@oxyhq/contracts 0.17.0 → 0.19.0

package/dist/types/commonsSignIn.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Canonical contract for the "Sign in with Oxy" approval handoff.
+ *
+ * SINGLE SOURCE OF TRUTH for the closed set of reasons an approver may attach
+ * when it DENIES a pending request via
+ * `POST /auth/session/deny/:authorizeCode`.
+ *
+ * That endpoint is UNAUTHENTICATED — the public `authorizeCode` is the only
+ * credential — so a free-form string from it is never stored: it would be an
+ * unauthenticated write of arbitrary text onto a record other surfaces read.
+ * The set is therefore deliberately tiny, and closed:
+ *
+ *  - `'declined'` the approver rejected a request they recognised ("Not now").
+ *  - `'not_me'`   the approver did not start the request ("This wasn't me").
+ *                 The ONE value that records the denial as suspicious rather
+ *                 than an ordinary cancel, so a UI may only offer it where the
+ *                 user genuinely said so.
+ *
+ * Why this lives in `@oxyhq/contracts` rather than in either consumer: the same
+ * closed set is enforced in three places — the request schema of the API route,
+ * the `enum` of the persisted `AuthSession.deniedReason` field, and the client
+ * SDK's `denyCommonsSignIn` parameter. Two hand-maintained copies of a wire
+ * contract drift the moment a value is added on one side only, and the failure
+ * lands at runtime, in an auth path, as a generic validation error. One
+ * declaration makes that impossible.
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo. ESM-safe (no
+ * `require()`).
+ */
+import { z } from 'zod';
+/**
+ * The closed set, as a value — consumed directly where a runtime list is
+ * required (e.g. the Mongoose `enum` of `AuthSession.deniedReason`, which is
+ * the storage-level guarantee that an unauthenticated caller can never write
+ * free-form text into the field).
+ */
+export declare const COMMONS_DENY_REASONS: readonly ["declined", "not_me"];
+/**
+ * The same set as a zod enum — the edge validator. Anything outside it
+ * (including free-form text) is rejected with 400 before any handler runs.
+ */
+export declare const commonsDenyReasonSchema: z.ZodEnum<["declined", "not_me"]>;
+/** Why the approver denied a "Sign in with Oxy" request. */
+export type CommonsDenyReason = z.infer<typeof commonsDenyReasonSchema>;
+/**
+ * Android notification channel id the identity-approval push is sent on.
+ *
+ * A wire contract for the same reason the deny set is: Android 8+ DROPS a
+ * notification whose channel id the app has not created, silently and with no
+ * client-side error. The API attaches this id when it sends, and the vault
+ * creates the channel with it before registering a push token — two hand-typed
+ * copies of that string would fail as "the notification never arrived", which
+ * is the single hardest push symptom to diagnose.
+ *
+ * The channel's user-visible NAME and description are deliberately NOT here:
+ * those are localized app copy, and the vault owns them.
+ */
+export declare const IDENTITY_APPROVAL_PUSH_CHANNEL = "auth-approval";

