@oxyhq/contracts 0.24.0 → 0.26.0

package/dist/types/deviceSession.d.ts

@@ -5,13 +5,13 @@ export declare const sessionAccountSchema: z.ZodObject<{
     authuser: z.ZodNumber;
     operatedByUserId: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    sessionId: string;
     accountId: string;
+    sessionId: string;
     authuser: number;
     operatedByUserId?: string | undefined;
 }, {
-    sessionId: string;
     accountId: string;
+    sessionId: string;
     authuser: number;
     operatedByUserId?: string | undefined;
 }>;
@@ -23,13 +23,13 @@ export declare const deviceSessionStateSchema: z.ZodObject<{
         authuser: z.ZodNumber;
         operatedByUserId: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        sessionId: string;
         accountId: string;
+        sessionId: string;
         authuser: number;
         operatedByUserId?: string | undefined;
     }, {
-        sessionId: string;
         accountId: string;
+        sessionId: string;
         authuser: number;
         operatedByUserId?: string | undefined;
     }>, "many">;
@@ -37,37 +37,37 @@ export declare const deviceSessionStateSchema: z.ZodObject<{
     revision: z.ZodNumber;
     updatedAt: z.ZodNumber;
 }, "strip", z.ZodTypeAny, {
-    updatedAt: number;
     deviceId: string;
     accounts: {
-        sessionId: string;
         accountId: string;
+        sessionId: string;
         authuser: number;
         operatedByUserId?: string | undefined;
     }[];
     activeAccountId: string | null;
     revision: number;
-}, {
     updatedAt: number;
+}, {
     deviceId: string;
     accounts: {
-        sessionId: string;
         accountId: string;
+        sessionId: string;
         authuser: number;
         operatedByUserId?: string | undefined;
     }[];
     activeAccountId: string | null;
     revision: number;
+    updatedAt: number;
 }>;
 export declare const activeTokenSchema: z.ZodObject<{
     accessToken: z.ZodString;
     expiresAt: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    expiresAt: string;
     accessToken: string;
-}, {
     expiresAt: string;
+}, {
     accessToken: string;
+    expiresAt: string;
 }>;
 export declare const deviceSessionSyncSchema: z.ZodObject<{
     state: z.ZodObject<{
@@ -78,13 +78,13 @@ export declare const deviceSessionSyncSchema: z.ZodObject<{
             authuser: z.ZodNumber;
             operatedByUserId: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            sessionId: string;
             accountId: string;
+            sessionId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }, {
-            sessionId: string;
             accountId: string;
+            sessionId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }>, "many">;
@@ -92,71 +92,71 @@ export declare const deviceSessionSyncSchema: z.ZodObject<{
         revision: z.ZodNumber;
         updatedAt: z.ZodNumber;
     }, "strip", z.ZodTypeAny, {
-        updatedAt: number;
         deviceId: string;
         accounts: {
-            sessionId: string;
             accountId: string;
+            sessionId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
         activeAccountId: string | null;
         revision: number;
-    }, {
         updatedAt: number;
+    }, {
         deviceId: string;
         accounts: {
-            sessionId: string;
             accountId: string;
+            sessionId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
         activeAccountId: string | null;
         revision: number;
+        updatedAt: number;
     }>;
     activeToken: z.ZodNullable<z.ZodObject<{
         accessToken: z.ZodString;
         expiresAt: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        expiresAt: string;
         accessToken: string;
-    }, {
         expiresAt: string;
+    }, {
         accessToken: string;
+        expiresAt: string;
     }>>;
 }, "strip", z.ZodTypeAny, {
     state: {
-        updatedAt: number;
         deviceId: string;
         accounts: {
-            sessionId: string;
             accountId: string;
+            sessionId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
         activeAccountId: string | null;
         revision: number;
+        updatedAt: number;
     };
     activeToken: {
-        expiresAt: string;
         accessToken: string;
+        expiresAt: string;
     } | null;
 }, {
     state: {
-        updatedAt: number;
         deviceId: string;
         accounts: {
-            sessionId: string;
