@oxyhq/contracts 0.9.0 → 0.10.0

package/dist/cjs/deviceBoot.js

@@ -35,7 +35,7 @@
  * `require()`).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deviceResolveResponseSchema = exports.deviceResolveRequestSchema = exports.loginResultSchema = exports.deviceTokenIssueResponseSchema = exports.tokenRefreshResponseSchema = exports.tokenRefreshRequestSchema = exports.authTokenBundleSchema = exports.deviceExchangeRequestSchema = exports.deviceBootFragmentSchema = exports.deviceBootReasonSchema = void 0;
+exports.deviceResolveResponseSchema = exports.deviceResolveRequestSchema = exports.loginResultSchema = exports.deviceTokenIssueResponseSchema = exports.tokenRefreshResponseSchema = exports.tokenRefreshRequestSchema = exports.webSessionResultSchema = exports.authTokenBundleSchema = exports.deviceExchangeRequestSchema = exports.deviceBootFragmentSchema = exports.deviceBootReasonSchema = void 0;
 const zod_1 = require("zod");
 const userResponse_1 = require("./userResponse");
 /* -------------------------------------------------------------------------- */
@@ -51,17 +51,36 @@ const userResponse_1 = require("./userResponse");
 exports.deviceBootReasonSchema = zod_1.z.enum(['session', 'no_session', 'new_device']);
 /**
  * The `#oxy_boot=<json>` fragment `GET /auth/device/bootstrap` appends to the
- * `return_to` URL. Carries the CSRF `state` echo, the resolution `reason`, an
- * optional single-use exchange `code` (present iff `reason === 'session'`), and
- * the opaque `deviceToken`. NEVER carries tokens or a deviceId.
+ * `return_to` URL. Carries the CSRF `state` echo, the resolution `reason`, the
+ * opaque `deviceToken`, and — ONLY on the `session` arm — the single-use
+ * exchange `code`. NEVER carries tokens or a deviceId.
+ *
+ * Discriminated on `reason` so the code↔reason coupling is enforced by the
+ * schema, not by the consumer: the `session` arm REQUIRES `code`, and the
+ * `no_session` / `new_device` arms omit it (a stray `code` on those arms is
+ * stripped). A `session` fragment WITHOUT a code therefore fails to parse and
+ * is treated as "no usable fragment" rather than half-processed.
  */
-exports.deviceBootFragmentSchema = zod_1.z.object({
+const deviceBootFragmentBase = {
     v: zod_1.z.literal(1),
     state: zod_1.z.string().min(1).max(256),
-    reason: exports.deviceBootReasonSchema,
-    code: zod_1.z.string().min(20).max(128).optional(),
     deviceToken: zod_1.z.string().min(20).max(512),
-});
+};
+exports.deviceBootFragmentSchema = zod_1.z.discriminatedUnion('reason', [
+    zod_1.z.object({
+        ...deviceBootFragmentBase,
+        reason: zod_1.z.literal('session'),
+        code: zod_1.z.string().min(20).max(128),
+    }),
+    zod_1.z.object({
+        ...deviceBootFragmentBase,
+        reason: zod_1.z.literal('no_session'),
+    }),
+    zod_1.z.object({
+        ...deviceBootFragmentBase,
+        reason: zod_1.z.literal('new_device'),
+    }),
+]);
 /* -------------------------------------------------------------------------- */
 /*  Boot-code exchange                                                        */
 /* -------------------------------------------------------------------------- */
@@ -76,6 +95,30 @@ exports.authTokenBundleSchema = zod_1.z.object({
     expiresAt: zod_1.z.string(),
     user: userResponse_1.userResponseSchema,
 });
+// Internal (unexported) arm schemas — PLAIN `z.object` literals (no
+// `z.ZodType<>` annotation) so `z.discriminatedUnion` can introspect the
+// `reason` discriminator. The node10 `.d.ts`-degradation safety comes from the
+// EXPORTED symbols instead: the public types are explicit interfaces
+// (`WebSessionSession` / `WebSessionNoSession` / `WebSessionResult`) and the
+// exported schema is annotated `z.ZodType<WebSessionResult>` below, so the
+// emitted declaration states the shape literally rather than a degradable
+// `z.infer<>` of the nested `session` object.