package/dist/types/devicePairing.d.ts

@@ -0,0 +1,130 @@
+/**
+ * Device-to-device identity transfer contracts (b3 Feature 2 — "add a device").
+ *
+ * SINGLE SOURCE OF TRUTH for the wire shape of the short-lived, unauthenticated
+ * relay that carries E2E-encrypted key material from an existing (old) device to
+ * a fresh (new) device so both end up holding the SAME secp256k1 private key
+ * (key cloning). The relay is E2E-encrypted via an ephemeral secp256k1 ECDH
+ * handshake: the server stores only the two ephemeral public keys plus an opaque
+ * AEAD ciphertext + nonce and NEVER holds a decryption key.
+ *
+ * Flow:
+ *  1. New device (no identity) generates an ephemeral pair and calls
+ *     `POST /identity/device-transfer/init { newEphPub, newDeviceLabel? }` →
+ *     `{ pairingId, expiresAt }`. The QR carries ONLY `pairingId` (not
+ *     self-contained — mirrors the QR sign-in `approve-info` resolution).
+ *  2. Old device (has identity) scans, resolves the request via
+ *     `GET /identity/device-transfer/:pairingId` (returns `newEphPub` + label),
+ *     derives `transferKey = HKDF(ECDH(oldEphPriv, newEphPub), pairingId,
+ *     'oxy-device-transfer-v1')`, AEAD-encrypts `{ privateKey, publicKey }`, and
+ *     calls `POST /identity/device-transfer/:pairingId/approve` with the
+ *     ciphertext PLUS a fresh signature over
+ *     `{ action:'approve_device_transfer', pairingId, timestamp }` made with the
+ *     CURRENT identity key (dual-proof: a bearer alone cannot exfiltrate the key).
+ *  3. New device (socket push or poll fallback) re-derives the same
+ *     `transferKey` from `ECDH(newEphPriv, oldEphPub)`, decrypts, and imports the
+ *     private key, then completes a NORMAL challenge/verify sign-in.
+ *
+ * The load-bearing response shapes are declared as explicit `interface`s (same
+ * `moduleResolution: node` rationale as `UserNameResponse` / the identity/civic
+ * contracts: a nested `z.infer<>` can degrade to `{}` under a consumer's
+ * `moduleResolution: "node"`), with the runtime schemas annotated
+ * `z.ZodType<Interface>`.
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo, ESM-safe.
+ */
+import { z } from 'zod';
+/**
+ * Pairing lifecycle:
+ *  - `pending`  — created by the new device, awaiting the old device's approval.
+ *  - `approved` — the old device sealed and posted the encrypted key material.
+ *  - `denied`   — the old device explicitly cancelled the transfer.
+ *  - `expired`  — the 3-minute TTL elapsed before approval.
+ */
+export declare const devicePairingStatusSchema: z.ZodEnum<["pending", "approved", "denied", "expired"]>;
+export type DevicePairingStatus = z.infer<typeof devicePairingStatusSchema>;
+/** Request body for `POST /identity/device-transfer/init` (public). */
+export declare const deviceTransferInitRequestSchema: z.ZodObject<{
+    /** The new device's ephemeral secp256k1 public key (single-use). */
+    newEphPub: z.ZodString;
+    /** Optional human-readable label for the new device (e.g. "iPhone 15"). */
+    newDeviceLabel: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    newEphPub: string;
+    newDeviceLabel?: string | undefined;
+}, {
+    newEphPub: string;
+    newDeviceLabel?: string | undefined;
+}>;
+export type DeviceTransferInitRequest = z.infer<typeof deviceTransferInitRequestSchema>;
+export interface DeviceTransferInitResponse {
+    /** 128-bit single-use handle carried in the QR. Also the HKDF salt. */
+    pairingId: string;
+    /** ISO-8601 expiry (3 minutes from creation). */
+    expiresAt: string;
+}
+export declare const deviceTransferInitResponseSchema: z.ZodType<DeviceTransferInitResponse>;
+export interface DeviceTransferInfoResponse {
+    pairingId: string;
+    /** The new device's ephemeral public key (so the old device can ECDH). */
+    newDeviceEphemeralPublicKey: string;
+    /** Optional new-device label supplied at init. */
+    newDeviceLabel: string | null;
+    status: DevicePairingStatus;
+    /** ISO-8601 expiry. */
+    expiresAt: string;
+    /**
+     * The old device's ephemeral public key — present ONLY once `status` is
+     * `approved` (so the new device can re-derive the shared secret).
+     */
+    oldDeviceEphemeralPublicKey: string | null;
+    /** AEAD ciphertext (hex) — present ONLY once `status` is `approved`. */
+    ciphertext: string | null;
+    /** AEAD nonce (hex) — present ONLY once `status` is `approved`. */
+    nonce: string | null;
+}
+export declare const deviceTransferInfoResponseSchema: z.ZodType<DeviceTransferInfoResponse>;
+/**
+ * Request body for `POST /identity/device-transfer/:pairingId/approve`
+ * (bearer-authenticated AND signature-proven). The `signature` covers
+ * `JSON.stringify({ action:'approve_device_transfer', pairingId, timestamp })`
+ * made with the caller's CURRENT identity key — dual-proof so a bearer token
+ * alone can never exfiltrate the private key.
+ */
+export declare const deviceTransferApproveRequestSchema: z.ZodObject<{
+    /** The old device's ephemeral secp256k1 public key (single-use). */
+    oldEphPub: z.ZodString;
+    /** AEAD ciphertext of `{ privateKey, publicKey }`, hex. */
+    ciphertext: z.ZodString;
+    /** AEAD nonce, hex (24 bytes). */
+    nonce: z.ZodString;
+    /** ECDSA (DER, hex) signature proving control of the CURRENT identity key. */
+    signature: z.ZodString;
+    /** Signing timestamp (ms since epoch) — freshness-checked server-side. */
+    timestamp: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    signature: string;
+    nonce: string;
+    ciphertext: string;
+    oldEphPub: string;
+    timestamp: number;
+}, {
+    signature: string;
+    nonce: string;
+    ciphertext: string;
+    oldEphPub: string;
+    timestamp: number;
+}>;
+export type DeviceTransferApproveRequest = z.infer<typeof deviceTransferApproveRequestSchema>;
+export interface DeviceTransferApproveResponse {
+    success: boolean;
+    pairingId: string;
+    status: DevicePairingStatus;
+}
+export declare const deviceTransferApproveResponseSchema: z.ZodType<DeviceTransferApproveResponse>;
+export interface DeviceTransferDenyResponse {
+    success: boolean;
+    pairingId: string;
+    status: DevicePairingStatus;
+}
+export declare const deviceTransferDenyResponseSchema: z.ZodType<DeviceTransferDenyResponse>;

