@oxyhq/contracts 0.10.0 → 0.12.0

package/dist/types/deviceBoot.d.ts

@@ -115,6 +115,14 @@ export interface AuthTokenBundle {
     refreshToken: string;
     expiresAt: string;
     user: UserResponse;
+    /**
+     * The device secret (phase 2c — zero-cookie transport). Present ONLY when
+     * the bundle is minted for a device that carries a `DeviceSession` doc; the
+     * client persists it first-party and later mints access tokens via
+     * `POST /session/device/token`. Optional and additive: cookie-lane bundles
+     * for a device with no doc omit it, so existing consumers are unaffected.
+     */
+    deviceSecret?: string;
 }
 export declare const authTokenBundleSchema: z.ZodType<AuthTokenBundle>;
 /**
@@ -213,6 +221,13 @@ export interface LoginSessionResult {
     expiresAt: string;
     accessToken?: string;
     refreshToken?: string;
+    /**
+     * The device secret (phase 2c — zero-cookie transport). Present ONLY when
+     * the sign-in resolved a device binding; the client persists it first-party
+     * and later mints access tokens via `POST /session/device/token`. Optional
+     * and additive — wired identically to `refreshToken`.
+     */
+    deviceSecret?: string;
     user: {
         id: string;
         username?: string;
@@ -245,7 +260,7 @@ export interface DeviceResolveAccount {
 /**
  * Wire shape of `POST /auth/device/resolve` — the device's active account id
  * (or `null` when signed out of all) plus every account signed in on the
- * device. Replaces the IdP's `/auth/refresh-all` chooser feed.
+ * device. Replaces the IdP's legacy cookie-based chooser feed.
  */
 export interface DeviceResolveResponse {
     activeAccountId: string | null;

package/dist/types/deviceSession.d.ts

@@ -163,3 +163,110 @@ export type SessionAccount = z.infer<typeof sessionAccountSchema>;
 export type DeviceSessionState = z.infer<typeof deviceSessionStateSchema>;
 export type ActiveToken = z.infer<typeof activeTokenSchema>;
 export type DeviceSessionSync = z.infer<typeof deviceSessionSyncSchema>;
+/**
+ * Request body for `POST /session/device/token` — the client presents the
+ * `deviceId` it stored first-party plus the opaque `deviceSecret`. NO bearer:
+ * possession of the secret IS the proof of device ownership. The server matches
+ * `sha256(deviceSecret)` against the device's stored `secretHash` (constant-time)
+ * and mints a short access token for the device's active account.
+ */
+export declare const deviceTokenMintRequestSchema: z.ZodObject<{
+    deviceId: z.ZodString;
+    deviceSecret: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    deviceSecret: string;
+    deviceId: string;
+}, {
+    deviceSecret: string;
+    deviceId: string;
+}>;
+/**
+ * Wire shape of a successful `POST /session/device/token`: the freshly-minted
+ * short access token for the active account, its expiry, the NEXT rotating
+ * device secret the client must persist (rotation-in-use — the presented secret
+ * stays valid for a short grace so multi-tab races don't lock out), and the
+ * projected device-session state.
+ */
+export declare const deviceTokenMintResponseSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    expiresAt: z.ZodString;
+    nextDeviceSecret: z.ZodString;
+    state: z.ZodObject<{
+        deviceId: z.ZodString;
+        accounts: z.ZodArray<z.ZodObject<{
+            accountId: z.ZodString;
+            sessionId: z.ZodString;
+            authuser: z.ZodNumber;
+            operatedByUserId: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            sessionId: string;
+            accountId: string;
+            authuser: number;
+            operatedByUserId?: string | undefined;
+        }, {
+            sessionId: string;
+            accountId: string;
+            authuser: number;
+            operatedByUserId?: string | undefined;
+        }>, "many">;
+        activeAccountId: z.ZodNullable<z.ZodString>;
+        revision: z.ZodNumber;
+        updatedAt: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        updatedAt: number;
+        deviceId: string;
+        activeAccountId: string | null;
+        accounts: {
+            sessionId: string;
+            accountId: string;
+            authuser: number;
+            operatedByUserId?: string | undefined;
+        }[];
+        revision: number;
+    }, {
+        updatedAt: number;
+        deviceId: string;
+        activeAccountId: string | null;
+        accounts: {
+            sessionId: string;
+            accountId: string;
+            authuser: number;
+            operatedByUserId?: string | undefined;
+        }[];
+        revision: number;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    expiresAt: string;
+    state: {
+        updatedAt: number;
+        deviceId: string;
+        activeAccountId: string | null;
+        accounts: {
+            sessionId: string;
+            accountId: string;
+            authuser: number;
+            operatedByUserId?: string | undefined;
+        }[];
+        revision: number;
+    };
+    accessToken: string;
+    nextDeviceSecret: string;
+}, {
+    expiresAt: string;
+    state: {
+        updatedAt: number;
+        deviceId: string;
+        activeAccountId: string | null;
+        accounts: {
+            sessionId: string;
+            accountId: string;
+            authuser: number;
+            operatedByUserId?: string | undefined;
+        }[];
+        revision: number;
+    };
+    accessToken: string;
+    nextDeviceSecret: string;
+}>;
+export type DeviceTokenMintRequest = z.infer<typeof deviceTokenMintRequestSchema>;
+export type DeviceTokenMintResponse = z.infer<typeof deviceTokenMintResponseSchema>;

