defineProperty(exports, "accountKindSchema", { enumerable: true, get: function () { return accountGraph_1.accountKindSchema; } });
@@ -421,10 +421,12 @@ Object.defineProperty(exports, "secondFactorRequiredSchema", { enumerable: true,
 Object.defineProperty(exports, "signUpRequestSchema", { enumerable: true, get: function () { return signIn_1.signUpRequestSchema; } });
 Object.defineProperty(exports, "isSecondFactorRequired", { enumerable: true, get: function () { return signIn_1.isSecondFactorRequired; } });
 Object.defineProperty(exports, "reauthProofSchema", { enumerable: true, get: function () { return signIn_1.reauthProofSchema; } });
-Object.defineProperty(exports, "emailReauthProofSchema", { enumerable: true, get: function () { return signIn_1.emailReauthProofSchema; } });
 Object.defineProperty(exports, "REAUTH_ACTIONS", { enumerable: true, get: function () { return signIn_1.REAUTH_ACTIONS; } });
 Object.defineProperty(exports, "reauthEmailStartRequestSchema", { enumerable: true, get: function () { return signIn_1.reauthEmailStartRequestSchema; } });
 Object.defineProperty(exports, "passwordSetRequestSchema", { enumerable: true, get: function () { return signIn_1.passwordSetRequestSchema; } });
+Object.defineProperty(exports, "signInMethodRemoveRequestSchema", { enumerable: true, get: function () { return signIn_1.signInMethodRemoveRequestSchema; } });
+Object.defineProperty(exports, "emailChangeStartRequestSchema", { enumerable: true, get: function () { return signIn_1.emailChangeStartRequestSchema; } });
+Object.defineProperty(exports, "emailSetRequestSchema", { enumerable: true, get: function () { return signIn_1.emailSetRequestSchema; } });
 Object.defineProperty(exports, "signInMethodsSchema", { enumerable: true, get: function () { return signIn_1.signInMethodsSchema; } });
 Object.defineProperty(exports, "totpEnrollResponseSchema", { enumerable: true, get: function () { return signIn_1.totpEnrollResponseSchema; } });
 Object.defineProperty(exports, "totpConfirmRequestSchema", { enumerable: true, get: function () { return signIn_1.totpConfirmRequestSchema; } });

