@oxyhq/contracts 0.18.0 → 0.19.0

package/dist/cjs/commonsSignIn.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * Canonical contract for the "Sign in with Oxy" approval handoff.
+ *
+ * SINGLE SOURCE OF TRUTH for the closed set of reasons an approver may attach
+ * when it DENIES a pending request via
+ * `POST /auth/session/deny/:authorizeCode`.
+ *
+ * That endpoint is UNAUTHENTICATED — the public `authorizeCode` is the only
+ * credential — so a free-form string from it is never stored: it would be an
+ * unauthenticated write of arbitrary text onto a record other surfaces read.
+ * The set is therefore deliberately tiny, and closed:
+ *
+ *  - `'declined'` the approver rejected a request they recognised ("Not now").
+ *  - `'not_me'`   the approver did not start the request ("This wasn't me").
+ *                 The ONE value that records the denial as suspicious rather
+ *                 than an ordinary cancel, so a UI may only offer it where the
+ *                 user genuinely said so.
+ *
+ * Why this lives in `@oxyhq/contracts` rather than in either consumer: the same
+ * closed set is enforced in three places — the request schema of the API route,
+ * the `enum` of the persisted `AuthSession.deniedReason` field, and the client
+ * SDK's `denyCommonsSignIn` parameter. Two hand-maintained copies of a wire
+ * contract drift the moment a value is added on one side only, and the failure
+ * lands at runtime, in an auth path, as a generic validation error. One
+ * declaration makes that impossible.
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo. ESM-safe (no
+ * `require()`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_APPROVAL_PUSH_CHANNEL = exports.commonsDenyReasonSchema = exports.COMMONS_DENY_REASONS = void 0;
+const zod_1 = require("zod");
+/**
+ * The closed set, as a value — consumed directly where a runtime list is
+ * required (e.g. the Mongoose `enum` of `AuthSession.deniedReason`, which is
+ * the storage-level guarantee that an unauthenticated caller can never write
+ * free-form text into the field).
+ */
+exports.COMMONS_DENY_REASONS = ['declined', 'not_me'];
+/**
+ * The same set as a zod enum — the edge validator. Anything outside it
+ * (including free-form text) is rejected with 400 before any handler runs.
+ */
+exports.commonsDenyReasonSchema = zod_1.z.enum(exports.COMMONS_DENY_REASONS);
+/**
+ * Android notification channel id the identity-approval push is sent on.
+ *
+ * A wire contract for the same reason the deny set is: Android 8+ DROPS a
+ * notification whose channel id the app has not created, silently and with no
+ * client-side error. The API attaches this id when it sends, and the vault
+ * creates the channel with it before registering a push token — two hand-typed
+ * copies of that string would fail as "the notification never arrived", which
+ * is the single hardest push symptom to diagnose.
+ *
+ * The channel's user-visible NAME and description are deliberately NOT here:
+ * those are localized app copy, and the vault owns them.
