@reopt-ai/data-contract 0.6.2 → 0.7.0

package/dist/identity.js

@@ -1,57 +1,127 @@
-import {
-  COOKIE_MAX_AGE_SECONDS,
-  IDENTITY_ID_PATTERN,
-  IDENTITY_REQUEST_HEADERS,
-  OPT_OUT_CONSENT_CATEGORY,
-  SESSION_HEADER_SEPARATOR,
-  SESSION_ID_HEADER,
-  consentCookieName,
-  deviceCookieName,
-  formatSessionHeader,
-  isOptedOut,
-  isValidIdentityId,
-  parseConsentCookie,
-  parseDeviceCookie,
-  parseSessionHeader,
-  serializeConsentCookie,
-  serializeDeviceCookie,
-  signSessionToken,
-  verifySessionToken
-} from "./chunk-FMOKJTQD.js";
-import {
-  CLIENT_ID_HEADER,
-  CLIENT_SECRET_HEADER,
-  CONTRACT_VERSION,
-  CONTRACT_VERSION_HEADER,
-  DEVICE_ID_HEADER,
-  REQUEST_ID_HEADER,
-  WRITE_KEY_HEADER
-} from "./chunk-ZCKVMUIQ.js";
-export {
-  CLIENT_ID_HEADER,
-  CLIENT_SECRET_HEADER,
-  CONTRACT_VERSION,
-  CONTRACT_VERSION_HEADER,
-  COOKIE_MAX_AGE_SECONDS,
-  DEVICE_ID_HEADER,
-  IDENTITY_ID_PATTERN,
-  IDENTITY_REQUEST_HEADERS,
-  OPT_OUT_CONSENT_CATEGORY,
-  REQUEST_ID_HEADER,
-  SESSION_HEADER_SEPARATOR,
-  SESSION_ID_HEADER,
-  WRITE_KEY_HEADER,
-  consentCookieName,
-  deviceCookieName,
-  formatSessionHeader,
-  isOptedOut,
-  isValidIdentityId,
-  parseConsentCookie,
-  parseDeviceCookie,
-  parseSessionHeader,
-  serializeConsentCookie,
-  serializeDeviceCookie,
-  signSessionToken,
-  verifySessionToken
-};
+import { a as DEVICE_ID_HEADER, i as CONTRACT_VERSION_HEADER, n as CLIENT_SECRET_HEADER, o as REQUEST_ID_HEADER, r as CONTRACT_VERSION, s as WRITE_KEY_HEADER, t as CLIENT_ID_HEADER } from "./version-C09Cyf4R.js";
+//#region src/identity.ts
+const SESSION_ID_HEADER = "reopt-session-id";
+const IDENTITY_REQUEST_HEADERS = [DEVICE_ID_HEADER, SESSION_ID_HEADER];
+const COOKIE_MAX_AGE_SECONDS = 3456e4;
+const OPT_OUT_CONSENT_CATEGORY = "analytics";
+const COOKIE_PREFIX = "reopt_";
+function cookieSafe(writeKey) {
+	if (!writeKey) throw new Error("[reopt] writeKey is required to derive cookie names");
+	return writeKey.replace(/[^A-Za-z0-9_-]/g, "_");
+}
+function deviceCookieName(writeKey) {
+	return `${COOKIE_PREFIX}${cookieSafe(writeKey)}_device`;
+}
+function consentCookieName(writeKey) {
+	return `${COOKIE_PREFIX}${cookieSafe(writeKey)}_consent`;
+}
+const IDENTITY_ID_PATTERN = /^[A-Za-z0-9._~-]{1,200}$/;
+function isValidIdentityId(value) {
+	return typeof value === "string" && IDENTITY_ID_PATTERN.test(value);
+}
+function decode(raw) {
+	let text = raw;
+	for (let round = 0; round < 3 && /%[0-9A-Fa-f]{2}/.test(text); round++) {
+		try {
+			const next = decodeURIComponent(text);
+			if (next === text) break;
+			text = next;
+		} catch {
+			break;
+		}
+		if (text.startsWith("{")) break;
+	}
+	return text;
+}
+function parseDeviceCookie(raw) {
+	if (!raw) return null;
+	const text = decode(raw.trim());
+	if (!text) return null;
+	if (!text.startsWith("{")) return isValidIdentityId(text) ? { deviceId: text } : null;
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return null;
+	}
+	if (typeof parsed !== "object" || parsed === null) return null;
+	const candidate = parsed;
+	if (!isValidIdentityId(candidate.deviceId)) return null;
+	const state = { deviceId: candidate.deviceId };
+	if (isValidIdentityId(candidate.sessionId)) state.sessionId = candidate.sessionId;
+	if (isValidIdentityId(candidate.profileId)) state.profileId = candidate.profileId;
+	return state;
+}
+function serializeDeviceCookie(state) {
+	if (!isValidIdentityId(state.deviceId)) throw new Error("[reopt] deviceId must be a non-empty string without control characters");
+	const envelope = { deviceId: state.deviceId };
+	if (isValidIdentityId(state.sessionId)) envelope.sessionId = state.sessionId;
+	if (isValidIdentityId(state.profileId)) envelope.profileId = state.profileId;
+	return encodeURIComponent(JSON.stringify(envelope));
+}
+function parseConsentCookie(raw) {
+	if (!raw) return null;
+	const text = decode(raw.trim());
+	if (!text.startsWith("{")) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return null;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+	const state = {};
+	for (const [category, decision] of Object.entries(parsed)) if (typeof decision === "boolean" && isValidIdentityId(category)) state[category] = decision;
+	return state;
+}
+function serializeConsentCookie(state) {