package/dist/types/fedcmToken.d.ts

@@ -1,6 +1,16 @@
 /**
  * Canonical contract for the FedCM ID-token JWT payload.
  *
+ * DEAD SINCE THE WAVE-2 FEDCM DELETION (found during the comment sweep, not
+ * fixed here — this is a published `@oxyhq/contracts` export, so removing it
+ * is a breaking change/major-version decision, out of scope for a comment
+ * fix): `POST /fedcm/exchange`, `fedcm.service.exchangeIdToken`, and
+ * `packages/auth/server/index.ts`'s `mintSessionForClient` — every consumer
+ * and producer this file describes — are all deleted. No current code
+ * imports `fedcmTokenPayloadSchema` / `FedcmTokenPayload` outside this
+ * package. Flag for a follow-up major-version cleanup.
+ *
+ * Original doc (historical, describes the now-deleted system):
  * SINGLE SOURCE OF TRUTH for the decoded claims of the HS256 ID token the auth
  * IdP (`auth.oxy.so`) signs and `POST /fedcm/exchange` consumes. The API decodes
  * the JWT, verifies its signature, then validates the resulting claim object

package/dist/types/index.d.ts

@@ -9,8 +9,8 @@
  * Platform-agnostic — zod is the only runtime dependency. No react/react-native/
  * expo, no `require()` in the ESM build.
  */
-export { userNameSchema, userResponseSchema, userProfileUpdateSchema, currentUserResponseSchema, deviceSessionAccountSchema, deviceSessionsResponseSchema, resolveUserId, safeParseContract, } from './userResponse';
-export type { UserNameResponse, UserResponse, UserProfileUpdate, CurrentUserResponseContract, DeviceSessionAccountResponse, DeviceSessionsResponseContract, } from './userResponse';
+export { userNameSchema, userResponseSchema, userProfileUpdateSchema, currentUserResponseSchema, deviceLinkedSessionSchema, deviceLinkedSessionsResponseSchema, resolveUserId, safeParseContract, } from './userResponse';
+export type { UserNameResponse, UserResponse, UserProfileUpdate, CurrentUserResponseContract, DeviceLinkedSessionResponse, DeviceLinkedSessionsResponseContract, } from './userResponse';
 export { applicationTypeSchema, publicApplicationSchema, sessionStatusSchema, } from './sessionStatus';
 export type { ApplicationTypeContract, PublicApplicationResponse, SessionStatusResponse, } from './sessionStatus';
 export { fedcmTokenPayloadSchema, } from './fedcmToken';
@@ -27,7 +27,7 @@ export { publicCardSchema, signedPublicCardSchema, realLifeAttestationRecordSche
 export type { CardTrustTier, PersonhoodStatus, PublicCard, SignedPublicCard, RealLifeAttestationRecord, RealLifeAttestationResult, ValidationVerdict, ValidationRequestStatus, ValidationVerdictRecord, ValidationOpenRequest, ValidationOpenResult, ValidationRequestSummary, ValidationVoteResult, PersonhoodVouchRecord, PersonhoodBreakdown, PersonhoodStatusResult, VouchResult, CredentialStatus, CredentialRecord, VerifiableCredentialResponse, CredentialIssueResult, CredentialListResult, CredentialVerifyResult, } from './civic';
 export { linkPreviewSchema, linkPreviewBatchRequestSchema, linkPreviewBatchResponseSchema, linkPreviewResponseSchema, } from './links';
 export type { LinkPreviewStatus, LinkPreview, LinkPreviewBatchRequest, LinkPreviewBatchResponse, } from './links';
-export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, } from './deviceSession';
-export type { SessionAccount, DeviceSessionState, ActiveToken, DeviceSessionSync, } from './deviceSession';
+export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, deviceTokenMintRequestSchema, deviceTokenMintResponseSchema, } from './deviceSession';
+export type { SessionAccount, DeviceSessionState, ActiveToken, DeviceSessionSync, DeviceTokenMintRequest, DeviceTokenMintResponse, } from './deviceSession';
 export { deviceBootReasonSchema, deviceBootFragmentSchema, deviceExchangeRequestSchema, authTokenBundleSchema, webSessionResultSchema, tokenRefreshRequestSchema, tokenRefreshResponseSchema, deviceTokenIssueResponseSchema, loginResultSchema, deviceResolveRequestSchema, deviceResolveResponseSchema, } from './deviceBoot';
 export type { DeviceBootReason, DeviceBootFragment, DeviceExchangeRequest, AuthTokenBundle, WebSessionResult, WebSessionSession, WebSessionNoSession, TokenRefreshRequest, TokenRefreshResponse, DeviceTokenIssueResponse, LoginTwoFactorRequired, LoginSessionResult, LoginResult, DeviceResolveRequest, DeviceResolveAccount, DeviceResolveResponse, } from './deviceBoot';