+ */
+exports.IDENTITY_APPROVAL_PUSH_CHANNEL = 'auth-approval';

package/dist/cjs/deviceSession.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceHubTicketRedeemResponseSchema = exports.deviceHubTicketRedeemRequestSchema = exports.deviceHubTicketIssueResponseSchema = exports.deviceHubTicketIssueRequestSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = void 0;
+exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = void 0;
 const zod_1 = require("zod");
 exports.sessionAccountSchema = zod_1.z.object({
     accountId: zod_1.z.string(),
@@ -60,28 +60,6 @@ exports.deviceTokenMintResponseSchema = zod_1.z.object({
     state: exports.deviceSessionStateSchema,
 });
 /* -------------------------------------------------------------------------- */
-/*  Hub ticket — server-side cross-origin device credential sync               */
-/* -------------------------------------------------------------------------- */
-/** Request body for `POST /session/device/hub-ticket`. */
-exports.deviceHubTicketIssueRequestSchema = zod_1.z.object({
-    returnOrigin: zod_1.z.string().min(1),
-});
-/** Response from `POST /session/device/hub-ticket`. */
-exports.deviceHubTicketIssueResponseSchema = zod_1.z.object({
-    ticket: zod_1.z.string().min(1),
-    expiresIn: zod_1.z.number().int().positive(),
-});
-/** Request body for `POST /session/device/redeem-ticket`. */
-exports.deviceHubTicketRedeemRequestSchema = zod_1.z.object({
-    ticket: zod_1.z.string().min(1),
-    returnOrigin: zod_1.z.string().min(1),
-});
-/** Response from `POST /session/device/redeem-ticket`. */
-exports.deviceHubTicketRedeemResponseSchema = zod_1.z.object({
-    deviceId: zod_1.z.string().min(1),
-    deviceSecret: zod_1.z.string().min(1),
-});
-/* -------------------------------------------------------------------------- */
 /*  Instant cross-app session sync (token-free socket signal)                 */
 /* -------------------------------------------------------------------------- */
 /**

package/dist/cjs/inboxPush.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * Canonical contract for Inbox new-mail push notifications.
+ *
+ * The Android channel id and payload `type` are wire contracts: Android 8+
+ * drops a notification whose channel the app has not created, and the client
+ * only routes taps it recognises. Two hand-typed copies of either string fail as
+ * "the notification never arrived" or "tapping does nothing" — the hardest push
+ * symptoms to diagnose.
+ *
+ * Platform-agnostic — zod only, no react/react-native/expo.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inboxEmailPushDataSchema = exports.INBOX_EMAIL_PUSH_TYPE = exports.INBOX_EMAIL_PUSH_CHANNEL = void 0;
+const zod_1 = require("zod");
+/** Android notification channel id the new-mail push is sent on. */
+exports.INBOX_EMAIL_PUSH_CHANNEL = 'email';
+/** Runtime type discriminator of the new-mail push payload. */
+exports.INBOX_EMAIL_PUSH_TYPE = 'oxy_inbox_new_message';
+exports.inboxEmailPushDataSchema = zod_1.z.object({
+    type: zod_1.z.literal(exports.INBOX_EMAIL_PUSH_TYPE),
+    messageId: zod_1.z.string().min(1),
+    mailboxId: zod_1.z.string().min(1),
+});

package/dist/cjs/index.js

@@ -11,9 +11,9 @@
  * expo, no `require()` in the ESM build.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validationOpenResultSchema = exports.validationOpenRequestSchema = exports.validationVerdictRecordSchema = exports.realLifeAttestationResultSchema = exports.realLifeAttestationRecordSchema = exports.signedPublicCardSchema = exports.publicCardSchema = exports.logPageResponseSchema = exports.chainHeadResponseSchema = exports.oxySignedRecordTypeSchema = exports.exportBundleSchema = exports.exportAttestationSchema = exports.authMethodsResponseSchema = exports.authMethodEntrySchema = exports.domainVerificationInstructionsSchema = exports.domainVerificationRequestSchema = exports.verifiedDomainSchema = exports.signedRecordEnvelopeSchema = exports.didDocumentSchema = exports.didServiceSchema = exports.verificationMethodSchema = exports.appAffinityEventsIngestSchema = exports.appAffinityEventSchema = exports.appAffinityEventTypeSchema = exports.appUserSignalIngestSchema = exports.appInterestInputSchema = exports.appEndorsementInputSchema = exports.recommendationResponseSchema = exports.recommendationItemSchema = exports.recommendationCountSchema = exports.recommendationRequestSchema = exports.recommendationSignalWeightsSchema = exports.recommendationBoostSchema = exports.recommendationExcludeTypeSchema = exports.sessionStatusSchema = exports.publicApplicationSchema = exports.applicationTypeSchema = exports.safeParseContract = exports.resolveUserId = exports.deviceLinkedSessionsResponseSchema = exports.deviceLinkedSessionSchema = exports.currentUserResponseSchema = exports.userProfileUpdateSchema = exports.userResponseSchema = exports.themePreferenceSchema = exports.userRelationshipSchema = exports.userNameSchema = exports.createAccountRequestSchema = exports.organizationCategorySchema = exports.ORGANIZATION_CATEGORIES = void 0;
-exports.assetCompleteResponseSchema = exports.assetCompleteResultItemSchema = exports.assetCompleteRequestSchema = exports.assetInitResponseSchema = exports.assetUploadTicketSchema = exports.assetInitRequestSchema = exports.assetInitItemSchema = exports.rolloutPercentSchema = exports.runtimeVersionSchema = exports.channelNameSchema = exports.sha256HexSchema = exports.updateAssetStatusSchema = exports.updateStatusSchema = exports.updatePlatformSchema = exports.backupStatusResponseSchema = exports.backupUploadRequestSchema = exports.encryptedBackupEnvelopeSchema = exports.backupLookupIdSchema = exports.rotateKeyCompleteResponseSchema = exports.rotateKeyCompleteRequestSchema = exports.rotateKeyChallengeResponseSchema = exports.loginResultSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceHubTicketRedeemResponseSchema = exports.deviceHubTicketRedeemRequestSchema = exports.deviceHubTicketIssueResponseSchema = exports.deviceHubTicketIssueRequestSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.linkPreviewResponseSchema = exports.linkPreviewBatchResponseSchema = exports.linkPreviewBatchRequestSchema = exports.linkPreviewSchema = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = exports.vouchResultSchema = exports.personhoodStatusResultSchema = exports.personhoodBreakdownSchema = exports.personhoodVouchRecordSchema = exports.validationVoteResultSchema = exports.validationRequestSummarySchema = void 0;
-exports.transparencyCheckpointListSchema = exports.transparencyInclusionProofSchema = exports.transparencyCheckpointSchema = exports.transparencyAnchorSchema = exports.transparencyCheckpointSignatureSchema = exports.deviceTransferDenyResponseSchema = exports.deviceTransferApproveResponseSchema = exports.deviceTransferApproveRequestSchema = exports.deviceTransferInfoResponseSchema = exports.deviceTransferInitResponseSchema = exports.deviceTransferInitRequestSchema = exports.devicePairingStatusSchema = exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.updateRolloutPatchSchema = exports.promoteRequestSchema = exports.rollbackToEmbeddedRequestSchema = exports.rollbackRequestSchema = exports.updateListResponseSchema = exports.channelListResponseSchema = exports.channelSchema = exports.rollbackToEmbeddedEntrySchema = exports.createUpdateResponseSchema = exports.updateSchema = exports.createUpdateRequestSchema = exports.updateAssetRefSchema = void 0;
+exports.publicCardSchema = exports.logPageResponseSchema = exports.chainHeadResponseSchema = exports.oxySignedRecordTypeSchema = exports.exportBundleSchema = exports.exportAttestationSchema = exports.authMethodsResponseSchema = exports.authMethodEntrySchema = exports.domainVerificationInstructionsSchema = exports.domainVerificationRequestSchema = exports.verifiedDomainSchema = exports.signedRecordEnvelopeSchema = exports.didDocumentSchema = exports.didServiceSchema = exports.verificationMethodSchema = exports.appAffinityEventsIngestSchema = exports.appAffinityEventSchema = exports.appAffinityEventTypeSchema = exports.appUserSignalIngestSchema = exports.appInterestInputSchema = exports.appEndorsementInputSchema = exports.recommendationResponseSchema = exports.recommendationItemSchema = exports.recommendationCountSchema = exports.recommendationRequestSchema = exports.recommendationSignalWeightsSchema = exports.recommendationBoostSchema = exports.recommendationExcludeTypeSchema = exports.inboxEmailPushDataSchema = exports.INBOX_EMAIL_PUSH_TYPE = exports.INBOX_EMAIL_PUSH_CHANNEL = exports.IDENTITY_APPROVAL_PUSH_CHANNEL = exports.commonsDenyReasonSchema = exports.COMMONS_DENY_REASONS = exports.sessionStatusSchema = exports.publicApplicationSchema = exports.applicationTypeSchema = exports.safeParseContract = exports.resolveUserId = exports.deviceLinkedSessionsResponseSchema = exports.deviceLinkedSessionSchema = exports.currentUserResponseSchema = exports.userProfileUpdateSchema = exports.userResponseSchema = exports.themePreferenceSchema = exports.userRelationshipSchema = exports.userNameSchema = exports.createAccountRequestSchema = exports.organizationCategorySchema = exports.ORGANIZATION_CATEGORIES = void 0;
+exports.assetCompleteRequestSchema = exports.assetInitResponseSchema = exports.assetUploadTicketSchema = exports.assetInitRequestSchema = exports.assetInitItemSchema = exports.rolloutPercentSchema = exports.runtimeVersionSchema = exports.channelNameSchema = exports.sha256HexSchema = exports.updateAssetStatusSchema = exports.updateStatusSchema = exports.updatePlatformSchema = exports.backupStatusResponseSchema = exports.backupUploadRequestSchema = exports.encryptedBackupEnvelopeSchema = exports.backupLookupIdSchema = exports.rotateKeyCompleteResponseSchema = exports.rotateKeyCompleteRequestSchema = exports.rotateKeyChallengeResponseSchema = exports.loginResultSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.linkPreviewResponseSchema = exports.linkPreviewBatchResponseSchema = exports.linkPreviewBatchRequestSchema = exports.linkPreviewSchema = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = exports.vouchResultSchema = exports.personhoodStatusResultSchema = exports.personhoodBreakdownSchema = exports.personhoodVouchRecordSchema = exports.validationVoteResultSchema = exports.validationRequestSummarySchema = exports.validationOpenResultSchema = exports.validationOpenRequestSchema = exports.validationVerdictRecordSchema = exports.realLifeAttestationResultSchema = exports.realLifeAttestationRecordSchema = exports.signedPublicCardSchema = void 0;
+exports.transparencyCheckpointListSchema = exports.transparencyInclusionProofSchema = exports.transparencyCheckpointSchema = exports.transparencyAnchorSchema = exports.transparencyCheckpointSignatureSchema = exports.deviceTransferDenyResponseSchema = exports.deviceTransferApproveResponseSchema = exports.deviceTransferApproveRequestSchema = exports.deviceTransferInfoResponseSchema = exports.deviceTransferInitResponseSchema = exports.deviceTransferInitRequestSchema = exports.devicePairingStatusSchema = exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.updateRolloutPatchSchema = exports.promoteRequestSchema = exports.rollbackToEmbeddedRequestSchema = exports.rollbackRequestSchema = exports.updateListResponseSchema = exports.channelListResponseSchema = exports.channelSchema = exports.rollbackToEmbeddedEntrySchema = exports.createUpdateResponseSchema = exports.updateSchema = exports.createUpdateRequestSchema = exports.updateAssetRefSchema = exports.assetCompleteResponseSchema = exports.assetCompleteResultItemSchema = void 0;
 var accountGraph_1 = require("./accountGraph");
 Object.defineProperty(exports, "ORGANIZATION_CATEGORIES", { enumerable: true, get: function () { return accountGraph_1.ORGANIZATION_CATEGORIES; } });
 Object.defineProperty(exports, "organizationCategorySchema", { enumerable: true, get: function () { return accountGraph_1.organizationCategorySchema; } });
@@ -36,6 +36,17 @@ var sessionStatus_1 = require("./sessionStatus");
 Object.defineProperty(exports, "applicationTypeSchema", { enumerable: true, get: function () { return sessionStatus_1.applicationTypeSchema; } });
 Object.defineProperty(exports, "publicApplicationSchema", { enumerable: true, get: function () { return sessionStatus_1.publicApplicationSchema; } });
 Object.defineProperty(exports, "sessionStatusSchema", { enumerable: true, get: function () { return sessionStatus_1.sessionStatusSchema; } });
+var commonsSignIn_1 = require("./commonsSignIn");
+// Closed set of denial reasons for POST /auth/session/deny/:authorizeCode —
+// shared by the API request schema, the persisted `AuthSession.deniedReason`
+// enum, and the SDK's `denyCommonsSignIn`.
