@oxyhq/contracts 0.25.0 → 0.26.0

package/dist/cjs/browserHub.js

@@ -0,0 +1,215 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hubAuthorizeResultSchema = exports.hubAuthorizeRequestSchema = exports.hubActivateRequestSchema = exports.hubClaimRequestSchema = exports.hubSessionSchema = exports.browserHubRevokeResponseSchema = exports.browserHubErrorSchema = exports.browserHubResolveResponseSchema = exports.browserHubHandleResponseSchema = exports.browserHubHandleRequestSchema = exports.browserHubHandleSchema = exports.BROWSER_HUB_HANDLE_TTL_MS = exports.BROWSER_HUB_COOKIE_ATTRIBUTES = exports.BROWSER_HUB_COOKIE_NAME = void 0;
+const zod_1 = require("zod");
+const deviceDirectory_1 = require("./deviceDirectory");
+/**
+ * The browser DeviceSession hub at `auth.oxy.so` (issue #937, Phase 5, ADR 0003).
+ *
+ * Two wire surfaces live in this file and they are deliberately different
+ * shapes, because they answer to different callers:
+ *
+ *  - The `browserHub*` schemas below the first divider are the API's
+ *    (`api.oxy.so/session/browser-hub/*`), spoken ONLY by the IdP's own
+ *    server/edge layer. They carry the raw handle and a bearer, so nothing that
+ *    speaks them may run in a browser.
+ *  - The `hub*` schemas below the second divider are the EDGE's
+ *    (`auth.oxy.so/hub/*`), spoken by the IdP SPA. They carry neither: the
+ *    handle stays in an `HttpOnly` cookie the script cannot read, and the
+ *    device-wide bearer stays at the edge.
+ *
+ * That split is the whole point of the phase. A single schema covering both
+ * would let a refactor move a credential across the boundary without any type
+ * changing shape.
+ *
+ * ## What is NOT reopened here
+ *
+ * Relying-party origins remain zero-cookie: they keep `{deviceId,
+ * deviceSecret}` + `POST /session/device/token` and set no cookie of any kind.
+ * `auth.oxy.so` alone holds a handle, first-party only. There is no
+ * refresh-token family and no bootstrap hop.
+ */
+/* -------------------------------------------------------------------------- */
+/*  The cookie                                                                */
+/* -------------------------------------------------------------------------- */
+/**
+ * The one cookie name, `__Host-` prefixed.
+ *
+ * The prefix is not decoration: a browser refuses to store a `__Host-` cookie
+ * that carries a `Domain` attribute or a `Path` other than `/`, or that arrives
+ * without `Secure`. So the name itself is what makes "bound to `auth.oxy.so`
+ * alone, readable by no other `oxy.so` host" enforced by the client rather than
+ * merely intended by the server — including against a compromised sibling
+ * subdomain, which is the specific attack `Domain=.oxy.so` would have opened.
+ */
+exports.BROWSER_HUB_COOKIE_NAME = '__Host-oxy-device';
+/**
+ * The exact attribute set the edge sets, in the order it writes them.
+ *
+ * Held as data rather than as a template string so a test can assert the set
+ * rather than a rendered line, and so removing one attribute is a diff to a
+ * named constant instead of an edit inside a string literal.
+ *
+ * `Max-Age` is deliberately NOT in this list — see
+ * {@link BROWSER_HUB_HANDLE_TTL_MS}, which the edge appends. Everything here is
+ * a SECURITY attribute and none of them is ever conditional.
+ */
+exports.BROWSER_HUB_COOKIE_ATTRIBUTES = ['Secure', 'HttpOnly', 'SameSite=Lax', 'Path=/'];
+/**
+ * How long a hub handle lives, server-side and in the cookie alike.
+ *
+ * Thirty days. The cookie's `Max-Age` is derived from this same constant so the
+ * two cannot disagree: a cookie outliving its credential produces a browser that
+ * believes it is signed in and is refused on every call, and a credential
+ * outliving its cookie leaves an un-addressable row alive on the server.
+ *
+ * A hub handle is NOT a session cookie (one with no `Max-Age`, discarded when
+ * the browser closes). It cannot be: the thing it identifies is the browser
+ * PROFILE's device session, and a device session that evaporates when the user
+ * quits their browser would send them back to a QR scan every morning — the
+ * exact failure ADR 0003 exists to remove.
+ */
+exports.BROWSER_HUB_HANDLE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/* -------------------------------------------------------------------------- */
+/*  api.oxy.so/session/browser-hub/*  —  spoken by the edge, never a browser   */
+/* -------------------------------------------------------------------------- */
+/**
+ * The raw handle, as it travels between the edge and the API.
+ *
+ * An opaque base64url random value and NOTHING else — no token, no user id, no
+ * device id, no account id, no serialized state. The server stores only
+ * `sha256(handle)`, so a dump of the column cannot address a browser.
+ *
+ * The minimum length is a floor against an empty or truncated value reaching a
+ * hash comparison, not a statement about the entropy: that is fixed by the
+ * issuer (`BROWSER_HUB_HANDLE_BYTES` in the API), and a handle is the only
+ * credential in this flow, so it is 256 bits.
