@oxyhq/contracts 0.11.0 → 0.12.0

package/dist/esm/deviceBoot.js

@@ -91,6 +91,7 @@ export const authTokenBundleSchema = z.object({
     refreshToken: z.string(),
     expiresAt: z.string(),
     user: userResponseSchema,
+    deviceSecret: z.string().optional(),
 });
 // Internal (unexported) arm schemas — PLAIN `z.object` literals (no
 // `z.ZodType<>` annotation) so `z.discriminatedUnion` can introspect the
@@ -155,6 +156,7 @@ const loginSessionResultSchema = z.object({
     expiresAt: z.string(),
     accessToken: z.string().optional(),
     refreshToken: z.string().optional(),
+    deviceSecret: z.string().optional(),
     user: z.object({
         id: z.string(),
         username: z.string().optional(),

package/dist/esm/deviceSession.js

@@ -20,3 +20,30 @@ export const deviceSessionSyncSchema = z.object({
     state: deviceSessionStateSchema,
     activeToken: activeTokenSchema.nullable(),
 });
+/* -------------------------------------------------------------------------- */
+/*  Device-secret token mint (phase 2c — zero-cookie transport)               */
+/* -------------------------------------------------------------------------- */
+/**
+ * Request body for `POST /session/device/token` — the client presents the
+ * `deviceId` it stored first-party plus the opaque `deviceSecret`. NO bearer:
+ * possession of the secret IS the proof of device ownership. The server matches
+ * `sha256(deviceSecret)` against the device's stored `secretHash` (constant-time)
+ * and mints a short access token for the device's active account.
+ */
+export const deviceTokenMintRequestSchema = z.object({
+    deviceId: z.string().min(1),
+    deviceSecret: z.string().min(1),
+});
+/**
+ * Wire shape of a successful `POST /session/device/token`: the freshly-minted
+ * short access token for the active account, its expiry, the NEXT rotating
+ * device secret the client must persist (rotation-in-use — the presented secret
+ * stays valid for a short grace so multi-tab races don't lock out), and the
+ * projected device-session state.
+ */
+export const deviceTokenMintResponseSchema = z.object({
+    accessToken: z.string(),
+    expiresAt: z.string(),
+    nextDeviceSecret: z.string(),
+    state: deviceSessionStateSchema,
+});

package/dist/esm/index.js

@@ -40,7 +40,7 @@ credentialRecordSchema, verifiableCredentialResponseSchema, credentialIssueResul
 export { 
 // Schemas
 linkPreviewSchema, linkPreviewBatchRequestSchema, linkPreviewBatchResponseSchema, linkPreviewResponseSchema, } from './links.js';
-export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, } from './deviceSession.js';
+export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, deviceTokenMintRequestSchema, deviceTokenMintResponseSchema, } from './deviceSession.js';
 export { 
 // Schemas
 deviceBootReasonSchema, deviceBootFragmentSchema, deviceExchangeRequestSchema, authTokenBundleSchema, webSessionResultSchema, tokenRefreshRequestSchema, tokenRefreshResponseSchema, deviceTokenIssueResponseSchema, loginResultSchema, deviceResolveRequestSchema, deviceResolveResponseSchema, } from './deviceBoot.js';