@oxyhq/contracts 0.14.0 → 0.14.2

package/dist/cjs/deviceSession.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deviceHubTicketRedeemResponseSchema = exports.deviceHubTicketRedeemRequestSchema = exports.deviceHubTicketIssueResponseSchema = exports.deviceHubTicketIssueRequestSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = void 0;
+exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceHubTicketRedeemResponseSchema = exports.deviceHubTicketRedeemRequestSchema = exports.deviceHubTicketIssueResponseSchema = exports.deviceHubTicketIssueRequestSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = void 0;
 const zod_1 = require("zod");
 exports.sessionAccountSchema = zod_1.z.object({
     accountId: zod_1.z.string(),
@@ -72,3 +72,44 @@ exports.deviceHubTicketRedeemResponseSchema = zod_1.z.object({
     deviceId: zod_1.z.string().min(1),
     deviceSecret: zod_1.z.string().min(1),
 });
+/* -------------------------------------------------------------------------- */
+/*  Instant cross-app session sync (token-free socket signal)                 */
+/* -------------------------------------------------------------------------- */
+/**
+ * Name of the token-free Socket.IO event emitted to room `user:<userId>` on
+ * every DeviceSession mutation that changes what is signed in for that user.
+ *
+ * This is a pure SIGNAL — it carries NO access token, NO deviceSecret and NO
+ * account bodies. A client that receives it re-fetches its authenticated
+ * session/account state (`GET /session/device/state`, `GET /accounts`). Unlike
+ * `session_state` (scoped to `device:<deviceId>`, i.e. a single origin), this
+ * reaches ALL of a user's connected sockets across their devices/origins so
+ * every Oxy app reflects an add / switch / signout instantly.
+ */
+exports.SESSION_ACCOUNTS_CHANGED_EVENT = 'session_accounts_changed';
+/**
+ * Why the signed-in set changed:
+ *  - `login`   — a brand-new session was minted for the user (QR / cross-app authorize)
+ *  - `add`     — an account was registered onto a device set
+ *  - `switch`  — the active account on a device changed
+ *  - `signout` — one or all accounts were signed out of a device
+ *  - `revoke`  — a dead/revoked account was healed out of a device set
+ */
+exports.sessionAccountsChangedReasonSchema = zod_1.z.enum([
+    'login',
+    'add',
+    'switch',
+    'signout',
+    'revoke',
+]);
+/**
+ * Payload of {@link SESSION_ACCOUNTS_CHANGED_EVENT}. `revision` is the mutated
+ * DeviceSession revision for device-scoped reasons (`add`/`switch`/`signout`/
+ * `revoke`); for `login` (no device mutation at emit time) it is `0`. The
+ * payload is deliberately minimal and secret-free — the client refetches.