+ */
+exports.browserHubHandleSchema = zod_1.z.string().min(32);
+/** Request body of every handle-presenting API endpoint. */
+exports.browserHubHandleRequestSchema = zod_1.z.object({
+    handle: exports.browserHubHandleSchema,
+});
+/**
+ * Response of `POST /session/browser-hub/establish` and `.../rotate`.
+ *
+ * The raw handle is returned exactly ONCE, to the edge, which puts it straight
+ * into the cookie and keeps no copy. It is never logged, never re-readable, and
+ * never reaches the browser's script context.
+ */
+exports.browserHubHandleResponseSchema = zod_1.z.object({
+    handle: exports.browserHubHandleSchema,
+    expiresAt: zod_1.z.string(),
+});
+/**
+ * Response of `POST /session/browser-hub/resolve` — the browser's device
+ * session, resolved from the handle alone.
+ *
+ * Carries a bearer because the edge needs one to run the authorize lane on the
+ * browser's behalf. It is the ordinary short-lived access token of the device's
+ * active context, and it stops at the edge.
+ */
+exports.browserHubResolveResponseSchema = zod_1.z.object({
+    accessToken: zod_1.z.string().min(1),
+    expiresAt: zod_1.z.string(),
+    directory: deviceDirectory_1.deviceDirectorySchema,
+});
+/**
+ * Why a handle did not resolve. A CLOSED set, and deliberately coarse.
+ *
+ *  - `invalid_handle`    — unknown, expired, or revoked. One code for all
+ *                          three: distinguishing them would tell a caller
+ *                          holding a guessed value whether it ever existed.
+ *  - `no_active_session` — the handle is good and the device has nothing live
+ *                          to mint for. The credential is NOT revoked; the
+ *                          browser re-authenticates and keeps its cookie.
+ */
+exports.browserHubErrorSchema = zod_1.z.enum(['invalid_handle', 'no_active_session']);
+/** Response of `POST /session/browser-hub/revoke`. Idempotent by construction. */
+exports.browserHubRevokeResponseSchema = zod_1.z.object({
+    revoked: zod_1.z.boolean(),
+});
+/* -------------------------------------------------------------------------- */
+/*  auth.oxy.so/hub/*  —  spoken by the IdP SPA                                */
+/* -------------------------------------------------------------------------- */
+/**
+ * What the SPA is allowed to know about the hub session.
+ *
+ * `signed_out` covers "no cookie", "cookie present but the handle no longer
+ * resolves" and "resolved, but the device has nothing live" — from the script's
+ * side those are one state, and collapsing them here is what stops a UI from
+ * branching on a distinction it must not act on.
+ *
+ * `active` carries the DIRECTORY and no credential. A switcher renders from it;
+ * nothing in it can be spent against the API. The bearer that produced it never
+ * left the edge.
+ */
+exports.hubSessionSchema = zod_1.z.discriminatedUnion('status', [
+    zod_1.z.object({ status: zod_1.z.literal('signed_out') }),
+    zod_1.z.object({ status: zod_1.z.literal('active'), directory: deviceDirectory_1.deviceDirectorySchema }),
+]);
+/** Request body of `POST /hub/claim` — the Commons approval lane's handoff. */
+exports.hubClaimRequestSchema = zod_1.z.object({
+    /**
+     * The secret `sessionToken` of an approved `AuthSession`, held only by the
+     * page that created it. The edge spends it server-side: the access token and
+     * device secret the claim yields are consumed to establish the hub and are
+     * then discarded, so neither is ever returned to the script.
+     */
+    sessionToken: zod_1.z.string().min(1),
+});
+/** Request body of `POST /hub/activate` — pick the globally active context. */
+exports.hubActivateRequestSchema = zod_1.z.object({
+    contextId: zod_1.z.string().min(1),
+});
+/**
+ * Request body of `POST /hub/authorize` — a later official origin joining.
+ *
+ * There is no `prompt` field, and that is not an omission. `'none'` is absent
+ * from `buildOAuthAuthorizeUrl`'s union in `@oxyhq/core` precisely so a silent
+ * loop cannot be rebuilt in one line, and this endpoint would be the second
+ * place to rebuild it. A caller that needs a login or consent prompt gets one
+ * by not passing `approve`.
+ */
+exports.hubAuthorizeRequestSchema = zod_1.z.object({
+    clientId: zod_1.z.string().min(1),
+    redirectUri: zod_1.z.string().url(),
+    state: zod_1.z.string().optional(),
+    codeChallenge: zod_1.z.string().min(1),
+    /** S256 only. `plain` is refused before the request leaves the edge. */
+    codeChallengeMethod: zod_1.z.literal('S256'),
+    scope: zod_1.z.string().optional(),
+    /**
+     * The user's explicit answer on the consent screen.
+     *
+     * Absent or `false` means "tell me whether consent is needed"; the edge then
+     * returns `consent_required` and mints nothing. Only `true` may mint, and only
+     * the consent screen's own button sends it — which is why the decision of
+     * WHETHER consent is required is re-read from the server on both passes rather
+     * than remembered from the first.
+     */
+    approve: zod_1.z.boolean().optional(),
+});
+/**
+ * Result of `POST /hub/authorize`.
+ *
+ * `signed_out` is the honest answer for a browser with no hub session: the SPA
+ * runs the ordinary Commons-first authentication and tries again. It is never a
+ * redirect the edge performs on the browser's behalf — no automatic chain
+ * across Oxy origins, and nothing here can be hidden inside an iframe.