             accountId: string;
+            sessionId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
         activeAccountId: string | null;
         revision: number;
+        updatedAt: number;
     };
     activeToken: {
-        expiresAt: string;
         accessToken: string;
+        expiresAt: string;
     } | null;
 }>;
 export type SessionAccount = z.infer<typeof sessionAccountSchema>;
@@ -211,13 +211,13 @@ export declare const deviceTokenMintResponseSchema: z.ZodObject<{
             authuser: z.ZodNumber;
             operatedByUserId: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            sessionId: string;
             accountId: string;
+            sessionId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }, {
-            sessionId: string;
             accountId: string;
+            sessionId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }>, "many">;
@@ -225,58 +225,58 @@ export declare const deviceTokenMintResponseSchema: z.ZodObject<{
         revision: z.ZodNumber;
         updatedAt: z.ZodNumber;
     }, "strip", z.ZodTypeAny, {
-        updatedAt: number;
         deviceId: string;
         accounts: {
-            sessionId: string;
             accountId: string;
+            sessionId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
         activeAccountId: string | null;
         revision: number;
-    }, {
         updatedAt: number;
+    }, {
         deviceId: string;
         accounts: {
-            sessionId: string;
             accountId: string;
+            sessionId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
         activeAccountId: string | null;
         revision: number;
+        updatedAt: number;
     }>;
 }, "strip", z.ZodTypeAny, {
-    expiresAt: string;
     accessToken: string;
+    expiresAt: string;
     state: {
-        updatedAt: number;
         deviceId: string;
         accounts: {
-            sessionId: string;
             accountId: string;
+            sessionId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
         activeAccountId: string | null;
         revision: number;
+        updatedAt: number;
     };
     nextDeviceSecret: string;
 }, {
-    expiresAt: string;
     accessToken: string;
+    expiresAt: string;
     state: {
-        updatedAt: number;
         deviceId: string;
         accounts: {
-            sessionId: string;
             accountId: string;
+            sessionId: string;
             authuser: number;
             operatedByUserId?: string | undefined;
         }[];
         activeAccountId: string | null;
         revision: number;
+        updatedAt: number;
     };
     nextDeviceSecret: string;
 }>;
@@ -314,13 +314,13 @@ export declare const sessionAccountsChangedEventSchema: z.ZodObject<{
     revision: z.ZodNumber;
     reason: z.ZodEnum<["login", "add", "switch", "signout", "revoke"]>;
 }, "strip", z.ZodTypeAny, {
+    revision: number;
     userId: string;
     reason: "login" | "add" | "switch" | "signout" | "revoke";
-    revision: number;
 }, {
+    revision: number;
     userId: string;
     reason: "login" | "add" | "switch" | "signout" | "revoke";
-    revision: number;
 }>;
 export type SessionAccountsChangedReason = z.infer<typeof sessionAccountsChangedReasonSchema>;
 export type SessionAccountsChangedEvent = z.infer<typeof sessionAccountsChangedEventSchema>;
@@ -353,14 +353,14 @@ export declare const deviceBackgroundCredentialResponseSchema: z.ZodObject<{
     accountId: z.ZodString;
     expiresAt: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    expiresAt: string;
-    deviceId: string;
     accountId: string;
+    deviceId: string;
+    expiresAt: string;
     secret: string;
 }, {
-    expiresAt: string;
-    deviceId: string;
     accountId: string;
+    deviceId: string;
+    expiresAt: string;
     secret: string;
 }>;
 /**
@@ -398,13 +398,13 @@ export declare const deviceBackgroundTokenResponseSchema: z.ZodObject<{
     expiresAt: z.ZodString;
     accountId: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    expiresAt: string;
-    accessToken: string;
     accountId: string;
-}, {
-    expiresAt: string;
     accessToken: string;
+    expiresAt: string;
+}, {
     accountId: string;
+    accessToken: string;
+    expiresAt: string;
 }>;
 export type DeviceBackgroundCredentialResponse = z.infer<typeof deviceBackgroundCredentialResponseSchema>;
 export type DeviceBackgroundTokenRequest = z.infer<typeof deviceBackgroundTokenRequestSchema>;

