@oxyhq/contracts 0.10.0 → 0.12.0

package/dist/esm/deviceBoot.js

@@ -91,6 +91,7 @@ export const authTokenBundleSchema = z.object({
     refreshToken: z.string(),
     expiresAt: z.string(),
     user: userResponseSchema,
+    deviceSecret: z.string().optional(),
 });
 // Internal (unexported) arm schemas — PLAIN `z.object` literals (no
 // `z.ZodType<>` annotation) so `z.discriminatedUnion` can introspect the
@@ -155,6 +156,7 @@ const loginSessionResultSchema = z.object({
     expiresAt: z.string(),
     accessToken: z.string().optional(),
     refreshToken: z.string().optional(),
+    deviceSecret: z.string().optional(),
     user: z.object({
         id: z.string(),
         username: z.string().optional(),

package/dist/esm/deviceSession.js

@@ -20,3 +20,30 @@ export const deviceSessionSyncSchema = z.object({
     state: deviceSessionStateSchema,
     activeToken: activeTokenSchema.nullable(),
 });
+/* -------------------------------------------------------------------------- */
+/*  Device-secret token mint (phase 2c — zero-cookie transport)               */
+/* -------------------------------------------------------------------------- */
+/**
+ * Request body for `POST /session/device/token` — the client presents the
+ * `deviceId` it stored first-party plus the opaque `deviceSecret`. NO bearer:
+ * possession of the secret IS the proof of device ownership. The server matches
+ * `sha256(deviceSecret)` against the device's stored `secretHash` (constant-time)
+ * and mints a short access token for the device's active account.
+ */
+export const deviceTokenMintRequestSchema = z.object({
+    deviceId: z.string().min(1),
+    deviceSecret: z.string().min(1),
+});
+/**
+ * Wire shape of a successful `POST /session/device/token`: the freshly-minted
+ * short access token for the active account, its expiry, the NEXT rotating
+ * device secret the client must persist (rotation-in-use — the presented secret
+ * stays valid for a short grace so multi-tab races don't lock out), and the
+ * projected device-session state.
+ */
+export const deviceTokenMintResponseSchema = z.object({
+    accessToken: z.string(),
+    expiresAt: z.string(),
+    nextDeviceSecret: z.string(),
+    state: deviceSessionStateSchema,
+});

package/dist/esm/fedcmToken.js

@@ -1,6 +1,16 @@
 /**
  * Canonical contract for the FedCM ID-token JWT payload.
  *
+ * DEAD SINCE THE WAVE-2 FEDCM DELETION (found during the comment sweep, not
+ * fixed here — this is a published `@oxyhq/contracts` export, so removing it
+ * is a breaking change/major-version decision, out of scope for a comment
+ * fix): `POST /fedcm/exchange`, `fedcm.service.exchangeIdToken`, and
+ * `packages/auth/server/index.ts`'s `mintSessionForClient` — every consumer
+ * and producer this file describes — are all deleted. No current code
+ * imports `fedcmTokenPayloadSchema` / `FedcmTokenPayload` outside this
+ * package. Flag for a follow-up major-version cleanup.
+ *
+ * Original doc (historical, describes the now-deleted system):
  * SINGLE SOURCE OF TRUTH for the decoded claims of the HS256 ID token the auth
  * IdP (`auth.oxy.so`) signs and `POST /fedcm/exchange` consumes. The API decodes
  * the JWT, verifies its signature, then validates the resulting claim object

package/dist/esm/index.js

@@ -11,7 +11,7 @@
  */
 export { 
 // Schemas
-userNameSchema, userResponseSchema, userProfileUpdateSchema, currentUserResponseSchema, deviceSessionAccountSchema, deviceSessionsResponseSchema, 
+userNameSchema, userResponseSchema, userProfileUpdateSchema, currentUserResponseSchema, deviceLinkedSessionSchema, deviceLinkedSessionsResponseSchema, 
 // Helpers
 resolveUserId, safeParseContract, } from './userResponse.js';
 export { 
@@ -40,7 +40,7 @@ credentialRecordSchema, verifiableCredentialResponseSchema, credentialIssueResul
 export { 
 // Schemas
 linkPreviewSchema, linkPreviewBatchRequestSchema, linkPreviewBatchResponseSchema, linkPreviewResponseSchema, } from './links.js';
-export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, } from './deviceSession.js';
+export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, deviceTokenMintRequestSchema, deviceTokenMintResponseSchema, } from './deviceSession.js';
 export { 
 // Schemas
 deviceBootReasonSchema, deviceBootFragmentSchema, deviceExchangeRequestSchema, authTokenBundleSchema, webSessionResultSchema, tokenRefreshRequestSchema, tokenRefreshResponseSchema, deviceTokenIssueResponseSchema, loginResultSchema, deviceResolveRequestSchema, deviceResolveResponseSchema, } from './deviceBoot.js';

