@oxyhq/contracts 0.18.0 → 0.20.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,59 @@
1
+ "use strict";
2
+ /**
3
+ * Canonical contract for the "Sign in with Oxy" approval handoff.
4
+ *
5
+ * SINGLE SOURCE OF TRUTH for the closed set of reasons an approver may attach
6
+ * when it DENIES a pending request via
7
+ * `POST /auth/session/deny/:authorizeCode`.
8
+ *
9
+ * That endpoint is UNAUTHENTICATED — the public `authorizeCode` is the only
10
+ * credential — so a free-form string from it is never stored: it would be an
11
+ * unauthenticated write of arbitrary text onto a record other surfaces read.
12
+ * The set is therefore deliberately tiny, and closed:
13
+ *
14
+ * - `'declined'` the approver rejected a request they recognised ("Not now").
15
+ * - `'not_me'` the approver did not start the request ("This wasn't me").
16
+ * The ONE value that records the denial as suspicious rather
17
+ * than an ordinary cancel, so a UI may only offer it where the
18
+ * user genuinely said so.
19
+ *
20
+ * Why this lives in `@oxyhq/contracts` rather than in either consumer: the same
21
+ * closed set is enforced in three places — the request schema of the API route,
22
+ * the `enum` of the persisted `AuthSession.deniedReason` field, and the client
23
+ * SDK's `denyCommonsSignIn` parameter. Two hand-maintained copies of a wire
24
+ * contract drift the moment a value is added on one side only, and the failure
25
+ * lands at runtime, in an auth path, as a generic validation error. One
26
+ * declaration makes that impossible.
27
+ *
28
+ * Platform-agnostic — zod only, no react/react-native/expo. ESM-safe (no
29
+ * `require()`).
30
+ */
31
+ Object.defineProperty(exports, "__esModule", { value: true });
32
+ exports.IDENTITY_APPROVAL_PUSH_CHANNEL = exports.commonsDenyReasonSchema = exports.COMMONS_DENY_REASONS = void 0;
33
+ const zod_1 = require("zod");
34
+ /**
35
+ * The closed set, as a value — consumed directly where a runtime list is
36
+ * required (e.g. the Mongoose `enum` of `AuthSession.deniedReason`, which is
37
+ * the storage-level guarantee that an unauthenticated caller can never write
38
+ * free-form text into the field).
39
+ */
40
+ exports.COMMONS_DENY_REASONS = ['declined', 'not_me'];
41
+ /**
42
+ * The same set as a zod enum — the edge validator. Anything outside it
43
+ * (including free-form text) is rejected with 400 before any handler runs.
44
+ */
45
+ exports.commonsDenyReasonSchema = zod_1.z.enum(exports.COMMONS_DENY_REASONS);
46
+ /**
47
+ * Android notification channel id the identity-approval push is sent on.
48
+ *
49
+ * A wire contract for the same reason the deny set is: Android 8+ DROPS a
50
+ * notification whose channel id the app has not created, silently and with no
51
+ * client-side error. The API attaches this id when it sends, and the vault
52
+ * creates the channel with it before registering a push token — two hand-typed
53
+ * copies of that string would fail as "the notification never arrived", which
54
+ * is the single hardest push symptom to diagnose.
55
+ *
56
+ * The channel's user-visible NAME and description are deliberately NOT here:
57
+ * those are localized app copy, and the vault owns them.
58
+ */
59
+ exports.IDENTITY_APPROVAL_PUSH_CHANNEL = 'auth-approval';
@@ -1,6 +1,6 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceHubTicketRedeemResponseSchema = exports.deviceHubTicketRedeemRequestSchema = exports.deviceHubTicketIssueResponseSchema = exports.deviceHubTicketIssueRequestSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = void 0;
3
+ exports.deviceBackgroundTokenResponseSchema = exports.deviceBackgroundTokenRequestSchema = exports.deviceBackgroundCredentialResponseSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = void 0;
4
4
  const zod_1 = require("zod");
5
5
  exports.sessionAccountSchema = zod_1.z.object({
6
6
  accountId: zod_1.z.string(),
@@ -60,28 +60,6 @@ exports.deviceTokenMintResponseSchema = zod_1.z.object({
60
60
  state: exports.deviceSessionStateSchema,
61
61
  });
62
62
  /* -------------------------------------------------------------------------- */
63
- /* Hub ticket — server-side cross-origin device credential sync */
64
- /* -------------------------------------------------------------------------- */
65
- /** Request body for `POST /session/device/hub-ticket`. */
66
- exports.deviceHubTicketIssueRequestSchema = zod_1.z.object({
67
- returnOrigin: zod_1.z.string().min(1),
68
- });
69
- /** Response from `POST /session/device/hub-ticket`. */
70
- exports.deviceHubTicketIssueResponseSchema = zod_1.z.object({
71
- ticket: zod_1.z.string().min(1),
72
- expiresIn: zod_1.z.number().int().positive(),
73
- });
74
- /** Request body for `POST /session/device/redeem-ticket`. */
75
- exports.deviceHubTicketRedeemRequestSchema = zod_1.z.object({
76
- ticket: zod_1.z.string().min(1),
77
- returnOrigin: zod_1.z.string().min(1),
78
- });
79
- /** Response from `POST /session/device/redeem-ticket`. */
80
- exports.deviceHubTicketRedeemResponseSchema = zod_1.z.object({
81
- deviceId: zod_1.z.string().min(1),
82
- deviceSecret: zod_1.z.string().min(1),
83
- });
84
- /* -------------------------------------------------------------------------- */
85
63
  /* Instant cross-app session sync (token-free socket signal) */
86
64
  /* -------------------------------------------------------------------------- */
87
65
  /**
@@ -122,3 +100,64 @@ exports.sessionAccountsChangedEventSchema = zod_1.z.object({
122
100
  revision: zod_1.z.number().int().nonnegative(),
123
101
  reason: exports.sessionAccountsChangedReasonSchema,
124
102
  });
103
+ /* -------------------------------------------------------------------------- */
104
+ /* Background credential — native background code with no JS runtime */
105
+ /* -------------------------------------------------------------------------- */
106
+ /**
107
+ * Response from `POST /session/device/background-credential` — provisioned by
108
+ * the SDK WHILE THE APP IS RUNNING (bearer required, `deviceId` and account
109
+ * derived server-side from it) and consumed afterwards only by native
110
+ * background code, which has no JS runtime to mint a token for itself.