+ */
+exports.hubAuthorizeResultSchema = zod_1.z.discriminatedUnion('status', [
+    zod_1.z.object({ status: zod_1.z.literal('signed_out') }),
+    zod_1.z.object({
+        status: zod_1.z.literal('consent_required'),
+        reason: zod_1.z.enum(['new', 'scope_changed']),
+        userConsentScopes: zod_1.z.array(zod_1.z.string()).optional(),
+    }),
+    zod_1.z.object({
+        status: zod_1.z.literal('code'),
+        code: zod_1.z.string().min(1),
+        state: zod_1.z.string().nullable(),
+        redirectUri: zod_1.z.string(),
+        expiresIn: zod_1.z.number().int().positive(),
+    }),
+]);

package/dist/cjs/deviceDirectory.js

@@ -0,0 +1,189 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deviceDirectorySyncSchema = exports.deviceActivateResponseSchema = exports.deviceActivateRequestSchema = exports.deviceDirectorySchema = exports.devicePrincipalSchema = exports.deviceAccountContextSchema = exports.deviceDirectoryProfileSchema = exports.deviceContextRelationshipSchema = void 0;
+const zod_1 = require("zod");
+const accountGraph_1 = require("./accountGraph");
+const deviceSession_1 = require("./deviceSession");
+const userResponse_1 = require("./userResponse");
+/**
+ * The canonical device directory — the ONE server-authoritative read model an
+ * account switcher renders (issue #937, ADR 0002).
+ *
+ * It replaces the client-side union of `DeviceSessionState.accounts[]` with a
+ * separately fetched `AccountNode[]` graph. That union cannot be correct on a
+ * device holding more than one person: the client only ever holds ONE caller's
+ * account graph, so it cannot enumerate what the OTHER principals may act as.
+ * Switchability is an authorization question, so the server answers it.
+ *
+ * The directory is deterministic and revision-bound: two reads at the same
+ * `revision` describe the same device state, and `revision` only advances on a
+ * real mutation (an idempotent activation advances nothing — ADR 0002).
+ */
+/**
+ * How a principal reaches an account.
+ *
+ * Mirrors `AccountRelationship` in `@oxyhq/core`'s account graph rather than
+ * inventing a second vocabulary for the same fact:
+ *  - `self`   — the principal's own personal account (`principal.userId === accountId`)
+ *  - `owner`  — the principal owns this account
+ *  - `member` — the principal holds a membership granting `account:act_as`
+ */
+exports.deviceContextRelationshipSchema = zod_1.z.enum(['self', 'owner', 'member']);
+/**
+ * Sanitized display metadata for a principal or an account context.
+ *
+ * Deliberately NOT `userResponseSchema`: a switcher needs a handle, a name, an
+ * avatar and the accent the row is drawn in, and the directory is read by every
+ * app on the device — so it carries the minimum that renders a row and nothing
+ * that would make it a general profile feed. `name.displayName` stays OPTIONAL;
+ * consumers fall back to the handle (`getNormalizedUserHandle`), never to a
+ * synthesized name.
+ *
+ * `color` is here and `email` is not, and the line between them is what the
+ * field is FOR rather than how sensitive it looks. An accent is a property of
+ * drawing the row — without it every non-active row falls back to the ambient
+ * theme accent and a device holding two people renders them identically
+ * (issue #961). An address is somebody's contact detail, and the `@handle` the
+ * secondary line already shows fills the same slot, so putting one in a payload
+ * every installed app reads would widen the profile for no rendering gain.
+ */
+exports.deviceDirectoryProfileSchema = zod_1.z.object({
+    id: zod_1.z.string().min(1),
+    username: zod_1.z.string(),
+    name: userResponse_1.userNameSchema.optional(),
+    avatar: zod_1.z.string().nullable().optional(),
+    /**
+     * Named Bloom color preset (e.g. `"blue"`), or null when the account has
+     * none. Same shape as `userResponseSchema.color` — one spelling of one fact,
+     * so a consumer that themes a row from either source reads the same values.
+     */
+    color: zod_1.z.string().nullable().optional(),
+});
+/**
+ * One `principal acting as account` pair — the globally switchable unit.
+ *
+ * `id` is the identifier `POST /session/device/activate` takes. It names the
+ * PAIR, not the account: the same `accountId` legitimately appears under two
+ * principals on a shared device, and those are different sessions, permissions,
+ * audit actors and revocation paths.
+ *
+ * `onDevice` is `false` for a context the principal may act as but has never
+ * activated here — it exists as a row so it has a stable id to activate, and
+ * its delegated session is minted on first activation rather than eagerly for
+ * every organization the principal belongs to.
+ *
+ * `available` is `principalLive && (personal || live account:act_as)`, and the
+ * principal clause is not decoration: a principal whose own personal session
+ * has died makes EVERY context of theirs unavailable, including delegated ones
+ * whose sessions are perfectly alive. Activation verifies the principal's
+ * personal session (ADR 0002 step 3), so a client that models availability as
+ * "delegated context has a live session ⇒ activatable" will be refused by the
+ * server and the context healed away.
+ *
+ * A managed account whose membership was revoked is returned with
+ * `available: false` rather than silently omitted, so the UI can explain a row
+ * disappearing instead of just dropping it.
