@oxyhq/contracts 0.11.0 → 0.13.0

package/dist/cjs/deviceBoot.js

@@ -1,28 +1,16 @@
 "use strict";
 /**
- * Device-first bootstrap & token contracts (auth centralization, wave 1).
+ * First-party login result contract.
  *
- * SINGLE SOURCE OF TRUTH for the wire shape of the new device-first session
- * bootstrap: the top-level `#oxy_boot=…` fragment the API hands back from
- * `GET /auth/device/bootstrap`, the token bundle a boot code / web-session
- * fast-path exchanges into, the persisted-refresh rotation, the native
- * device-token issuance, the IdP chooser's device-resolve, and the first-party
- * password login result (2FA arm vs. session arm). The API validates its OUTPUT
- * against these schemas; every consumer (`@oxyhq/core`'s device-boot mixin, the
- * SDK cold boot, the IdP chooser) validates its INPUT against the same
- * definitions, so producer and consumers cannot drift.
+ * SINGLE SOURCE OF TRUTH for the first-party password login result (2FA arm vs.
+ * session arm). The API validates its OUTPUT against this schema; every consumer
+ * (`@oxyhq/core`'s auth mixin) validates its INPUT against the same definition,
+ * so producer and consumers cannot drift.
  *
- * Design anchors (from the auth-centralization plan):
- *  - The bootstrap fragment carries NO tokens and NO deviceId — only a
- *    `state` echo (CSRF), a `reason`, a short-lived single-use `code`, and an
- *    opaque `deviceToken`. Tokens are obtained by exchanging the `code` at
- *    `POST /auth/device/exchange` (origin-bound GETDEL burn).
- *  - Refresh is ONE rotating, single-use family shared by web and native.
- *  - `loginResult` mirrors what `POST /auth/login` returns today
- *    (`buildSessionAuthResponse` in the API's `session.controller.ts`): either a
- *    2FA challenge (`{ twoFactorRequired: true, loginToken }`) or a session
- *    payload. The session arm matches `SessionAuthResponse` EXACTLY, plus an
- *    optional `refreshToken` the new server adds for the persisted-refresh lane.
+ * The device transport is `deviceId` + `deviceSecret` + `POST /session/device/token`
+ * (see `deviceSession.ts`). The legacy cookie/bootstrap/refresh-family lanes were
+ * removed in the zero-cookie cutover — nothing here carries a refresh token or a
+ * boot fragment.
  *
  * Nested-object response shapes are declared as explicit `interface`s with the
  * runtime schema annotated `z.ZodType<Interface>` — the same rationale as
@@ -35,129 +23,27 @@
  * `require()`).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deviceResolveResponseSchema = exports.deviceResolveRequestSchema = exports.loginResultSchema = exports.deviceTokenIssueResponseSchema = exports.tokenRefreshResponseSchema = exports.tokenRefreshRequestSchema = exports.webSessionResultSchema = exports.authTokenBundleSchema = exports.deviceExchangeRequestSchema = exports.deviceBootFragmentSchema = exports.deviceBootReasonSchema = void 0;
+exports.loginResultSchema = void 0;
 const zod_1 = require("zod");
-const userResponse_1 = require("./userResponse");
-/* -------------------------------------------------------------------------- */
-/*  Bootstrap fragment                                                        */
-/* -------------------------------------------------------------------------- */
-/**
- * Why the bootstrap hop resolved the way it did.
- *  - `session` — the device cookie resolved an active session; a `code` is
- *    present to exchange for tokens.
- *  - `no_session` — the device is known but has no active session; no `code`.
- *  - `new_device` — first contact; the cookie was just planted, no session yet.
- */
-exports.deviceBootReasonSchema = zod_1.z.enum(['session', 'no_session', 'new_device']);
-/**
- * The `#oxy_boot=<json>` fragment `GET /auth/device/bootstrap` appends to the
- * `return_to` URL. Carries the CSRF `state` echo, the resolution `reason`, the
- * opaque `deviceToken`, and — ONLY on the `session` arm — the single-use
- * exchange `code`. NEVER carries tokens or a deviceId.
- *
- * Discriminated on `reason` so the code↔reason coupling is enforced by the
- * schema, not by the consumer: the `session` arm REQUIRES `code`, and the
- * `no_session` / `new_device` arms omit it (a stray `code` on those arms is
- * stripped). A `session` fragment WITHOUT a code therefore fails to parse and
- * is treated as "no usable fragment" rather than half-processed.
- */
-const deviceBootFragmentBase = {
-    v: zod_1.z.literal(1),
-    state: zod_1.z.string().min(1).max(256),
-    deviceToken: zod_1.z.string().min(20).max(512),
-};
-exports.deviceBootFragmentSchema = zod_1.z.discriminatedUnion('reason', [
-    zod_1.z.object({
-        ...deviceBootFragmentBase,
-        reason: zod_1.z.literal('session'),
-        code: zod_1.z.string().min(20).max(128),
-    }),
-    zod_1.z.object({
-        ...deviceBootFragmentBase,
-        reason: zod_1.z.literal('no_session'),
-    }),
-    zod_1.z.object({
-        ...deviceBootFragmentBase,
-        reason: zod_1.z.literal('new_device'),
-    }),
-]);
-/* -------------------------------------------------------------------------- */