111
+ *
112
+ * Deliberately a SEPARATE credential from the rotating `deviceSecret`: that one
113
+ * rotates on every mint, so background code presenting it would become a second
114
+ * writer of a value the JS runtime depends on, and background code killed
115
+ * mid-rotation would silently sign the user out on the next cold start. Against
116
+ * this credential background code is the sole writer, and it can never rotate
117
+ * anything JS reads.
118
+ *
119
+ * The raw `secret` is returned exactly once, at provision time — never stored
120
+ * retrievably, never logged, never re-read. A caller that loses it provisions
121
+ * a new one.
122
+ *
123
+ * `expiresAt` is an unvalidated string, like every other expiry in this file:
124
+ * no consumer on the JS path interprets it (native background code parses it
125
+ * itself), and a `.datetime()` here alone would leave one strict field beside
126
+ * two lax ones. If expiry is ever validated it goes on all three at once, with
127
+ * the API's serializers checked against it — the producer is the same server.
128
+ */
129
+ exports.deviceBackgroundCredentialResponseSchema = zod_1.z.object({
130
+ deviceId: zod_1.z.string().min(1),
131
+ secret: zod_1.z.string().min(1),
132
+ accountId: zod_1.z.string().min(1),
133
+ expiresAt: zod_1.z.string(),
134
+ });
135
+ /**
136
+ * Request body for `POST /session/device/background-token` — presented by
137
+ * native background code with NO bearer and NO cookies: possession of the
138
+ * background `secret` IS the proof, as it is for the device-secret mint.
139
+ *
140
+ * Unlike that mint this one NEVER rotates the presented secret (hence no
141
+ * `next…` field to persist in the response), so background code interrupted
142
+ * anywhere between request and response leaves the credential intact and
143
+ * usable on its next run.
144
+ */
145
+ exports.deviceBackgroundTokenRequestSchema = zod_1.z.object({
146
+ deviceId: zod_1.z.string().min(1),
147
+ secret: zod_1.z.string().min(1),
148
+ });
149
+ /**
150
+ * Wire shape of a successful `POST /session/device/background-token`: the short
151
+ * access token, its expiry, and the account the token belongs to — the last so
152
+ * a caller can key cached data per account and drop data belonging to a
153
+ * foreign one.
154
+ *
155
+ * Carries NO device state — no account list, no `activeAccountId`, no
156
+ * `revision`, unlike {@link deviceTokenMintResponseSchema} — deliberately, to
157
+ * cap what a compromised credential record yields.
158
+ */
159
+ exports.deviceBackgroundTokenResponseSchema = zod_1.z.object({
160
+ accessToken: zod_1.z.string(),
161
+ expiresAt: zod_1.z.string(),
162
+ accountId: zod_1.z.string().min(1),
163
+ });
@@ -0,0 +1,24 @@
1
+ "use strict";
2
+ /**
3
+ * Canonical contract for Inbox new-mail push notifications.
4
+ *
5
+ * The Android channel id and payload `type` are wire contracts: Android 8+
6
+ * drops a notification whose channel the app has not created, and the client
7
+ * only routes taps it recognises. Two hand-typed copies of either string fail as
8
+ * "the notification never arrived" or "tapping does nothing" — the hardest push
9
+ * symptoms to diagnose.
10
+ *
11
+ * Platform-agnostic — zod only, no react/react-native/expo.
12
+ */
13
+ Object.defineProperty(exports, "__esModule", { value: true });
14
+ exports.inboxEmailPushDataSchema = exports.INBOX_EMAIL_PUSH_TYPE = exports.INBOX_EMAIL_PUSH_CHANNEL = void 0;
15
+ const zod_1 = require("zod");
16
+ /** Android notification channel id the new-mail push is sent on. */
17
+ exports.INBOX_EMAIL_PUSH_CHANNEL = 'email';
18
+ /** Runtime type discriminator of the new-mail push payload. */
19
+ exports.INBOX_EMAIL_PUSH_TYPE = 'oxy_inbox_new_message';
20
+ exports.inboxEmailPushDataSchema = zod_1.z.object({
21
+ type: zod_1.z.literal(exports.INBOX_EMAIL_PUSH_TYPE),
22
+ messageId: zod_1.z.string().min(1),
23
+ mailboxId: zod_1.z.string().min(1),
24
+ });
package/dist/cjs/index.js CHANGED
@@ -11,9 +11,10 @@
11
11
  * expo, no `require()` in the ESM build.