package/dist/types/followGraph.d.ts

@@ -82,6 +82,12 @@ export interface FollowRecord {
     target: FollowTarget;
     globalState: FollowState;
     applicationMode: FollowApplicationMode;
+    /**
+     * Whether this follow acts in the requesting application right now — the
+     * same field a button renders. List rows carry it so a follow list can seed
+     * `FollowTargetButton` without recomputing the server's derivation.
+     */
+    effectiveState: FollowEffectiveState;
     /**
      * Where the user was when they followed. Provenance for the audit trail and
      * for notification routing — never authority: this application cannot undo

package/dist/types/index.d.ts

@@ -40,6 +40,12 @@ export type { LinkPreviewStatus, LinkPreview, LinkPreviewBatchRequest, LinkPrevi
 export type { FollowTargetKind, FollowState, FollowEffectiveState, FollowApplicationMode, FollowTarget, FollowRecord, FollowStatus, FollowMutation, UnfollowMutation, FollowListPage, FollowOptions, } from './followGraph';
 export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, deviceTokenMintRequestSchema, deviceTokenMintResponseSchema, deviceBackgroundCredentialResponseSchema, deviceBackgroundTokenRequestSchema, deviceBackgroundTokenResponseSchema, SESSION_ACCOUNTS_CHANGED_EVENT, sessionAccountsChangedReasonSchema, sessionAccountsChangedEventSchema, } from './deviceSession';
 export type { SessionAccount, DeviceSessionState, ActiveToken, DeviceSessionSync, DeviceTokenMintRequest, DeviceTokenMintResponse, DeviceBackgroundCredentialResponse, DeviceBackgroundTokenRequest, DeviceBackgroundTokenResponse, SessionAccountsChangedReason, SessionAccountsChangedEvent, } from './deviceSession';
+export { deviceContextRelationshipSchema, deviceDirectoryProfileSchema, deviceAccountContextSchema, devicePrincipalSchema, deviceDirectorySchema, deviceActivateRequestSchema, deviceActivateResponseSchema, deviceDirectorySyncSchema, } from './deviceDirectory';
+export type { DeviceContextRelationship, DeviceDirectoryProfile, DeviceAccountContext, DevicePrincipal, DeviceDirectory, DeviceActivateRequest, DeviceActivateResponse, DeviceDirectorySync, } from './deviceDirectory';
+export { oauthConsentDecisionSchema, oauthAuthorizeCodeResponseSchema, } from './oauth';
+export type { OauthConsentDecision, OauthAuthorizeCodeResponse, } from './oauth';
+export { BROWSER_HUB_COOKIE_NAME, BROWSER_HUB_COOKIE_ATTRIBUTES, BROWSER_HUB_HANDLE_TTL_MS, browserHubHandleSchema, browserHubHandleRequestSchema, browserHubHandleResponseSchema, browserHubResolveResponseSchema, browserHubErrorSchema, browserHubRevokeResponseSchema, hubSessionSchema, hubClaimRequestSchema, hubActivateRequestSchema, hubAuthorizeRequestSchema, hubAuthorizeResultSchema, } from './browserHub';
+export type { BrowserHubHandleRequest, BrowserHubHandleResponse, BrowserHubResolveResponse, BrowserHubError, BrowserHubRevokeResponse, HubSession, HubClaimRequest, HubActivateRequest, HubAuthorizeRequest, HubAuthorizeResult, } from './browserHub';
 export { loginResultSchema, } from './deviceBoot';
 export type { LoginSessionResult, LoginResult, SecurityAlert, SecurityAlertAnomaly, } from './deviceBoot';
 export { rotateKeyChallengeResponseSchema, rotateKeyCompleteRequestSchema, rotateKeyCompleteResponseSchema, } from './keyRotation';