+ *
+ * (An earlier version of this comment described `available` as the
+ * `account:act_as` verdict alone. It was written before the server existed and
+ * was weaker than the code that shipped — the kind of wrong statement nothing
+ * recomputes, so it is spelled out here in full.)
+ */
+exports.deviceAccountContextSchema = zod_1.z.object({
+    id: zod_1.z.string().min(1),
+    accountId: zod_1.z.string().min(1),
+    kind: accountGraph_1.accountKindSchema,
+    relationship: exports.deviceContextRelationshipSchema,
+    account: exports.deviceDirectoryProfileSchema,
+    onDevice: zod_1.z.boolean(),
+    available: zod_1.z.boolean(),
+    active: zod_1.z.boolean(),
+    lastUsedAt: zod_1.z.number().nullable(),
+});
+/**
+ * A human who authenticated onto this device.
+ *
+ * Never an organization, project, channel or bot — those are subjects a
+ * principal acts as, and they appear only in `contexts`. `authuser` is the
+ * Google-style signed-in-human slot and belongs HERE, not to an account: adding
+ * an organization must never consume one.
+ */
+exports.devicePrincipalSchema = zod_1.z.object({
+    id: zod_1.z.string().min(1),
+    userId: zod_1.z.string().min(1),
+    authuser: zod_1.z.number().int().nonnegative(),
+    user: exports.deviceDirectoryProfileSchema,
+    contexts: zod_1.z.array(exports.deviceAccountContextSchema),
+});
+/**
+ * Response of `GET /session/device/directory`.
+ *
+ * `activeContextId` is the authority for what every official app in
+ * `sessionMode: 'account'` renders. It is null when the device has no active
+ * context — a real state (every context removed, or an active context healed
+ * away), not an error.
+ */
+exports.deviceDirectorySchema = zod_1.z.object({
+    deviceId: zod_1.z.string().min(1),
+    revision: zod_1.z.number().int().nonnegative(),
+    activeContextId: zod_1.z.string().nullable(),
+    principals: zod_1.z.array(exports.devicePrincipalSchema),
+    updatedAt: zod_1.z.number(),
+});
+/**
+ * Request body of `POST /session/device/activate`.
+ *
+ * `contextId`, never `accountId`: an account id cannot name a context on a
+ * device where two people can both reach the same organization, and resolving
+ * that ambiguity server-side would mean guessing inside an authorization path.
+ */
+exports.deviceActivateRequestSchema = zod_1.z.object({
+    contextId: zod_1.z.string().min(1),
+});
+/**
+ * Response of `POST /session/device/activate`.
+ *
+ * Carries the post-transition directory AND the bearer for the newly active
+ * context, because the client's ordering invariant is
+ * `commit token → reset caches → publish snapshot → notify` (ADR 0002). Handing
+ * the directory back without the token would force a second round trip in the
+ * middle of that sequence, which is exactly where a component would render the
+ * new subject while still holding the previous subject's bearer.
+ *
+ * `activeToken` is null when the activation legitimately produced no bearer for
+ * THIS caller — an identity-pinned client, or a caller whose application is not
+ * entitled to a token for the new context. It is never an error signal.
+ */
+exports.deviceActivateResponseSchema = zod_1.z.object({
+    directory: exports.deviceDirectorySchema,
+    activeToken: deviceSession_1.activeTokenSchema.nullable(),
+});
+/**
+ * Response of the CONTEXT-aware removals — `POST /session/device/signout` with
+ * `{ contextId }` (one `principal → account` pair) or `{ principalId }` (one
+ * person and every context they reach, and nobody else's).
+ *
+ * It carries BOTH halves because a removal elects a replacement active context,
+ * so both the directory and the flat compatibility projection move in the same
+ * transition — and a client that learned only one of them would render one
+ * half of a device that no longer exists.
+ *
+ * This is deliberately NOT {@link deviceSessionSyncSchema} and must never be
+ * merged into it. A zod object strips unknown keys, so `{directory, state,
+ * activeToken}` parses cleanly as `{state, activeToken}` — silently dropping the
+ * directory. One schema covering both shapes would therefore make "the server
+ * stopped sending the directory" and "this endpoint never sends one"
+ * indistinguishable at the parse, on the exact path that decides which identity
+ * the app is running as. Two schemas fail closed instead: `directory` is
+ * required here, so a directory-less payload is refused outright.
+ *
+ * `activeToken` is null on the same terms as everywhere else — an identity-
+ * pinned caller, or one not entitled to a bearer for the newly-elected context —
+ * and null is also the honest answer when the removal left the device with no
+ * active context at all.
