@oxyhq/contracts 0.12.0 → 0.13.1

package/dist/types/deviceBoot.d.ts

@@ -1,27 +1,15 @@
 /**
- * Device-first bootstrap & token contracts (auth centralization, wave 1).
+ * First-party login result contract.
  *
- * SINGLE SOURCE OF TRUTH for the wire shape of the new device-first session
- * bootstrap: the top-level `#oxy_boot=…` fragment the API hands back from
- * `GET /auth/device/bootstrap`, the token bundle a boot code / web-session
- * fast-path exchanges into, the persisted-refresh rotation, the native
- * device-token issuance, the IdP chooser's device-resolve, and the first-party
- * password login result (2FA arm vs. session arm). The API validates its OUTPUT
- * against these schemas; every consumer (`@oxyhq/core`'s device-boot mixin, the
- * SDK cold boot, the IdP chooser) validates its INPUT against the same
- * definitions, so producer and consumers cannot drift.
+ * SINGLE SOURCE OF TRUTH for the first-party password login result (2FA arm vs.
+ * session arm). The API validates its OUTPUT against this schema; every consumer
+ * (`@oxyhq/core`'s auth mixin) validates its INPUT against the same definition,
+ * so producer and consumers cannot drift.
  *
- * Design anchors (from the auth-centralization plan):
- *  - The bootstrap fragment carries NO tokens and NO deviceId — only a
- *    `state` echo (CSRF), a `reason`, a short-lived single-use `code`, and an
- *    opaque `deviceToken`. Tokens are obtained by exchanging the `code` at
- *    `POST /auth/device/exchange` (origin-bound GETDEL burn).
- *  - Refresh is ONE rotating, single-use family shared by web and native.
- *  - `loginResult` mirrors what `POST /auth/login` returns today
- *    (`buildSessionAuthResponse` in the API's `session.controller.ts`): either a
- *    2FA challenge (`{ twoFactorRequired: true, loginToken }`) or a session
- *    payload. The session arm matches `SessionAuthResponse` EXACTLY, plus an
- *    optional `refreshToken` the new server adds for the persisted-refresh lane.
+ * The device transport is `deviceId` + `deviceSecret` + `POST /session/device/token`
+ * (see `deviceSession.ts`). The legacy cookie/bootstrap/refresh-family lanes were
+ * removed in the zero-cookie cutover — nothing here carries a refresh token or a
+ * boot fragment.
  *
  * Nested-object response shapes are declared as explicit `interface`s with the
  * runtime schema annotated `z.ZodType<Interface>` — the same rationale as
@@ -34,172 +22,22 @@
  * `require()`).
  */
 import { z } from 'zod';
-import { type UserResponse } from './userResponse';
-/**
- * Why the bootstrap hop resolved the way it did.
- *  - `session` — the device cookie resolved an active session; a `code` is
- *    present to exchange for tokens.
- *  - `no_session` — the device is known but has no active session; no `code`.
- *  - `new_device` — first contact; the cookie was just planted, no session yet.