+ */
+exports.sessionAccountsChangedEventSchema = zod_1.z.object({
+    userId: zod_1.z.string(),
+    revision: zod_1.z.number().int().nonnegative(),
+    reason: exports.sessionAccountsChangedReasonSchema,
+});

package/dist/cjs/identity.js

@@ -190,9 +190,11 @@ exports.domainVerificationInstructionsSchema = zod_1.z.object({
     }),
 });
 exports.authMethodEntrySchema = zod_1.z.object({
-    type: zod_1.z.enum(['identity', 'password', 'google', 'apple', 'github']),
+    type: zod_1.z.enum(['identity', 'password', 'google', 'apple', 'github', 'webauthn']),
     linkedAt: zod_1.z.union([zod_1.z.string(), zod_1.z.date()]),
     verificationMethodId: zod_1.z.string().optional(),
+    credentialId: zod_1.z.string().optional(),
+    name: zod_1.z.string().optional(),
 });
 exports.authMethodsResponseSchema = zod_1.z.object({
     did: zod_1.z.string(),

package/dist/cjs/index.js

@@ -12,7 +12,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validationVoteResultSchema = exports.validationRequestSummarySchema = exports.validationOpenResultSchema = exports.validationOpenRequestSchema = exports.validationVerdictRecordSchema = exports.realLifeAttestationResultSchema = exports.realLifeAttestationRecordSchema = exports.signedPublicCardSchema = exports.publicCardSchema = exports.logPageResponseSchema = exports.chainHeadResponseSchema = exports.oxySignedRecordTypeSchema = exports.exportBundleSchema = exports.exportAttestationSchema = exports.authMethodsResponseSchema = exports.authMethodEntrySchema = exports.domainVerificationInstructionsSchema = exports.domainVerificationRequestSchema = exports.verifiedDomainSchema = exports.signedRecordEnvelopeSchema = exports.didDocumentSchema = exports.didServiceSchema = exports.verificationMethodSchema = exports.appAffinityEventsIngestSchema = exports.appAffinityEventSchema = exports.appAffinityEventTypeSchema = exports.appUserSignalIngestSchema = exports.appInterestInputSchema = exports.appEndorsementInputSchema = exports.recommendationResponseSchema = exports.recommendationItemSchema = exports.recommendationCountSchema = exports.recommendationRequestSchema = exports.recommendationSignalWeightsSchema = exports.recommendationBoostSchema = exports.recommendationExcludeTypeSchema = exports.sessionStatusSchema = exports.publicApplicationSchema = exports.applicationTypeSchema = exports.safeParseContract = exports.resolveUserId = exports.deviceLinkedSessionsResponseSchema = exports.deviceLinkedSessionSchema = exports.currentUserResponseSchema = exports.userProfileUpdateSchema = exports.userResponseSchema = exports.userNameSchema = exports.createAccountRequestSchema = exports.organizationCategorySchema = exports.ORGANIZATION_CATEGORIES = void 0;
-exports.loginResultSchema = exports.deviceHubTicketRedeemResponseSchema = exports.deviceHubTicketRedeemRequestSchema = exports.deviceHubTicketIssueResponseSchema = exports.deviceHubTicketIssueRequestSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.linkPreviewResponseSchema = exports.linkPreviewBatchResponseSchema = exports.linkPreviewBatchRequestSchema = exports.linkPreviewSchema = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = exports.vouchResultSchema = exports.personhoodStatusResultSchema = exports.personhoodBreakdownSchema = exports.personhoodVouchRecordSchema = void 0;
+exports.rollbackRequestSchema = exports.updateListResponseSchema = exports.channelListResponseSchema = exports.channelSchema = exports.rollbackToEmbeddedEntrySchema = exports.createUpdateResponseSchema = exports.updateSchema = exports.createUpdateRequestSchema = exports.updateAssetRefSchema = exports.assetCompleteResponseSchema = exports.assetCompleteResultItemSchema = exports.assetCompleteRequestSchema = exports.assetInitResponseSchema = exports.assetUploadTicketSchema = exports.assetInitRequestSchema = exports.assetInitItemSchema = exports.rolloutPercentSchema = exports.runtimeVersionSchema = exports.channelNameSchema = exports.sha256HexSchema = exports.updateAssetStatusSchema = exports.updateStatusSchema = exports.updatePlatformSchema = exports.loginResultSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceHubTicketRedeemResponseSchema = exports.deviceHubTicketRedeemRequestSchema = exports.deviceHubTicketIssueResponseSchema = exports.deviceHubTicketIssueRequestSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.linkPreviewResponseSchema = exports.linkPreviewBatchResponseSchema = exports.linkPreviewBatchRequestSchema = exports.linkPreviewSchema = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = exports.vouchResultSchema = exports.personhoodStatusResultSchema = exports.personhoodBreakdownSchema = exports.personhoodVouchRecordSchema = void 0;
+exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.updateRolloutPatchSchema = exports.promoteRequestSchema = exports.rollbackToEmbeddedRequestSchema = void 0;
 var accountGraph_1 = require("./accountGraph");
 Object.defineProperty(exports, "ORGANIZATION_CATEGORIES", { enumerable: true, get: function () { return accountGraph_1.ORGANIZATION_CATEGORIES; } });
 Object.defineProperty(exports, "organizationCategorySchema", { enumerable: true, get: function () { return accountGraph_1.organizationCategorySchema; } });
@@ -106,6 +107,47 @@ Object.defineProperty(exports, "deviceHubTicketIssueRequestSchema", { enumerable
 Object.defineProperty(exports, "deviceHubTicketIssueResponseSchema", { enumerable: true, get: function () { return deviceSession_1.deviceHubTicketIssueResponseSchema; } });
 Object.defineProperty(exports, "deviceHubTicketRedeemRequestSchema", { enumerable: true, get: function () { return deviceSession_1.deviceHubTicketRedeemRequestSchema; } });
 Object.defineProperty(exports, "deviceHubTicketRedeemResponseSchema", { enumerable: true, get: function () { return deviceSession_1.deviceHubTicketRedeemResponseSchema; } });
+Object.defineProperty(exports, "SESSION_ACCOUNTS_CHANGED_EVENT", { enumerable: true, get: function () { return deviceSession_1.SESSION_ACCOUNTS_CHANGED_EVENT; } });
+Object.defineProperty(exports, "sessionAccountsChangedReasonSchema", { enumerable: true, get: function () { return deviceSession_1.sessionAccountsChangedReasonSchema; } });
+Object.defineProperty(exports, "sessionAccountsChangedEventSchema", { enumerable: true, get: function () { return deviceSession_1.sessionAccountsChangedEventSchema; } });
 var deviceBoot_1 = require("./deviceBoot");
 // Schemas
 Object.defineProperty(exports, "loginResultSchema", { enumerable: true, get: function () { return deviceBoot_1.loginResultSchema; } });
+var updates_1 = require("./updates");
+// Shared primitives
+Object.defineProperty(exports, "updatePlatformSchema", { enumerable: true, get: function () { return updates_1.updatePlatformSchema; } });
+Object.defineProperty(exports, "updateStatusSchema", { enumerable: true, get: function () { return updates_1.updateStatusSchema; } });
+Object.defineProperty(exports, "updateAssetStatusSchema", { enumerable: true, get: function () { return updates_1.updateAssetStatusSchema; } });
+Object.defineProperty(exports, "sha256HexSchema", { enumerable: true, get: function () { return updates_1.sha256HexSchema; } });
+Object.defineProperty(exports, "channelNameSchema", { enumerable: true, get: function () { return updates_1.channelNameSchema; } });
+Object.defineProperty(exports, "runtimeVersionSchema", { enumerable: true, get: function () { return updates_1.runtimeVersionSchema; } });
+Object.defineProperty(exports, "rolloutPercentSchema", { enumerable: true, get: function () { return updates_1.rolloutPercentSchema; } });
+// Assets: init + complete
+Object.defineProperty(exports, "assetInitItemSchema", { enumerable: true, get: function () { return updates_1.assetInitItemSchema; } });
+Object.defineProperty(exports, "assetInitRequestSchema", { enumerable: true, get: function () { return updates_1.assetInitRequestSchema; } });
+Object.defineProperty(exports, "assetUploadTicketSchema", { enumerable: true, get: function () { return updates_1.assetUploadTicketSchema; } });
+Object.defineProperty(exports, "assetInitResponseSchema", { enumerable: true, get: function () { return updates_1.assetInitResponseSchema; } });
