@oxyhq/contracts 0.9.1 → 0.11.0

package/dist/types/userResponse.d.ts

@@ -16,7 +16,8 @@
  *
  * Faithful to the producers:
  *  - `packages/api/src/utils/userTransform.ts` `formatUserResponse` — the
- *    canonical serialization used by `/auth/refresh-all`, device sessions, etc.
+ *    canonical serialization used by the device-first bootstrap/exchange
+ *    endpoints (`deviceAuth.ts`), login/signup, device sessions, etc.
  *    Emits `id` (NOT `_id`), forwards `username` verbatim (may be absent), and
  *    emits `name` as the structured `{ first, last, full, displayName }`
  *    subdocument.
@@ -24,8 +25,6 @@
  *    `''`; `full` and `displayName` are Mongoose VIRTUALS. Formatted API
  *    responses compose both fields, while raw-document responses may omit the
  *    virtuals if the query did not materialise them.
- *  - The `/auth/refresh-all` handler in `packages/api/src/routes/auth.ts`, whose
- *    per-slot `authuser` is the numeric `oxy_rt_${authuser}` cookie slot.
  *
  * Platform-agnostic — zod only, no react/react-native/expo. ESM-safe (no
  * `require()`).
@@ -314,358 +313,6 @@ export type UserProfileUpdate = z.infer<typeof userProfileUpdateSchema>;
  * the `formatUserResponse` `id` field or the raw-document `_id` field.
  */
 export declare function resolveUserId(user: UserResponse): string | undefined;
-/**
- * One rotated account entry from `POST /auth/refresh-all`.
- *
- * `authuser` is the device-local slot index (`0..N-1`). `user` is the canonical
- * {@link userResponseSchema} shape (the handler projects a whitelist and runs it
- * through `formatUserResponse`).
- */
-export declare const refreshAllAccountSchema: z.ZodObject<{
-    authuser: z.ZodNumber;
-    accessToken: z.ZodString;
-    expiresAt: z.ZodString;
-    sessionId: z.ZodString;
-    user: z.ZodObject<{
-        /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
-        id: z.ZodOptional<z.ZodString>;
-        /** Raw-document id (e.g. `GET /users/me`). Present when `id` is not. */
-        _id: z.ZodOptional<z.ZodString>;
-        publicKey: z.ZodOptional<z.ZodString>;
-        username: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodString>;
-        phone: z.ZodOptional<z.ZodString>;
-        address: z.ZodOptional<z.ZodString>;
-        birthday: z.ZodOptional<z.ZodString>;
-        /** Avatar file id (string) or null. */
-        avatar: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        /** Named Bloom color preset (e.g. `"blue"`) or null. */
-        color: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        name: z.ZodType<UserNameResponse, z.ZodTypeDef, UserNameResponse>;
-        verified: z.ZodOptional<z.ZodBoolean>;
-        language: z.ZodOptional<z.ZodString>;
-        /**
-         * The account's self-sovereign identifier
-         * (`did:web:<FEDERATION_DOMAIN>:u:<userId>`). Surfaced as a `User`
-         * virtual; present on formatted DTOs once the identity layer is live.
-         */
-        did: z.ZodOptional<z.ZodString>;
-        /**
-         * Proven domain-ownership badges. Each is a {@link verifiedDomainSchema}
-         * entry; present only when the account has verified at least one domain.
-         */
-        verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
-        id: z.ZodOptional<z.ZodString>;
-        /** Raw-document id (e.g. `GET /users/me`). Present when `id` is not. */
-        _id: z.ZodOptional<z.ZodString>;
-        publicKey: z.ZodOptional<z.ZodString>;
-        username: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodString>;
-        phone: z.ZodOptional<z.ZodString>;
-        address: z.ZodOptional<z.ZodString>;
-        birthday: z.ZodOptional<z.ZodString>;
-        /** Avatar file id (string) or null. */
-        avatar: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        /** Named Bloom color preset (e.g. `"blue"`) or null. */
-        color: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        name: z.ZodType<UserNameResponse, z.ZodTypeDef, UserNameResponse>;
-        verified: z.ZodOptional<z.ZodBoolean>;
-        language: z.ZodOptional<z.ZodString>;
-        /**
-         * The account's self-sovereign identifier
-         * (`did:web:<FEDERATION_DOMAIN>:u:<userId>`). Surfaced as a `User`
-         * virtual; present on formatted DTOs once the identity layer is live.