package/dist/types/deviceSession.d.ts

@@ -169,16 +169,27 @@ export type DeviceSessionSync = z.infer<typeof deviceSessionSyncSchema>;
  * possession of the secret IS the proof of device ownership. The server matches
  * `sha256(deviceSecret)` against the device's stored `secretHash` (constant-time)
  * and mints a short access token for the device's active account.
+ *
+ * `accountId` pins the mint to ONE account of that device instead of whichever
+ * account is currently active. It exists for identity-bound clients (Commons),
+ * whose authenticated user is determined by a local cryptographic key and must
+ * never follow an account switch made by another app on the same device. The
+ * account must already be a member of the device session; the mint NEVER
+ * mutates `activeAccountId`, so pinning is read-only with respect to the device
+ * state every other app observes.
  */
 export declare const deviceTokenMintRequestSchema: z.ZodObject<{
     deviceId: z.ZodString;
     deviceSecret: z.ZodString;
+    accountId: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     deviceId: string;
     deviceSecret: string;
+    accountId?: string | undefined;
 }, {
     deviceId: string;
     deviceSecret: string;
+    accountId?: string | undefined;
 }>;
 /**
  * Wire shape of a successful `POST /session/device/token`: the freshly-minted
@@ -270,51 +281,6 @@ export declare const deviceTokenMintResponseSchema: z.ZodObject<{
 }>;
 export type DeviceTokenMintRequest = z.infer<typeof deviceTokenMintRequestSchema>;
 export type DeviceTokenMintResponse = z.infer<typeof deviceTokenMintResponseSchema>;
-/** Request body for `POST /session/device/hub-ticket`. */
-export declare const deviceHubTicketIssueRequestSchema: z.ZodObject<{
-    returnOrigin: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    returnOrigin: string;
-}, {
-    returnOrigin: string;
-}>;
-/** Response from `POST /session/device/hub-ticket`. */
-export declare const deviceHubTicketIssueResponseSchema: z.ZodObject<{
-    ticket: z.ZodString;
-    expiresIn: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    ticket: string;
-    expiresIn: number;
-}, {
-    ticket: string;
-    expiresIn: number;
-}>;
-/** Request body for `POST /session/device/redeem-ticket`. */
-export declare const deviceHubTicketRedeemRequestSchema: z.ZodObject<{
-    ticket: z.ZodString;
-    returnOrigin: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    returnOrigin: string;
-    ticket: string;
-}, {
-    returnOrigin: string;
-    ticket: string;
-}>;
-/** Response from `POST /session/device/redeem-ticket`. */
-export declare const deviceHubTicketRedeemResponseSchema: z.ZodObject<{
-    deviceId: z.ZodString;
-    deviceSecret: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    deviceId: string;
-    deviceSecret: string;
-}, {
-    deviceId: string;
-    deviceSecret: string;
-}>;
-export type DeviceHubTicketIssueRequest = z.infer<typeof deviceHubTicketIssueRequestSchema>;
-export type DeviceHubTicketIssueResponse = z.infer<typeof deviceHubTicketIssueResponseSchema>;
-export type DeviceHubTicketRedeemRequest = z.infer<typeof deviceHubTicketRedeemRequestSchema>;
-export type DeviceHubTicketRedeemResponse = z.infer<typeof deviceHubTicketRedeemResponseSchema>;
 /**
  * Name of the token-free Socket.IO event emitted to room `user:<userId>` on
  * every DeviceSession mutation that changes what is signed in for that user.