- */
-export declare const deviceBootReasonSchema: z.ZodEnum<["session", "no_session", "new_device"]>;
-export type DeviceBootReason = z.infer<typeof deviceBootReasonSchema>;
-export declare const deviceBootFragmentSchema: z.ZodDiscriminatedUnion<"reason", [z.ZodObject<{
-    reason: z.ZodLiteral<"session">;
-    code: z.ZodString;
-    v: z.ZodLiteral<1>;
-    state: z.ZodString;
-    deviceToken: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    code: string;
-    reason: "session";
-    v: 1;
-    state: string;
-    deviceToken: string;
-}, {
-    code: string;
-    reason: "session";
-    v: 1;
-    state: string;
-    deviceToken: string;
-}>, z.ZodObject<{
-    reason: z.ZodLiteral<"no_session">;
-    v: z.ZodLiteral<1>;
-    state: z.ZodString;
-    deviceToken: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    reason: "no_session";
-    v: 1;
-    state: string;
-    deviceToken: string;
-}, {
-    reason: "no_session";
-    v: 1;
-    state: string;
-    deviceToken: string;
-}>, z.ZodObject<{
-    reason: z.ZodLiteral<"new_device">;
-    v: z.ZodLiteral<1>;
-    state: z.ZodString;
-    deviceToken: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    reason: "new_device";
-    v: 1;
-    state: string;
-    deviceToken: string;
-}, {
-    reason: "new_device";
-    v: 1;
-    state: string;
-    deviceToken: string;
-}>]>;
-export type DeviceBootFragment = z.infer<typeof deviceBootFragmentSchema>;
-/** Request body for `POST /auth/device/exchange` — the single-use boot code. */
-export declare const deviceExchangeRequestSchema: z.ZodObject<{
-    code: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    code: string;
-}, {
-    code: string;
-}>;
-export type DeviceExchangeRequest = z.infer<typeof deviceExchangeRequestSchema>;
-/**
- * The token bundle returned by `POST /auth/device/exchange` and
- * `POST /auth/device/web-session` — the freshly-minted access token, its
- * rotating refresh-family head, the owning `sessionId`, and the full canonical
- * user object. `expiresAt` is an ISO string.
- */
-export interface AuthTokenBundle {
-    sessionId: string;
-    accessToken: string;
-    refreshToken: string;
-    expiresAt: string;
-    user: UserResponse;
-    /**
-     * The device secret (phase 2c — zero-cookie transport). Present ONLY when
-     * the bundle is minted for a device that carries a `DeviceSession` doc; the
-     * client persists it first-party and later mints access tokens via
-     * `POST /session/device/token`. Optional and additive: cookie-lane bundles
-     * for a device with no doc omit it, so existing consumers are unaffected.
-     */
-    deviceSecret?: string;
+/** One anomalous signal the server flagged on a sign-in (new device, location, …). */
+export interface SecurityAlertAnomaly {
+    type: string;
+    reason: string;
+    details?: string;
 }
-export declare const authTokenBundleSchema: z.ZodType<AuthTokenBundle>;
 /**
- * The `*.oxy.so` same-site fast path returns a `reason`-discriminated result:
- * a full session (the device cookie resolved an active session) OR a
- * signed-out arm (the device is known / was just planted). BOTH arms carry the
- * rotated opaque `deviceToken` to persist — the deviceToken is device-level
- * attribution, not session-level, so it is refreshed even when signed out.
- *
- * IMPORTANT: the success arm nests the token bundle under `session` — it is
- * NOT a bare {@link AuthTokenBundle}. That distinction is load-bearing for the
- * consumer (`@oxyhq/core`'s cold boot uses `result.session` and persists the
- * `deviceToken` from the SAME envelope).
- */
-/**
- * Success arm: an active session resolved from the same-site device cookie.
- */
-export interface WebSessionSession {
-    reason: 'session';
-    session: AuthTokenBundle;
-    deviceToken: string;
-}
-/**
- * Signed-out arm: the device is known (or freshly planted) but has no active
- * session. Carries only the rotated `deviceToken`.
+ * The "New sign-in detected" payload the API attaches to a successful
+ * `POST /auth/login` when anomaly detection fires (`session.controller.ts`).
+ * The IdP renders `message` and gates the flow on user acknowledgement before
+ * continuing to the OAuth authorize step.
  */
-export interface WebSessionNoSession {
-    reason: 'no_session' | 'new_device';
-    deviceToken: string;
+export interface SecurityAlert {
+    message: string;
+    anomalies: SecurityAlertAnomaly[];
 }
-/** The `reason`-discriminated outcome of `POST /auth/device/web-session`. */
-export type WebSessionResult = WebSessionSession | WebSessionNoSession;
-export declare const webSessionResultSchema: z.ZodType<WebSessionResult>;
-/** Request body for `POST /auth/refresh-token` — the current refresh token. */
-export declare const tokenRefreshRequestSchema: z.ZodObject<{
-    refreshToken: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    refreshToken: string;
-}, {
-    refreshToken: string;
-}>;
-export type TokenRefreshRequest = z.infer<typeof tokenRefreshRequestSchema>;
-/**
- * Wire shape of `POST /auth/refresh-token`: the rotated (single-use) family —
- * a new access token, the next refresh token, the new access-token expiry, and
- * the owning session id. `expiresAt` is an ISO string.