+ */
+exports.deviceDirectorySyncSchema = zod_1.z.object({
+    directory: exports.deviceDirectorySchema,
+    state: deviceSession_1.deviceSessionStateSchema,
+    activeToken: deviceSession_1.activeTokenSchema.nullable(),
+});

package/dist/cjs/index.js

@@ -14,8 +14,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.appInterestInputSchema = exports.appEndorsementInputSchema = exports.recommendationResponseSchema = exports.recommendationItemSchema = exports.recommendationCountSchema = exports.recommendationRequestSchema = exports.recommendationSignalWeightsSchema = exports.recommendationBoostSchema = exports.recommendationExcludeTypeSchema = exports.oxyUserInvalidationEventSchema = exports.isPublishedOxyUserChangeReason = exports.OXY_PUBLISHED_USER_CHANGE_REASONS = exports.OXY_USER_CHANGE_REASONS = exports.OXY_USER_INVALIDATION_CHANNEL = exports.inboxEmailPushDataSchema = exports.INBOX_EMAIL_PUSH_TYPE = exports.INBOX_EMAIL_PUSH_CHANNEL = exports.IDENTITY_APPROVAL_PUSH_CHANNEL = exports.commonsDenyReasonSchema = exports.COMMONS_DENY_REASONS = exports.sessionStatusSchema = exports.publicApplicationSchema = exports.applicationTypeSchema = exports.safeParseContract = exports.resolveUserId = exports.deviceLinkedSessionsResponseSchema = exports.deviceLinkedSessionSchema = exports.currentUserResponseSchema = exports.userProfileUpdateSchema = exports.userResponseSchema = exports.themePreferenceSchema = exports.userRelationshipSchema = exports.userNameSchema = exports.createAccountRequestSchema = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.RETIRED_ACCOUNT_CATEGORY_IDS = exports.newlyAddedRetiredCategories = exports.MAX_ACCOUNT_CATEGORIES = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.accountCategoryIdSchema = exports.accountCategoriesSchema = exports.ACCOUNT_CATEGORY_KINDS = exports.ACCOUNT_CATEGORY_IDS = exports.isActAsEligibleKind = exports.isAccountKind = exports.childAccountKindSchema = exports.CHILD_ACCOUNT_KINDS = exports.accountKindSchema = exports.ACCOUNT_KINDS = void 0;
 exports.reputationBalanceBreakdownSchema = exports.reputationTransactionSchema = exports.reputationInfluenceContextSchema = exports.reputationDisputeStatusSchema = exports.reputationTargetEntityTypeSchema = exports.trustTierSchema = exports.reputationTransactionStatusSchema = exports.reputationCategorySchema = exports.REPUTATION_INFLUENCE_CONTEXTS = exports.REPUTATION_DISPUTE_STATUSES = exports.REPUTATION_TARGET_ENTITY_TYPES = exports.TRUST_TIERS = exports.REPUTATION_TRANSACTION_STATUSES = exports.REPUTATION_CATEGORIES = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = exports.vouchResultSchema = exports.personhoodStatusResultSchema = exports.personhoodBreakdownSchema = exports.personhoodVouchRecordSchema = exports.validationVoteResultSchema = exports.validationRequestSummarySchema = exports.validationOpenResultSchema = exports.validationOpenRequestSchema = exports.validationVerdictRecordSchema = exports.realLifeAttestationResultSchema = exports.realLifeAttestationRecordSchema = exports.signedPublicCardSchema = exports.publicCardSchema = exports.logPageResponseSchema = exports.chainHeadResponseSchema = exports.oxySignedRecordTypeSchema = exports.exportBundleSchema = exports.exportAttestationSchema = exports.authMethodsResponseSchema = exports.authMethodEntrySchema = exports.domainVerificationInstructionsSchema = exports.domainVerificationRequestSchema = exports.verifiedDomainSchema = exports.signedRecordEnvelopeSchema = exports.didDocumentSchema = exports.didServiceSchema = exports.verificationMethodSchema = exports.appAffinityEventsIngestSchema = exports.appAffinityEventSchema = exports.appAffinityEventTypeSchema = exports.appUserSignalIngestSchema = void 0;
 exports.reverseModerationEffectSchema = exports.finalizeModerationDecisionSchema = exports.moderationDecisionEventSchema = exports.moderationPolicyVersionsSchema = exports.moderationDecisionEventSubjectSchema = exports.moderationFindingSchema = exports.applicationModerationStandingSchema = exports.identityBindingStatusSchema = exports.identityBindingTypeSchema = exports.personhoodStatusSchema = exports.contributionTierSchema = exports.conductStandingSchema = exports.conductStrikeStatusSchema = exports.moderationEffectSkipReasonSchema = exports.moderationEffectStatusSchema = exports.moderationEffectTypeSchema = exports.moderationDecisionStatusSchema = exports.moderationAttributionSchema = exports.moderationFindingScopeSchema = exports.moderationSeveritySchema = exports.APPLICATION_MODERATION_STANDINGS = exports.IDENTITY_BINDING_STATUSES = exports.IDENTITY_BINDING_TYPES = exports.PERSONHOOD_STATUSES = exports.CONTRIBUTION_TIERS = exports.CONDUCT_STANDINGS = exports.CONDUCT_STRIKE_STATUSES = exports.MODERATION_EFFECT_SKIP_REASONS = exports.MODERATION_EFFECT_STATUSES = exports.MODERATION_EFFECT_TYPES = exports.MODERATION_DECISION_STATUSES = exports.MODERATION_ATTRIBUTIONS = exports.MODERATION_FINDING_SCOPES = exports.MODERATION_SEVERITIES = exports.isFullReputationBalance = exports.reverseReputationTransactionSchema = exports.upsertReputationRuleSchema = exports.resolveReputationDisputeSchema = exports.createReputationDisputeSchema = exports.awardReputationSchema = exports.reverseReputationTransactionResultSchema = exports.reputationInfluenceResultSchema = exports.reputationLeaderboardEntrySchema = exports.reputationLeaderboardUserSchema = exports.reputationRuleSchema = exports.reputationDisputeSchema = exports.reputationBalanceSchema = exports.reputationBalanceSummarySchema = exports.reputationReliabilitySchema = exports.reputationInfluenceSchema = void 0;