+Object.defineProperty(exports, "assetCompleteRequestSchema", { enumerable: true, get: function () { return updates_1.assetCompleteRequestSchema; } });
+Object.defineProperty(exports, "assetCompleteResultItemSchema", { enumerable: true, get: function () { return updates_1.assetCompleteResultItemSchema; } });
+Object.defineProperty(exports, "assetCompleteResponseSchema", { enumerable: true, get: function () { return updates_1.assetCompleteResponseSchema; } });
+// Create update
+Object.defineProperty(exports, "updateAssetRefSchema", { enumerable: true, get: function () { return updates_1.updateAssetRefSchema; } });
+Object.defineProperty(exports, "createUpdateRequestSchema", { enumerable: true, get: function () { return updates_1.createUpdateRequestSchema; } });
+// Read models
+Object.defineProperty(exports, "updateSchema", { enumerable: true, get: function () { return updates_1.updateSchema; } });
+Object.defineProperty(exports, "createUpdateResponseSchema", { enumerable: true, get: function () { return updates_1.createUpdateResponseSchema; } });
+Object.defineProperty(exports, "rollbackToEmbeddedEntrySchema", { enumerable: true, get: function () { return updates_1.rollbackToEmbeddedEntrySchema; } });
+Object.defineProperty(exports, "channelSchema", { enumerable: true, get: function () { return updates_1.channelSchema; } });
+Object.defineProperty(exports, "channelListResponseSchema", { enumerable: true, get: function () { return updates_1.channelListResponseSchema; } });
+Object.defineProperty(exports, "updateListResponseSchema", { enumerable: true, get: function () { return updates_1.updateListResponseSchema; } });
+// Rollback / promote / rollout
+Object.defineProperty(exports, "rollbackRequestSchema", { enumerable: true, get: function () { return updates_1.rollbackRequestSchema; } });
+Object.defineProperty(exports, "rollbackToEmbeddedRequestSchema", { enumerable: true, get: function () { return updates_1.rollbackToEmbeddedRequestSchema; } });
+Object.defineProperty(exports, "promoteRequestSchema", { enumerable: true, get: function () { return updates_1.promoteRequestSchema; } });
+Object.defineProperty(exports, "updateRolloutPatchSchema", { enumerable: true, get: function () { return updates_1.updateRolloutPatchSchema; } });
+var webauthn_1 = require("./webauthn");
+// Schemas
+Object.defineProperty(exports, "webauthnRegisterOptionsRequestSchema", { enumerable: true, get: function () { return webauthn_1.webauthnRegisterOptionsRequestSchema; } });
+Object.defineProperty(exports, "webauthnLoginOptionsRequestSchema", { enumerable: true, get: function () { return webauthn_1.webauthnLoginOptionsRequestSchema; } });
+Object.defineProperty(exports, "webauthnRegisterVerifyRequestSchema", { enumerable: true, get: function () { return webauthn_1.webauthnRegisterVerifyRequestSchema; } });
+Object.defineProperty(exports, "webauthnLoginVerifyRequestSchema", { enumerable: true, get: function () { return webauthn_1.webauthnLoginVerifyRequestSchema; } });

package/dist/cjs/updates.js

@@ -0,0 +1,250 @@
+"use strict";
+/**
+ * Oxy Updates (self-hosted expo-updates protocol) — publish/admin API contracts.
+ *
+ * SINGLE SOURCE OF TRUTH for the wire shape of the AUTHENTICATED publish/admin
+ * surface that the `oxy-ship` CLI and the console Updates tab call. The PUBLIC
+ * manifest endpoint (`GET /updates/v1/apps/:clientId/manifest`) speaks the
+ * expo-updates v1 protocol verbatim (multipart/mixed, signed) and is therefore
+ * NOT modelled here — its shape is dictated by the Expo spec, not by us.
+ *
+ * The API validates its OUTPUT against these schemas; every consumer (the ship
+ * CLI, the console hook) validates its INPUT against the same definitions, so
+ * producer and consumers cannot drift.
+ *
+ * Domain model (mirrors the Mongoose models in `@oxyhq/api`):
+ *  - A `channel` (e.g. `production`, `preview`, `pr-123`) is a named release
+ *    track for one application.
+ *  - An `update` is one published bundle for a single `(channel, runtimeVersion,
+ *    platform)`. Its `updateId` is a UUIDv4 (the client parses it as a UUID).