-         */
-        did: z.ZodOptional<z.ZodString>;
-        /**
-         * Proven domain-ownership badges. Each is a {@link verifiedDomainSchema}
-         * entry; present only when the account has verified at least one domain.
-         */
-        verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
-        id: z.ZodOptional<z.ZodString>;
-        /** Raw-document id (e.g. `GET /users/me`). Present when `id` is not. */
-        _id: z.ZodOptional<z.ZodString>;
-        publicKey: z.ZodOptional<z.ZodString>;
-        username: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodString>;
-        phone: z.ZodOptional<z.ZodString>;
-        address: z.ZodOptional<z.ZodString>;
-        birthday: z.ZodOptional<z.ZodString>;
-        /** Avatar file id (string) or null. */
-        avatar: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        /** Named Bloom color preset (e.g. `"blue"`) or null. */
-        color: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        name: z.ZodType<UserNameResponse, z.ZodTypeDef, UserNameResponse>;
-        verified: z.ZodOptional<z.ZodBoolean>;
-        language: z.ZodOptional<z.ZodString>;
-        /**
-         * The account's self-sovereign identifier
-         * (`did:web:<FEDERATION_DOMAIN>:u:<userId>`). Surfaced as a `User`
-         * virtual; present on formatted DTOs once the identity layer is live.
-         */
-        did: z.ZodOptional<z.ZodString>;
-        /**
-         * Proven domain-ownership badges. Each is a {@link verifiedDomainSchema}
-         * entry; present only when the account has verified at least one domain.
-         */
-        verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
-    }, z.ZodTypeAny, "passthrough">>;
-}, "strip", z.ZodTypeAny, {
-    expiresAt: string;
-    authuser: number;
-    accessToken: string;
-    sessionId: string;
-    user: {
-        name: UserNameResponse;
-        id?: string | undefined;
-        publicKey?: string | undefined;
-        did?: string | undefined;
-        verifiedDomains?: import("./identity").VerifiedDomain[] | undefined;
-        verified?: boolean | undefined;
-        username?: string | undefined;
-        _id?: string | undefined;
-        email?: string | undefined;
-        phone?: string | undefined;
-        address?: string | undefined;
-        birthday?: string | undefined;
-        avatar?: string | null | undefined;
-        color?: string | null | undefined;
-        language?: string | undefined;
-    } & {
-        [k: string]: unknown;
-    };
-}, {
-    expiresAt: string;
-    authuser: number;
-    accessToken: string;
-    sessionId: string;
-    user: {
-        name: UserNameResponse;
-        id?: string | undefined;
-        publicKey?: string | undefined;
-        did?: string | undefined;
-        verifiedDomains?: import("./identity").VerifiedDomain[] | undefined;
-        verified?: boolean | undefined;
-        username?: string | undefined;
-        _id?: string | undefined;
-        email?: string | undefined;
-        phone?: string | undefined;
-        address?: string | undefined;
-        birthday?: string | undefined;
-        avatar?: string | null | undefined;
-        color?: string | null | undefined;
-        language?: string | undefined;
-    } & {
-        [k: string]: unknown;
-    };
-}>;
-export type RefreshAllAccountResponse = z.infer<typeof refreshAllAccountSchema>;
-/**
- * Wire shape of `POST /auth/refresh-all`: every valid device-local account,
- * sorted by `authuser` ascending. An empty `accounts` array means "no signed-in
- * accounts on this device" — the IdP must show the sign-in form.