package/dist/types/oauth.d.ts

@@ -0,0 +1,86 @@
+import { z } from 'zod';
+/**
+ * The two `/auth/oauth/*` responses the browser hub's edge layer reads.
+ *
+ * They existed on the wire long before this file — `GET /auth/oauth/consent`
+ * and `POST /auth/oauth/authorize` are the surface `auth.oxy.so` has always
+ * driven with a bearer. What is new (issue #937 Phase 5) is a SECOND consumer
+ * that is not the SPA: the IdP's edge layer runs both calls server-side so the
+ * device-wide bearer never enters the browser's script context. A shape read by
+ * two independently deployed consumers is a contract, so it is written down
+ * once here and validated on both sides rather than transcribed into the edge.
+ *
+ * These are NOT the RFC 6749 token/userinfo responses. Those two speak flat
+ * OAuth/OIDC on the wire and are the one place in the API that does not use the
+ * `{ data }` envelope; these two are ordinary internal API responses that happen
+ * to be about OAuth.
+ */
+/**
+ * Server-authoritative answer to "must this user be shown a consent screen".
+ *
+ * Discriminated on `consentRequired` so the two arms cannot be confused by a
+ * consumer that reads `reason` first: `trusted`/`granted` are reasons NOT to
+ * ask, `new`/`scope_changed` are reasons to ask, and a flat object would let a
+ * typo in one produce a plausible value of the other.
+ *
+ *  - `trusted`       — the application is first-party/internal/system/official
+ *                      by the REGISTRY's verdict (`isTrustedApplication`), and
+ *                      the request names no scope over the user's own follow
+ *                      graph. Never inferred from a hostname.
+ *  - `granted`       — a prior `AppGrant` already covers every requested scope.
+ *  - `scope_changed` — a prior grant exists and is missing one.
+ *  - `new`           — no prior grant.
+ *
+ * `userConsentScopes` names the scopes that FORCED the screen, so the consent UI
+ * can say which one it is asking about. Present only on the `true` arm, and only
+ * when such a scope exists — a trusted app asked for one is still asked.
+ */
+export declare const oauthConsentDecisionSchema: z.ZodDiscriminatedUnion<"consentRequired", [z.ZodObject<{
+    consentRequired: z.ZodLiteral<false>;
+    reason: z.ZodEnum<["trusted", "granted"]>;
+}, "strip", z.ZodTypeAny, {
+    reason: "trusted" | "granted";
+    consentRequired: false;
+}, {
+    reason: "trusted" | "granted";
+    consentRequired: false;
+}>, z.ZodObject<{
+    consentRequired: z.ZodLiteral<true>;
+    reason: z.ZodEnum<["new", "scope_changed"]>;
+    userConsentScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    reason: "new" | "scope_changed";
+    consentRequired: true;
+    userConsentScopes?: string[] | undefined;
+}, {
+    reason: "new" | "scope_changed";
+    consentRequired: true;
+    userConsentScopes?: string[] | undefined;
+}>]>;
+/**
+ * A minted authorization code.
+ *
+ * `state` is echoed back as the caller sent it and is `null` when they sent
+ * none — never omitted, so a consumer cannot read "the server dropped my state"
+ * as "I sent none". `redirectUri` is echoed for the same reason the code is
+ * bound to it server-side: the caller must be able to see that the value the
+ * code was issued against is the one it registered.
+ */
+export declare const oauthAuthorizeCodeResponseSchema: z.ZodObject<{
+    code: z.ZodString;
+    state: z.ZodNullable<z.ZodString>;
+    redirectUri: z.ZodString;
+    expiresIn: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    state: string | null;
+    redirectUri: string;
+    expiresIn: number;
+}, {
+    code: string;
+    state: string | null;
+    redirectUri: string;
+    expiresIn: number;
+}>;
+export type OauthConsentDecision = z.infer<typeof oauthConsentDecisionSchema>;
+export type OauthAuthorizeCodeResponse = z.infer<typeof oauthAuthorizeCodeResponseSchema>;