12
12
  */
13
13
  Object.defineProperty(exports, "__esModule", { value: true });
14
- exports.validationOpenResultSchema = exports.validationOpenRequestSchema = exports.validationVerdictRecordSchema = exports.realLifeAttestationResultSchema = exports.realLifeAttestationRecordSchema = exports.signedPublicCardSchema = exports.publicCardSchema = exports.logPageResponseSchema = exports.chainHeadResponseSchema = exports.oxySignedRecordTypeSchema = exports.exportBundleSchema = exports.exportAttestationSchema = exports.authMethodsResponseSchema = exports.authMethodEntrySchema = exports.domainVerificationInstructionsSchema = exports.domainVerificationRequestSchema = exports.verifiedDomainSchema = exports.signedRecordEnvelopeSchema = exports.didDocumentSchema = exports.didServiceSchema = exports.verificationMethodSchema = exports.appAffinityEventsIngestSchema = exports.appAffinityEventSchema = exports.appAffinityEventTypeSchema = exports.appUserSignalIngestSchema = exports.appInterestInputSchema = exports.appEndorsementInputSchema = exports.recommendationResponseSchema = exports.recommendationItemSchema = exports.recommendationCountSchema = exports.recommendationRequestSchema = exports.recommendationSignalWeightsSchema = exports.recommendationBoostSchema = exports.recommendationExcludeTypeSchema = exports.sessionStatusSchema = exports.publicApplicationSchema = exports.applicationTypeSchema = exports.safeParseContract = exports.resolveUserId = exports.deviceLinkedSessionsResponseSchema = exports.deviceLinkedSessionSchema = exports.currentUserResponseSchema = exports.userProfileUpdateSchema = exports.userResponseSchema = exports.themePreferenceSchema = exports.userRelationshipSchema = exports.userNameSchema = exports.createAccountRequestSchema = exports.organizationCategorySchema = exports.ORGANIZATION_CATEGORIES = void 0;
15
- exports.assetCompleteResponseSchema = exports.assetCompleteResultItemSchema = exports.assetCompleteRequestSchema = exports.assetInitResponseSchema = exports.assetUploadTicketSchema = exports.assetInitRequestSchema = exports.assetInitItemSchema = exports.rolloutPercentSchema = exports.runtimeVersionSchema = exports.channelNameSchema = exports.sha256HexSchema = exports.updateAssetStatusSchema = exports.updateStatusSchema = exports.updatePlatformSchema = exports.backupStatusResponseSchema = exports.backupUploadRequestSchema = exports.encryptedBackupEnvelopeSchema = exports.backupLookupIdSchema = exports.rotateKeyCompleteResponseSchema = exports.rotateKeyCompleteRequestSchema = exports.rotateKeyChallengeResponseSchema = exports.loginResultSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceHubTicketRedeemResponseSchema = exports.deviceHubTicketRedeemRequestSchema = exports.deviceHubTicketIssueResponseSchema = exports.deviceHubTicketIssueRequestSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.linkPreviewResponseSchema = exports.linkPreviewBatchResponseSchema = exports.linkPreviewBatchRequestSchema = exports.linkPreviewSchema = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = exports.vouchResultSchema = exports.personhoodStatusResultSchema = exports.personhoodBreakdownSchema = exports.personhoodVouchRecordSchema = exports.validationVoteResultSchema = exports.validationRequestSummarySchema = void 0;
16
- exports.transparencyCheckpointListSchema = exports.transparencyInclusionProofSchema = exports.transparencyCheckpointSchema = exports.transparencyAnchorSchema = exports.transparencyCheckpointSignatureSchema = exports.deviceTransferDenyResponseSchema = exports.deviceTransferApproveResponseSchema = exports.deviceTransferApproveRequestSchema = exports.deviceTransferInfoResponseSchema = exports.deviceTransferInitResponseSchema = exports.deviceTransferInitRequestSchema = exports.devicePairingStatusSchema = exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.updateRolloutPatchSchema = exports.promoteRequestSchema = exports.rollbackToEmbeddedRequestSchema = exports.rollbackRequestSchema = exports.updateListResponseSchema = exports.channelListResponseSchema = exports.channelSchema = exports.rollbackToEmbeddedEntrySchema = exports.createUpdateResponseSchema = exports.updateSchema = exports.createUpdateRequestSchema = exports.updateAssetRefSchema = void 0;
14
+ exports.publicCardSchema = exports.logPageResponseSchema = exports.chainHeadResponseSchema = exports.oxySignedRecordTypeSchema = exports.exportBundleSchema = exports.exportAttestationSchema = exports.authMethodsResponseSchema = exports.authMethodEntrySchema = exports.domainVerificationInstructionsSchema = exports.domainVerificationRequestSchema = exports.verifiedDomainSchema = exports.signedRecordEnvelopeSchema = exports.didDocumentSchema = exports.didServiceSchema = exports.verificationMethodSchema = exports.appAffinityEventsIngestSchema = exports.appAffinityEventSchema = exports.appAffinityEventTypeSchema = exports.appUserSignalIngestSchema = exports.appInterestInputSchema = exports.appEndorsementInputSchema = exports.recommendationResponseSchema = exports.recommendationItemSchema = exports.recommendationCountSchema = exports.recommendationRequestSchema = exports.recommendationSignalWeightsSchema = exports.recommendationBoostSchema = exports.recommendationExcludeTypeSchema = exports.inboxEmailPushDataSchema = exports.INBOX_EMAIL_PUSH_TYPE = exports.INBOX_EMAIL_PUSH_CHANNEL = exports.IDENTITY_APPROVAL_PUSH_CHANNEL = exports.commonsDenyReasonSchema = exports.COMMONS_DENY_REASONS = exports.sessionStatusSchema = exports.publicApplicationSchema = exports.applicationTypeSchema = exports.safeParseContract = exports.resolveUserId = exports.deviceLinkedSessionsResponseSchema = exports.deviceLinkedSessionSchema = exports.currentUserResponseSchema = exports.userProfileUpdateSchema = exports.userResponseSchema = exports.themePreferenceSchema = exports.userRelationshipSchema = exports.userNameSchema = exports.createAccountRequestSchema = exports.organizationCategorySchema = exports.ORGANIZATION_CATEGORIES = void 0;
15