- */
-export declare const tokenRefreshResponseSchema: z.ZodObject<{
-    accessToken: z.ZodString;
-    refreshToken: z.ZodString;
-    expiresAt: z.ZodString;
-    sessionId: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    expiresAt: string;
-    sessionId: string;
-    accessToken: string;
-    refreshToken: string;
-}, {
-    expiresAt: string;
-    sessionId: string;
-    accessToken: string;
-    refreshToken: string;
-}>;
-export type TokenRefreshResponse = z.infer<typeof tokenRefreshResponseSchema>;
-/**
- * Wire shape of `POST /auth/device/token` — issues (or rotates) the opaque
- * device token for the native channel. The deviceId is taken from the bearer
- * JWT claims server-side; only the token comes back.
- */
-export declare const deviceTokenIssueResponseSchema: z.ZodObject<{
-    deviceToken: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    deviceToken: string;
-}, {
-    deviceToken: string;
-}>;
-export type DeviceTokenIssueResponse = z.infer<typeof deviceTokenIssueResponseSchema>;
 /**
  * `POST /auth/login` when the account has 2FA enabled: a short-lived login
  * token to be presented at the 2FA challenge, and no session yet.
@@ -210,8 +48,7 @@ export interface LoginTwoFactorRequired {
 }
 /**
  * `POST /auth/login` when authentication completed in one step. Matches the
- * API's `SessionAuthResponse` EXACTLY (`buildSessionAuthResponse`), plus the
- * optional `refreshToken` the persisted-refresh lane adds. `user` is the
+ * API's `SessionAuthResponse` EXACTLY (`buildSessionAuthResponse`). `user` is the
  * truncated session-user shape the login endpoint emits (NOT the full
  * `userResponseSchema`).
  */
@@ -220,14 +57,20 @@ export interface LoginSessionResult {
     deviceId: string;
     expiresAt: string;
     accessToken?: string;
-    refreshToken?: string;
     /**
-     * The device secret (phase 2c — zero-cookie transport). Present ONLY when
-     * the sign-in resolved a device binding; the client persists it first-party
-     * and later mints access tokens via `POST /session/device/token`. Optional
-     * and additive — wired identically to `refreshToken`.
+     * The device secret (zero-cookie transport). Emitted on every successful
+     * sign-in; the client persists it first-party alongside `deviceId` and later
+     * mints access tokens via `POST /session/device/token`. Optional only because
+     * a best-effort mint can fail — it is the sole restore credential.
      */
     deviceSecret?: string;
+    /**
+     * Present only when the server's anomaly detection flagged this sign-in.
+     * The IdP shows a "New sign-in detected" acknowledgement before proceeding.
+     * The session is already established regardless — this is an interstitial,
+     * not a gate on the credential check.
+     */
+    securityAlert?: SecurityAlert;
     user: {
         id: string;
         username?: string;
@@ -237,33 +80,3 @@ export interface LoginSessionResult {
 /** The discriminated outcome of `POST /auth/login`. */
 export type LoginResult = LoginTwoFactorRequired | LoginSessionResult;
 export declare const loginResultSchema: z.ZodType<LoginResult>;
-/**
- * Request body for `POST /auth/device/resolve` (X-Oxy-Internal, called by the
- * IdP chooser) — the device key the chooser read from the first-party
- * `oxy_device` cookie.