package/dist/types/oxyRecordTypes.d.ts

@@ -1,31 +1,59 @@
 /**
  * Oxy-scoped signed-record types.
  *
- * The base `signedRecordEnvelopeSchema` (`./identity`) now treats `type` as an
- * OPEN, non-empty string so ANY Oxy app may define its own record categories
- * (e.g. `app.mention.*`'s `app_record`) on the shared envelope grammar. The Oxy
- * identity/civic/node STORE, however, accepts ONLY the closed set of categories
- * it knows how to verify and materialize — this module is that closed set.
+ * The base `signedRecordEnvelopeSchema` (`./identity`) treats `type` as an OPEN,
+ * non-empty string so ANY Oxy app may sign on the shared envelope grammar. The
+ * Oxy STORE re-narrows it to the closed set in this module — a `type` outside it
+ * is rejected as `invalid_envelope`.
  *
- * `oxySignedRecordTypeSchema` is the runtime gate the Oxy store re-narrows with
- * (the API's `verifyEnvelope` rejects any `type` outside it; the Mongoose
- * `SignedRecord.type` enum is derived from `.options`); `OxySignedRecordType` is
- * the matching compile-time union the SDK identity/civic mixins type against.
+ * `oxySignedRecordTypeSchema` is that runtime gate (the API's `verifyEnvelope`
+ * re-narrows with it; the Mongoose `SignedRecord.type` enum and the Postgres
+ * CHECK on `signed_records.type` are both derived from `.options`);
+ * `OxySignedRecordType` is the matching compile-time union the SDK
+ * identity/civic mixins type against.
  *
  * The signing input INCLUDES `type`, so this set is part of the signed bytes —
- * a record cannot have its category swapped after signing.
+ * a record cannot have its category swapped after signing, and a value once
+ * signed can never be renamed.
  *
  * v1 only ever carried `identity` / `profile` (already in production); v2 added
  * the civic record types (reputation attestations, real-life / peer validations,
  * personhood vouches, verifiable credentials) and the user-node registration
- * record. Every value here is an Oxy `app.oxy.*` (or legacy v1) category — an
- * app's own `type` (e.g. `app_record`) is intentionally NOT in this set and is
- * rejected by the Oxy store.
+ * record.
+ *
+ * ## Why `app_record` is here, when it deliberately was not
+ *
+ * This set used to hold Oxy's own categories only, and said so: an app's `type`
+ * was "intentionally NOT in this set". The reason given was that the store
+ * accepts only what it knows how to **verify and materialize**. Verification
+ * turned out not to argue for the exclusion — the engine verifies a signature
+ * against the subject's keys whatever the category says — and materialization
+ * is the app's job, not the store's: an app projects its own feed tables from
+ * records it reads back.
+ *
+ * What changed is the decision the exclusion blocked. One chain per PERSON, held
+ * by Oxy, is the ecosystem substrate: apps append their records to the subject's
+ * one chain instead of each keeping a private chain for the same person. A
+ * closed set that admits no app category makes that unrepresentable.
+ *
+ * `app_record` is ONE value rather than an open lane, and the lexicon lives in
+ * the envelope's `collection` (`app.mention.feed.post`, `app.syra.*`), which the
+ * store denormalizes to `signed_records.nsid` and indexes. So a new app needs no
+ * change here — it picks its own collection namespace and signs `app_record`,
+ * exactly as Mention already does in production. Keeping the set closed is what
+ * keeps the CHECK a real constraint.
+ *
+ * **Admitting the category is not the whole of that decision.** Two gates sit
+ * beside it and are unchanged: an app record must arrive as a v2 (chained)
+ * envelope, and `oxyVerificationResolver` accepts exactly one custodial issuer
+ * (`OXY_DID`). So a record a user signs themselves verifies here today, while
+ * one an app signs custodially under its OWN issuer DID does not — that needs a
+ * separate, deliberate answer about which issuers may write to a person's chain.
  *
  * Platform-agnostic — zod only, no react/react-native/expo, ESM-safe.
  */
 import { z } from 'zod';
-export declare const oxySignedRecordTypeSchema: z.ZodEnum<["identity", "profile", "reputation_attestation", "real_life_attestation", "validation_verdict", "personhood_vouch", "credential", "node"]>;
+export declare const oxySignedRecordTypeSchema: z.ZodEnum<["identity", "profile", "reputation_attestation", "real_life_attestation", "validation_verdict", "personhood_vouch", "credential", "node", "app_record"]>;
 /**
  * The closed set of record categories the Oxy identity/civic/node store accepts.
  * The base envelope `type` is an open string; this is what the Oxy store

package/dist/types/sessionStatus.d.ts

@@ -179,12 +179,12 @@ export declare const sessionStatusSchema: z.ZodObject<{
     openedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
     status: string;
-    publicKey?: string | null | undefined;
-    userId?: string | null | undefined;
-    expiresAt?: string | undefined;
     sessionId?: string | null | undefined;
-    authorized?: boolean | undefined;
+    expiresAt?: string | undefined;
+    userId?: string | null | undefined;
+    publicKey?: string | null | undefined;
     sessionToken?: string | undefined;
+    authorized?: boolean | undefined;
     application?: {
         type: "system" | "first_party" | "third_party" | "internal";
         name: string;
@@ -204,12 +204,12 @@ export declare const sessionStatusSchema: z.ZodObject<{
     openedAt?: string | null | undefined;
 }, {
     status: string;
-    publicKey?: string | null | undefined;
-    userId?: string | null | undefined;
-    expiresAt?: string | undefined;
     sessionId?: string | null | undefined;
-    authorized?: boolean | undefined;
+    expiresAt?: string | undefined;
+    userId?: string | null | undefined;
+    publicKey?: string | null | undefined;
     sessionToken?: string | undefined;
+    authorized?: boolean | undefined;
     application?: {
         type: "system" | "first_party" | "third_party" | "internal";
         name: string;