package/dist/cjs/signIn.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.totpBackupCodesResponseSchema = exports.totpReauthRequestSchema = exports.totpConfirmRequestSchema = exports.totpEnrollResponseSchema = exports.signInMethodsSchema = exports.passwordSetRequestSchema = exports.emailReauthProofSchema = exports.reauthProofSchema = exports.reauthEmailStartRequestSchema = exports.emailSignInChooseRequestSchema = exports.emailSignInChooseAccountSchema = exports.emailSignInAccountOptionSchema = exports.emailSignInPendingSchema = exports.secondFactorRequiredSchema = exports.signUpRequestSchema = exports.secondFactorSignInRequestSchema = exports.passwordSignInRequestSchema = exports.emailSignInLinkResponseSchema = exports.emailSignInLinkRequestSchema = exports.emailSignInCollectRequestSchema = exports.emailSignInConfirmRequestSchema = exports.emailSignInCodeSchema = exports.emailSignInStartResponseSchema = exports.emailSignInStartRequestSchema = exports.secondFactorCodeSchema = exports.newPasswordSchema = exports.passwordInputSchema = exports.signInIdentifierSchema = exports.SIGN_IN_ERROR_CODES = exports.REAUTH_ACTIONS = exports.isEmailSignInChooseAccount = exports.isSecondFactorRequired = exports.EMAIL_ACCOUNTS_MAX = exports.EMAIL_SIGNIN_CHOICE_TTL_MS = exports.normalizeEmailSignInCode = exports.EMAIL_SIGNIN_LONG_CODE_LENGTH = exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET = exports.TOTP_BACKUP_CODE_COUNT = exports.TOTP_PERIOD_SECONDS = exports.TOTP_DIGITS = exports.PASSWORD_MAX_LENGTH = exports.PASSWORD_MIN_LENGTH = exports.SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = exports.SIGNIN_SECOND_FACTOR_TTL_MS = exports.EMAIL_SIGNIN_LINK_TTL_MS = void 0;
+exports.totpBackupCodesResponseSchema = exports.totpReauthRequestSchema = exports.totpConfirmRequestSchema = exports.totpEnrollResponseSchema = exports.signInMethodsSchema = exports.emailSetRequestSchema = exports.emailChangeStartRequestSchema = exports.signInMethodRemoveRequestSchema = exports.passwordSetRequestSchema = exports.reauthProofSchema = exports.reauthEmailStartRequestSchema = exports.emailSignInChooseRequestSchema = exports.emailSignInChooseAccountSchema = exports.emailSignInAccountOptionSchema = exports.emailSignInPendingSchema = exports.secondFactorRequiredSchema = exports.signUpRequestSchema = exports.secondFactorSignInRequestSchema = exports.passwordSignInRequestSchema = exports.emailSignInLinkResponseSchema = exports.emailSignInLinkRequestSchema = exports.emailSignInCollectRequestSchema = exports.emailSignInConfirmRequestSchema = exports.emailSignInCodeSchema = exports.emailSignInStartResponseSchema = exports.emailSignInStartRequestSchema = exports.secondFactorCodeSchema = exports.newPasswordSchema = exports.passwordInputSchema = exports.signInIdentifierSchema = exports.SIGN_IN_ERROR_CODES = exports.REAUTH_ACTIONS = exports.isEmailSignInChooseAccount = exports.isSecondFactorRequired = exports.EMAIL_ACCOUNTS_MAX = exports.EMAIL_SIGNIN_CHOICE_TTL_MS = exports.normalizeEmailSignInCode = exports.EMAIL_SIGNIN_LONG_CODE_LENGTH = exports.EMAIL_SIGNIN_LONG_CODE_ALPHABET = exports.TOTP_BACKUP_CODE_COUNT = exports.TOTP_PERIOD_SECONDS = exports.TOTP_DIGITS = exports.PASSWORD_MAX_LENGTH = exports.PASSWORD_MIN_LENGTH = exports.SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = exports.SIGNIN_SECOND_FACTOR_TTL_MS = exports.EMAIL_SIGNIN_LINK_TTL_MS = void 0;
 /**
  * Signing in: an email code or link, an optional password,
  * and an optional authenticator app (TOTP) as a second factor.
@@ -228,18 +228,6 @@ exports.reauthProofSchema = zod_1.z
     .refine((proof) => proof.password !== undefined || proof.emailCode !== undefined, {
     message: 'password or emailCode is required',
 });
-/** A proof by email code only (+ TOTP): deleting an account, linking Commons. */
-exports.emailReauthProofSchema = zod_1.z
-    .object({
-    emailCode: zod_1.z
-        .object({
-        verificationId: zod_1.z.string().trim().min(1).max(64),
-        code: sixDigits,
-    })
-        .strict(),
-    totpCode: exports.secondFactorCodeSchema.optional(),
-})
-    .strict();
 /** `PUT /users/me/password` — set or change the password. */
 exports.passwordSetRequestSchema = zod_1.z
     .object({
@@ -249,6 +237,27 @@ exports.passwordSetRequestSchema = zod_1.z
     revokeOtherSessions: zod_1.z.boolean().optional(),
 })
     .strict();
+/**
+ * `DELETE /users/me/password` — only while the account has an email to sign
+ * in with; `DELETE /users/me/email` — only while it has a password, and
+ * confirmed with that password.
+ */
+exports.signInMethodRemoveRequestSchema = zod_1.z.object({ reauth: exports.reauthProofSchema }).strict();
+/** `POST /users/me/email/verify/start` — a code to the address the account moves to. */
+exports.emailChangeStartRequestSchema = zod_1.z.object({ email: accountEmail_1.emailAddressSchema }).strict();
+/**
+ * `PUT /users/me/email` — add or change the email: the NEW address and the
+ * code it got (`verificationId`, `code`), and the proof it is the person (the
+ * password, or a code to the current email; plus the authenticator's).
+ */
+exports.emailSetRequestSchema = zod_1.z
+    .object({
+    email: accountEmail_1.emailAddressSchema,
+    verificationId: zod_1.z.string().trim().min(1).max(64),
+    code: sixDigits,
+    reauth: exports.reauthProofSchema,
+})
+    .strict();
 exports.signInMethodsSchema = zod_1.z.object({
     hasEmail: zod_1.z.boolean(),
     hasPassword: zod_1.z.boolean(),