- */
-export declare const deviceResolveRequestSchema: z.ZodObject<{
-    deviceKey: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    deviceKey: string;
-}, {
-    deviceKey: string;
-}>;
-export type DeviceResolveRequest = z.infer<typeof deviceResolveRequestSchema>;
-/** One account resolved for the IdP chooser from a device's session set. */
-export interface DeviceResolveAccount {
-    user: UserResponse;
-    sessionId: string;
-    accessToken: string;
-    expiresAt: string;
-}
-/**
- * Wire shape of `POST /auth/device/resolve` — the device's active account id
- * (or `null` when signed out of all) plus every account signed in on the
- * device. Replaces the IdP's legacy cookie-based chooser feed.
- */
-export interface DeviceResolveResponse {
-    activeAccountId: string | null;
-    accounts: DeviceResolveAccount[];
-}
-export declare const deviceResolveResponseSchema: z.ZodType<DeviceResolveResponse>;

package/dist/types/deviceSession.d.ts

@@ -39,24 +39,24 @@ export declare const deviceSessionStateSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     updatedAt: number;
     deviceId: string;
-    activeAccountId: string | null;
     accounts: {
         sessionId: string;
         accountId: string;
         authuser: number;
         operatedByUserId?: string | undefined;
     }[];
+    activeAccountId: string | null;
     revision: number;
 }, {
     updatedAt: number;
     deviceId: string;
-    activeAccountId: string | null;
     accounts: {
         sessionId: string;
         accountId: string;
         authuser: number;
         operatedByUserId?: string | undefined;
     }[];
+    activeAccountId: string | null;
     revision: number;
 }>;
 export declare const activeTokenSchema: z.ZodObject<{
@@ -94,24 +94,24 @@ export declare const deviceSessionSyncSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         updatedAt: number;
         deviceId: string;
-        activeAccountId: string | null;
         accounts: {
             sessionId: string;
             accountId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
+        activeAccountId: string | null;
         revision: number;
     }, {
         updatedAt: number;
         deviceId: string;
-        activeAccountId: string | null;
         accounts: {
             sessionId: string;
             accountId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
+        activeAccountId: string | null;
         revision: number;
     }>;
     activeToken: z.ZodNullable<z.ZodObject<{
@@ -128,13 +128,13 @@ export declare const deviceSessionSyncSchema: z.ZodObject<{
     state: {
         updatedAt: number;
         deviceId: string;
-        activeAccountId: string | null;
         accounts: {
             sessionId: string;
             accountId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
+        activeAccountId: string | null;
         revision: number;
     };
     activeToken: {
@@ -145,13 +145,13 @@ export declare const deviceSessionSyncSchema: z.ZodObject<{
     state: {
         updatedAt: number;
         deviceId: string;
-        activeAccountId: string | null;
         accounts: {
             sessionId: string;
             accountId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
+        activeAccountId: string | null;
         revision: number;
     };
     activeToken: {
@@ -174,11 +174,11 @@ export declare const deviceTokenMintRequestSchema: z.ZodObject<{
     deviceId: z.ZodString;
     deviceSecret: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    deviceSecret: string;
     deviceId: string;
-}, {
     deviceSecret: string;
+}, {
     deviceId: string;
+    deviceSecret: string;
 }>;
 /**
  * Wire shape of a successful `POST /session/device/token`: the freshly-minted
@@ -215,58 +215,103 @@ export declare const deviceTokenMintResponseSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         updatedAt: number;