package/dist/types/userResponse.d.ts

@@ -813,13 +813,13 @@ export declare const currentUserResponseSchema: z.ZodObject<{
         publicKey?: string | undefined;
         did?: string | undefined;
         verifiedDomains?: import("./identity").VerifiedDomain[] | undefined;
-        verified?: boolean | undefined;
-        email?: string | undefined;
         _id?: string | undefined;
+        email?: string | undefined;
         phone?: string | undefined;
         address?: string | undefined;
         birthday?: string | undefined;
         color?: string | null | undefined;
+        verified?: boolean | undefined;
         languages?: string[] | undefined;
         relationship?: UserRelationship | undefined;
         themePreference?: ThemePreference | undefined;
@@ -837,13 +837,13 @@ export declare const currentUserResponseSchema: z.ZodObject<{
         publicKey?: string | undefined;
         did?: string | undefined;
         verifiedDomains?: import("./identity").VerifiedDomain[] | undefined;
-        verified?: boolean | undefined;
-        email?: string | undefined;
         _id?: string | undefined;
+        email?: string | undefined;
         phone?: string | undefined;
         address?: string | undefined;
         birthday?: string | undefined;
         color?: string | null | undefined;
+        verified?: boolean | undefined;
         languages?: string[] | undefined;
         relationship?: UserRelationship | undefined;
         themePreference?: ThemePreference | undefined;
@@ -1107,6 +1107,7 @@ export declare const deviceLinkedSessionSchema: z.ZodObject<{
     }, z.ZodTypeAny, "passthrough">>>>;
 }, "strip", z.ZodTypeAny, {
     sessionId: string;
+    isCurrent?: boolean | undefined;
     user?: z.objectOutputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -1189,9 +1190,9 @@ export declare const deviceLinkedSessionSchema: z.ZodObject<{
          */
         themePreference: z.ZodOptional<z.ZodType<ThemePreference, z.ZodTypeDef, ThemePreference>>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
-    isCurrent?: boolean | undefined;
 }, {
     sessionId: string;
+    isCurrent?: boolean | undefined;
     user?: z.objectInputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -1274,7 +1275,6 @@ export declare const deviceLinkedSessionSchema: z.ZodObject<{
          */
         themePreference: z.ZodOptional<z.ZodType<ThemePreference, z.ZodTypeDef, ThemePreference>>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
-    isCurrent?: boolean | undefined;
 }>;
 export type DeviceLinkedSessionResponse = z.infer<typeof deviceLinkedSessionSchema>;
 /** Wire shape of `GET /session/device/sessions/:sessionId` (an array). */
@@ -1527,6 +1527,7 @@ export declare const deviceLinkedSessionsResponseSchema: z.ZodArray<z.ZodObject<
     }, z.ZodTypeAny, "passthrough">>>>;
 }, "strip", z.ZodTypeAny, {
     sessionId: string;
+    isCurrent?: boolean | undefined;
     user?: z.objectOutputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -1609,9 +1610,9 @@ export declare const deviceLinkedSessionsResponseSchema: z.ZodArray<z.ZodObject<
          */
         themePreference: z.ZodOptional<z.ZodType<ThemePreference, z.ZodTypeDef, ThemePreference>>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
-    isCurrent?: boolean | undefined;
 }, {
     sessionId: string;
+    isCurrent?: boolean | undefined;
     user?: z.objectInputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -1694,7 +1695,6 @@ export declare const deviceLinkedSessionsResponseSchema: z.ZodArray<z.ZodObject<
          */
         themePreference: z.ZodOptional<z.ZodType<ThemePreference, z.ZodTypeDef, ThemePreference>>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
-    isCurrent?: boolean | undefined;
 }>, "many">;
 export type DeviceLinkedSessionsResponseContract = z.infer<typeof deviceLinkedSessionsResponseSchema>;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/contracts",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "OxyHQ API contracts — single source of truth for request/response Zod schemas and inferred types, shared by the backend and the client SDKs",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -26,6 +26,7 @@
     "./package.json": "./package.json"
   },
   "files": [
+    "NOTICE",
     "dist"
   ],
   "keywords": [
@@ -42,7 +43,7 @@
     "directory": "packages/contracts"
   },
   "author": "OxyHQ",
-  "license": "AGPL-3.0-only",
+  "license": "Apache-2.0",
   "homepage": "https://oxy.so",
   "engines": {
     "node": ">=18.0.0"