package/dist/esm/client/accountEmail.js

@@ -10,8 +10,10 @@ import { email, exact, int, maxLength, minLength, number, object, pattern, posit
  * - `reauth`: a signed-in person proving it is them before a sensitive step
  *   (`POST /users/me/reauth/email`): a password, an authenticator, deleting the
  *   account, linking Commons.
+ * - `email_change`: a signed-in account proving the NEW address it moves to
+ *   (`POST /users/me/email/verify/start`); bound to the account and that address.
  */
-export const EMAIL_VERIFICATION_PURPOSES = ['signup', 'signin', 'reauth'];
+export const EMAIL_VERIFICATION_PURPOSES = ['signup', 'signin', 'reauth', 'email_change'];
 /** Digits in a code. */
 export const EMAIL_CODE_LENGTH = 6;
 /** How long a code can be confirmed. */

package/dist/esm/client/signIn.js

@@ -60,6 +60,7 @@ export function isEmailSignInChooseAccount(result) {
  */
 export const REAUTH_ACTIONS = [
     'change_password',
+    'change_email',
     'totp',
     'link_commons',
     'delete_account',
@@ -102,6 +103,12 @@ export const SIGN_IN_ERROR_CODES = {
     usernameTaken: 'USERNAME_TAKEN',
     /** The email already holds `EMAIL_ACCOUNTS_MAX` accounts: no sign-up adds another. */
     emailAccountsFull: 'EMAIL_ACCOUNTS_FULL',
+    /** Removing the one way in left (the email when there is no password, or the reverse). */
+    lastSignInMethod: 'LAST_SIGN_IN_METHOD',
+    /** Removing the email needs a password set, and is confirmed with it. */
+    passwordRequired: 'PASSWORD_REQUIRED',
+    /** The new email is the one the account already has. */
+    emailUnchanged: 'EMAIL_UNCHANGED',
 };
 /* -------------------------------------------------------------------------- */
 /*  Checks                                                                    */

package/dist/esm/identityLink.js

@@ -25,7 +25,7 @@
  */
 import { z } from 'zod';
 import { identityProofSchema } from './identityProof.js';
-import { emailReauthProofSchema } from './signIn.js';
+import { reauthProofSchema } from './signIn.js';
 // The Zod-free half of this contract lives in `./client/` (`@oxy.so/contracts/client`);
 // it is re-exported here so the root entry is unchanged.
 import { IDENTITY_LINK_STATUSES, IDENTITY_LINK_QR_PREFIX, LINK_ID, CHALLENGE, } from './client/identityLink.js';
@@ -61,9 +61,7 @@ export const identityLinkProofRequestSchema = z
     .strict();
 /**
  * `POST /identity/link/:linkId/complete` — the account's own confirmation: a
- * code just sent to its email for this link (`reauth`, plus its authenticator
- * code when it has one).
+ * code just sent to its email for this link, or its password when it has no
+ * email (`reauth`, plus its authenticator code when it has one).
  */
-export const identityLinkCompleteRequestSchema = z
-    .object({ reauth: emailReauthProofSchema })
-    .strict();
+export const identityLinkCompleteRequestSchema = z.object({ reauth: reauthProofSchema }).strict();