package/dist/esm/sessionStatus.js

@@ -19,9 +19,10 @@
  * Faithful to the producers:
  *  - `packages/api/src/utils/serializeApplication.ts` `serializePublicApplication`
  *    — the ONLY shape returned to an unauthenticated consent UI. Optional fields
- *    (`description`, `icon`, `websiteUrl`, `developerName`) are OMITTED when
- *    absent (never serialized as `null`), so they are `.optional()` — NOT
- *    `.nullable()`. `type` is the `Application.type` enum.
+ *    (`description`, `icon`, `websiteUrl`, `privacyPolicyUrl`, `termsUrl`,
+ *    `developerName`) are OMITTED when absent (never serialized as `null`), so
+ *    they are `.optional()` — NOT `.nullable()`. `type` is the `Application.type`
+ *    enum.
  *  - `packages/api/src/routes/auth.ts` `GET /session/status/:sessionToken` — the
  *    inner object of the API's `{ data: ... }` success envelope. The handler
  *    ALWAYS emits `status`, `authorized` (`status === 'authorized'`),
@@ -52,9 +53,10 @@ export const applicationTypeSchema = z.enum([
  * `GET /auth/oauth/client/:clientId` (OAuth code flow).
  *
  * Optional fields are `.optional()` (NOT `.nullable()`): the serializer OMITS
- * `description` / `icon` / `websiteUrl` / `developerName` when the underlying
- * value is absent — it never writes `null` for them. `developerName` is only
- * attached for non-official apps when a name could be resolved.
+ * `description` / `icon` / `websiteUrl` / `privacyPolicyUrl` / `termsUrl` /
+ * `developerName` when the underlying value is absent — it never writes `null`
+ * for them. `developerName` is only attached for non-official apps when a name
+ * could be resolved.
  */
 export const publicApplicationSchema = z.object({
     id: z.string(),
@@ -62,6 +64,8 @@ export const publicApplicationSchema = z.object({
     description: z.string().optional(),
     icon: z.string().optional(),
     websiteUrl: z.string().optional(),
+    privacyPolicyUrl: z.string().optional(),
+    termsUrl: z.string().optional(),
     type: applicationTypeSchema,
     isOfficial: z.boolean(),
     isInternal: z.boolean(),

package/dist/esm/userResponse.js

@@ -16,7 +16,8 @@
  *
  * Faithful to the producers:
  *  - `packages/api/src/utils/userTransform.ts` `formatUserResponse` — the
- *    canonical serialization used by `/auth/refresh-all`, device sessions, etc.
+ *    canonical serialization used by the device-first bootstrap/exchange
+ *    endpoints (`deviceAuth.ts`), login/signup, device sessions, etc.
  *    Emits `id` (NOT `_id`), forwards `username` verbatim (may be absent), and
  *    emits `name` as the structured `{ first, last, full, displayName }`
  *    subdocument.
@@ -24,8 +25,6 @@
  *    `''`; `full` and `displayName` are Mongoose VIRTUALS. Formatted API
  *    responses compose both fields, while raw-document responses may omit the
  *    virtuals if the query did not materialise them.
- *  - The `/auth/refresh-all` handler in `packages/api/src/routes/auth.ts`, whose
- *    per-slot `authuser` is the numeric `oxy_rt_${authuser}` cookie slot.
  *
  * Platform-agnostic — zod only, no react/react-native/expo. ESM-safe (no
  * `require()`).
@@ -146,13 +145,13 @@ export const currentUserResponseSchema = z.object({
  * session). Backs the multi-account chooser. The embedded user mirrors
  * `formatUserResponse`; it is nullable on slots that lost their user document.
  */
-export const deviceSessionAccountSchema = z.object({
+export const deviceLinkedSessionSchema = z.object({
     sessionId: z.string(),
     isCurrent: z.boolean().optional(),
     user: userResponseSchema.nullable().optional(),
 });
 /** Wire shape of `GET /session/device/sessions/:sessionId` (an array). */
-export const deviceSessionsResponseSchema = z.array(deviceSessionAccountSchema);
+export const deviceLinkedSessionsResponseSchema = z.array(deviceLinkedSessionSchema);
 /**
  * Safely parse a value against a contract schema. Returns the parsed (typed)
  * value, or `null` when validation fails — the same ergonomics the auth app's