- */
-export declare const refreshAllResponseSchema: z.ZodObject<{
-    accounts: z.ZodArray<z.ZodObject<{
-        authuser: z.ZodNumber;
-        accessToken: z.ZodString;
-        expiresAt: z.ZodString;
-        sessionId: z.ZodString;
-        user: z.ZodObject<{
-            /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
-            id: z.ZodOptional<z.ZodString>;
-            /** Raw-document id (e.g. `GET /users/me`). Present when `id` is not. */
-            _id: z.ZodOptional<z.ZodString>;
-            publicKey: z.ZodOptional<z.ZodString>;
-            username: z.ZodOptional<z.ZodString>;
-            email: z.ZodOptional<z.ZodString>;
-            phone: z.ZodOptional<z.ZodString>;
-            address: z.ZodOptional<z.ZodString>;
-            birthday: z.ZodOptional<z.ZodString>;
-            /** Avatar file id (string) or null. */
-            avatar: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-            /** Named Bloom color preset (e.g. `"blue"`) or null. */
-            color: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-            name: z.ZodType<UserNameResponse, z.ZodTypeDef, UserNameResponse>;
-            verified: z.ZodOptional<z.ZodBoolean>;
-            language: z.ZodOptional<z.ZodString>;
-            /**
-             * The account's self-sovereign identifier
-             * (`did:web:<FEDERATION_DOMAIN>:u:<userId>`). Surfaced as a `User`
-             * virtual; present on formatted DTOs once the identity layer is live.
-             */
-            did: z.ZodOptional<z.ZodString>;
-            /**
-             * Proven domain-ownership badges. Each is a {@link verifiedDomainSchema}
-             * entry; present only when the account has verified at least one domain.
-             */
-            verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
-        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-            /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
-            id: z.ZodOptional<z.ZodString>;
-            /** Raw-document id (e.g. `GET /users/me`). Present when `id` is not. */
-            _id: z.ZodOptional<z.ZodString>;
-            publicKey: z.ZodOptional<z.ZodString>;
-            username: z.ZodOptional<z.ZodString>;
-            email: z.ZodOptional<z.ZodString>;
-            phone: z.ZodOptional<z.ZodString>;
-            address: z.ZodOptional<z.ZodString>;
-            birthday: z.ZodOptional<z.ZodString>;
-            /** Avatar file id (string) or null. */
-            avatar: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-            /** Named Bloom color preset (e.g. `"blue"`) or null. */
-            color: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-            name: z.ZodType<UserNameResponse, z.ZodTypeDef, UserNameResponse>;
-            verified: z.ZodOptional<z.ZodBoolean>;
-            language: z.ZodOptional<z.ZodString>;
-            /**
-             * The account's self-sovereign identifier
-             * (`did:web:<FEDERATION_DOMAIN>:u:<userId>`). Surfaced as a `User`
-             * virtual; present on formatted DTOs once the identity layer is live.
-             */
-            did: z.ZodOptional<z.ZodString>;
-            /**
-             * Proven domain-ownership badges. Each is a {@link verifiedDomainSchema}
-             * entry; present only when the account has verified at least one domain.
-             */
-            verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
-        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-            /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
-            id: z.ZodOptional<z.ZodString>;
-            /** Raw-document id (e.g. `GET /users/me`). Present when `id` is not. */
-            _id: z.ZodOptional<z.ZodString>;
-            publicKey: z.ZodOptional<z.ZodString>;
-            username: z.ZodOptional<z.ZodString>;
-            email: z.ZodOptional<z.ZodString>;
-            phone: z.ZodOptional<z.ZodString>;
-            address: z.ZodOptional<z.ZodString>;
-            birthday: z.ZodOptional<z.ZodString>;
-            /** Avatar file id (string) or null. */
-            avatar: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-            /** Named Bloom color preset (e.g. `"blue"`) or null. */
-            color: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-            name: z.ZodType<UserNameResponse, z.ZodTypeDef, UserNameResponse>;
-            verified: z.ZodOptional<z.ZodBoolean>;
-            language: z.ZodOptional<z.ZodString>;
-            /**
-             * The account's self-sovereign identifier
-             * (`did:web:<FEDERATION_DOMAIN>:u:<userId>`). Surfaced as a `User`
-             * virtual; present on formatted DTOs once the identity layer is live.