package/dist/esm/index.js

@@ -100,7 +100,7 @@ export {
 EMAIL_VERIFICATION_PURPOSES, EMAIL_CODE_LENGTH, EMAIL_CODE_TTL_MS, EMAIL_CODE_MAX_ATTEMPTS, EMAIL_TICKET_TTL_MS, EMAIL_VERIFICATION_ERROR_CODES, emailAddressSchema, emailTicketSchema, emailVerificationStartRequestSchema, emailVerificationStartResponseSchema, emailVerificationConfirmRequestSchema, emailVerificationConfirmResponseSchema, } from './accountEmail.js';
 export { 
 // Email code/link, password and authenticator sign-in
-EMAIL_SIGNIN_LINK_TTL_MS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, PASSWORD_MIN_LENGTH, PASSWORD_MAX_LENGTH, TOTP_DIGITS, TOTP_PERIOD_SECONDS, TOTP_BACKUP_CODE_COUNT, SIGN_IN_ERROR_CODES, signInIdentifierSchema, passwordInputSchema, newPasswordSchema, secondFactorCodeSchema, emailSignInStartRequestSchema, emailSignInStartResponseSchema, emailSignInConfirmRequestSchema, emailSignInCodeSchema, normalizeEmailSignInCode, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, emailSignInCollectRequestSchema, emailSignInLinkRequestSchema, emailSignInLinkResponseSchema, emailSignInPendingSchema, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_ACCOUNTS_MAX, emailSignInAccountOptionSchema, emailSignInChooseAccountSchema, emailSignInChooseRequestSchema, isEmailSignInChooseAccount, passwordSignInRequestSchema, secondFactorSignInRequestSchema, secondFactorRequiredSchema, signUpRequestSchema, isSecondFactorRequired, reauthProofSchema, emailReauthProofSchema, REAUTH_ACTIONS, reauthEmailStartRequestSchema, passwordSetRequestSchema, signInMethodsSchema, totpEnrollResponseSchema, totpConfirmRequestSchema, totpReauthRequestSchema, totpBackupCodesResponseSchema, } from './signIn.js';
+EMAIL_SIGNIN_LINK_TTL_MS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, PASSWORD_MIN_LENGTH, PASSWORD_MAX_LENGTH, TOTP_DIGITS, TOTP_PERIOD_SECONDS, TOTP_BACKUP_CODE_COUNT, SIGN_IN_ERROR_CODES, signInIdentifierSchema, passwordInputSchema, newPasswordSchema, secondFactorCodeSchema, emailSignInStartRequestSchema, emailSignInStartResponseSchema, emailSignInConfirmRequestSchema, emailSignInCodeSchema, normalizeEmailSignInCode, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, emailSignInCollectRequestSchema, emailSignInLinkRequestSchema, emailSignInLinkResponseSchema, emailSignInPendingSchema, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_ACCOUNTS_MAX, emailSignInAccountOptionSchema, emailSignInChooseAccountSchema, emailSignInChooseRequestSchema, isEmailSignInChooseAccount, passwordSignInRequestSchema, secondFactorSignInRequestSchema, secondFactorRequiredSchema, signUpRequestSchema, isSecondFactorRequired, reauthProofSchema, REAUTH_ACTIONS, reauthEmailStartRequestSchema, passwordSetRequestSchema, signInMethodRemoveRequestSchema, emailChangeStartRequestSchema, emailSetRequestSchema, signInMethodsSchema, totpEnrollResponseSchema, totpConfirmRequestSchema, totpReauthRequestSchema, totpBackupCodesResponseSchema, } from './signIn.js';
 export { 
 // Linking Commons to an account without a key (ADR 0029 D3)
 IDENTITY_LINK_STATUSES, IDENTITY_LINK_QR_PREFIX, identityLinkIdSchema, buildIdentityLinkQrPayload, parseIdentityLinkQrPayload, identityLinkCreateResponseSchema, identityLinkStateSchema, identityLinkProofRequestSchema, identityLinkCompleteRequestSchema, } from './identityLink.js';

package/dist/esm/signIn.js

@@ -208,18 +208,6 @@ export const reauthProofSchema = z
     .refine((proof) => proof.password !== undefined || proof.emailCode !== undefined, {
     message: 'password or emailCode is required',
 });
-/** A proof by email code only (+ TOTP): deleting an account, linking Commons. */
-export const emailReauthProofSchema = z
-    .object({
-    emailCode: z
-        .object({
-        verificationId: z.string().trim().min(1).max(64),
-        code: sixDigits,
-    })
-        .strict(),
-    totpCode: secondFactorCodeSchema.optional(),
-})
-    .strict();
 /** `PUT /users/me/password` — set or change the password. */
 export const passwordSetRequestSchema = z
     .object({
@@ -229,6 +217,27 @@ export const passwordSetRequestSchema = z
     revokeOtherSessions: z.boolean().optional(),
 })
     .strict();
+/**
+ * `DELETE /users/me/password` — only while the account has an email to sign
+ * in with; `DELETE /users/me/email` — only while it has a password, and
+ * confirmed with that password.
+ */
+export const signInMethodRemoveRequestSchema = z.object({ reauth: reauthProofSchema }).strict();
+/** `POST /users/me/email/verify/start` — a code to the address the account moves to. */
+export const emailChangeStartRequestSchema = z.object({ email: emailAddressSchema }).strict();
+/**
+ * `PUT /users/me/email` — add or change the email: the NEW address and the
+ * code it got (`verificationId`, `code`), and the proof it is the person (the
+ * password, or a code to the current email; plus the authenticator's).
+ */
+export const emailSetRequestSchema = z
+    .object({
+    email: emailAddressSchema,
+    verificationId: z.string().trim().min(1).max(64),
+    code: sixDigits,
+    reauth: reauthProofSchema,
+})
+    .strict();
 export const signInMethodsSchema = z.object({
     hasEmail: z.boolean(),
     hasPassword: z.boolean(),