+const webSessionSessionSchema = zod_1.z.object({
+    reason: zod_1.z.literal('session'),
+    session: exports.authTokenBundleSchema,
+    deviceToken: zod_1.z.string().min(1),
+});
+const webSessionNoSessionSchema = zod_1.z.object({
+    reason: zod_1.z.enum(['no_session', 'new_device']),
+    deviceToken: zod_1.z.string().min(1),
+});
+// Discriminated on `reason` — a true `discriminatedUnion` (not `z.union`): it
+// dispatches on the discriminator instead of sequentially probing each arm,
+// giving precise per-arm errors.
+exports.webSessionResultSchema = zod_1.z.discriminatedUnion('reason', [
+    webSessionSessionSchema,
+    webSessionNoSessionSchema,
+]);
 /* -------------------------------------------------------------------------- */
 /*  Refresh-token rotation (web + native, one implementation)                 */
 /* -------------------------------------------------------------------------- */

package/dist/cjs/index.js

@@ -11,15 +11,13 @@
  * expo, no `require()` in the ESM build.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validationVoteResultSchema = exports.validationRequestSummarySchema = exports.validationOpenResultSchema = exports.validationOpenRequestSchema = exports.validationVerdictRecordSchema = exports.realLifeAttestationResultSchema = exports.realLifeAttestationRecordSchema = exports.signedPublicCardSchema = exports.publicCardSchema = exports.logPageResponseSchema = exports.chainHeadResponseSchema = exports.oxySignedRecordTypeSchema = exports.exportBundleSchema = exports.exportAttestationSchema = exports.authMethodsResponseSchema = exports.authMethodEntrySchema = exports.domainVerificationInstructionsSchema = exports.domainVerificationRequestSchema = exports.verifiedDomainSchema = exports.signedRecordEnvelopeSchema = exports.didDocumentSchema = exports.didServiceSchema = exports.verificationMethodSchema = exports.appAffinityEventsIngestSchema = exports.appAffinityEventSchema = exports.appAffinityEventTypeSchema = exports.appUserSignalIngestSchema = exports.appInterestInputSchema = exports.appEndorsementInputSchema = exports.recommendationResponseSchema = exports.recommendationItemSchema = exports.recommendationCountSchema = exports.recommendationRequestSchema = exports.recommendationSignalWeightsSchema = exports.recommendationBoostSchema = exports.recommendationExcludeTypeSchema = exports.fedcmTokenPayloadSchema = exports.sessionStatusSchema = exports.publicApplicationSchema = exports.applicationTypeSchema = exports.safeParseContract = exports.resolveUserId = exports.deviceSessionsResponseSchema = exports.deviceSessionAccountSchema = exports.currentUserResponseSchema = exports.refreshAllResponseSchema = exports.refreshAllAccountSchema = exports.userProfileUpdateSchema = exports.userResponseSchema = exports.userNameSchema = void 0;
-exports.deviceResolveResponseSchema = exports.deviceResolveRequestSchema = exports.loginResultSchema = exports.deviceTokenIssueResponseSchema = exports.tokenRefreshResponseSchema = exports.tokenRefreshRequestSchema = exports.authTokenBundleSchema = exports.deviceExchangeRequestSchema = exports.deviceBootFragmentSchema = exports.deviceBootReasonSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.linkPreviewResponseSchema = exports.linkPreviewBatchResponseSchema = exports.linkPreviewBatchRequestSchema = exports.linkPreviewSchema = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = exports.vouchResultSchema = exports.personhoodStatusResultSchema = exports.personhoodBreakdownSchema = exports.personhoodVouchRecordSchema = void 0;