         deviceId: string;
-        activeAccountId: string | null;
         accounts: {
             sessionId: string;
             accountId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
+        activeAccountId: string | null;
         revision: number;
     }, {
         updatedAt: number;
         deviceId: string;
-        activeAccountId: string | null;
         accounts: {
             sessionId: string;
             accountId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
+        activeAccountId: string | null;
         revision: number;
     }>;
 }, "strip", z.ZodTypeAny, {
     expiresAt: string;
+    accessToken: string;
     state: {
         updatedAt: number;
         deviceId: string;
-        activeAccountId: string | null;
         accounts: {
             sessionId: string;
             accountId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
+        activeAccountId: string | null;
         revision: number;
     };
-    accessToken: string;
     nextDeviceSecret: string;
 }, {
     expiresAt: string;
+    accessToken: string;
     state: {
         updatedAt: number;
         deviceId: string;
-        activeAccountId: string | null;
         accounts: {
             sessionId: string;
             accountId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
+        activeAccountId: string | null;
         revision: number;
     };
-    accessToken: string;
     nextDeviceSecret: string;
 }>;
 export type DeviceTokenMintRequest = z.infer<typeof deviceTokenMintRequestSchema>;
 export type DeviceTokenMintResponse = z.infer<typeof deviceTokenMintResponseSchema>;
+/** Request body for `POST /session/device/hub-ticket`. */
+export declare const deviceHubTicketIssueRequestSchema: z.ZodObject<{
+    returnOrigin: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    returnOrigin: string;
+}, {
+    returnOrigin: string;
+}>;
+/** Response from `POST /session/device/hub-ticket`. */
+export declare const deviceHubTicketIssueResponseSchema: z.ZodObject<{
+    ticket: z.ZodString;
+    expiresIn: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    ticket: string;
+    expiresIn: number;
+}, {
+    ticket: string;
+    expiresIn: number;
+}>;
+/** Request body for `POST /session/device/redeem-ticket`. */
+export declare const deviceHubTicketRedeemRequestSchema: z.ZodObject<{
+    ticket: z.ZodString;
+    returnOrigin: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    returnOrigin: string;
+    ticket: string;
+}, {
+    returnOrigin: string;
+    ticket: string;
+}>;
+/** Response from `POST /session/device/redeem-ticket`. */
+export declare const deviceHubTicketRedeemResponseSchema: z.ZodObject<{
+    deviceId: z.ZodString;
+    deviceSecret: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    deviceId: string;
+    deviceSecret: string;
+}, {
+    deviceId: string;
+    deviceSecret: string;
+}>;
+export type DeviceHubTicketIssueRequest = z.infer<typeof deviceHubTicketIssueRequestSchema>;
+export type DeviceHubTicketIssueResponse = z.infer<typeof deviceHubTicketIssueResponseSchema>;
+export type DeviceHubTicketRedeemRequest = z.infer<typeof deviceHubTicketRedeemRequestSchema>;
+export type DeviceHubTicketRedeemResponse = z.infer<typeof deviceHubTicketRedeemResponseSchema>;

package/dist/types/index.d.ts

@@ -2,7 +2,7 @@
  * @oxyhq/contracts — single source of truth for API request/response contracts.
  *
  * Zod schemas plus their inferred types, shared by the backend (`@oxyhq/api`)
- * and the client SDKs (`@oxyhq/core`, `@oxyhq/auth`, `@oxyhq/services`). The
+ * and the client SDKs (`@oxyhq/core`, `@oxyhq/services`). The
  * producer validates its output and every consumer validates its input against
  * exactly the same definitions, so the wire shape cannot drift.