+ exports.linkPreviewBatchResponseSchema = exports.linkPreviewBatchRequestSchema = exports.linkPreviewSchema = exports.isFullReputationBalance = exports.reverseReputationTransactionSchema = exports.upsertReputationRuleSchema = exports.resolveReputationDisputeSchema = exports.createReputationDisputeSchema = exports.awardReputationSchema = exports.reverseReputationTransactionResultSchema = exports.reputationInfluenceResultSchema = exports.reputationLeaderboardEntrySchema = exports.reputationLeaderboardUserSchema = exports.reputationRuleSchema = exports.reputationDisputeSchema = exports.reputationBalanceSchema = exports.reputationBalanceSummarySchema = exports.reputationReliabilitySchema = exports.reputationInfluenceSchema = exports.reputationBalanceBreakdownSchema = exports.reputationTransactionSchema = exports.reputationInfluenceContextSchema = exports.reputationDisputeStatusSchema = exports.reputationTargetEntityTypeSchema = exports.trustTierSchema = exports.reputationTransactionStatusSchema = exports.reputationCategorySchema = exports.REPUTATION_INFLUENCE_CONTEXTS = exports.REPUTATION_DISPUTE_STATUSES = exports.REPUTATION_TARGET_ENTITY_TYPES = exports.TRUST_TIERS = exports.REPUTATION_TRANSACTION_STATUSES = exports.REPUTATION_CATEGORIES = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = exports.vouchResultSchema = exports.personhoodStatusResultSchema = exports.personhoodBreakdownSchema = exports.personhoodVouchRecordSchema = exports.validationVoteResultSchema = exports.validationRequestSummarySchema = exports.validationOpenResultSchema = exports.validationOpenRequestSchema = exports.validationVerdictRecordSchema = exports.realLifeAttestationResultSchema = exports.realLifeAttestationRecordSchema = exports.signedPublicCardSchema = void 0;
16
+ exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.updateRolloutPatchSchema = exports.promoteRequestSchema = exports.rollbackToEmbeddedRequestSchema = exports.rollbackRequestSchema = exports.updateListResponseSchema = exports.channelListResponseSchema = exports.channelSchema = exports.rollbackToEmbeddedEntrySchema = exports.createUpdateResponseSchema = exports.updateSchema = exports.createUpdateRequestSchema = exports.updateAssetRefSchema = exports.assetCompleteResponseSchema = exports.assetCompleteResultItemSchema = exports.assetCompleteRequestSchema = exports.assetInitResponseSchema = exports.assetUploadTicketSchema = exports.assetInitRequestSchema = exports.assetInitItemSchema = exports.rolloutPercentSchema = exports.runtimeVersionSchema = exports.channelNameSchema = exports.sha256HexSchema = exports.updateAssetStatusSchema = exports.updateStatusSchema = exports.updatePlatformSchema = exports.backupStatusResponseSchema = exports.backupUploadRequestSchema = exports.encryptedBackupEnvelopeSchema = exports.backupLookupIdSchema = exports.rotateKeyCompleteResponseSchema = exports.rotateKeyCompleteRequestSchema = exports.rotateKeyChallengeResponseSchema = exports.loginResultSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceBackgroundTokenResponseSchema = exports.deviceBackgroundTokenRequestSchema = exports.deviceBackgroundCredentialResponseSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.linkPreviewResponseSchema = void 0;
17
+ exports.transparencyCheckpointListSchema = exports.transparencyInclusionProofSchema = exports.transparencyCheckpointSchema = exports.transparencyAnchorSchema = exports.transparencyCheckpointSignatureSchema = exports.deviceTransferDenyResponseSchema = exports.deviceTransferApproveResponseSchema = exports.deviceTransferApproveRequestSchema = exports.deviceTransferInfoResponseSchema = exports.deviceTransferInitResponseSchema = exports.deviceTransferInitRequestSchema = exports.devicePairingStatusSchema = exports.webauthnLoginVerifyRequestSchema = void 0;
17
18
  var accountGraph_1 = require("./accountGraph");
18
19
  Object.defineProperty(exports, "ORGANIZATION_CATEGORIES", { enumerable: true, get: function () { return accountGraph_1.ORGANIZATION_CATEGORIES; } });
19
20
  Object.defineProperty(exports, "organizationCategorySchema", { enumerable: true, get: function () { return accountGraph_1.organizationCategorySchema; } });
@@ -36,6 +37,17 @@ var sessionStatus_1 = require("./sessionStatus");
36
37
  Object.defineProperty(exports, "applicationTypeSchema", { enumerable: true, get: function () { return sessionStatus_1.applicationTypeSchema; } });
37
38
  Object.defineProperty(exports, "publicApplicationSchema", { enumerable: true, get: function () { return sessionStatus_1.publicApplicationSchema; } });
38
39
  Object.defineProperty(exports, "sessionStatusSchema", { enumerable: true, get: function () { return sessionStatus_1.sessionStatusSchema; } });
40
+ var commonsSignIn_1 = require("./commonsSignIn");
41
+ // Closed set of denial reasons for POST /auth/session/deny/:authorizeCode —
42
+ // shared by the API request schema, the persisted `AuthSession.deniedReason`
43
+ // enum, and the SDK's `denyCommonsSignIn`.
44
+ Object.defineProperty(exports, "COMMONS_DENY_REASONS", { enumerable: true, get: function () { return commonsSignIn_1.COMMONS_DENY_REASONS; } });
45
+ Object.defineProperty(exports, "commonsDenyReasonSchema", { enumerable: true, get: function () { return commonsSignIn_1.commonsDenyReasonSchema; } });
46
+ Object.defineProperty(exports, "IDENTITY_APPROVAL_PUSH_CHANNEL", { enumerable: true, get: function () { return commonsSignIn_1.IDENTITY_APPROVAL_PUSH_CHANNEL; } });
47
+ var inboxPush_1 = require("./inboxPush");
48
+ Object.defineProperty(exports, "INBOX_EMAIL_PUSH_CHANNEL", { enumerable: true, get: function () { return inboxPush_1.INBOX_EMAIL_PUSH_CHANNEL; } });
49
+ Object.defineProperty(exports, "INBOX_EMAIL_PUSH_TYPE", { enumerable: true, get: function () { return inboxPush_1.INBOX_EMAIL_PUSH_TYPE; } });
50
+ Object.defineProperty(exports, "inboxEmailPushDataSchema", { enumerable: true, get: function () { return inboxPush_1.inboxEmailPushDataSchema; } });
39
51
  var recommendations_1 = require("./recommendations");
40
52
  // Schemas
41
53
  Object.defineProperty(exports, "recommendationExcludeTypeSchema", { enumerable: true, get: function () { return recommendations_1.recommendationExcludeTypeSchema; } });
@@ -92,6 +104,44 @@ Object.defineProperty(exports, "verifiableCredentialResponseSchema", { enumerabl
92
104
  Object.defineProperty(exports, "credentialIssueResultSchema", { enumerable: true, get: function () { return civic_1.credentialIssueResultSchema; } });
93
105
  Object.defineProperty(exports, "credentialListResultSchema", { enumerable: true, get: function () { return civic_1.credentialListResultSchema; } });
94
106
  Object.defineProperty(exports, "credentialVerifyResultSchema", { enumerable: true, get: function () { return civic_1.credentialVerifyResultSchema; } });
107
+ var reputation_1 = require("./reputation");
108
+ // Closed value sets — shared by the API's mongoose enums, the API's request
109
+ // validation, and the SDK's unions, so a new category/tier/status cannot be
110
+ // added on one side only.