-exports.assetCompleteResponseSchema = exports.assetCompleteResultItemSchema = exports.assetCompleteRequestSchema = exports.assetInitResponseSchema = exports.assetUploadTicketSchema = exports.assetInitRequestSchema = exports.assetInitItemSchema = exports.rolloutPercentSchema = exports.runtimeVersionSchema = exports.channelNameSchema = exports.sha256HexSchema = exports.updateAssetStatusSchema = exports.updateStatusSchema = exports.updatePlatformSchema = exports.backupStatusResponseSchema = exports.backupUploadRequestSchema = exports.encryptedBackupEnvelopeSchema = exports.backupLookupIdSchema = exports.rotateKeyCompleteResponseSchema = exports.rotateKeyCompleteRequestSchema = exports.rotateKeyChallengeResponseSchema = exports.loginResultSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceBackgroundTokenResponseSchema = exports.deviceBackgroundTokenRequestSchema = exports.deviceBackgroundCredentialResponseSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.linkPreviewResponseSchema = exports.linkPreviewBatchResponseSchema = exports.linkPreviewBatchRequestSchema = exports.linkPreviewSchema = exports.applicationModerationTrustSchema = exports.reputationContextualInfluenceSchema = exports.reputationReviewingSchema = exports.reputationReportingSchema = exports.reputationConductSchema = exports.reputationContributionSchema = exports.reputationPersonhoodSchema = exports.identityBindingSchema = exports.registerIdentityBindingSchema = exports.reverseModerationEffectResultSchema = exports.applyModerationDecisionResultSchema = exports.moderationEffectSchema = void 0;
-exports.transparencyCheckpointListSchema = exports.transparencyInclusionProofSchema = exports.transparencyCheckpointSchema = exports.transparencyAnchorSchema = exports.transparencyCheckpointSignatureSchema = exports.deviceTransferDenyResponseSchema = exports.deviceTransferApproveResponseSchema = exports.deviceTransferApproveRequestSchema = exports.deviceTransferInfoResponseSchema = exports.deviceTransferInitResponseSchema = exports.deviceTransferInitRequestSchema = exports.devicePairingStatusSchema = exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.updateRolloutPatchSchema = exports.promoteRequestSchema = exports.rollbackToEmbeddedRequestSchema = exports.rollbackRequestSchema = exports.updateListResponseSchema = exports.channelListResponseSchema = exports.channelSchema = exports.rollbackToEmbeddedEntrySchema = exports.createUpdateResponseSchema = exports.updateSchema = exports.createUpdateRequestSchema = exports.updateAssetRefSchema = void 0;
+exports.hubActivateRequestSchema = exports.hubClaimRequestSchema = exports.hubSessionSchema = exports.browserHubRevokeResponseSchema = exports.browserHubErrorSchema = exports.browserHubResolveResponseSchema = exports.browserHubHandleResponseSchema = exports.browserHubHandleRequestSchema = exports.browserHubHandleSchema = exports.BROWSER_HUB_HANDLE_TTL_MS = exports.BROWSER_HUB_COOKIE_ATTRIBUTES = exports.BROWSER_HUB_COOKIE_NAME = exports.oauthAuthorizeCodeResponseSchema = exports.oauthConsentDecisionSchema = exports.deviceDirectorySyncSchema = exports.deviceActivateResponseSchema = exports.deviceActivateRequestSchema = exports.deviceDirectorySchema = exports.devicePrincipalSchema = exports.deviceAccountContextSchema = exports.deviceDirectoryProfileSchema = exports.deviceContextRelationshipSchema = exports.sessionAccountsChangedEventSchema = exports.sessionAccountsChangedReasonSchema = exports.SESSION_ACCOUNTS_CHANGED_EVENT = exports.deviceBackgroundTokenResponseSchema = exports.deviceBackgroundTokenRequestSchema = exports.deviceBackgroundCredentialResponseSchema = exports.deviceTokenMintResponseSchema = exports.deviceTokenMintRequestSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.linkPreviewResponseSchema = exports.linkPreviewBatchResponseSchema = exports.linkPreviewBatchRequestSchema = exports.linkPreviewSchema = exports.applicationModerationTrustSchema = exports.reputationContextualInfluenceSchema = exports.reputationReviewingSchema = exports.reputationReportingSchema = exports.reputationConductSchema = exports.reputationContributionSchema = exports.reputationPersonhoodSchema = exports.identityBindingSchema = exports.registerIdentityBindingSchema = exports.reverseModerationEffectResultSchema = exports.applyModerationDecisionResultSchema = exports.moderationEffectSchema = void 0;