package/dist/types/client/accountEmail.d.ts

@@ -10,8 +10,10 @@ import type { EmailVerificationConfirmResponse, EmailVerificationStartResponse }
  * - `reauth`: a signed-in person proving it is them before a sensitive step
  *   (`POST /users/me/reauth/email`): a password, an authenticator, deleting the
  *   account, linking Commons.
+ * - `email_change`: a signed-in account proving the NEW address it moves to
+ *   (`POST /users/me/email/verify/start`); bound to the account and that address.
  */
-export declare const EMAIL_VERIFICATION_PURPOSES: readonly ["signup", "signin", "reauth"];
+export declare const EMAIL_VERIFICATION_PURPOSES: readonly ["signup", "signin", "reauth", "email_change"];
 export type EmailVerificationPurpose = (typeof EMAIL_VERIFICATION_PURPOSES)[number];
 /** Digits in a code. */
 export declare const EMAIL_CODE_LENGTH = 6;

package/dist/types/client/signIn.d.ts

@@ -50,7 +50,7 @@ export declare function isEmailSignInChooseAccount(result: EmailSignInStepResult
  * What a re-verification email code confirms. The code is bound to it: a code
  * asked for one change never authorises another, and the email names it.
  */
-export declare const REAUTH_ACTIONS: readonly ["change_password", "totp", "link_commons", "delete_account", "credentials_manage", "supervision", "supervision_purchase"];
+export declare const REAUTH_ACTIONS: readonly ["change_password", "change_email", "totp", "link_commons", "delete_account", "credentials_manage", "supervision", "supervision_purchase"];
 export type ReauthAction = (typeof REAUTH_ACTIONS)[number];
 /**
  * Stable error codes (`error.code` in the API error body). Clients map these
@@ -87,6 +87,12 @@ export declare const SIGN_IN_ERROR_CODES: {
     readonly usernameTaken: "USERNAME_TAKEN";
     /** The email already holds `EMAIL_ACCOUNTS_MAX` accounts: no sign-up adds another. */
     readonly emailAccountsFull: "EMAIL_ACCOUNTS_FULL";
+    /** Removing the one way in left (the email when there is no password, or the reverse). */
+    readonly lastSignInMethod: "LAST_SIGN_IN_METHOD";
+    /** Removing the email needs a password set, and is confirmed with it. */
+    readonly passwordRequired: "PASSWORD_REQUIRED";
+    /** The new email is the one the account already has. */
+    readonly emailUnchanged: "EMAIL_UNCHANGED";
 };
 export type SignInErrorCode = (typeof SIGN_IN_ERROR_CODES)[keyof typeof SIGN_IN_ERROR_CODES];
 export declare const emailSignInStartResponseCheck: import("./check").Check<EmailSignInStartResponse>;

package/dist/types/identityLink.d.ts

@@ -89,12 +89,13 @@ export declare const identityLinkProofRequestSchema: z.ZodObject<{
 export type IdentityLinkProofRequest = z.infer<typeof identityLinkProofRequestSchema>;
 /**
  * `POST /identity/link/:linkId/complete` — the account's own confirmation: a
- * code just sent to its email for this link (`reauth`, plus its authenticator
- * code when it has one).
+ * code just sent to its email for this link, or its password when it has no
+ * email (`reauth`, plus its authenticator code when it has one).
  */
 export declare const identityLinkCompleteRequestSchema: z.ZodObject<{
-    reauth: z.ZodObject<{
-        emailCode: z.ZodObject<{
+    reauth: z.ZodEffects<z.ZodObject<{
+        password: z.ZodOptional<z.ZodString>;
+        emailCode: z.ZodOptional<z.ZodObject<{
             verificationId: z.ZodString;
             code: z.ZodString;
         }, "strict", z.ZodTypeAny, {
@@ -103,35 +104,53 @@ export declare const identityLinkCompleteRequestSchema: z.ZodObject<{
         }, {
             code: string;
             verificationId: string;
-        }>;
+        }>>;
         totpCode: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
-        emailCode: {
+        password?: string | undefined;
+        emailCode?: {
             code: string;
             verificationId: string;
-        };
+        } | undefined;
         totpCode?: string | undefined;
     }, {
-        emailCode: {
+        password?: string | undefined;
+        emailCode?: {
             code: string;
             verificationId: string;
-        };
+        } | undefined;
+        totpCode?: string | undefined;
+    }>, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
         totpCode?: string | undefined;
     }>;
 }, "strict", z.ZodTypeAny, {
     reauth: {
-        emailCode: {
+        password?: string | undefined;
+        emailCode?: {
             code: string;
             verificationId: string;
-        };
+        } | undefined;
         totpCode?: string | undefined;
     };
 }, {
     reauth: {
-        emailCode: {
+        password?: string | undefined;
+        emailCode?: {
             code: string;
             verificationId: string;
-        };
+        } | undefined;
         totpCode?: string | undefined;
     };
 }>;