-             */
-            did: z.ZodOptional<z.ZodString>;
-            /**
-             * Proven domain-ownership badges. Each is a {@link verifiedDomainSchema}
-             * entry; present only when the account has verified at least one domain.
-             */
-            verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
-        }, z.ZodTypeAny, "passthrough">>;
-    }, "strip", z.ZodTypeAny, {
-        expiresAt: string;
-        authuser: number;
-        accessToken: string;
-        sessionId: string;
-        user: {
-            name: UserNameResponse;
-            id?: string | undefined;
-            publicKey?: string | undefined;
-            did?: string | undefined;
-            verifiedDomains?: import("./identity").VerifiedDomain[] | undefined;
-            verified?: boolean | undefined;
-            username?: string | undefined;
-            _id?: string | undefined;
-            email?: string | undefined;
-            phone?: string | undefined;
-            address?: string | undefined;
-            birthday?: string | undefined;
-            avatar?: string | null | undefined;
-            color?: string | null | undefined;
-            language?: string | undefined;
-        } & {
-            [k: string]: unknown;
-        };
-    }, {
-        expiresAt: string;
-        authuser: number;
-        accessToken: string;
-        sessionId: string;
-        user: {
-            name: UserNameResponse;
-            id?: string | undefined;
-            publicKey?: string | undefined;
-            did?: string | undefined;
-            verifiedDomains?: import("./identity").VerifiedDomain[] | undefined;
-            verified?: boolean | undefined;
-            username?: string | undefined;
-            _id?: string | undefined;
-            email?: string | undefined;
-            phone?: string | undefined;
-            address?: string | undefined;
-            birthday?: string | undefined;
-            avatar?: string | null | undefined;
-            color?: string | null | undefined;
-            language?: string | undefined;
-        } & {
-            [k: string]: unknown;
-        };
-    }>, "many">;
-}, "strip", z.ZodTypeAny, {
-    accounts: {
-        expiresAt: string;
-        authuser: number;
-        accessToken: string;
-        sessionId: string;
-        user: {
-            name: UserNameResponse;
-            id?: string | undefined;
-            publicKey?: string | undefined;
-            did?: string | undefined;
-            verifiedDomains?: import("./identity").VerifiedDomain[] | undefined;
-            verified?: boolean | undefined;
-            username?: string | undefined;
-            _id?: string | undefined;
-            email?: string | undefined;
-            phone?: string | undefined;
-            address?: string | undefined;
-            birthday?: string | undefined;
-            avatar?: string | null | undefined;
-            color?: string | null | undefined;
-            language?: string | undefined;
-        } & {
-            [k: string]: unknown;
-        };
-    }[];
-}, {
-    accounts: {
-        expiresAt: string;
-        authuser: number;
-        accessToken: string;
-        sessionId: string;
-        user: {
-            name: UserNameResponse;
-            id?: string | undefined;
-            publicKey?: string | undefined;
-            did?: string | undefined;
-            verifiedDomains?: import("./identity").VerifiedDomain[] | undefined;
-            verified?: boolean | undefined;
-            username?: string | undefined;
-            _id?: string | undefined;
-            email?: string | undefined;
-            phone?: string | undefined;
-            address?: string | undefined;
-            birthday?: string | undefined;
-            avatar?: string | null | undefined;
-            color?: string | null | undefined;
-            language?: string | undefined;
-        } & {
-            [k: string]: unknown;
-        };
-    }[];
-}>;
-export type RefreshAllResponseContract = z.infer<typeof refreshAllResponseSchema>;
 /**
  * Wire shape of `GET /users/me` — the API success envelope (`{ data: <user> }`)
  * wrapping the current-user DTO. Some older producers use `_id` instead of
@@ -809,7 +456,7 @@ export type CurrentUserResponseContract = z.infer<typeof currentUserResponseSche
  * session). Backs the multi-account chooser. The embedded user mirrors
  * `formatUserResponse`; it is nullable on slots that lost their user document.