+ *    The HEAD of a track is the newest `published` update for that tuple.
+ *  - An `asset` is content-addressed by its `sha256`; assets are shared across
+ *    updates and applications (an unchanged JS bundle is uploaded once).
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo. ESM-safe (no
+ * `require()`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.updateRolloutPatchSchema = exports.promoteRequestSchema = exports.rollbackToEmbeddedRequestSchema = exports.rollbackRequestSchema = exports.updateListResponseSchema = exports.channelListResponseSchema = exports.channelSchema = exports.rollbackToEmbeddedEntrySchema = exports.createUpdateResponseSchema = exports.updateSchema = exports.createUpdateRequestSchema = exports.updateAssetRefSchema = exports.assetCompleteResponseSchema = exports.assetCompleteResultItemSchema = exports.assetCompleteRequestSchema = exports.assetInitResponseSchema = exports.assetUploadTicketSchema = exports.assetInitRequestSchema = exports.assetInitItemSchema = exports.rolloutPercentSchema = exports.runtimeVersionSchema = exports.channelNameSchema = exports.sha256HexSchema = exports.updateAssetStatusSchema = exports.updateStatusSchema = exports.updatePlatformSchema = void 0;
+const zod_1 = require("zod");
+/* -------------------------------------------------------------------------- */
+/*  Shared primitives                                                         */
+/* -------------------------------------------------------------------------- */
+/** The two platforms the expo-updates protocol addresses. */
+exports.updatePlatformSchema = zod_1.z.enum(['ios', 'android']);
+/** Lifecycle of a single published update row. */
+exports.updateStatusSchema = zod_1.z.enum(['published', 'superseded', 'rolled_back']);
+/** Upload lifecycle of a content-addressed asset. */
+exports.updateAssetStatusSchema = zod_1.z.enum(['pending', 'uploaded']);
+/** Lowercase-hex SHA-256 content hash (64 hex chars). */
+exports.sha256HexSchema = zod_1.z
+    .string()
+    .regex(/^[a-f0-9]{64}$/, 'sha256 must be 64 lowercase hex characters');
+/**
+ * A channel name. Constrained to a URL/path-safe slug so it can appear in the
+ * `expo-channel-name` header and be used CI-friendly for `pr-<n>` tracks. No
+ * colon (BullMQ/id safety) and no slash (path safety).
+ */
+exports.channelNameSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(100)
+    .regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/, 'channel name must be a URL-safe slug');
+/** A runtime version string (expo-updates `runtimeVersion`, e.g. an appVersion). */
+exports.runtimeVersionSchema = zod_1.z.string().min(1).max(255);
+/** A rollout percentage: 0 rolls out to nobody, 100 to everybody. */
+exports.rolloutPercentSchema = zod_1.z.number().int().min(0).max(100);
+/* -------------------------------------------------------------------------- */
+/*  Assets: init + complete                                                   */
+/* -------------------------------------------------------------------------- */
+/**
+ * One asset the client intends to upload as part of an update. `sha256` is the
+ * content hash (dedup key); `contentType` and `size` describe the object the
+ * server will accept at the presigned URL.
+ */
+exports.assetInitItemSchema = zod_1.z.object({
+    sha256: exports.sha256HexSchema,
+    contentType: zod_1.z.string().min(1).max(255),
+    size: zod_1.z.number().int().positive(),
+});
+/**
+ * `POST /updates/v1/assets/init` request. Declares the full asset set of an
+ * update; the server replies with a presigned PUT for every asset it does NOT
+ * already hold (content-addressed dedup — unchanged assets are never re-uploaded).