+exports.transparencyCheckpointSchema = exports.transparencyAnchorSchema = exports.transparencyCheckpointSignatureSchema = exports.deviceTransferDenyResponseSchema = exports.deviceTransferApproveResponseSchema = exports.deviceTransferApproveRequestSchema = exports.deviceTransferInfoResponseSchema = exports.deviceTransferInitResponseSchema = exports.deviceTransferInitRequestSchema = exports.devicePairingStatusSchema = exports.webauthnLoginVerifyRequestSchema = exports.webauthnRegisterVerifyRequestSchema = exports.webauthnLoginOptionsRequestSchema = exports.webauthnRegisterOptionsRequestSchema = exports.updateRolloutPatchSchema = exports.promoteRequestSchema = exports.rollbackToEmbeddedRequestSchema = exports.rollbackRequestSchema = exports.updateListResponseSchema = exports.channelListResponseSchema = exports.channelSchema = exports.rollbackToEmbeddedEntrySchema = exports.createUpdateResponseSchema = exports.updateSchema = exports.createUpdateRequestSchema = exports.updateAssetRefSchema = exports.assetCompleteResponseSchema = exports.assetCompleteResultItemSchema = exports.assetCompleteRequestSchema = exports.assetInitResponseSchema = exports.assetUploadTicketSchema = exports.assetInitRequestSchema = exports.assetInitItemSchema = exports.rolloutPercentSchema = exports.runtimeVersionSchema = exports.channelNameSchema = exports.sha256HexSchema = exports.updateAssetStatusSchema = exports.updateStatusSchema = exports.updatePlatformSchema = exports.backupStatusResponseSchema = exports.backupUploadRequestSchema = exports.encryptedBackupEnvelopeSchema = exports.backupLookupIdSchema = exports.rotateKeyCompleteResponseSchema = exports.rotateKeyCompleteRequestSchema = exports.rotateKeyChallengeResponseSchema = exports.loginResultSchema = exports.hubAuthorizeResultSchema = exports.hubAuthorizeRequestSchema = void 0;
+exports.transparencyCheckpointListSchema = exports.transparencyInclusionProofSchema = void 0;
 var accountGraph_1 = require("./accountGraph");
 Object.defineProperty(exports, "ACCOUNT_KINDS", { enumerable: true, get: function () { return accountGraph_1.ACCOUNT_KINDS; } });
 Object.defineProperty(exports, "accountKindSchema", { enumerable: true, get: function () { return accountGraph_1.accountKindSchema; } });
@@ -234,6 +235,33 @@ Object.defineProperty(exports, "deviceBackgroundTokenResponseSchema", { enumerab
 Object.defineProperty(exports, "SESSION_ACCOUNTS_CHANGED_EVENT", { enumerable: true, get: function () { return deviceSession_1.SESSION_ACCOUNTS_CHANGED_EVENT; } });
 Object.defineProperty(exports, "sessionAccountsChangedReasonSchema", { enumerable: true, get: function () { return deviceSession_1.sessionAccountsChangedReasonSchema; } });
 Object.defineProperty(exports, "sessionAccountsChangedEventSchema", { enumerable: true, get: function () { return deviceSession_1.sessionAccountsChangedEventSchema; } });
+var deviceDirectory_1 = require("./deviceDirectory");
+Object.defineProperty(exports, "deviceContextRelationshipSchema", { enumerable: true, get: function () { return deviceDirectory_1.deviceContextRelationshipSchema; } });
+Object.defineProperty(exports, "deviceDirectoryProfileSchema", { enumerable: true, get: function () { return deviceDirectory_1.deviceDirectoryProfileSchema; } });
+Object.defineProperty(exports, "deviceAccountContextSchema", { enumerable: true, get: function () { return deviceDirectory_1.deviceAccountContextSchema; } });
+Object.defineProperty(exports, "devicePrincipalSchema", { enumerable: true, get: function () { return deviceDirectory_1.devicePrincipalSchema; } });
+Object.defineProperty(exports, "deviceDirectorySchema", { enumerable: true, get: function () { return deviceDirectory_1.deviceDirectorySchema; } });
+Object.defineProperty(exports, "deviceActivateRequestSchema", { enumerable: true, get: function () { return deviceDirectory_1.deviceActivateRequestSchema; } });
+Object.defineProperty(exports, "deviceActivateResponseSchema", { enumerable: true, get: function () { return deviceDirectory_1.deviceActivateResponseSchema; } });
+Object.defineProperty(exports, "deviceDirectorySyncSchema", { enumerable: true, get: function () { return deviceDirectory_1.deviceDirectorySyncSchema; } });
+var oauth_1 = require("./oauth");
+Object.defineProperty(exports, "oauthConsentDecisionSchema", { enumerable: true, get: function () { return oauth_1.oauthConsentDecisionSchema; } });
+Object.defineProperty(exports, "oauthAuthorizeCodeResponseSchema", { enumerable: true, get: function () { return oauth_1.oauthAuthorizeCodeResponseSchema; } });
+var browserHub_1 = require("./browserHub");
+Object.defineProperty(exports, "BROWSER_HUB_COOKIE_NAME", { enumerable: true, get: function () { return browserHub_1.BROWSER_HUB_COOKIE_NAME; } });
+Object.defineProperty(exports, "BROWSER_HUB_COOKIE_ATTRIBUTES", { enumerable: true, get: function () { return browserHub_1.BROWSER_HUB_COOKIE_ATTRIBUTES; } });
+Object.defineProperty(exports, "BROWSER_HUB_HANDLE_TTL_MS", { enumerable: true, get: function () { return browserHub_1.BROWSER_HUB_HANDLE_TTL_MS; } });
+Object.defineProperty(exports, "browserHubHandleSchema", { enumerable: true, get: function () { return browserHub_1.browserHubHandleSchema; } });