+	const clean = {};
+	for (const [category, decision] of Object.entries(state)) if (typeof decision === "boolean" && isValidIdentityId(category)) clean[category] = decision;
+	return encodeURIComponent(JSON.stringify(clean));
+}
+function isOptedOut(consent) {
+	return consent?.[OPT_OUT_CONSENT_CATEGORY] === false;
+}
+const SESSION_HEADER_SEPARATOR = ".";
+function formatSessionHeader(credential) {
+	return `${credential.id}.${credential.token}`;
+}
+function parseSessionHeader(value) {
+	if (!value) return null;
+	const at = value.lastIndexOf(".");
+	if (at <= 0 || at === value.length - 1) return null;
+	const id = value.slice(0, at);
+	const token = value.slice(at + 1);
+	return isValidIdentityId(id) && /^[A-Za-z0-9_-]{43}$/.test(token) ? {
+		id,
+		token
+	} : null;
+}
+const encoder = new TextEncoder();
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of new Uint8Array(bytes)) binary += String.fromCharCode(byte);
+	return (typeof btoa === "function" ? btoa(binary) : Buffer.from(binary, "binary").toString("base64")).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function hmacKey(secret) {
+	return crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+}
+async function signSessionToken(secret, sessionId) {
+	if (!secret) throw new Error("[reopt] a session signing secret is required");
+	return base64url(await crypto.subtle.sign("HMAC", await hmacKey(secret), encoder.encode(sessionId)));
+}
+async function verifySessionToken(secret, credential) {
+	if (!secret || !credential) return false;
+	const expected = await signSessionToken(secret, credential.id);
+	if (expected.length !== credential.token.length) return false;
+	let diff = 0;
+	for (let index = 0; index < expected.length; index++) diff |= expected.charCodeAt(index) ^ credential.token.charCodeAt(index);
+	return diff === 0;
+}
+//#endregion
+export { CLIENT_ID_HEADER, CLIENT_SECRET_HEADER, CONTRACT_VERSION, CONTRACT_VERSION_HEADER, COOKIE_MAX_AGE_SECONDS, DEVICE_ID_HEADER, IDENTITY_ID_PATTERN, IDENTITY_REQUEST_HEADERS, OPT_OUT_CONSENT_CATEGORY, REQUEST_ID_HEADER, SESSION_HEADER_SEPARATOR, SESSION_ID_HEADER, WRITE_KEY_HEADER, consentCookieName, deviceCookieName, formatSessionHeader, isOptedOut, isValidIdentityId, parseConsentCookie, parseDeviceCookie, parseSessionHeader, serializeConsentCookie, serializeDeviceCookie, signSessionToken, verifySessionToken };
+
 //# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"file":"identity.js","names":[],"sources":["../src/identity.ts"],"sourcesContent":["/**\n * `@reopt-ai/data-contract/identity` — the names and encodings that carry a\n * visitor's identity between the browser SDK, the server SDK, the Next.js\n * proxy and the ingest pipeline.\n *\n * Every one of those parties reads or writes the same cookies and headers.\n * None of them depends on another (ingest does not import the SDKs), so this\n * module is the only place a name may be spelled out. A party that hardcodes\n * `reopt_<key>_device` instead of calling `deviceCookieName()` fails silently:\n * the browser sets one cookie, the server looks for another, and every\n * visitor is counted as new. `packages/db/src/__tests__/redis-namespace.test.ts`\n * guards Redis key prefixes for exactly the same reason.\n *\n * Nothing here touches `document`, `fetch` or Node built-ins — it runs in\n * browsers, edge runtimes and Node alike.\n */\nimport { DEVICE_ID_HEADER } from \"./version.js\";\n\nexport {\n  CLIENT_ID_HEADER,\n  CLIENT_SECRET_HEADER,\n  CONTRACT_VERSION,\n  CONTRACT_VERSION_HEADER,\n  DEVICE_ID_HEADER,\n  REQUEST_ID_HEADER,\n  WRITE_KEY_HEADER,\n} from \"./version.js\";\n\n/**\n * Request header carrying the browser's current session id. The browser SDK\n * adds it to same-origin requests so a server-side `track()` can land in the\n * session the user is actually in; the server SDK forwards it to ingest.\n *\n * Ingest treats it as a *hint*, never as authority — a browser can put any\n * value here.\n */\nexport const SESSION_ID_HEADER = \"reopt-session-id\";\n\n/** Every request header the identity protocol may carry, for CORS allow-lists. */\nexport const IDENTITY_REQUEST_HEADERS = [DEVICE_ID_HEADER, SESSION_ID_HEADER] as const;\n\n/**\n * 400 days — the longest lifetime Chrome will honour. Anything longer is\n * silently clamped to this, so asking for more only hides the real expiry.