package/dist/types/inboxPush.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Canonical contract for Inbox new-mail push notifications.
+ *
+ * The Android channel id and payload `type` are wire contracts: Android 8+
+ * drops a notification whose channel the app has not created, and the client
+ * only routes taps it recognises. Two hand-typed copies of either string fail as
+ * "the notification never arrived" or "tapping does nothing" — the hardest push
+ * symptoms to diagnose.
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo.
+ */
+import { z } from 'zod';
+/** Android notification channel id the new-mail push is sent on. */
+export declare const INBOX_EMAIL_PUSH_CHANNEL = "email";
+/** Runtime type discriminator of the new-mail push payload. */
+export declare const INBOX_EMAIL_PUSH_TYPE = "oxy_inbox_new_message";
+export declare const inboxEmailPushDataSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oxy_inbox_new_message">;
+    messageId: z.ZodString;
+    mailboxId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "oxy_inbox_new_message";
+    messageId: string;
+    mailboxId: string;
+}, {
+    type: "oxy_inbox_new_message";
+    messageId: string;
+    mailboxId: string;
+}>;
+export type InboxEmailPushData = z.infer<typeof inboxEmailPushDataSchema>;

package/dist/types/index.d.ts

@@ -15,6 +15,10 @@ export { userNameSchema, userRelationshipSchema, themePreferenceSchema, userResp
 export type { UserNameResponse, UserRelationship, ThemePreference, UserResponse, UserProfileUpdate, CurrentUserResponseContract, DeviceLinkedSessionResponse, DeviceLinkedSessionsResponseContract, } from './userResponse';
 export { applicationTypeSchema, publicApplicationSchema, sessionStatusSchema, } from './sessionStatus';
 export type { ApplicationTypeContract, PublicApplicationResponse, SessionStatusResponse, } from './sessionStatus';
+export { COMMONS_DENY_REASONS, commonsDenyReasonSchema, IDENTITY_APPROVAL_PUSH_CHANNEL, } from './commonsSignIn';
+export type { CommonsDenyReason } from './commonsSignIn';
+export { INBOX_EMAIL_PUSH_CHANNEL, INBOX_EMAIL_PUSH_TYPE, inboxEmailPushDataSchema, } from './inboxPush';
+export type { InboxEmailPushData } from './inboxPush';
 export { recommendationExcludeTypeSchema, recommendationBoostSchema, recommendationSignalWeightsSchema, recommendationRequestSchema, recommendationCountSchema, recommendationItemSchema, recommendationResponseSchema, appEndorsementInputSchema, appInterestInputSchema, appUserSignalIngestSchema, appAffinityEventTypeSchema, appAffinityEventSchema, appAffinityEventsIngestSchema, } from './recommendations';
 export type { RecommendationExcludeType, RecommendationBoost, RecommendationSignalWeights, RecommendationRequest, RecommendationCount, RecommendationItem, RecommendationResponse, AppEndorsementInput, AppInterestInput, AppUserSignalIngest, AppAffinityEventType, AppAffinityEvent, AppAffinityEventsIngest, } from './recommendations';
 export { verificationMethodSchema, didServiceSchema, didDocumentSchema, signedRecordEnvelopeSchema, verifiedDomainSchema, domainVerificationRequestSchema, domainVerificationInstructionsSchema, authMethodEntrySchema, authMethodsResponseSchema, exportAttestationSchema, exportBundleSchema, } from './identity';
@@ -27,8 +31,8 @@ export { publicCardSchema, signedPublicCardSchema, realLifeAttestationRecordSche
 export type { CardTrustTier, PersonhoodStatus, PublicCard, SignedPublicCard, RealLifeAttestationRecord, RealLifeAttestationResult, ValidationVerdict, ValidationRequestStatus, ValidationVerdictRecord, ValidationOpenRequest, ValidationOpenResult, ValidationRequestSummary, ValidationVoteResult, PersonhoodVouchRecord, PersonhoodBreakdown, PersonhoodStatusResult, VouchResult, CredentialStatus, CredentialRecord, VerifiableCredentialResponse, CredentialIssueResult, CredentialListResult, CredentialVerifyResult, } from './civic';
