@oxyhq/contracts 0.11.0 → 0.12.0

package/dist/types/deviceBoot.d.ts

@@ -115,6 +115,14 @@ export interface AuthTokenBundle {
     refreshToken: string;
     expiresAt: string;
     user: UserResponse;
+    /**
+     * The device secret (phase 2c — zero-cookie transport). Present ONLY when
+     * the bundle is minted for a device that carries a `DeviceSession` doc; the
+     * client persists it first-party and later mints access tokens via
+     * `POST /session/device/token`. Optional and additive: cookie-lane bundles
+     * for a device with no doc omit it, so existing consumers are unaffected.
+     */
+    deviceSecret?: string;
 }
 export declare const authTokenBundleSchema: z.ZodType<AuthTokenBundle>;
 /**
@@ -213,6 +221,13 @@ export interface LoginSessionResult {
     expiresAt: string;
     accessToken?: string;
     refreshToken?: string;
+    /**
+     * The device secret (phase 2c — zero-cookie transport). Present ONLY when
+     * the sign-in resolved a device binding; the client persists it first-party
+     * and later mints access tokens via `POST /session/device/token`. Optional
+     * and additive — wired identically to `refreshToken`.
+     */
+    deviceSecret?: string;
     user: {
         id: string;
         username?: string;

package/dist/types/deviceSession.d.ts

@@ -163,3 +163,110 @@ export type SessionAccount = z.infer<typeof sessionAccountSchema>;
 export type DeviceSessionState = z.infer<typeof deviceSessionStateSchema>;
 export type ActiveToken = z.infer<typeof activeTokenSchema>;
 export type DeviceSessionSync = z.infer<typeof deviceSessionSyncSchema>;
+/**
+ * Request body for `POST /session/device/token` — the client presents the
+ * `deviceId` it stored first-party plus the opaque `deviceSecret`. NO bearer:
+ * possession of the secret IS the proof of device ownership. The server matches
+ * `sha256(deviceSecret)` against the device's stored `secretHash` (constant-time)
+ * and mints a short access token for the device's active account.
+ */
+export declare const deviceTokenMintRequestSchema: z.ZodObject<{
+    deviceId: z.ZodString;
+    deviceSecret: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    deviceSecret: string;
+    deviceId: string;
+}, {
+    deviceSecret: string;
+    deviceId: string;
+}>;
+/**
+ * Wire shape of a successful `POST /session/device/token`: the freshly-minted
+ * short access token for the active account, its expiry, the NEXT rotating
+ * device secret the client must persist (rotation-in-use — the presented secret
+ * stays valid for a short grace so multi-tab races don't lock out), and the
+ * projected device-session state.
+ */
+export declare const deviceTokenMintResponseSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    expiresAt: z.ZodString;
+    nextDeviceSecret: z.ZodString;
+    state: z.ZodObject<{
+        deviceId: z.ZodString;
+        accounts: z.ZodArray<z.ZodObject<{
+            accountId: z.ZodString;
+            sessionId: z.ZodString;
+            authuser: z.ZodNumber;
+            operatedByUserId: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            sessionId: string;
+            accountId: string;
+            authuser: number;
+            operatedByUserId?: string | undefined;
+        }, {
+            sessionId: string;
+            accountId: string;
+            authuser: number;
+            operatedByUserId?: string | undefined;
+        }>, "many">;
+        activeAccountId: z.ZodNullable<z.ZodString>;
+        revision: z.ZodNumber;
+        updatedAt: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        updatedAt: number;
+        deviceId: string;
+        activeAccountId: string | null;
+        accounts: {
+            sessionId: string;
+            accountId: string;
+            authuser: number;
+            operatedByUserId?: string | undefined;
+        }[];
+        revision: number;
+    }, {
+        updatedAt: number;
+        deviceId: string;
+        activeAccountId: string | null;
+        accounts: {
+            sessionId: string;
+            accountId: string;
+            authuser: number;
+            operatedByUserId?: string | undefined;
+        }[];
+        revision: number;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    expiresAt: string;
+    state: {
+        updatedAt: number;
+        deviceId: string;
+        activeAccountId: string | null;
+        accounts: {
+            sessionId: string;
+            accountId: string;
+            authuser: number;
+            operatedByUserId?: string | undefined;
+        }[];
+        revision: number;
+    };
+    accessToken: string;
+    nextDeviceSecret: string;
+}, {
+    expiresAt: string;
+    state: {
+        updatedAt: number;
+        deviceId: string;
+        activeAccountId: string | null;
+        accounts: {
+            sessionId: string;
+            accountId: string;
+            authuser: number;
+            operatedByUserId?: string | undefined;
+        }[];
+        revision: number;
+    };
+    accessToken: string;
+    nextDeviceSecret: string;
+}>;
+export type DeviceTokenMintRequest = z.infer<typeof deviceTokenMintRequestSchema>;
+export type DeviceTokenMintResponse = z.infer<typeof deviceTokenMintResponseSchema>;

package/dist/types/index.d.ts

@@ -27,7 +27,7 @@ export { publicCardSchema, signedPublicCardSchema, realLifeAttestationRecordSche
 export type { CardTrustTier, PersonhoodStatus, PublicCard, SignedPublicCard, RealLifeAttestationRecord, RealLifeAttestationResult, ValidationVerdict, ValidationRequestStatus, ValidationVerdictRecord, ValidationOpenRequest, ValidationOpenResult, ValidationRequestSummary, ValidationVoteResult, PersonhoodVouchRecord, PersonhoodBreakdown, PersonhoodStatusResult, VouchResult, CredentialStatus, CredentialRecord, VerifiableCredentialResponse, CredentialIssueResult, CredentialListResult, CredentialVerifyResult, } from './civic';
 export { linkPreviewSchema, linkPreviewBatchRequestSchema, linkPreviewBatchResponseSchema, linkPreviewResponseSchema, } from './links';
 export type { LinkPreviewStatus, LinkPreview, LinkPreviewBatchRequest, LinkPreviewBatchResponse, } from './links';
-export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, } from './deviceSession';
-export type { SessionAccount, DeviceSessionState, ActiveToken, DeviceSessionSync, } from './deviceSession';
+export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, deviceTokenMintRequestSchema, deviceTokenMintResponseSchema, } from './deviceSession';
+export type { SessionAccount, DeviceSessionState, ActiveToken, DeviceSessionSync, DeviceTokenMintRequest, DeviceTokenMintResponse, } from './deviceSession';
 export { deviceBootReasonSchema, deviceBootFragmentSchema, deviceExchangeRequestSchema, authTokenBundleSchema, webSessionResultSchema, tokenRefreshRequestSchema, tokenRefreshResponseSchema, deviceTokenIssueResponseSchema, loginResultSchema, deviceResolveRequestSchema, deviceResolveResponseSchema, } from './deviceBoot';
 export type { DeviceBootReason, DeviceBootFragment, DeviceExchangeRequest, AuthTokenBundle, WebSessionResult, WebSessionSession, WebSessionNoSession, TokenRefreshRequest, TokenRefreshResponse, DeviceTokenIssueResponse, LoginTwoFactorRequired, LoginSessionResult, LoginResult, DeviceResolveRequest, DeviceResolveAccount, DeviceResolveResponse, } from './deviceBoot';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/contracts",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "OxyHQ API contracts — single source of truth for request/response Zod schemas and inferred types, shared by the backend and the client SDKs",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",