  */
-export declare const deviceSessionAccountSchema: z.ZodObject<{
+export declare const deviceLinkedSessionSchema: z.ZodObject<{
     sessionId: z.ZodString;
     isCurrent: z.ZodOptional<z.ZodBoolean>;
     user: z.ZodOptional<z.ZodNullable<z.ZodObject<{
@@ -902,6 +549,7 @@ export declare const deviceSessionAccountSchema: z.ZodObject<{
     }, z.ZodTypeAny, "passthrough">>>>;
 }, "strip", z.ZodTypeAny, {
     sessionId: string;
+    isCurrent?: boolean | undefined;
     user?: z.objectOutputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -932,9 +580,9 @@ export declare const deviceSessionAccountSchema: z.ZodObject<{
          */
         verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
-    isCurrent?: boolean | undefined;
 }, {
     sessionId: string;
+    isCurrent?: boolean | undefined;
     user?: z.objectInputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -965,11 +613,10 @@ export declare const deviceSessionAccountSchema: z.ZodObject<{
          */
         verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
-    isCurrent?: boolean | undefined;
 }>;
-export type DeviceSessionAccountResponse = z.infer<typeof deviceSessionAccountSchema>;
+export type DeviceLinkedSessionResponse = z.infer<typeof deviceLinkedSessionSchema>;
 /** Wire shape of `GET /session/device/sessions/:sessionId` (an array). */
-export declare const deviceSessionsResponseSchema: z.ZodArray<z.ZodObject<{
+export declare const deviceLinkedSessionsResponseSchema: z.ZodArray<z.ZodObject<{
     sessionId: z.ZodString;
     isCurrent: z.ZodOptional<z.ZodBoolean>;
     user: z.ZodOptional<z.ZodNullable<z.ZodObject<{
@@ -1062,6 +709,7 @@ export declare const deviceSessionsResponseSchema: z.ZodArray<z.ZodObject<{
     }, z.ZodTypeAny, "passthrough">>>>;
 }, "strip", z.ZodTypeAny, {
     sessionId: string;
+    isCurrent?: boolean | undefined;
     user?: z.objectOutputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -1092,9 +740,9 @@ export declare const deviceSessionsResponseSchema: z.ZodArray<z.ZodObject<{
          */
         verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
-    isCurrent?: boolean | undefined;
 }, {
     sessionId: string;
+    isCurrent?: boolean | undefined;
     user?: z.objectInputType<{
         /** MongoDB ObjectId as a string. Present on `formatUserResponse` output. */
         id: z.ZodOptional<z.ZodString>;
@@ -1125,9 +773,8 @@ export declare const deviceSessionsResponseSchema: z.ZodArray<z.ZodObject<{
          */
         verifiedDomains: z.ZodOptional<z.ZodArray<z.ZodType<import("./identity").VerifiedDomain, z.ZodTypeDef, import("./identity").VerifiedDomain>, "many">>;
     }, z.ZodTypeAny, "passthrough"> | null | undefined;
-    isCurrent?: boolean | undefined;
 }>, "many">;
-export type DeviceSessionsResponseContract = z.infer<typeof deviceSessionsResponseSchema>;
+export type DeviceLinkedSessionsResponseContract = z.infer<typeof deviceLinkedSessionsResponseSchema>;
 /**
  * Safely parse a value against a contract schema. Returns the parsed (typed)
  * value, or `null` when validation fails — the same ergonomics the auth app's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/contracts",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "OxyHQ API contracts — single source of truth for request/response Zod schemas and inferred types, shared by the backend and the client SDKs",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",