 export { linkPreviewSchema, linkPreviewBatchRequestSchema, linkPreviewBatchResponseSchema, linkPreviewResponseSchema, } from './links';
 export type { LinkPreviewStatus, LinkPreview, LinkPreviewBatchRequest, LinkPreviewBatchResponse, } from './links';
-export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, deviceTokenMintRequestSchema, deviceTokenMintResponseSchema, deviceHubTicketIssueRequestSchema, deviceHubTicketIssueResponseSchema, deviceHubTicketRedeemRequestSchema, deviceHubTicketRedeemResponseSchema, SESSION_ACCOUNTS_CHANGED_EVENT, sessionAccountsChangedReasonSchema, sessionAccountsChangedEventSchema, } from './deviceSession';
-export type { SessionAccount, DeviceSessionState, ActiveToken, DeviceSessionSync, DeviceTokenMintRequest, DeviceTokenMintResponse, DeviceHubTicketIssueRequest, DeviceHubTicketIssueResponse, DeviceHubTicketRedeemRequest, DeviceHubTicketRedeemResponse, SessionAccountsChangedReason, SessionAccountsChangedEvent, } from './deviceSession';
+export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, deviceTokenMintRequestSchema, deviceTokenMintResponseSchema, SESSION_ACCOUNTS_CHANGED_EVENT, sessionAccountsChangedReasonSchema, sessionAccountsChangedEventSchema, } from './deviceSession';
+export type { SessionAccount, DeviceSessionState, ActiveToken, DeviceSessionSync, DeviceTokenMintRequest, DeviceTokenMintResponse, SessionAccountsChangedReason, SessionAccountsChangedEvent, } from './deviceSession';
 export { loginResultSchema, } from './deviceBoot';
 export type { LoginSessionResult, LoginResult, SecurityAlert, SecurityAlertAnomaly, } from './deviceBoot';
 export { rotateKeyChallengeResponseSchema, rotateKeyCompleteRequestSchema, rotateKeyCompleteResponseSchema, } from './keyRotation';
@@ -39,3 +43,7 @@ export { updatePlatformSchema, updateStatusSchema, updateAssetStatusSchema, sha2
 export type { UpdatePlatform, UpdateStatus, UpdateAssetStatus, AssetInitItem, AssetInitRequest, AssetUploadTicket, AssetInitResponse, AssetCompleteRequest, AssetCompleteResultItem, AssetCompleteResponse, UpdateAssetRef, CreateUpdateRequest, Update, CreateUpdateResponse, RollbackToEmbeddedEntry, Channel, ChannelListResponse, UpdateListResponse, RollbackRequest, RollbackToEmbeddedRequest, PromoteRequest, UpdateRolloutPatch, } from './updates';
 export { webauthnRegisterOptionsRequestSchema, webauthnLoginOptionsRequestSchema, webauthnRegisterVerifyRequestSchema, webauthnLoginVerifyRequestSchema, } from './webauthn';
 export type { WebauthnRegisterOptionsRequest, WebauthnLoginOptionsRequest, WebauthnRegisterVerifyRequest, WebauthnLoginVerifyRequest, } from './webauthn';
+export { devicePairingStatusSchema, deviceTransferInitRequestSchema, deviceTransferInitResponseSchema, deviceTransferInfoResponseSchema, deviceTransferApproveRequestSchema, deviceTransferApproveResponseSchema, deviceTransferDenyResponseSchema, } from './devicePairing';
+export type { DevicePairingStatus, DeviceTransferInitRequest, DeviceTransferInitResponse, DeviceTransferInfoResponse, DeviceTransferApproveRequest, DeviceTransferApproveResponse, DeviceTransferDenyResponse, } from './devicePairing';
+export { transparencyCheckpointSignatureSchema, transparencyAnchorSchema, transparencyCheckpointSchema, transparencyInclusionProofSchema, transparencyCheckpointListSchema, } from './transparency';
+export type { TransparencyCheckpointSignature, TransparencyAnchor, TransparencyCheckpoint, TransparencyInclusionProof, TransparencyCheckpointList, } from './transparency';