111
+ Object.defineProperty(exports, "REPUTATION_CATEGORIES", { enumerable: true, get: function () { return reputation_1.REPUTATION_CATEGORIES; } });
112
+ Object.defineProperty(exports, "REPUTATION_TRANSACTION_STATUSES", { enumerable: true, get: function () { return reputation_1.REPUTATION_TRANSACTION_STATUSES; } });
113
+ Object.defineProperty(exports, "TRUST_TIERS", { enumerable: true, get: function () { return reputation_1.TRUST_TIERS; } });
114
+ Object.defineProperty(exports, "REPUTATION_TARGET_ENTITY_TYPES", { enumerable: true, get: function () { return reputation_1.REPUTATION_TARGET_ENTITY_TYPES; } });
115
+ Object.defineProperty(exports, "REPUTATION_DISPUTE_STATUSES", { enumerable: true, get: function () { return reputation_1.REPUTATION_DISPUTE_STATUSES; } });
116
+ Object.defineProperty(exports, "REPUTATION_INFLUENCE_CONTEXTS", { enumerable: true, get: function () { return reputation_1.REPUTATION_INFLUENCE_CONTEXTS; } });
117
+ // Schemas — closed value sets
118
+ Object.defineProperty(exports, "reputationCategorySchema", { enumerable: true, get: function () { return reputation_1.reputationCategorySchema; } });
119
+ Object.defineProperty(exports, "reputationTransactionStatusSchema", { enumerable: true, get: function () { return reputation_1.reputationTransactionStatusSchema; } });
120
+ Object.defineProperty(exports, "trustTierSchema", { enumerable: true, get: function () { return reputation_1.trustTierSchema; } });
121
+ Object.defineProperty(exports, "reputationTargetEntityTypeSchema", { enumerable: true, get: function () { return reputation_1.reputationTargetEntityTypeSchema; } });
122
+ Object.defineProperty(exports, "reputationDisputeStatusSchema", { enumerable: true, get: function () { return reputation_1.reputationDisputeStatusSchema; } });
123
+ Object.defineProperty(exports, "reputationInfluenceContextSchema", { enumerable: true, get: function () { return reputation_1.reputationInfluenceContextSchema; } });
124
+ // Schemas — responses
125
+ Object.defineProperty(exports, "reputationTransactionSchema", { enumerable: true, get: function () { return reputation_1.reputationTransactionSchema; } });
126
+ Object.defineProperty(exports, "reputationBalanceBreakdownSchema", { enumerable: true, get: function () { return reputation_1.reputationBalanceBreakdownSchema; } });
127
+ Object.defineProperty(exports, "reputationInfluenceSchema", { enumerable: true, get: function () { return reputation_1.reputationInfluenceSchema; } });
128
+ Object.defineProperty(exports, "reputationReliabilitySchema", { enumerable: true, get: function () { return reputation_1.reputationReliabilitySchema; } });
129
+ Object.defineProperty(exports, "reputationBalanceSummarySchema", { enumerable: true, get: function () { return reputation_1.reputationBalanceSummarySchema; } });
130
+ Object.defineProperty(exports, "reputationBalanceSchema", { enumerable: true, get: function () { return reputation_1.reputationBalanceSchema; } });
131
+ Object.defineProperty(exports, "reputationDisputeSchema", { enumerable: true, get: function () { return reputation_1.reputationDisputeSchema; } });
132
+ Object.defineProperty(exports, "reputationRuleSchema", { enumerable: true, get: function () { return reputation_1.reputationRuleSchema; } });
133
+ Object.defineProperty(exports, "reputationLeaderboardUserSchema", { enumerable: true, get: function () { return reputation_1.reputationLeaderboardUserSchema; } });
134
+ Object.defineProperty(exports, "reputationLeaderboardEntrySchema", { enumerable: true, get: function () { return reputation_1.reputationLeaderboardEntrySchema; } });
135
+ Object.defineProperty(exports, "reputationInfluenceResultSchema", { enumerable: true, get: function () { return reputation_1.reputationInfluenceResultSchema; } });
136
+ Object.defineProperty(exports, "reverseReputationTransactionResultSchema", { enumerable: true, get: function () { return reputation_1.reverseReputationTransactionResultSchema; } });
137
+ // Schemas — request bodies
138
+ Object.defineProperty(exports, "awardReputationSchema", { enumerable: true, get: function () { return reputation_1.awardReputationSchema; } });
139
+ Object.defineProperty(exports, "createReputationDisputeSchema", { enumerable: true, get: function () { return reputation_1.createReputationDisputeSchema; } });
140
+ Object.defineProperty(exports, "resolveReputationDisputeSchema", { enumerable: true, get: function () { return reputation_1.resolveReputationDisputeSchema; } });
141
+ Object.defineProperty(exports, "upsertReputationRuleSchema", { enumerable: true, get: function () { return reputation_1.upsertReputationRuleSchema; } });
142
+ Object.defineProperty(exports, "reverseReputationTransactionSchema", { enumerable: true, get: function () { return reputation_1.reverseReputationTransactionSchema; } });
143
+ // Narrows the two balance views apart at runtime.