package/dist/types/sessionStatus.d.ts

@@ -19,9 +19,10 @@
  * Faithful to the producers:
  *  - `packages/api/src/utils/serializeApplication.ts` `serializePublicApplication`
  *    — the ONLY shape returned to an unauthenticated consent UI. Optional fields
- *    (`description`, `icon`, `websiteUrl`, `developerName`) are OMITTED when
- *    absent (never serialized as `null`), so they are `.optional()` — NOT
- *    `.nullable()`. `type` is the `Application.type` enum.
+ *    (`description`, `icon`, `websiteUrl`, `privacyPolicyUrl`, `termsUrl`,
+ *    `developerName`) are OMITTED when absent (never serialized as `null`), so
+ *    they are `.optional()` — NOT `.nullable()`. `type` is the `Application.type`
+ *    enum.
  *  - `packages/api/src/routes/auth.ts` `GET /session/status/:sessionToken` — the
  *    inner object of the API's `{ data: ... }` success envelope. The handler
  *    ALWAYS emits `status`, `authorized` (`status === 'authorized'`),
@@ -48,9 +49,10 @@ export type ApplicationTypeContract = z.infer<typeof applicationTypeSchema>;
  * `GET /auth/oauth/client/:clientId` (OAuth code flow).
  *
  * Optional fields are `.optional()` (NOT `.nullable()`): the serializer OMITS
- * `description` / `icon` / `websiteUrl` / `developerName` when the underlying
- * value is absent — it never writes `null` for them. `developerName` is only
- * attached for non-official apps when a name could be resolved.
+ * `description` / `icon` / `websiteUrl` / `privacyPolicyUrl` / `termsUrl` /
+ * `developerName` when the underlying value is absent — it never writes `null`
+ * for them. `developerName` is only attached for non-official apps when a name
+ * could be resolved.
  */
 export declare const publicApplicationSchema: z.ZodObject<{
     id: z.ZodString;
@@ -58,6 +60,8 @@ export declare const publicApplicationSchema: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     icon: z.ZodOptional<z.ZodString>;
     websiteUrl: z.ZodOptional<z.ZodString>;
+    privacyPolicyUrl: z.ZodOptional<z.ZodString>;
+    termsUrl: z.ZodOptional<z.ZodString>;
     type: z.ZodEnum<["first_party", "third_party", "internal", "system"]>;
     isOfficial: z.ZodBoolean;
     isInternal: z.ZodBoolean;
@@ -73,6 +77,8 @@ export declare const publicApplicationSchema: z.ZodObject<{
     description?: string | undefined;
     icon?: string | undefined;
     websiteUrl?: string | undefined;
+    privacyPolicyUrl?: string | undefined;
+    termsUrl?: string | undefined;
     developerName?: string | undefined;
 }, {
     id: string;
@@ -84,6 +90,8 @@ export declare const publicApplicationSchema: z.ZodObject<{
     description?: string | undefined;
     icon?: string | undefined;
     websiteUrl?: string | undefined;
+    privacyPolicyUrl?: string | undefined;
+    termsUrl?: string | undefined;
     developerName?: string | undefined;
 }>;
 export type PublicApplicationResponse = z.infer<typeof publicApplicationSchema>;
@@ -116,6 +124,8 @@ export declare const sessionStatusSchema: z.ZodObject<{
         description: z.ZodOptional<z.ZodString>;
         icon: z.ZodOptional<z.ZodString>;
         websiteUrl: z.ZodOptional<z.ZodString>;
+        privacyPolicyUrl: z.ZodOptional<z.ZodString>;
+        termsUrl: z.ZodOptional<z.ZodString>;
         type: z.ZodEnum<["first_party", "third_party", "internal", "system"]>;
         isOfficial: z.ZodBoolean;
         isInternal: z.ZodBoolean;
@@ -131,6 +141,8 @@ export declare const sessionStatusSchema: z.ZodObject<{
         description?: string | undefined;
         icon?: string | undefined;
         websiteUrl?: string | undefined;
+        privacyPolicyUrl?: string | undefined;
+        termsUrl?: string | undefined;
         developerName?: string | undefined;
     }, {
         id: string;
@@ -142,6 +154,8 @@ export declare const sessionStatusSchema: z.ZodObject<{
         description?: string | undefined;
         icon?: string | undefined;
         websiteUrl?: string | undefined;
+        privacyPolicyUrl?: string | undefined;
+        termsUrl?: string | undefined;
         developerName?: string | undefined;
     }>>>;
     expiresAt: z.ZodOptional<z.ZodString>;
@@ -166,6 +180,8 @@ export declare const sessionStatusSchema: z.ZodObject<{
         description?: string | undefined;
         icon?: string | undefined;
         websiteUrl?: string | undefined;
+        privacyPolicyUrl?: string | undefined;
+        termsUrl?: string | undefined;
         developerName?: string | undefined;
     } | null | undefined;
 }, {
@@ -186,6 +202,8 @@ export declare const sessionStatusSchema: z.ZodObject<{
         description?: string | undefined;
         icon?: string | undefined;
         websiteUrl?: string | undefined;
+        privacyPolicyUrl?: string | undefined;
+        termsUrl?: string | undefined;
         developerName?: string | undefined;
     } | null | undefined;
 }>;