package/dist/types/keyRecovery.d.ts

@@ -61,17 +61,17 @@ export declare const encryptedBackupEnvelopeSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     version: number;
     nonce: string;
+    ciphertext: string;
     algorithm: "xchacha20poly1305";
     kdfInfo: string;
-    ciphertext: string;
     publicKeyHint: string;
     createdAt: string;
 }, {
     version: number;
     nonce: string;
+    ciphertext: string;
     algorithm: "xchacha20poly1305";
     kdfInfo: string;
-    ciphertext: string;
     publicKeyHint: string;
     createdAt: string;
 }>;
@@ -100,18 +100,18 @@ export declare const backupUploadRequestSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     version: number;
     nonce: string;
+    ciphertext: string;
     algorithm: "xchacha20poly1305";
     kdfInfo: string;
-    ciphertext: string;
     publicKeyHint: string;
     createdAt: string;
     lookupId: string;
 }, {
     version: number;
     nonce: string;
+    ciphertext: string;
     algorithm: "xchacha20poly1305";
     kdfInfo: string;
-    ciphertext: string;
     publicKeyHint: string;
     createdAt: string;
     lookupId: string;

package/dist/types/keyRotation.d.ts

@@ -72,17 +72,17 @@ export declare const rotateKeyCompleteRequestSchema: z.ZodObject<{
     signOutEverywhere: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     signature: string;
+    timestamp: number;
     challenge: string;
     newPublicKey: string;
     newKeyProof: string;
-    timestamp: number;
     signOutEverywhere?: boolean | undefined;
 }, {
     signature: string;
+    timestamp: number;
     challenge: string;
     newPublicKey: string;
     newKeyProof: string;
-    timestamp: number;
     signOutEverywhere?: boolean | undefined;
 }>;
 export type RotateKeyCompleteRequest = z.infer<typeof rotateKeyCompleteRequestSchema>;

package/dist/types/sessionStatus.d.ts

@@ -113,6 +113,14 @@ export type PublicApplicationResponse = z.infer<typeof publicApplicationSchema>;
  * current producer and are never `null`, but stay `.optional()` so the contract
  * tolerates leaner shapes from other producers of this same payload without a
  * coordinated bump.
+ *
+ * `pushSentAt` / `openedAt` are DELIVERY PROGRESS, not authorization state: they
+ * let a waiting surface render "Check Commons on your phone" → "Opened in
+ * Commons" without inventing competing statuses. `status` remains the only
+ * authority on whether the request is pending, authorized, cancelled or expired.
+ * Both are `.nullable().optional()` for the same reason as `sessionId` — the
+ * producer always emits the key with `null` until that step happens, and an
+ * older API that omits them entirely must degrade, not fail the parse.
  */
 export declare const sessionStatusSchema: z.ZodObject<{
     status: z.ZodString;
@@ -162,6 +170,13 @@ export declare const sessionStatusSchema: z.ZodObject<{
     sessionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     publicKey: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     userId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    /**
+     * What approving this request does. Legacy rows read as `device_sign_in`.
+     * OAuth-bound sessions finalize into an authorization code (no `sessionId`).
+     */
+    purpose: z.ZodOptional<z.ZodEnum<["device_sign_in", "oauth_authorization"]>>;
+    pushSentAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    openedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
     status: string;
     publicKey?: string | null | undefined;
@@ -184,6 +199,9 @@ export declare const sessionStatusSchema: z.ZodObject<{
         termsUrl?: string | undefined;
         developerName?: string | undefined;
     } | null | undefined;
+    purpose?: "device_sign_in" | "oauth_authorization" | undefined;
+    pushSentAt?: string | null | undefined;
+    openedAt?: string | null | undefined;
 }, {
     status: string;
     publicKey?: string | null | undefined;
@@ -206,5 +224,8 @@ export declare const sessionStatusSchema: z.ZodObject<{
         termsUrl?: string | undefined;
         developerName?: string | undefined;
     } | null | undefined;
+    purpose?: "device_sign_in" | "oauth_authorization" | undefined;
+    pushSentAt?: string | null | undefined;
+    openedAt?: string | null | undefined;
 }>;
 export type SessionStatusResponse = z.infer<typeof sessionStatusSchema>;