144
+ Object.defineProperty(exports, "isFullReputationBalance", { enumerable: true, get: function () { return reputation_1.isFullReputationBalance; } });
95
145
  var links_1 = require("./links");
96
146
  // Schemas
97
147
  Object.defineProperty(exports, "linkPreviewSchema", { enumerable: true, get: function () { return links_1.linkPreviewSchema; } });
@@ -105,10 +155,9 @@ Object.defineProperty(exports, "activeTokenSchema", { enumerable: true, get: fun
105
155
  Object.defineProperty(exports, "deviceSessionSyncSchema", { enumerable: true, get: function () { return deviceSession_1.deviceSessionSyncSchema; } });
106
156
  Object.defineProperty(exports, "deviceTokenMintRequestSchema", { enumerable: true, get: function () { return deviceSession_1.deviceTokenMintRequestSchema; } });
107
157
  Object.defineProperty(exports, "deviceTokenMintResponseSchema", { enumerable: true, get: function () { return deviceSession_1.deviceTokenMintResponseSchema; } });
108
- Object.defineProperty(exports, "deviceHubTicketIssueRequestSchema", { enumerable: true, get: function () { return deviceSession_1.deviceHubTicketIssueRequestSchema; } });
109
- Object.defineProperty(exports, "deviceHubTicketIssueResponseSchema", { enumerable: true, get: function () { return deviceSession_1.deviceHubTicketIssueResponseSchema; } });
110
- Object.defineProperty(exports, "deviceHubTicketRedeemRequestSchema", { enumerable: true, get: function () { return deviceSession_1.deviceHubTicketRedeemRequestSchema; } });
111
- Object.defineProperty(exports, "deviceHubTicketRedeemResponseSchema", { enumerable: true, get: function () { return deviceSession_1.deviceHubTicketRedeemResponseSchema; } });
158
+ Object.defineProperty(exports, "deviceBackgroundCredentialResponseSchema", { enumerable: true, get: function () { return deviceSession_1.deviceBackgroundCredentialResponseSchema; } });
159
+ Object.defineProperty(exports, "deviceBackgroundTokenRequestSchema", { enumerable: true, get: function () { return deviceSession_1.deviceBackgroundTokenRequestSchema; } });
160
+ Object.defineProperty(exports, "deviceBackgroundTokenResponseSchema", { enumerable: true, get: function () { return deviceSession_1.deviceBackgroundTokenResponseSchema; } });
112
161
  Object.defineProperty(exports, "SESSION_ACCOUNTS_CHANGED_EVENT", { enumerable: true, get: function () { return deviceSession_1.SESSION_ACCOUNTS_CHANGED_EVENT; } });
113
162
  Object.defineProperty(exports, "sessionAccountsChangedReasonSchema", { enumerable: true, get: function () { return deviceSession_1.sessionAccountsChangedReasonSchema; } });
114
163
  Object.defineProperty(exports, "sessionAccountsChangedEventSchema", { enumerable: true, get: function () { return deviceSession_1.sessionAccountsChangedEventSchema; } });
@@ -0,0 +1,285 @@
1
+ "use strict";
2
+ /**
3
+ * Oxy Trust — reputation API contracts.
4
+ *
5
+ * SINGLE SOURCE OF TRUTH for the reputation ledger's wire shapes: the closed
6
+ * value sets (`REPUTATION_CATEGORIES`, `TRUST_TIERS`, …), the response entities
7
+ * (`ReputationTransaction`, the two balance views, `ReputationDispute`,
8
+ * `ReputationRule`, the leaderboard entry) and the request bodies the write
9
+ * endpoints accept. The API validates its OUTPUT against these schemas and its
10
+ * INPUT with the same request schemas the SDK's input types are derived from;
11
+ * `@oxyhq/core`'s reputation mixin imports every type from here rather than
12
+ * declaring its own.
13
+ *
14
+ * Why this module exists: the balance endpoint was view-split server-side
15
+ * without the SDK type moving with it, and for hours the SDK affirmatively
16
+ * type-checked a read of `balance.reliability.reportAccuracyScore` against a
17
+ * response that no longer carried `reliability`. Nothing structural connected
18
+ * the API's hand-written serializers (which returned `Record<string, unknown>`)
19
+ * to the SDK's interfaces — only human attention. With the serializers
20
+ * annotated against these definitions, that divergence is a build failure.
21
+ *
22
+ * Design anchors:
23
+ * - **Ids are strings, timestamps are ISO 8601 strings.** The server holds
24
+ * `ObjectId`s and `Date`s; every serializer converts at the boundary, so a
25
+ * `Date` leaking into a field this module types as `string` fails to compile.
26
+ * - **The balance has two views, and the union is the contract.** See
27
+ * {@link ReputationBalanceView} — the compile-time assertions below are what
28
+ * stop the private view's fields becoming reachable on a stranger's balance.
29
+ * - **The closed value sets live here, not beside the mongoose models.** The
30
+ * API's model enums and the SDK's unions are the same `as const` tuple, so a
31
+ * seventh category cannot be added on one side only.
32
+ *
33
+ * The response entities are declared as explicit `interface`s with their runtime
34
+ * schemas annotated `z.ZodType<Interface>`, following `./links` and
35
+ * `./userResponse`: a `z.infer<>` of a nested-object schema can degrade to `{}`
36
+ * under a consumer's `moduleResolution: "node"` (node10) resolution, while a
37
+ * literal interface emits the field types verbatim in the `.d.ts` and survives
38
+ * both `node` and `bundler`.
39
+ *
40
+ * Platform-agnostic — zod only, no react/react-native/expo. ESM-safe (no
41
+ * `require()`).
42
+ */
43
+ Object.defineProperty(exports, "__esModule", { value: true });
44
+ exports.reverseReputationTransactionSchema = exports.upsertReputationRuleSchema = exports.resolveReputationDisputeSchema = exports.createReputationDisputeSchema = exports.awardReputationSchema = exports.reverseReputationTransactionResultSchema = exports.reputationInfluenceResultSchema = exports.reputationLeaderboardEntrySchema = exports.reputationLeaderboardUserSchema = exports.reputationRuleSchema = exports.reputationDisputeSchema = exports.reputationBalanceSchema = exports.reputationBalanceSummarySchema = exports.reputationReliabilitySchema = exports.reputationInfluenceSchema = exports.reputationBalanceBreakdownSchema = exports.reputationTransactionSchema = exports.reputationInfluenceContextSchema = exports.REPUTATION_INFLUENCE_CONTEXTS = exports.reputationDisputeStatusSchema = exports.REPUTATION_DISPUTE_STATUSES = exports.reputationTargetEntityTypeSchema = exports.REPUTATION_TARGET_ENTITY_TYPES = exports.trustTierSchema = exports.TRUST_TIERS = exports.reputationTransactionStatusSchema = exports.REPUTATION_TRANSACTION_STATUSES = exports.reputationCategorySchema = exports.REPUTATION_CATEGORIES = void 0;
45
+ exports.isFullReputationBalance = isFullReputationBalance;
46
+ const zod_1 = require("zod");
47
+ const userResponse_1 = require("./userResponse");
48
+ /* -------------------------------------------------------------------------- */
49
+ /* Closed value sets */
50
+ /* -------------------------------------------------------------------------- */
51
+ /**
52
+ * Category bucket a reputation transaction falls into. Drives the per-category
53
+ * balance breakdown; every rule and transaction carries exactly one.
