@oxyhq/contracts 0.14.0 → 0.14.2

package/dist/types/webauthn.d.ts

@@ -0,0 +1,83 @@
+/**
+ * WebAuthn / passkey ceremony contracts (Fase B/b1).
+ *
+ * These schemas describe ONLY the outer Oxy envelope that wraps a WebAuthn
+ * ceremony request — the username the client is registering/authenticating as,
+ * plus the device-session options every first-party sign-in accepts. The browser
+ * `RegistrationResponseJSON` / `AuthenticationResponseJSON` payloads are NOT
+ * mirrored here: they are validated by `@simplewebauthn/server` inside the route
+ * (`verifyRegistrationResponse` / `verifyAuthenticationResponse`), which is the
+ * single source of truth for their structure. Re-encoding them in Zod would just
+ * create a second, drift-prone definition of a shape we do not own.
+ */
+import { z } from 'zod';
+/**
+ * `POST /webauthn/register/options` — request registration options. With a bearer
+ * token the caller links a passkey to their signed-in account and `username` is
+ * ignored; without one it is a prospective signup and `username` is the desired
+ * (not-yet-created) handle.
+ */
+export declare const webauthnRegisterOptionsRequestSchema: z.ZodObject<{
+    username: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    username?: string | undefined;
+}, {
+    username?: string | undefined;
+}>;
+export type WebauthnRegisterOptionsRequest = z.infer<typeof webauthnRegisterOptionsRequestSchema>;
+/**
+ * `POST /webauthn/login/options` — request authentication options. When
+ * `username` is present the server scopes `allowCredentials` to that user's
+ * passkeys (username-first); when omitted it returns an empty allow-list for the
+ * usernameless / discoverable-credential flow (the default).
+ */
+export declare const webauthnLoginOptionsRequestSchema: z.ZodObject<{
+    username: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    username?: string | undefined;
+}, {
+    username?: string | undefined;
+}>;
+export type WebauthnLoginOptionsRequest = z.infer<typeof webauthnLoginOptionsRequestSchema>;
+/**
+ * `POST /webauthn/register/verify` — the outer envelope. The browser
+ * `RegistrationResponseJSON` travels alongside these fields under `response` and
+ * is validated by `@simplewebauthn/server`, not here. `username` is required only
+ * for the prospective-signup branch (no bearer); the linking branch ignores it.
+ */
+export declare const webauthnRegisterVerifyRequestSchema: z.ZodObject<{
+    deviceName: z.ZodOptional<z.ZodString>;
+    deviceFingerprint: z.ZodOptional<z.ZodString>;
+    deviceId: z.ZodOptional<z.ZodString>;
+    username: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    username?: string | undefined;
+    deviceId?: string | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}, {
+    username?: string | undefined;
+    deviceId?: string | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}>;
+export type WebauthnRegisterVerifyRequest = z.infer<typeof webauthnRegisterVerifyRequestSchema>;
+/**
+ * `POST /webauthn/login/verify` — the outer envelope. The browser
+ * `AuthenticationResponseJSON` travels alongside these fields under `response`
+ * and is validated by `@simplewebauthn/server`, not here.
+ */
+export declare const webauthnLoginVerifyRequestSchema: z.ZodObject<{
+    deviceName: z.ZodOptional<z.ZodString>;
+    deviceFingerprint: z.ZodOptional<z.ZodString>;
+    deviceId: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    deviceId?: string | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}, {
+    deviceId?: string | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}>;
+export type WebauthnLoginVerifyRequest = z.infer<typeof webauthnLoginVerifyRequestSchema>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/contracts",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "OxyHQ API contracts — single source of truth for request/response Zod schemas and inferred types, shared by the backend and the client SDKs",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",