package/dist/types/index.d.ts

@@ -58,8 +58,8 @@ export type { IdentityProofAction, IdentityErrorCode, IdentityProofClaims, Ident
 export { updatePlatformSchema, updateStatusSchema, updateAssetStatusSchema, sha256HexSchema, channelNameSchema, runtimeVersionSchema, rolloutPercentSchema, assetInitItemSchema, assetInitRequestSchema, assetUploadTicketSchema, assetInitResponseSchema, assetCompleteRequestSchema, assetCompleteResultItemSchema, assetCompleteResponseSchema, updateAssetRefSchema, createUpdateRequestSchema, updateSchema, createUpdateResponseSchema, rollbackToEmbeddedEntrySchema, channelSchema, channelListResponseSchema, updateListResponseSchema, rollbackRequestSchema, rollbackToEmbeddedRequestSchema, promoteRequestSchema, updateRolloutPatchSchema, } from './updates';
 export type { UpdatePlatform, UpdateStatus, UpdateAssetStatus, AssetInitItem, AssetInitRequest, AssetUploadTicket, AssetInitResponse, AssetCompleteRequest, AssetCompleteResultItem, AssetCompleteResponse, UpdateAssetRef, CreateUpdateRequest, Update, CreateUpdateResponse, RollbackToEmbeddedEntry, Channel, ChannelListResponse, UpdateListResponse, RollbackRequest, RollbackToEmbeddedRequest, PromoteRequest, UpdateRolloutPatch, } from './updates';
 export { EMAIL_VERIFICATION_PURPOSES, EMAIL_CODE_LENGTH, EMAIL_CODE_TTL_MS, EMAIL_CODE_MAX_ATTEMPTS, EMAIL_TICKET_TTL_MS, EMAIL_VERIFICATION_ERROR_CODES, emailAddressSchema, emailTicketSchema, emailVerificationStartRequestSchema, emailVerificationStartResponseSchema, emailVerificationConfirmRequestSchema, emailVerificationConfirmResponseSchema, } from './accountEmail';
-export { EMAIL_SIGNIN_LINK_TTL_MS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, PASSWORD_MIN_LENGTH, PASSWORD_MAX_LENGTH, TOTP_DIGITS, TOTP_PERIOD_SECONDS, TOTP_BACKUP_CODE_COUNT, SIGN_IN_ERROR_CODES, signInIdentifierSchema, passwordInputSchema, newPasswordSchema, secondFactorCodeSchema, emailSignInStartRequestSchema, emailSignInStartResponseSchema, emailSignInConfirmRequestSchema, emailSignInCodeSchema, normalizeEmailSignInCode, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, emailSignInCollectRequestSchema, emailSignInLinkRequestSchema, emailSignInLinkResponseSchema, emailSignInPendingSchema, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_ACCOUNTS_MAX, emailSignInAccountOptionSchema, emailSignInChooseAccountSchema, emailSignInChooseRequestSchema, isEmailSignInChooseAccount, passwordSignInRequestSchema, secondFactorSignInRequestSchema, secondFactorRequiredSchema, signUpRequestSchema, isSecondFactorRequired, reauthProofSchema, emailReauthProofSchema, REAUTH_ACTIONS, reauthEmailStartRequestSchema, passwordSetRequestSchema, signInMethodsSchema, totpEnrollResponseSchema, totpConfirmRequestSchema, totpReauthRequestSchema, totpBackupCodesResponseSchema, } from './signIn';
