@oxyhq/contracts 0.9.0 → 0.9.1

package/dist/esm/deviceBoot.js

@@ -48,17 +48,36 @@ import { userResponseSchema } from './userResponse.js';
 export const deviceBootReasonSchema = z.enum(['session', 'no_session', 'new_device']);
 /**
  * The `#oxy_boot=<json>` fragment `GET /auth/device/bootstrap` appends to the
- * `return_to` URL. Carries the CSRF `state` echo, the resolution `reason`, an
- * optional single-use exchange `code` (present iff `reason === 'session'`), and
- * the opaque `deviceToken`. NEVER carries tokens or a deviceId.
+ * `return_to` URL. Carries the CSRF `state` echo, the resolution `reason`, the
+ * opaque `deviceToken`, and — ONLY on the `session` arm — the single-use
+ * exchange `code`. NEVER carries tokens or a deviceId.
+ *
+ * Discriminated on `reason` so the code↔reason coupling is enforced by the
+ * schema, not by the consumer: the `session` arm REQUIRES `code`, and the
+ * `no_session` / `new_device` arms omit it (a stray `code` on those arms is
+ * stripped). A `session` fragment WITHOUT a code therefore fails to parse and
+ * is treated as "no usable fragment" rather than half-processed.
  */
-export const deviceBootFragmentSchema = z.object({
+const deviceBootFragmentBase = {
     v: z.literal(1),
     state: z.string().min(1).max(256),
-    reason: deviceBootReasonSchema,
-    code: z.string().min(20).max(128).optional(),
     deviceToken: z.string().min(20).max(512),
-});
+};
+export const deviceBootFragmentSchema = z.discriminatedUnion('reason', [
+    z.object({
+        ...deviceBootFragmentBase,
+        reason: z.literal('session'),
+        code: z.string().min(20).max(128),
+    }),
+    z.object({
+        ...deviceBootFragmentBase,
+        reason: z.literal('no_session'),
+    }),
+    z.object({
+        ...deviceBootFragmentBase,
+        reason: z.literal('new_device'),
+    }),
+]);
 /* -------------------------------------------------------------------------- */
 /*  Boot-code exchange                                                        */
 /* -------------------------------------------------------------------------- */
@@ -73,6 +92,30 @@ export const authTokenBundleSchema = z.object({
     expiresAt: z.string(),
     user: userResponseSchema,
 });
+// Internal (unexported) arm schemas — PLAIN `z.object` literals (no
+// `z.ZodType<>` annotation) so `z.discriminatedUnion` can introspect the
+// `reason` discriminator. The node10 `.d.ts`-degradation safety comes from the
+// EXPORTED symbols instead: the public types are explicit interfaces
+// (`WebSessionSession` / `WebSessionNoSession` / `WebSessionResult`) and the
+// exported schema is annotated `z.ZodType<WebSessionResult>` below, so the
+// emitted declaration states the shape literally rather than a degradable
+// `z.infer<>` of the nested `session` object.
+const webSessionSessionSchema = z.object({
+    reason: z.literal('session'),
+    session: authTokenBundleSchema,
+    deviceToken: z.string().min(1),
+});
+const webSessionNoSessionSchema = z.object({
+    reason: z.enum(['no_session', 'new_device']),
+    deviceToken: z.string().min(1),
+});
+// Discriminated on `reason` — a true `discriminatedUnion` (not `z.union`): it
+// dispatches on the discriminator instead of sequentially probing each arm,
+// giving precise per-arm errors.
+export const webSessionResultSchema = z.discriminatedUnion('reason', [
+    webSessionSessionSchema,
+    webSessionNoSessionSchema,
+]);
 /* -------------------------------------------------------------------------- */
 /*  Refresh-token rotation (web + native, one implementation)                 */
 /* -------------------------------------------------------------------------- */

package/dist/esm/index.js

@@ -43,4 +43,4 @@ linkPreviewSchema, linkPreviewBatchRequestSchema, linkPreviewBatchResponseSchema
 export { sessionAccountSchema, deviceSessionStateSchema, activeTokenSchema, deviceSessionSyncSchema, } from './deviceSession.js';
 export { 
 // Schemas
-deviceBootReasonSchema, deviceBootFragmentSchema, deviceExchangeRequestSchema, authTokenBundleSchema, tokenRefreshRequestSchema, tokenRefreshResponseSchema, deviceTokenIssueResponseSchema, loginResultSchema, deviceResolveRequestSchema, deviceResolveResponseSchema, } from './deviceBoot.js';
+deviceBootReasonSchema, deviceBootFragmentSchema, deviceExchangeRequestSchema, authTokenBundleSchema, webSessionResultSchema, tokenRefreshRequestSchema, tokenRefreshResponseSchema, deviceTokenIssueResponseSchema, loginResultSchema, deviceResolveRequestSchema, deviceResolveResponseSchema, } from './deviceBoot.js';

package/dist/esm/userResponse.js

@@ -106,7 +106,6 @@ export const userProfileUpdateSchema = z
     phone: z.string().optional(),
     address: z.string().optional(),
     birthday: z.string().optional(),
-    location: z.string().optional(),
     locations: z.array(z.unknown()).optional(),
     links: z.array(z.string()).optional(),
     linksMetadata: z