  *
@@ -13,8 +13,6 @@ export { userNameSchema, userResponseSchema, userProfileUpdateSchema, currentUse
 export type { UserNameResponse, UserResponse, UserProfileUpdate, CurrentUserResponseContract, DeviceLinkedSessionResponse, DeviceLinkedSessionsResponseContract, } from './userResponse';
 export { applicationTypeSchema, publicApplicationSchema, sessionStatusSchema, } from './sessionStatus';
 export type { ApplicationTypeContract, PublicApplicationResponse, SessionStatusResponse, } from './sessionStatus';
-export { fedcmTokenPayloadSchema, } from './fedcmToken';
-export type { FedcmTokenPayload, } from './fedcmToken';
 export { recommendationExcludeTypeSchema, recommendationBoostSchema, recommendationSignalWeightsSchema, recommendationRequestSchema, recommendationCountSchema, recommendationItemSchema, recommendationResponseSchema, appEndorsementInputSchema, appInterestInputSchema, appUserSignalIngestSchema, appAffinityEventTypeSchema, appAffinityEventSchema, appAffinityEventsIngestSchema, } from './recommendations';
 export type { RecommendationExcludeType, RecommendationBoost, RecommendationSignalWeights, RecommendationRequest, RecommendationCount, RecommendationItem, RecommendationResponse, AppEndorsementInput, AppInterestInput, AppUserSignalIngest, AppAffinityEventType, AppAffinityEvent, AppAffinityEventsIngest, } from './recommendations';
 export { verificationMethodSchema, didServiceSchema, didDocumentSchema, signedRecordEnvelopeSchema, verifiedDomainSchema, domainVerificationRequestSchema, domainVerificationInstructionsSchema, authMethodEntrySchema, authMethodsResponseSchema, exportAttestationSchema, exportBundleSchema, } from './identity';
@@ -27,7 +25,7 @@ export { publicCardSchema, signedPublicCardSchema, realLifeAttestationRecordSche
 export type { CardTrustTier, PersonhoodStatus, PublicCard, SignedPublicCard, RealLifeAttestationRecord, RealLifeAttestationResult, ValidationVerdict, ValidationRequestStatus, ValidationVerdictRecord, ValidationOpenRequest, ValidationOpenResult, ValidationRequestSummary, ValidationVoteResult, PersonhoodVouchRecord, PersonhoodBreakdown, PersonhoodStatusResult, VouchResult, CredentialStatus, CredentialRecord, VerifiableCredentialResponse, CredentialIssueResult, CredentialListResult, CredentialVerifyResult, } from './civic';
 export { linkPreviewSchema, linkPreviewBatchRequestSchema, linkPreviewBatchResponseSchema, linkPreviewResponseSchema, } from './links';
 export type { LinkPreviewStatus, LinkPreview, LinkPreviewBatchRequest, LinkPreviewBatchResponse, } from './links';
-export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, deviceTokenMintRequestSchema, deviceTokenMintResponseSchema, } from './deviceSession';
-export type { SessionAccount, DeviceSessionState, ActiveToken, DeviceSessionSync, DeviceTokenMintRequest, DeviceTokenMintResponse, } from './deviceSession';
-export { deviceBootReasonSchema, deviceBootFragmentSchema, deviceExchangeRequestSchema, authTokenBundleSchema, webSessionResultSchema, tokenRefreshRequestSchema, tokenRefreshResponseSchema, deviceTokenIssueResponseSchema, loginResultSchema, deviceResolveRequestSchema, deviceResolveResponseSchema, } from './deviceBoot';
-export type { DeviceBootReason, DeviceBootFragment, DeviceExchangeRequest, AuthTokenBundle, WebSessionResult, WebSessionSession, WebSessionNoSession, TokenRefreshRequest, TokenRefreshResponse, DeviceTokenIssueResponse, LoginTwoFactorRequired, LoginSessionResult, LoginResult, DeviceResolveRequest, DeviceResolveAccount, DeviceResolveResponse, } from './deviceBoot';
+export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, deviceTokenMintRequestSchema, deviceTokenMintResponseSchema, deviceHubTicketIssueRequestSchema, deviceHubTicketIssueResponseSchema, deviceHubTicketRedeemRequestSchema, deviceHubTicketRedeemResponseSchema, } from './deviceSession';
+export type { SessionAccount, DeviceSessionState, ActiveToken, DeviceSessionSync, DeviceTokenMintRequest, DeviceTokenMintResponse, DeviceHubTicketIssueRequest, DeviceHubTicketIssueResponse, DeviceHubTicketRedeemRequest, DeviceHubTicketRedeemResponse, } from './deviceSession';
+export { loginResultSchema, } from './deviceBoot';
+export type { LoginTwoFactorRequired, LoginSessionResult, LoginResult, SecurityAlert, SecurityAlertAnomaly, } from './deviceBoot';

package/dist/types/userResponse.d.ts

@@ -11,13 +11,12 @@
  *
  * This package (`@oxyhq/contracts`) is the dedicated, zero-dependency home for
  * these contracts so the backend (`@oxyhq/api`) and the client SDKs
- * (`@oxyhq/core`, `@oxyhq/auth`, `@oxyhq/services`) can all depend on it without
+ * (`@oxyhq/core`, `@oxyhq/services`) can all depend on it without
  * the backend having to depend on a client SDK to obtain its schemas.