+exports.personhoodBreakdownSchema = exports.personhoodVouchRecordSchema = exports.validationVoteResultSchema = exports.validationRequestSummarySchema = exports.validationOpenResultSchema = exports.validationOpenRequestSchema = exports.validationVerdictRecordSchema = exports.realLifeAttestationResultSchema = exports.realLifeAttestationRecordSchema = exports.signedPublicCardSchema = exports.publicCardSchema = exports.logPageResponseSchema = exports.chainHeadResponseSchema = exports.oxySignedRecordTypeSchema = exports.exportBundleSchema = exports.exportAttestationSchema = exports.authMethodsResponseSchema = exports.authMethodEntrySchema = exports.domainVerificationInstructionsSchema = exports.domainVerificationRequestSchema = exports.verifiedDomainSchema = exports.signedRecordEnvelopeSchema = exports.didDocumentSchema = exports.didServiceSchema = exports.verificationMethodSchema = exports.appAffinityEventsIngestSchema = exports.appAffinityEventSchema = exports.appAffinityEventTypeSchema = exports.appUserSignalIngestSchema = exports.appInterestInputSchema = exports.appEndorsementInputSchema = exports.recommendationResponseSchema = exports.recommendationItemSchema = exports.recommendationCountSchema = exports.recommendationRequestSchema = exports.recommendationSignalWeightsSchema = exports.recommendationBoostSchema = exports.recommendationExcludeTypeSchema = exports.fedcmTokenPayloadSchema = exports.sessionStatusSchema = exports.publicApplicationSchema = exports.applicationTypeSchema = exports.safeParseContract = exports.resolveUserId = exports.deviceSessionsResponseSchema = exports.deviceSessionAccountSchema = exports.currentUserResponseSchema = exports.userProfileUpdateSchema = exports.userResponseSchema = exports.userNameSchema = void 0;
+exports.deviceResolveResponseSchema = exports.deviceResolveRequestSchema = exports.loginResultSchema = exports.deviceTokenIssueResponseSchema = exports.tokenRefreshResponseSchema = exports.tokenRefreshRequestSchema = exports.webSessionResultSchema = exports.authTokenBundleSchema = exports.deviceExchangeRequestSchema = exports.deviceBootFragmentSchema = exports.deviceBootReasonSchema = exports.deviceSessionSyncSchema = exports.activeTokenSchema = exports.deviceSessionStateSchema = exports.sessionAccountSchema = exports.linkPreviewResponseSchema = exports.linkPreviewBatchResponseSchema = exports.linkPreviewBatchRequestSchema = exports.linkPreviewSchema = exports.credentialVerifyResultSchema = exports.credentialListResultSchema = exports.credentialIssueResultSchema = exports.verifiableCredentialResponseSchema = exports.credentialRecordSchema = exports.vouchResultSchema = exports.personhoodStatusResultSchema = void 0;
 var userResponse_1 = require("./userResponse");
 // Schemas
 Object.defineProperty(exports, "userNameSchema", { enumerable: true, get: function () { return userResponse_1.userNameSchema; } });
 Object.defineProperty(exports, "userResponseSchema", { enumerable: true, get: function () { return userResponse_1.userResponseSchema; } });
 Object.defineProperty(exports, "userProfileUpdateSchema", { enumerable: true, get: function () { return userResponse_1.userProfileUpdateSchema; } });
-Object.defineProperty(exports, "refreshAllAccountSchema", { enumerable: true, get: function () { return userResponse_1.refreshAllAccountSchema; } });
-Object.defineProperty(exports, "refreshAllResponseSchema", { enumerable: true, get: function () { return userResponse_1.refreshAllResponseSchema; } });
 Object.defineProperty(exports, "currentUserResponseSchema", { enumerable: true, get: function () { return userResponse_1.currentUserResponseSchema; } });
 Object.defineProperty(exports, "deviceSessionAccountSchema", { enumerable: true, get: function () { return userResponse_1.deviceSessionAccountSchema; } });