+ */
+exports.assetInitRequestSchema = zod_1.z.object({
+    applicationId: zod_1.z.string().min(1),
+    assets: zod_1.z.array(exports.assetInitItemSchema).min(1).max(2000),
+});
+/** One presigned upload the client must PUT its bytes to before completing. */
+exports.assetUploadTicketSchema = zod_1.z.object({
+    sha256: exports.sha256HexSchema,
+    /** Presigned S3 PUT URL. The client PUTs the exact bytes here. */
+    uploadUrl: zod_1.z.string(),
+    /** The S3 key the object will live at (`public/updates/assets/<sha256>`). */
+    storageKey: zod_1.z.string(),
+    /** The Content-Type the presigned URL was signed for; echo it on the PUT. */
+    contentType: zod_1.z.string(),
+    /**
+     * The Cache-Control the presigned URL was signed for; the client MUST send it
+     * verbatim on the PUT so the SigV4 signature matches and the stored object
+     * carries the long immutable cache header (assets are content-addressed).
+     */
+    cacheControl: zod_1.z.string(),
+});
+/**
+ * `POST /updates/v1/assets/init` response. `missing` holds a presigned upload
+ * for each asset the server does not yet have; `existing` lists the sha256s it
+ * already holds (the client skips those).
+ */
+exports.assetInitResponseSchema = zod_1.z.object({
+    missing: zod_1.z.array(exports.assetUploadTicketSchema),
+    existing: zod_1.z.array(exports.sha256HexSchema),
+});
+/**
+ * `POST /updates/v1/assets/complete` request. Sent after the client has PUT
+ * every `missing` asset. The server HEADs each object and flips it to
+ * `uploaded`; an object that is absent or size-mismatched is rejected.
+ */
+exports.assetCompleteRequestSchema = zod_1.z.object({
+    applicationId: zod_1.z.string().min(1),
+    sha256s: zod_1.z.array(exports.sha256HexSchema).min(1).max(2000),
+});
+/** Per-asset verification outcome from `assets/complete`. */
+exports.assetCompleteResultItemSchema = zod_1.z.object({
+    sha256: exports.sha256HexSchema,
+    status: exports.updateAssetStatusSchema,
+    size: zod_1.z.number().int().nonnegative(),
+});
+exports.assetCompleteResponseSchema = zod_1.z.object({
+    assets: zod_1.z.array(exports.assetCompleteResultItemSchema),
+});
+/* -------------------------------------------------------------------------- */
+/*  Create update                                                             */
+/* -------------------------------------------------------------------------- */
+/**
+ * A single asset reference inside a create-update request. `key` is the
+ * expo-export asset key (the md5-basename the client uses to look the asset up
+ * and skip embedded ones); `fileExtension` is the suggested on-disk extension.
+ */
+exports.updateAssetRefSchema = zod_1.z.object({
+    sha256: exports.sha256HexSchema,
+    /** expo-export asset key (md5 basename) — how app code references the asset. */
+    key: zod_1.z.string().min(1),
+    contentType: zod_1.z.string().min(1),
+    /** Suggested file extension including the leading dot (e.g. `.js`, `.png`). */
+    fileExtension: zod_1.z.string().optional(),
+});
+/**
+ * `POST /updates/v1/updates` request. Publishes one bundle for one platform to a
+ * channel (the channel is created on demand — CI-friendly for `pr-<n>`). All
+ * referenced assets MUST already be `uploaded` (via init/complete). `extra`
+ * MUST carry `expoClient` so `Constants.expoConfig` works after an OTA update.
+ */
+exports.createUpdateRequestSchema = zod_1.z.object({
+    applicationId: zod_1.z.string().min(1),
+    channel: exports.channelNameSchema,
+    runtimeVersion: exports.runtimeVersionSchema,
+    platform: exports.updatePlatformSchema,
+    /** The launch (entry-point) asset — its `fileExtension` is ignored by clients. */
+    launchAsset: exports.updateAssetRefSchema,
+    assets: zod_1.z.array(exports.updateAssetRefSchema),
+    /**
+     * Opaque `extra` blob embedded verbatim in the signed manifest. MUST contain
+     * `expoClient` (the public expo config) so `Constants.expoConfig` resolves
+     * after an OTA update; MAY carry other third-party config.