-/*  Boot-code exchange                                                        */
-/* -------------------------------------------------------------------------- */
-/** Request body for `POST /auth/device/exchange` — the single-use boot code. */
-exports.deviceExchangeRequestSchema = zod_1.z.object({
-    code: zod_1.z.string().min(20).max(128),
-});
-exports.authTokenBundleSchema = zod_1.z.object({
-    sessionId: zod_1.z.string(),
-    accessToken: zod_1.z.string(),
-    refreshToken: zod_1.z.string(),
-    expiresAt: zod_1.z.string(),
-    user: userResponse_1.userResponseSchema,
-});
-// Internal (unexported) arm schemas — PLAIN `z.object` literals (no
-// `z.ZodType<>` annotation) so `z.discriminatedUnion` can introspect the
-// `reason` discriminator. The node10 `.d.ts`-degradation safety comes from the
-// EXPORTED symbols instead: the public types are explicit interfaces
-// (`WebSessionSession` / `WebSessionNoSession` / `WebSessionResult`) and the
-// exported schema is annotated `z.ZodType<WebSessionResult>` below, so the
-// emitted declaration states the shape literally rather than a degradable
-// `z.infer<>` of the nested `session` object.
-const webSessionSessionSchema = zod_1.z.object({
-    reason: zod_1.z.literal('session'),
-    session: exports.authTokenBundleSchema,
-    deviceToken: zod_1.z.string().min(1),
-});
-const webSessionNoSessionSchema = zod_1.z.object({
-    reason: zod_1.z.enum(['no_session', 'new_device']),
-    deviceToken: zod_1.z.string().min(1),
-});
-// Discriminated on `reason` — a true `discriminatedUnion` (not `z.union`): it
-// dispatches on the discriminator instead of sequentially probing each arm,
-// giving precise per-arm errors.
-exports.webSessionResultSchema = zod_1.z.discriminatedUnion('reason', [
-    webSessionSessionSchema,
-    webSessionNoSessionSchema,
-]);
-/* -------------------------------------------------------------------------- */
-/*  Refresh-token rotation (web + native, one implementation)                 */
-/* -------------------------------------------------------------------------- */
-/** Request body for `POST /auth/refresh-token` — the current refresh token. */
-exports.tokenRefreshRequestSchema = zod_1.z.object({
-    refreshToken: zod_1.z.string().min(20),
-});
-/**
- * Wire shape of `POST /auth/refresh-token`: the rotated (single-use) family —
- * a new access token, the next refresh token, the new access-token expiry, and
- * the owning session id. `expiresAt` is an ISO string.
- */
-exports.tokenRefreshResponseSchema = zod_1.z.object({
-    accessToken: zod_1.z.string(),
-    refreshToken: zod_1.z.string(),
-    expiresAt: zod_1.z.string(),
-    sessionId: zod_1.z.string(),
-});
-/* -------------------------------------------------------------------------- */
-/*  Native device-token issuance                                              */
-/* -------------------------------------------------------------------------- */
-/**
- * Wire shape of `POST /auth/device/token` — issues (or rotates) the opaque
- * device token for the native channel. The deviceId is taken from the bearer
- * JWT claims server-side; only the token comes back.
- */
-exports.deviceTokenIssueResponseSchema = zod_1.z.object({
-    deviceToken: zod_1.z.string(),
-});
 const loginTwoFactorRequiredSchema = zod_1.z.object({
     twoFactorRequired: zod_1.z.literal(true),
     loginToken: zod_1.z.string(),
 });
+const securityAlertSchema = zod_1.z.object({
+    message: zod_1.z.string(),
+    anomalies: zod_1.z.array(zod_1.z.object({
+        type: zod_1.z.string(),
+        reason: zod_1.z.string(),
+        details: zod_1.z.string().optional(),
+    })),
+});
 const loginSessionResultSchema = zod_1.z.object({
     sessionId: zod_1.z.string(),
     deviceId: zod_1.z.string(),
     expiresAt: zod_1.z.string(),
     accessToken: zod_1.z.string().optional(),
-    refreshToken: zod_1.z.string().optional(),
+    deviceSecret: zod_1.z.string().optional(),
+    securityAlert: securityAlertSchema.optional(),
     user: zod_1.z.object({
         id: zod_1.z.string(),
         username: zod_1.z.string().optional(),
@@ -168,24 +54,3 @@ exports.loginResultSchema = zod_1.z.union([
     loginTwoFactorRequiredSchema,
     loginSessionResultSchema,
 ]);
-/* -------------------------------------------------------------------------- */
-/*  IdP chooser device-resolve                                                */
-/* -------------------------------------------------------------------------- */
-/**
- * Request body for `POST /auth/device/resolve` (X-Oxy-Internal, called by the
- * IdP chooser) — the device key the chooser read from the first-party
- * `oxy_device` cookie.
- */
-exports.deviceResolveRequestSchema = zod_1.z.object({
-    deviceKey: zod_1.z.string().min(20),
-});
-const deviceResolveAccountSchema = zod_1.z.object({
-    user: userResponse_1.userResponseSchema,
-    sessionId: zod_1.z.string(),
-    accessToken: zod_1.z.string(),
-    expiresAt: zod_1.z.string(),
-});
-exports.deviceResolveResponseSchema = zod_1.z.object({
-    activeAccountId: zod_1.z.string().nullable(),
-    accounts: zod_1.z.array(deviceResolveAccountSchema),
-});