+Object.defineProperty(exports, "browserHubHandleRequestSchema", { enumerable: true, get: function () { return browserHub_1.browserHubHandleRequestSchema; } });
+Object.defineProperty(exports, "browserHubHandleResponseSchema", { enumerable: true, get: function () { return browserHub_1.browserHubHandleResponseSchema; } });
+Object.defineProperty(exports, "browserHubResolveResponseSchema", { enumerable: true, get: function () { return browserHub_1.browserHubResolveResponseSchema; } });
+Object.defineProperty(exports, "browserHubErrorSchema", { enumerable: true, get: function () { return browserHub_1.browserHubErrorSchema; } });
+Object.defineProperty(exports, "browserHubRevokeResponseSchema", { enumerable: true, get: function () { return browserHub_1.browserHubRevokeResponseSchema; } });
+Object.defineProperty(exports, "hubSessionSchema", { enumerable: true, get: function () { return browserHub_1.hubSessionSchema; } });
+Object.defineProperty(exports, "hubClaimRequestSchema", { enumerable: true, get: function () { return browserHub_1.hubClaimRequestSchema; } });
+Object.defineProperty(exports, "hubActivateRequestSchema", { enumerable: true, get: function () { return browserHub_1.hubActivateRequestSchema; } });
+Object.defineProperty(exports, "hubAuthorizeRequestSchema", { enumerable: true, get: function () { return browserHub_1.hubAuthorizeRequestSchema; } });
+Object.defineProperty(exports, "hubAuthorizeResultSchema", { enumerable: true, get: function () { return browserHub_1.hubAuthorizeResultSchema; } });
 var deviceBoot_1 = require("./deviceBoot");
 // Schemas
 Object.defineProperty(exports, "loginResultSchema", { enumerable: true, get: function () { return deviceBoot_1.loginResultSchema; } });

package/dist/cjs/oauth.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthAuthorizeCodeResponseSchema = exports.oauthConsentDecisionSchema = void 0;
+const zod_1 = require("zod");
+/**
+ * The two `/auth/oauth/*` responses the browser hub's edge layer reads.
+ *
+ * They existed on the wire long before this file — `GET /auth/oauth/consent`
+ * and `POST /auth/oauth/authorize` are the surface `auth.oxy.so` has always
+ * driven with a bearer. What is new (issue #937 Phase 5) is a SECOND consumer
+ * that is not the SPA: the IdP's edge layer runs both calls server-side so the
+ * device-wide bearer never enters the browser's script context. A shape read by
+ * two independently deployed consumers is a contract, so it is written down
+ * once here and validated on both sides rather than transcribed into the edge.
+ *
+ * These are NOT the RFC 6749 token/userinfo responses. Those two speak flat
+ * OAuth/OIDC on the wire and are the one place in the API that does not use the
+ * `{ data }` envelope; these two are ordinary internal API responses that happen
+ * to be about OAuth.
+ */
+/**
+ * Server-authoritative answer to "must this user be shown a consent screen".
+ *
+ * Discriminated on `consentRequired` so the two arms cannot be confused by a
+ * consumer that reads `reason` first: `trusted`/`granted` are reasons NOT to
+ * ask, `new`/`scope_changed` are reasons to ask, and a flat object would let a
+ * typo in one produce a plausible value of the other.
+ *
+ *  - `trusted`       — the application is first-party/internal/system/official
+ *                      by the REGISTRY's verdict (`isTrustedApplication`), and
+ *                      the request names no scope over the user's own follow
+ *                      graph. Never inferred from a hostname.
+ *  - `granted`       — a prior `AppGrant` already covers every requested scope.
+ *  - `scope_changed` — a prior grant exists and is missing one.
+ *  - `new`           — no prior grant.
+ *
+ * `userConsentScopes` names the scopes that FORCED the screen, so the consent UI
+ * can say which one it is asking about. Present only on the `true` arm, and only
+ * when such a scope exists — a trusted app asked for one is still asked.
+ */
+exports.oauthConsentDecisionSchema = zod_1.z.discriminatedUnion('consentRequired', [
+    zod_1.z.object({
+        consentRequired: zod_1.z.literal(false),
+        reason: zod_1.z.enum(['trusted', 'granted']),
+    }),
+    zod_1.z.object({
+        consentRequired: zod_1.z.literal(true),
+        reason: zod_1.z.enum(['new', 'scope_changed']),
+        userConsentScopes: zod_1.z.array(zod_1.z.string()).optional(),
+    }),
+]);
+/**
+ * A minted authorization code.
+ *
+ * `state` is echoed back as the caller sent it and is `null` when they sent
+ * none — never omitted, so a consumer cannot read "the server dropped my state"
+ * as "I sent none". `redirectUri` is echoed for the same reason the code is
+ * bound to it server-side: the caller must be able to see that the value the
+ * code was issued against is the one it registered.
+ */
+exports.oauthAuthorizeCodeResponseSchema = zod_1.z.object({
+    code: zod_1.z.string().min(1),
+    state: zod_1.z.string().nullable(),
+    redirectUri: zod_1.z.string(),
+    expiresIn: zod_1.z.number().int().positive(),
+});