  *
  * Faithful to the producers:
  *  - `packages/api/src/utils/userTransform.ts` `formatUserResponse` — the
- *    canonical serialization used by the device-first bootstrap/exchange
- *    endpoints (`deviceAuth.ts`), login/signup, device sessions, etc.
+ *    canonical serialization used by login/signup, device sessions, etc.
  *    Emits `id` (NOT `_id`), forwards `username` verbatim (may be absent), and
  *    emits `name` as the structured `{ first, last, full, displayName }`
  *    subdocument.
@@ -417,12 +416,12 @@ export declare const currentUserResponseSchema: z.ZodObject<{
         verifiedDomains?: import("./identity").VerifiedDomain[] | undefined;
         verified?: boolean | undefined;
         username?: string | undefined;
+        avatar?: string | null | undefined;
         _id?: string | undefined;
         email?: string | undefined;
         phone?: string | undefined;
         address?: string | undefined;
         birthday?: string | undefined;
-        avatar?: string | null | undefined;
         color?: string | null | undefined;
         language?: string | undefined;
     } & {
@@ -437,12 +436,12 @@ export declare const currentUserResponseSchema: z.ZodObject<{
         verifiedDomains?: import("./identity").VerifiedDomain[] | undefined;
         verified?: boolean | undefined;
         username?: string | undefined;
+        avatar?: string | null | undefined;
         _id?: string | undefined;
         email?: string | undefined;
         phone?: string | undefined;
         address?: string | undefined;
         birthday?: string | undefined;
-        avatar?: string | null | undefined;
         color?: string | null | undefined;
         language?: string | undefined;
     } & {
@@ -549,7 +548,6 @@ export declare const deviceLinkedSessionSchema: z.ZodObject<{
     }, z.ZodTypeAny, "passthrough">>>>;
 }, "strip", z.ZodTypeAny, {
     sessionId: string;
-    isCurrent?: boolean | undefined;
     user?: z.objectOutputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -580,9 +578,9 @@ export declare const deviceLinkedSessionSchema: z.ZodObject<{
          */
         verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
+    isCurrent?: boolean | undefined;
 }, {
     sessionId: string;
-    isCurrent?: boolean | undefined;
     user?: z.objectInputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -613,6 +611,7 @@ export declare const deviceLinkedSessionSchema: z.ZodObject<{
          */
         verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
+    isCurrent?: boolean | undefined;
 }>;
 export type DeviceLinkedSessionResponse = z.infer<typeof deviceLinkedSessionSchema>;
 /** Wire shape of `GET /session/device/sessions/:sessionId` (an array). */
@@ -709,7 +708,6 @@ export declare const deviceLinkedSessionsResponseSchema: z.ZodArray<z.ZodObject<
     }, z.ZodTypeAny, "passthrough">>>>;
 }, "strip", z.ZodTypeAny, {
     sessionId: string;
-    isCurrent?: boolean | undefined;
     user?: z.objectOutputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -740,9 +738,9 @@ export declare const deviceLinkedSessionsResponseSchema: z.ZodArray<z.ZodObject<
          */
         verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
+    isCurrent?: boolean | undefined;
 }, {
     sessionId: string;
-    isCurrent?: boolean | undefined;
     user?: z.objectInputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -773,6 +771,7 @@ export declare const deviceLinkedSessionsResponseSchema: z.ZodArray<z.ZodObject<
          */
         verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
+    isCurrent?: boolean | undefined;
 }>, "many">;
 export type DeviceLinkedSessionsResponseContract = z.infer<typeof deviceLinkedSessionsResponseSchema>;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/contracts",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "OxyHQ API contracts — single source of truth for request/response Zod schemas and inferred types, shared by the backend and the client SDKs",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",