+     */
+    extra: zod_1.z
+        .object({ expoClient: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) })
+        .catchall(zod_1.z.unknown()),
+    /** String→string metadata dict; filtered client-side via manifest filters. */
+    metadata: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).optional(),
+    /** Initial rollout percentage (default 100 — full rollout). */
+    rolloutPercent: exports.rolloutPercentSchema.optional(),
+    /** Git commit the bundle was built from (audit / console display). */
+    gitCommit: zod_1.z.string().max(100).optional(),
+    /** Git branch the bundle was built from (audit / console display). */
+    gitBranch: zod_1.z.string().max(200).optional(),
+    /** Human-readable publish message (console display). */
+    message: zod_1.z.string().max(500).optional(),
+});
+exports.updateSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    applicationId: zod_1.z.string(),
+    channel: zod_1.z.string(),
+    runtimeVersion: zod_1.z.string(),
+    platform: exports.updatePlatformSchema,
+    status: exports.updateStatusSchema,
+    rolloutPercent: exports.rolloutPercentSchema,
+    launchAssetSha256: exports.sha256HexSchema,
+    assetSha256s: zod_1.z.array(exports.sha256HexSchema),
+    gitCommit: zod_1.z.string().optional(),
+    gitBranch: zod_1.z.string().optional(),
+    message: zod_1.z.string().optional(),
+    promotedFromUpdateId: zod_1.z.string().optional(),
+    createdAt: zod_1.z.string(),
+    updatedAt: zod_1.z.string(),
+});
+exports.createUpdateResponseSchema = zod_1.z.object({
+    update: exports.updateSchema,
+});
+exports.rollbackToEmbeddedEntrySchema = zod_1.z.object({
+    runtimeVersion: zod_1.z.string(),
+    platform: exports.updatePlatformSchema,
+    commitTime: zod_1.z.string(),
+});
+exports.channelSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    applicationId: zod_1.z.string(),
+    name: zod_1.z.string(),
+    rollbacksToEmbedded: zod_1.z.array(exports.rollbackToEmbeddedEntrySchema),
+    createdAt: zod_1.z.string(),
+    updatedAt: zod_1.z.string(),
+});
+exports.channelListResponseSchema = zod_1.z.object({
+    channels: zod_1.z.array(exports.channelSchema),
+});
+exports.updateListResponseSchema = zod_1.z.object({
+    updates: zod_1.z.array(exports.updateSchema),
+});
+/* -------------------------------------------------------------------------- */
+/*  Rollback / rollback-to-embedded / promote / rollout                       */
+/* -------------------------------------------------------------------------- */
+/**
+ * `POST /updates/v1/channels/:channel/rollback` request. Marks the current head
+ * for `(runtimeVersion, platform)` `rolled_back` so the previous published
+ * update (if any) becomes head again. Nothing is deleted.
+ */
+exports.rollbackRequestSchema = zod_1.z.object({
+    applicationId: zod_1.z.string().min(1),
+    runtimeVersion: exports.runtimeVersionSchema,
+    platform: exports.updatePlatformSchema,
+});
+/**
+ * `POST /updates/v1/channels/:channel/rollback-to-embedded` request. Records a
+ * `rollBackToEmbedded` directive so clients on this `(runtimeVersion, platform)`
+ * fall back to the update embedded in their binary.
+ */
+exports.rollbackToEmbeddedRequestSchema = zod_1.z.object({
+    applicationId: zod_1.z.string().min(1),
+    runtimeVersion: exports.runtimeVersionSchema,
+    platform: exports.updatePlatformSchema,
+});
+/**
+ * `POST /updates/v1/channels/:channel/promote` request. Promotes an existing
+ * update (by `updateId`) into the target channel by creating a NEW update (new
+ * UUID) pointing at the SAME assets. `toChannel` defaults to the path channel.