package/dist/cjs/deviceSession.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = void 0;
+exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = void 0;
 const zod_1 = require("zod");
 exports.sessionAccountSchema = zod_1.z.object({
     accountId: zod_1.z.string(),
@@ -23,3 +23,30 @@ exports.deviceSessionSyncSchema = zod_1.z.object({
     state: exports.deviceSessionStateSchema,
     activeToken: exports.activeTokenSchema.nullable(),
 });
+/* -------------------------------------------------------------------------- */
+/*  Device-secret token mint (phase 2c — zero-cookie transport)               */
+/* -------------------------------------------------------------------------- */
+/**
+ * Request body for `POST /session/device/token` — the client presents the
+ * `deviceId` it stored first-party plus the opaque `deviceSecret`. NO bearer:
+ * possession of the secret IS the proof of device ownership. The server matches
+ * `sha256(deviceSecret)` against the device's stored `secretHash` (constant-time)
+ * and mints a short access token for the device's active account.
+ */
+exports.deviceTokenMintRequestSchema = zod_1.z.object({
+    deviceId: zod_1.z.string().min(1),
+    deviceSecret: zod_1.z.string().min(1),
+});
+/**
+ * Wire shape of a successful `POST /session/device/token`: the freshly-minted
+ * short access token for the active account, its expiry, the NEXT rotating
+ * device secret the client must persist (rotation-in-use — the presented secret
+ * stays valid for a short grace so multi-tab races don't lock out), and the
+ * projected device-session state.
+ */
+exports.deviceTokenMintResponseSchema = zod_1.z.object({
+    accessToken: zod_1.z.string(),
+    expiresAt: zod_1.z.string(),
+    nextDeviceSecret: zod_1.z.string(),
+    state: exports.deviceSessionStateSchema,
+});