 Object.defineProperty(exports, "deviceSessionsResponseSchema", { enumerable: true, get: function () { return userResponse_1.deviceSessionsResponseSchema; } });
@@ -107,6 +105,7 @@ Object.defineProperty(exports, "deviceBootReasonSchema", { enumerable: true, get
 Object.defineProperty(exports, "deviceBootFragmentSchema", { enumerable: true, get: function () { return deviceBoot_1.deviceBootFragmentSchema; } });
 Object.defineProperty(exports, "deviceExchangeRequestSchema", { enumerable: true, get: function () { return deviceBoot_1.deviceExchangeRequestSchema; } });
 Object.defineProperty(exports, "authTokenBundleSchema", { enumerable: true, get: function () { return deviceBoot_1.authTokenBundleSchema; } });
+Object.defineProperty(exports, "webSessionResultSchema", { enumerable: true, get: function () { return deviceBoot_1.webSessionResultSchema; } });
 Object.defineProperty(exports, "tokenRefreshRequestSchema", { enumerable: true, get: function () { return deviceBoot_1.tokenRefreshRequestSchema; } });
 Object.defineProperty(exports, "tokenRefreshResponseSchema", { enumerable: true, get: function () { return deviceBoot_1.tokenRefreshResponseSchema; } });
 Object.defineProperty(exports, "deviceTokenIssueResponseSchema", { enumerable: true, get: function () { return deviceBoot_1.deviceTokenIssueResponseSchema; } });

package/dist/cjs/userResponse.js

@@ -32,7 +32,7 @@
  * `require()`).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deviceSessionsResponseSchema = exports.deviceSessionAccountSchema = exports.currentUserResponseSchema = exports.refreshAllResponseSchema = exports.refreshAllAccountSchema = exports.userProfileUpdateSchema = exports.userResponseSchema = exports.userNameSchema = void 0;
+exports.deviceSessionsResponseSchema = exports.deviceSessionAccountSchema = exports.currentUserResponseSchema = exports.userProfileUpdateSchema = exports.userResponseSchema = exports.userNameSchema = void 0;
 exports.resolveUserId = resolveUserId;
 exports.safeParseContract = safeParseContract;
 const zod_1 = require("zod");
@@ -111,7 +111,6 @@ exports.userProfileUpdateSchema = zod_1.z
     phone: zod_1.z.string().optional(),
     address: zod_1.z.string().optional(),
     birthday: zod_1.z.string().optional(),
-    location: zod_1.z.string().optional(),
     locations: zod_1.z.array(zod_1.z.unknown()).optional(),
     links: zod_1.z.array(zod_1.z.string()).optional(),
     linksMetadata: zod_1.z
@@ -137,28 +136,6 @@ exports.userProfileUpdateSchema = zod_1.z
 function resolveUserId(user) {
     return user.id ?? user._id;
 }
-/**
- * One rotated account entry from `POST /auth/refresh-all`.
- *
- * `authuser` is the device-local slot index (`0..N-1`). `user` is the canonical
- * {@link userResponseSchema} shape (the handler projects a whitelist and runs it
- * through `formatUserResponse`).
- */
-exports.refreshAllAccountSchema = zod_1.z.object({
-    authuser: zod_1.z.number().int().nonnegative(),
-    accessToken: zod_1.z.string(),
-    expiresAt: zod_1.z.string(),
-    sessionId: zod_1.z.string(),
-    user: exports.userResponseSchema,
-});
-/**
- * Wire shape of `POST /auth/refresh-all`: every valid device-local account,
- * sorted by `authuser` ascending. An empty `accounts` array means "no signed-in
- * accounts on this device" — the IdP must show the sign-in form.
- */
-exports.refreshAllResponseSchema = zod_1.z.object({
-    accounts: zod_1.z.array(exports.refreshAllAccountSchema),
-});
 /**
  * Wire shape of `GET /users/me` — the API success envelope (`{ data: <user> }`)
  * wrapping the current-user DTO. Some older producers use `_id` instead of