+ */
+exports.promoteRequestSchema = zod_1.z.object({
+    applicationId: zod_1.z.string().min(1),
+    updateId: zod_1.z.string().min(1),
+    /** Target channel to promote into. Defaults to the path `:channel`. */
+    toChannel: exports.channelNameSchema.optional(),
+    /** Rollout percentage for the promoted update (default 100). */
+    rolloutPercent: exports.rolloutPercentSchema.optional(),
+});
+/** `PATCH /updates/v1/updates/:updateId` request — adjust a rollout in place. */
+exports.updateRolloutPatchSchema = zod_1.z.object({
+    applicationId: zod_1.z.string().min(1),
+    rolloutPercent: exports.rolloutPercentSchema,
+});

package/dist/cjs/webauthn.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * WebAuthn / passkey ceremony contracts (Fase B/b1).
+ *
+ * These schemas describe ONLY the outer Oxy envelope that wraps a WebAuthn
+ * ceremony request — the username the client is registering/authenticating as,
+ * plus the device-session options every first-party sign-in accepts. The browser
+ * `RegistrationResponseJSON` / `AuthenticationResponseJSON` payloads are NOT
+ * mirrored here: they are validated by `@simplewebauthn/server` inside the route
+ * (`verifyRegistrationResponse` / `verifyAuthenticationResponse`), which is the
+ * single source of truth for their structure. Re-encoding them in Zod would just
+ * create a second, drift-prone definition of a shape we do not own.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = void 0;
+const zod_1 = require("zod");
+/**
+ * Device-session options shared by every first-party sign-in body
+ * (`deviceName`/`deviceFingerprint`/`deviceId`). Mirrors what
+ * `sessionCreateOptionsFromBody` reads in the API so a WebAuthn login/verify can
+ * name and pin its resulting session exactly like `/auth/login` or `/auth/verify`.
+ */
+const deviceSessionEnvelope = {
+    deviceName: zod_1.z.string().trim().min(1).max(120).optional(),
+    deviceFingerprint: zod_1.z.string().trim().min(1).max(256).optional(),
+    deviceId: zod_1.z.string().trim().min(1).max(256).optional(),
+};
+/**
+ * `POST /webauthn/register/options` — request registration options. With a bearer
+ * token the caller links a passkey to their signed-in account and `username` is
+ * ignored; without one it is a prospective signup and `username` is the desired
+ * (not-yet-created) handle.
+ */
+exports.webauthnRegisterOptionsRequestSchema = zod_1.z.object({
+    username: zod_1.z.string().trim().min(1).max(60).optional(),
+});
+/**
+ * `POST /webauthn/login/options` — request authentication options. When
+ * `username` is present the server scopes `allowCredentials` to that user's
+ * passkeys (username-first); when omitted it returns an empty allow-list for the
+ * usernameless / discoverable-credential flow (the default).
+ */
+exports.webauthnLoginOptionsRequestSchema = zod_1.z.object({
+    username: zod_1.z.string().trim().min(1).max(60).optional(),
+});
+/**
+ * `POST /webauthn/register/verify` — the outer envelope. The browser
+ * `RegistrationResponseJSON` travels alongside these fields under `response` and
+ * is validated by `@simplewebauthn/server`, not here. `username` is required only
+ * for the prospective-signup branch (no bearer); the linking branch ignores it.
+ */
+exports.webauthnRegisterVerifyRequestSchema = zod_1.z.object({
+    username: zod_1.z.string().trim().min(1).max(60).optional(),
+    ...deviceSessionEnvelope,
+});
+/**
+ * `POST /webauthn/login/verify` — the outer envelope. The browser
+ * `AuthenticationResponseJSON` travels alongside these fields under `response`
+ * and is validated by `@simplewebauthn/server`, not here.
+ */
+exports.webauthnLoginVerifyRequestSchema = zod_1.z.object({
+    ...deviceSessionEnvelope,
+});