package/dist/types/userResponse.d.ts

@@ -16,7 +16,8 @@
  *
  * Faithful to the producers:
  *  - `packages/api/src/utils/userTransform.ts` `formatUserResponse` — the
- *    canonical serialization used by `/auth/refresh-all`, device sessions, etc.
+ *    canonical serialization used by the device-first bootstrap/exchange
+ *    endpoints (`deviceAuth.ts`), login/signup, device sessions, etc.
  *    Emits `id` (NOT `_id`), forwards `username` verbatim (may be absent), and
  *    emits `name` as the structured `{ first, last, full, displayName }`
  *    subdocument.
@@ -24,8 +25,6 @@
  *    `''`; `full` and `displayName` are Mongoose VIRTUALS. Formatted API
  *    responses compose both fields, while raw-document responses may omit the
  *    virtuals if the query did not materialise them.
- *  - The `/auth/refresh-all` handler in `packages/api/src/routes/auth.ts`, whose
- *    per-slot `authuser` is the numeric `oxy_rt_${authuser}` cookie slot.
  *
  * Platform-agnostic — zod only, no react/react-native/expo. ESM-safe (no
  * `require()`).
@@ -457,7 +456,7 @@ export type CurrentUserResponseContract = z.infer<typeof currentUserResponseSche
  * session). Backs the multi-account chooser. The embedded user mirrors
  * `formatUserResponse`; it is nullable on slots that lost their user document.
  */
-export declare const deviceSessionAccountSchema: z.ZodObject<{
+export declare const deviceLinkedSessionSchema: z.ZodObject<{
     sessionId: z.ZodString;
     isCurrent: z.ZodOptional<z.ZodBoolean>;
     user: z.ZodOptional<z.ZodNullable<z.ZodObject<{
@@ -615,9 +614,9 @@ export declare const deviceSessionAccountSchema: z.ZodObject<{
         verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
 }>;
-export type DeviceSessionAccountResponse = z.infer<typeof deviceSessionAccountSchema>;
+export type DeviceLinkedSessionResponse = z.infer<typeof deviceLinkedSessionSchema>;
 /** Wire shape of `GET /session/device/sessions/:sessionId` (an array). */
-export declare const deviceSessionsResponseSchema: z.ZodArray<z.ZodObject<{
+export declare const deviceLinkedSessionsResponseSchema: z.ZodArray<z.ZodObject<{
     sessionId: z.ZodString;
     isCurrent: z.ZodOptional<z.ZodBoolean>;
     user: z.ZodOptional<z.ZodNullable<z.ZodObject<{
@@ -775,7 +774,7 @@ export declare const deviceSessionsResponseSchema: z.ZodArray<z.ZodObject<{
         verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
 }>, "many">;
-export type DeviceSessionsResponseContract = z.infer<typeof deviceSessionsResponseSchema>;
+export type DeviceLinkedSessionsResponseContract = z.infer<typeof deviceLinkedSessionsResponseSchema>;
 /**
  * Safely parse a value against a contract schema. Returns the parsed (typed)
  * value, or `null` when validation fails — the same ergonomics the auth app's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/contracts",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "OxyHQ API contracts — single source of truth for request/response Zod schemas and inferred types, shared by the backend and the client SDKs",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",