+Object.defineProperty(exports, "COMMONS_DENY_REASONS", { enumerable: true, get: function () { return commonsSignIn_1.COMMONS_DENY_REASONS; } });
+Object.defineProperty(exports, "commonsDenyReasonSchema", { enumerable: true, get: function () { return commonsSignIn_1.commonsDenyReasonSchema; } });
+Object.defineProperty(exports, "IDENTITY_APPROVAL_PUSH_CHANNEL", { enumerable: true, get: function () { return commonsSignIn_1.IDENTITY_APPROVAL_PUSH_CHANNEL; } });
+var inboxPush_1 = require("./inboxPush");
+Object.defineProperty(exports, "INBOX_EMAIL_PUSH_CHANNEL", { enumerable: true, get: function () { return inboxPush_1.INBOX_EMAIL_PUSH_CHANNEL; } });
+Object.defineProperty(exports, "INBOX_EMAIL_PUSH_TYPE", { enumerable: true, get: function () { return inboxPush_1.INBOX_EMAIL_PUSH_TYPE; } });
+Object.defineProperty(exports, "inboxEmailPushDataSchema", { enumerable: true, get: function () { return inboxPush_1.inboxEmailPushDataSchema; } });
 var recommendations_1 = require("./recommendations");
 // Schemas
 Object.defineProperty(exports, "recommendationExcludeTypeSchema", { enumerable: true, get: function () { return recommendations_1.recommendationExcludeTypeSchema; } });
@@ -105,10 +116,6 @@ Object.defineProperty(exports, "activeTokenSchema", { enumerable: true, get: fun
 Object.defineProperty(exports, "deviceSessionSyncSchema", { enumerable: true, get: function () { return deviceSession_1.deviceSessionSyncSchema; } });
 Object.defineProperty(exports, "deviceTokenMintRequestSchema", { enumerable: true, get: function () { return deviceSession_1.deviceTokenMintRequestSchema; } });
 Object.defineProperty(exports, "deviceTokenMintResponseSchema", { enumerable: true, get: function () { return deviceSession_1.deviceTokenMintResponseSchema; } });
-Object.defineProperty(exports, "deviceHubTicketIssueRequestSchema", { enumerable: true, get: function () { return deviceSession_1.deviceHubTicketIssueRequestSchema; } });
-Object.defineProperty(exports, "deviceHubTicketIssueResponseSchema", { enumerable: true, get: function () { return deviceSession_1.deviceHubTicketIssueResponseSchema; } });
-Object.defineProperty(exports, "deviceHubTicketRedeemRequestSchema", { enumerable: true, get: function () { return deviceSession_1.deviceHubTicketRedeemRequestSchema; } });
-Object.defineProperty(exports, "deviceHubTicketRedeemResponseSchema", { enumerable: true, get: function () { return deviceSession_1.deviceHubTicketRedeemResponseSchema; } });
 Object.defineProperty(exports, "SESSION_ACCOUNTS_CHANGED_EVENT", { enumerable: true, get: function () { return deviceSession_1.SESSION_ACCOUNTS_CHANGED_EVENT; } });
 Object.defineProperty(exports, "sessionAccountsChangedReasonSchema", { enumerable: true, get: function () { return deviceSession_1.sessionAccountsChangedReasonSchema; } });
 Object.defineProperty(exports, "sessionAccountsChangedEventSchema", { enumerable: true, get: function () { return deviceSession_1.sessionAccountsChangedEventSchema; } });