package/dist/cjs/index.js

@@ -12,7 +12,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.personhoodBreakdownSchema = exports.personhoodVouchRecordSchema = exports.validationVoteResultSchema = exports.validationRequestSummarySchema = exports.validationOpenResultSchema = exports.validationOpenRequestSchema = exports.validationVerdictRecordSchema = exports.realLifeAttestationResultSchema = exports.realLifeAttestationRecordSchema = exports.signedPublicCardSchema = exports.publicCardSchema = exports.logPageResponseSchema = exports.chainHeadResponseSchema = exports.oxySignedRecordTypeSchema = exports.exportBundleSchema = exports.exportAttestationSchema = exports.authMethodsResponseSchema = exports.authMethodEntrySchema = exports.domainVerificationInstructionsSchema = exports.domainVerificationRequestSchema = exports.verifiedDomainSchema = exports.signedRecordEnvelopeSchema = exports.didDocumentSchema = exports.didServiceSchema = exports.verificationMethodSchema = exports.appAffinityEventsIngestSchema = exports.appAffinityEventSchema = exports.appAffinityEventTypeSchema = exports.appUserSignalIngestSchema = exports.appInterestInputSchema = exports.appEndorsementInputSchema = exports.recommendationResponseSchema = exports.recommendationItemSchema = exports.recommendationCountSchema = exports.recommendationRequestSchema = exports.recommendationSignalWeightsSchema = exports.recommendationBoostSchema = exports.recommendationExcludeTypeSchema = exports.fedcmTokenPayloadSchema = exports.sessionStatusSchema = exports.publicApplicationSchema = exports.applicationTypeSchema = exports.safeParseContract = exports.resolveUserId = exports.deviceLinkedSessionsResponseSchema = exports.deviceLinkedSessionSchema = exports.currentUserResponseSchema = exports.userProfileUpdateSchema = exports.userResponseSchema = exports.userNameSchema = void 0;
-exports.deviceResolveResponseSchema = exports.deviceResolveRequestSchema = exports.loginResultSchema = exports.deviceTokenIssueResponseSchema = exports.tokenRefreshResponseSchema = exports.tokenRefreshRequestSchema = exports.webSessionResultSchema = exports.authTokenBundleSchema = exports.deviceExchangeRequestSchema = exports.deviceBootFragmentSchema = exports.deviceBootReasonSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.linkPreviewResponseSchema = exports.linkPreviewBatchResponseSchema = exports.linkPreviewBatchRequestSchema = exports.linkPreviewSchema = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = exports.vouchResultSchema = exports.personhoodStatusResultSchema = void 0;
+exports.loginResultSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.linkPreviewResponseSchema = exports.linkPreviewBatchResponseSchema = exports.linkPreviewBatchRequestSchema = exports.linkPreviewSchema = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = exports.vouchResultSchema = exports.personhoodStatusResultSchema = void 0;
 var userResponse_1 = require("./userResponse");
 // Schemas
 Object.defineProperty(exports, "userNameSchema", { enumerable: true, get: function () { return userResponse_1.userNameSchema; } });
@@ -99,16 +99,8 @@ Object.defineProperty(exports, "sessionAccountSchema", { enumerable: true, get:
 Object.defineProperty(exports, "deviceSessionStateSchema", { enumerable: true, get: function () { return deviceSession_1.deviceSessionStateSchema; } });
 Object.defineProperty(exports, "activeTokenSchema", { enumerable: true, get: function () { return deviceSession_1.activeTokenSchema; } });
 Object.defineProperty(exports, "deviceSessionSyncSchema", { enumerable: true, get: function () { return deviceSession_1.deviceSessionSyncSchema; } });
+Object.defineProperty(exports, "deviceTokenMintRequestSchema", { enumerable: true, get: function () { return deviceSession_1.deviceTokenMintRequestSchema; } });
+Object.defineProperty(exports, "deviceTokenMintResponseSchema", { enumerable: true, get: function () { return deviceSession_1.deviceTokenMintResponseSchema; } });
 var deviceBoot_1 = require("./deviceBoot");
 // Schemas
-Object.defineProperty(exports, "deviceBootReasonSchema", { enumerable: true, get: function () { return deviceBoot_1.deviceBootReasonSchema; } });
-Object.defineProperty(exports, "deviceBootFragmentSchema", { enumerable: true, get: function () { return deviceBoot_1.deviceBootFragmentSchema; } });
-Object.defineProperty(exports, "deviceExchangeRequestSchema", { enumerable: true, get: function () { return deviceBoot_1.deviceExchangeRequestSchema; } });
-Object.defineProperty(exports, "authTokenBundleSchema", { enumerable: true, get: function () { return deviceBoot_1.authTokenBundleSchema; } });
-Object.defineProperty(exports, "webSessionResultSchema", { enumerable: true, get: function () { return deviceBoot_1.webSessionResultSchema; } });
-Object.defineProperty(exports, "tokenRefreshRequestSchema", { enumerable: true, get: function () { return deviceBoot_1.tokenRefreshRequestSchema; } });
-Object.defineProperty(exports, "tokenRefreshResponseSchema", { enumerable: true, get: function () { return deviceBoot_1.tokenRefreshResponseSchema; } });
-Object.defineProperty(exports, "deviceTokenIssueResponseSchema", { enumerable: true, get: function () { return deviceBoot_1.deviceTokenIssueResponseSchema; } });
 Object.defineProperty(exports, "loginResultSchema", { enumerable: true, get: function () { return deviceBoot_1.loginResultSchema; } });
-Object.defineProperty(exports, "deviceResolveRequestSchema", { enumerable: true, get: function () { return deviceBoot_1.deviceResolveRequestSchema; } });
-Object.defineProperty(exports, "deviceResolveResponseSchema", { enumerable: true, get: function () { return deviceBoot_1.deviceResolveResponseSchema; } });

package/dist/cjs/userResponse.js

@@ -17,8 +17,7 @@
  *
  * Faithful to the producers:
  *  - `packages/api/src/utils/userTransform.ts` `formatUserResponse` — the
- *    canonical serialization used by the device-first bootstrap/exchange
- *    endpoints (`deviceAuth.ts`), login/signup, device sessions, etc.
+ *    canonical serialization used by login/signup, device sessions, etc.
  *    Emits `id` (NOT `_id`), forwards `username` verbatim (may be absent), and
  *    emits `name` as the structured `{ first, last, full, displayName }`
  *    subdocument.