54
+ *
55
+ * - `content` — posts, comments, media a user authored.
56
+ * - `social` — follows, likes, social interactions.
57
+ * - `trust` — identity / verification / trust-graph signals.
58
+ * - `moderation` — reports filed, moderation actions, review outcomes.
59
+ * - `physical` — real-world signals (event check-ins, verified purchases).
60
+ * - `penalty` — negative adjustments for abuse / policy violations.
61
+ * - `other` — anything that does not fit the buckets above.
62
+ */
63
+ exports.REPUTATION_CATEGORIES = [
64
+ 'content',
65
+ 'social',
66
+ 'trust',
67
+ 'moderation',
68
+ 'physical',
69
+ 'penalty',
70
+ 'other',
71
+ ];
72
+ exports.reputationCategorySchema = zod_1.z.enum(exports.REPUTATION_CATEGORIES);
73
+ /**
74
+ * Transaction lifecycle status.
75
+ *
76
+ * - `active` — counts toward the balance.
77
+ * - `disputed` — under dispute; still counts until the dispute resolves.
78
+ * - `reversed` — superseded by a compensating reversal transaction; excluded.
79
+ * - `voided` — administratively excluded with no compensating entry.
80
+ */
81
+ exports.REPUTATION_TRANSACTION_STATUSES = [
82
+ 'active',
83
+ 'disputed',
84
+ 'reversed',
85
+ 'voided',
86
+ ];
87
+ exports.reputationTransactionStatusSchema = zod_1.z.enum(exports.REPUTATION_TRANSACTION_STATUSES);
88
+ /**
89
+ * Trust tiers, lowest → highest trust, plus the punitive `restricted`.
90
+ *
91
+ * Publicly visible: this is the contribution ladder the reputation system
92
+ * exists to publish. Note it doubles as the sanction marker — a `restricted`
93
+ * account is publicly identifiable as such.
94
+ */
95
+ exports.TRUST_TIERS = ['restricted', 'new', 'trusted', 'high_trust', 'verified'];
96
+ exports.trustTierSchema = zod_1.z.enum(exports.TRUST_TIERS);
97
+ /** Kind of entity a transaction may target. */
98
+ exports.REPUTATION_TARGET_ENTITY_TYPES = [
99
+ 'post',
100
+ 'comment',
101
+ 'report',
102
+ 'purchase',
103
+ 'event',
104
+ 'check_in',
105
+ 'manual_review',
106
+ 'user',
107
+ 'other',
108
+ ];
109
+ exports.reputationTargetEntityTypeSchema = zod_1.z.enum(exports.REPUTATION_TARGET_ENTITY_TYPES);
110
+ /** Dispute lifecycle status. */
111
+ exports.REPUTATION_DISPUTE_STATUSES = [
112
+ 'open',
113
+ 'accepted',
114
+ 'rejected',
115
+ 'needs_review',
116
+ ];
117
+ exports.reputationDisputeStatusSchema = zod_1.z.enum(exports.REPUTATION_DISPUTE_STATUSES);
118
+ /** Influence context selecting which capped weight axis to read. */
119
+ exports.REPUTATION_INFLUENCE_CONTEXTS = [
120
+ 'default',
121
+ 'report',
122
+ 'moderation',
123
+ 'ranking',
124
+ ];
125
+ exports.reputationInfluenceContextSchema = zod_1.z.enum(exports.REPUTATION_INFLUENCE_CONTEXTS);
126
+ exports.reputationTransactionSchema = zod_1.z.object({
127
+ id: zod_1.z.string(),
128
+ userId: zod_1.z.string(),
129
+ points: zod_1.z.number(),
130
+ actionType: zod_1.z.string(),
131
+ category: exports.reputationCategorySchema,
132
+ applicationId: zod_1.z.string().optional(),
133
+ credentialId: zod_1.z.string().optional(),
134
+ sourceActionId: zod_1.z.string().optional(),
135
+ sourceActionType: zod_1.z.string().optional(),
136
+ targetEntityId: zod_1.z.string().optional(),
137
+ targetEntityType: exports.reputationTargetEntityTypeSchema.optional(),
138
+ status: exports.reputationTransactionStatusSchema,
139
+ reversedTransactionId: zod_1.z.string().optional(),
140
+ reason: zod_1.z.string().optional(),
141
+ metadata: zod_1.z.record(zod_1.z.unknown()).optional(),
142
+ createdByUserId: zod_1.z.string().optional(),
143
+ reviewedByUserId: zod_1.z.string().optional(),
144
+ reviewedAt: zod_1.z.string().optional(),
145
+ createdAt: zod_1.z.string(),
146
+ updatedAt: zod_1.z.string(),
147
+ });
148
+ exports.reputationBalanceBreakdownSchema = zod_1.z.object({
149
+ content: zod_1.z.number(),
150
+ social: zod_1.z.number(),
151
+ trust: zod_1.z.number(),
152
+ moderation: zod_1.z.number(),
153
+ physical: zod_1.z.number(),
154
+ penalties: zod_1.z.number(),
155
+ });
156
+ exports.reputationInfluenceSchema = zod_1.z.object({
157
+ defaultWeight: zod_1.z.number(),
158
+ reportWeight: zod_1.z.number(),
159
+ moderationWeight: zod_1.z.number(),
160
+ rankingFeedbackWeight: zod_1.z.number(),
161
+ });
162
+ exports.reputationReliabilitySchema = zod_1.z.object({
163
+ accurateReports: zod_1.z.number(),
164
+ rejectedReports: zod_1.z.number(),
165
+ reportAccuracyScore: zod_1.z.number(),
166
+ abuseScore: zod_1.z.number(),
167
+ });
168
+ /** The fields both balance views share. Kept as a shape so the full view can spread it. */
169
+ const balanceSummaryShape = {
170
+ userId: zod_1.z.string(),
171
+ total: zod_1.z.number(),
172
+ trustTier: exports.trustTierSchema,
173
+ };
174
+ exports.reputationBalanceSummarySchema = zod_1.z.object(balanceSummaryShape);
175
+ exports.reputationBalanceSchema = zod_1.z.object({
176
+ ...balanceSummaryShape,
177
+ positive: zod_1.z.number(),
178
+ negative: zod_1.z.number(),
179
+ breakdown: exports.reputationBalanceBreakdownSchema,
180
+ influence: exports.reputationInfluenceSchema,
181
+ reliability: exports.reputationReliabilitySchema,
182
+ recalculatedAt: zod_1.z.string(),
183
+ updatedAt: zod_1.z.string(),
184
+ });
185
+ /**
186
+ * Every field the full {@link ReputationBalance} carries beyond the public
187
+ * {@link ReputationBalanceSummary}. The runtime discriminant between the two
188
+ * views — the API sends this set all-or-nothing.