-export type { EmailSignInStartRequest, EmailSignInStartResponse, EmailSignInConfirmRequest, EmailSignInCollectRequest, EmailSignInLinkRequest, EmailSignInLinkResponse, EmailSignInPending, EmailSignInAccountOption, EmailSignInChooseAccount, EmailSignInChooseRequest, EmailSignInStepResult, PasswordSignInRequest, SecondFactorSignInRequest, SecondFactorRequired, SignInStepResult, SignUpRequest, ReauthProof, EmailReauthProof, ReauthAction, ReauthEmailStartRequest, PasswordSetRequest, SignInMethods, TotpEnrollResponse, TotpConfirmRequest, TotpReauthRequest, TotpBackupCodesResponse, SignInErrorCode, } from './signIn';
+export { EMAIL_SIGNIN_LINK_TTL_MS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, PASSWORD_MIN_LENGTH, PASSWORD_MAX_LENGTH, TOTP_DIGITS, TOTP_PERIOD_SECONDS, TOTP_BACKUP_CODE_COUNT, SIGN_IN_ERROR_CODES, signInIdentifierSchema, passwordInputSchema, newPasswordSchema, secondFactorCodeSchema, emailSignInStartRequestSchema, emailSignInStartResponseSchema, emailSignInConfirmRequestSchema, emailSignInCodeSchema, normalizeEmailSignInCode, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, emailSignInCollectRequestSchema, emailSignInLinkRequestSchema, emailSignInLinkResponseSchema, emailSignInPendingSchema, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_ACCOUNTS_MAX, emailSignInAccountOptionSchema, emailSignInChooseAccountSchema, emailSignInChooseRequestSchema, isEmailSignInChooseAccount, passwordSignInRequestSchema, secondFactorSignInRequestSchema, secondFactorRequiredSchema, signUpRequestSchema, isSecondFactorRequired, reauthProofSchema, REAUTH_ACTIONS, reauthEmailStartRequestSchema, passwordSetRequestSchema, signInMethodRemoveRequestSchema, emailChangeStartRequestSchema, emailSetRequestSchema, signInMethodsSchema, totpEnrollResponseSchema, totpConfirmRequestSchema, totpReauthRequestSchema, totpBackupCodesResponseSchema, } from './signIn';
+export type { EmailSignInStartRequest, EmailSignInStartResponse, EmailSignInConfirmRequest, EmailSignInCollectRequest, EmailSignInLinkRequest, EmailSignInLinkResponse, EmailSignInPending, EmailSignInAccountOption, EmailSignInChooseAccount, EmailSignInChooseRequest, EmailSignInStepResult, PasswordSignInRequest, SecondFactorSignInRequest, SecondFactorRequired, SignInStepResult, SignUpRequest, ReauthProof, ReauthAction, ReauthEmailStartRequest, PasswordSetRequest, SignInMethodRemoveRequest, EmailChangeStartRequest, EmailSetRequest, SignInMethods, TotpEnrollResponse, TotpConfirmRequest, TotpReauthRequest, TotpBackupCodesResponse, SignInErrorCode, } from './signIn';
 export { IDENTITY_LINK_STATUSES, IDENTITY_LINK_QR_PREFIX, identityLinkIdSchema, buildIdentityLinkQrPayload, parseIdentityLinkQrPayload, identityLinkCreateResponseSchema, identityLinkStateSchema, identityLinkProofRequestSchema, identityLinkCompleteRequestSchema, } from './identityLink';
 export type { IdentityLinkStatus, IdentityLinkCreateResponse, IdentityLinkState, IdentityLinkProofRequest, IdentityLinkCompleteRequest, } from './identityLink';
 export type { EmailVerificationPurpose, EmailVerificationStartRequest, EmailVerificationStartResponse, EmailVerificationConfirmRequest, EmailVerificationConfirmResponse, EmailVerificationErrorCode, } from './accountEmail';