189
+ */
190
+ const FULL_BALANCE_FIELDS = [
191
+ 'positive',
192
+ 'negative',
193
+ 'breakdown',
194
+ 'influence',
195
+ 'reliability',
196
+ 'recalculatedAt',
197
+ 'updatedAt',
198
+ ];
199
+ /**
200
+ * Whether a balance came back as the SUBJECT view, and so carries the
201
+ * breakdown / influence / reliability blocks.
202
+ *
203
+ * Checks every extra field rather than one representative: the point of the
204
+ * guard is that the caller then dereferences those blocks, so a partial payload
205
+ * must not narrow.
206
+ *
207
+ * @param balance - A balance from `getReputationBalance`.
208
+ */
209
+ function isFullReputationBalance(balance) {
210
+ return FULL_BALANCE_FIELDS.every((field) => field in balance);
211
+ }
212
+ exports.reputationDisputeSchema = zod_1.z.object({
213
+ id: zod_1.z.string(),
214
+ transactionId: zod_1.z.string(),
215
+ userId: zod_1.z.string(),
216
+ reason: zod_1.z.string(),
217
+ status: exports.reputationDisputeStatusSchema,
218
+ evidence: zod_1.z.array(zod_1.z.string()).optional(),
219
+ resolvedAt: zod_1.z.string().optional(),
220
+ resolvedByUserId: zod_1.z.string().optional(),
221
+ createdAt: zod_1.z.string(),
222
+ updatedAt: zod_1.z.string(),
223
+ });
224
+ exports.reputationRuleSchema = zod_1.z.object({
225
+ id: zod_1.z.string(),
226
+ actionType: zod_1.z.string(),
227
+ points: zod_1.z.number(),
228
+ category: exports.reputationCategorySchema,
229
+ description: zod_1.z.string(),
230
+ cooldownInMinutes: zod_1.z.number(),
231
+ isEnabled: zod_1.z.boolean(),
232
+ });
233
+ exports.reputationLeaderboardUserSchema = zod_1.z.object({
234
+ id: zod_1.z.string(),
235
+ username: zod_1.z.string(),
236
+ name: userResponse_1.userNameSchema,
237
+ avatar: zod_1.z.string().optional(),
238
+ publicKey: zod_1.z.string().optional(),
239
+ });
240
+ exports.reputationLeaderboardEntrySchema = zod_1.z.object({
241
+ user: exports.reputationLeaderboardUserSchema,
242
+ total: zod_1.z.number(),
243
+ trustTier: exports.trustTierSchema,
244
+ rank: zod_1.z.number(),
245
+ });
246
+ exports.reputationInfluenceResultSchema = zod_1.z.object({
247
+ context: exports.reputationInfluenceContextSchema,
248
+ weight: zod_1.z.number(),
249
+ influence: exports.reputationInfluenceSchema,
250
+ });
251
+ exports.reverseReputationTransactionResultSchema = zod_1.z.object({
252
+ original: exports.reputationTransactionSchema,
253
+ reversal: exports.reputationTransactionSchema,
254
+ });
255
+ exports.awardReputationSchema = zod_1.z.object({
256
+ userId: zod_1.z.string().trim().min(1),
257
+ actionType: zod_1.z.string().trim().min(1),
258
+ applicationId: zod_1.z.string().trim().min(1).optional(),
259
+ credentialId: zod_1.z.string().trim().min(1).optional(),
260
+ sourceActionId: zod_1.z.string().trim().min(1).optional(),
261
+ sourceActionType: zod_1.z.string().trim().min(1).optional(),
262
+ targetEntityId: zod_1.z.string().trim().min(1).optional(),
263
+ targetEntityType: exports.reputationTargetEntityTypeSchema.optional(),
264
+ reason: zod_1.z.string().trim().max(500).optional(),
265
+ metadata: zod_1.z.record(zod_1.z.unknown()).optional(),
266
+ });
267
+ exports.createReputationDisputeSchema = zod_1.z.object({
268
+ transactionId: zod_1.z.string().trim().min(1),
269
+ reason: zod_1.z.string().trim().min(1).max(1000),
270
+ evidence: zod_1.z.array(zod_1.z.string().trim().min(1)).max(20).optional(),
271
+ });
272
+ exports.resolveReputationDisputeSchema = zod_1.z.object({
273
+ status: zod_1.z.enum(['accepted', 'rejected']),
274
+ });
275
+ exports.upsertReputationRuleSchema = zod_1.z.object({
276
+ actionType: zod_1.z.string().trim().min(1),
277
+ points: zod_1.z.number(),
278
+ category: exports.reputationCategorySchema,
279
+ description: zod_1.z.string().trim().min(1).max(500),
280
+ cooldownInMinutes: zod_1.z.number().int().min(0).default(0),
281
+ isEnabled: zod_1.z.boolean().default(true),
282
+ });
283
+ exports.reverseReputationTransactionSchema = zod_1.z.object({
284
+ reason: zod_1.z.string().trim().max(500).optional(),
285
+ });