package/dist/types/signIn.d.ts

@@ -402,11 +402,11 @@ export declare const emailSignInChooseRequestSchema: z.ZodObject<{
 export type EmailSignInChooseRequest = z.infer<typeof emailSignInChooseRequestSchema>;
 /** `POST /users/me/reauth/email` */
 export declare const reauthEmailStartRequestSchema: z.ZodObject<{
-    action: z.ZodEnum<["change_password", "totp", "link_commons", "delete_account", "credentials_manage", "supervision", "supervision_purchase"]>;
+    action: z.ZodEnum<["change_password", "change_email", "totp", "link_commons", "delete_account", "credentials_manage", "supervision", "supervision_purchase"]>;
 }, "strict", z.ZodTypeAny, {
-    action: "change_password" | "totp" | "link_commons" | "delete_account" | "credentials_manage" | "supervision" | "supervision_purchase";
+    action: "change_password" | "change_email" | "totp" | "link_commons" | "delete_account" | "credentials_manage" | "supervision" | "supervision_purchase";
 }, {
-    action: "change_password" | "totp" | "link_commons" | "delete_account" | "credentials_manage" | "supervision" | "supervision_purchase";
+    action: "change_password" | "change_email" | "totp" | "link_commons" | "delete_account" | "credentials_manage" | "supervision" | "supervision_purchase";
 }>;
 export type ReauthEmailStartRequest = z.infer<typeof reauthEmailStartRequestSchema>;
 /**
@@ -459,33 +459,6 @@ export declare const reauthProofSchema: z.ZodEffects<z.ZodObject<{
     totpCode?: string | undefined;
 }>;
 export type ReauthProof = z.infer<typeof reauthProofSchema>;
-/** A proof by email code only (+ TOTP): deleting an account, linking Commons. */
-export declare const emailReauthProofSchema: z.ZodObject<{
-    emailCode: z.ZodObject<{
-        verificationId: z.ZodString;
-        code: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        code: string;
-        verificationId: string;
-    }, {
-        code: string;
-        verificationId: string;
-    }>;
-    totpCode: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    emailCode: {
-        code: string;
-        verificationId: string;
-    };
-    totpCode?: string | undefined;
-}, {
-    emailCode: {
-        code: string;
-        verificationId: string;
-    };
-    totpCode?: string | undefined;
-}>;
-export type EmailReauthProof = z.infer<typeof emailReauthProofSchema>;
 /** `PUT /users/me/password` — set or change the password. */
 export declare const passwordSetRequestSchema: z.ZodObject<{
     newPassword: z.ZodString;
@@ -558,6 +531,162 @@ export declare const passwordSetRequestSchema: z.ZodObject<{
     revokeOtherSessions?: boolean | undefined;
 }>;
 export type PasswordSetRequest = z.infer<typeof passwordSetRequestSchema>;
+/**
+ * `DELETE /users/me/password` — only while the account has an email to sign
+ * in with; `DELETE /users/me/email` — only while it has a password, and
+ * confirmed with that password.
+ */
+export declare const signInMethodRemoveRequestSchema: z.ZodObject<{
+    reauth: z.ZodEffects<z.ZodObject<{
+        password: z.ZodOptional<z.ZodString>;
+        emailCode: z.ZodOptional<z.ZodObject<{
+            verificationId: z.ZodString;
+            code: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            code: string;
+            verificationId: string;
+        }, {
+            code: string;
+            verificationId: string;
+        }>>;
+        /** Required when the account has an authenticator: its code or a backup code. */
+        totpCode: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }>, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    reauth: {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    };
+}, {
+    reauth: {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    };
+}>;
+export type SignInMethodRemoveRequest = z.infer<typeof signInMethodRemoveRequestSchema>;
+/** `POST /users/me/email/verify/start` — a code to the address the account moves to. */
+export declare const emailChangeStartRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    email: string;
+}, {
+    email: string;
+}>;
+export type EmailChangeStartRequest = z.infer<typeof emailChangeStartRequestSchema>;
+/**
+ * `PUT /users/me/email` — add or change the email: the NEW address and the
+ * code it got (`verificationId`, `code`), and the proof it is the person (the
+ * password, or a code to the current email; plus the authenticator's).
+ */
+export declare const emailSetRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+    verificationId: z.ZodString;
+    code: z.ZodString;
+    reauth: z.ZodEffects<z.ZodObject<{
+        password: z.ZodOptional<z.ZodString>;
+        emailCode: z.ZodOptional<z.ZodObject<{
+            verificationId: z.ZodString;
+            code: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            code: string;
+            verificationId: string;
+        }, {
+            code: string;
+            verificationId: string;
+        }>>;
+        /** Required when the account has an authenticator: its code or a backup code. */
+        totpCode: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }>, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }, {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    code: string;
+    email: string;
+    reauth: {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    };
+    verificationId: string;
+}, {
+    code: string;
+    email: string;
+    reauth: {
+        password?: string | undefined;
+        emailCode?: {
+            code: string;
+            verificationId: string;
+        } | undefined;
+        totpCode?: string | undefined;
+    };
+    verificationId: string;
+}>;
+export type EmailSetRequest = z.infer<typeof emailSetRequestSchema>;
 /** `GET /users/me/sign-in-methods` */
 export interface SignInMethods {
     hasEmail: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/contracts",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "OxyHQ API contracts — single source of truth for request/response Zod schemas and inferred types, shared by the backend and the client SDKs",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",