\n */\nexport const COOKIE_MAX_AGE_SECONDS = 400 * 24 * 60 * 60;\n\n/** Consent category whose refusal means \"send nothing at all\". */\nexport const OPT_OUT_CONSENT_CATEGORY = \"analytics\";\n\nconst COOKIE_PREFIX = \"reopt_\";\n\n/**\n * Cookie names may not contain separators (`=`, `;`, `,`, whitespace) or\n * control characters. A write key is opaque to us, so anything outside the\n * safe set is folded to `_` — deterministically, so both ends agree.\n */\nfunction cookieSafe(writeKey: string): string {\n  if (!writeKey) {\n    throw new Error(\"[reopt] writeKey is required to derive cookie names\");\n  }\n  return writeKey.replace(/[^A-Za-z0-9_-]/g, \"_\");\n}\n\n/**\n * `reopt_<writeKey>_device` — device id plus session/profile hints.\n *\n * The write key is **sanitized**: any character outside `[A-Za-z0-9_-]`\n * becomes `_` (see `cookieSafe`), so do not derive prefix/suffix pieces by\n * probing this with a marker character — the marker is folded too. Always\n * call this with the real write key and compare whole names.\n */\nexport function deviceCookieName(writeKey: string): string {\n  return `${COOKIE_PREFIX}${cookieSafe(writeKey)}_device`;\n}\n\n/** `reopt_<writeKey>_consent` — per-category consent decisions. Same sanitizing as `deviceCookieName`. */\nexport function consentCookieName(writeKey: string): string {\n  return `${COOKIE_PREFIX}${cookieSafe(writeKey)}_consent`;\n}\n\n/** Everything the device cookie may carry. Only `deviceId` is required. */\nexport interface DeviceCookieState {\n  deviceId: string;\n  /** Current session, if the browser has one. */\n  sessionId?: string | undefined;\n  /** Last identified profile. A hint for the server SDK, never trusted by ingest. */\n  profileId?: string | undefined;\n}\n\n/** Per-category consent. `false` withdraws, `true` grants, absent = undecided. */\nexport type ConsentCookieState = Record<string, boolean>;\n\n/**\n * What the server hands the browser SDK so the first render already agrees\n * with the server about who the visitor is. Plain JSON — it crosses the\n * RSC → client component boundary as a prop.\n */\nexport interface ReoptBootstrap {\n  /** From the device cookie (seeded by the proxy on first visit). */\n  deviceId: string;\n  /** Session hint, or `null` when the browser has not started one. */\n  sessionId: string | null;\n  /** Result of the server's `getProfileId` resolver, or `null`. */\n  profileId: string | null;\n  consent: ConsentCookieState;\n  /** Server clock at render time, so a skewed device clock can be corrected. */\n  serverTimeMs: number;\n}\n\n/**\n * Ids are opaque, but a cookie is attacker-controlled input (a sibling\n * subdomain can set one). The value ends up in an HTTP header, and\n * `Headers.set` throws on anything outside ISO-8859-1 — so a single odd\n * cookie would break every `fetch` the tracing patch touches. Only the URL\n * \"unreserved\" set is accepted; every id this SDK mints is a UUID.\n */\nexport const IDENTITY_ID_PATTERN = /^[A-Za-z0-9._~-]{1,200}$/;\n\nexport function isValidIdentityId(value: unknown): value is string {\n  return typeof value === \"string\" && IDENTITY_ID_PATTERN.test(value);\n}\n\n/**\n * Decodes the envelope. Tolerates one extra layer (`%257B…`) — a cookie\n * setter that encodes an already-encoded value is a mistake we have shipped\n * once, and a visitor's identity should survive it rather than be reminted.\n */\nfunction decode(raw: string): string {\n  let text = raw;\n  for (let round = 0; round < 3 && /%[0-9A-Fa-f]{2}/.test(text); round++) {\n    try {\n      const next = decodeURIComponent(text);\n      if (next === text) break;\n      text = next;\n    } catch {\n      break;\n    }\n    if (text.startsWith(\"{\")) break;\n  }\n  return text;\n}\n\n/**\n * Reads a device cookie value. Accepts the JSON envelope written by\n * `serializeDeviceCookie` and, for cookies seeded before the envelope existed,\n * a bare device id. Returns `null` for anything else — a malformed cookie is\n * treated as absent, never as an error, so a corrupted value cannot take the\n * page down.\n */\nexport function parseDeviceCookie(raw: string | null | undefined): DeviceCookieState | null {\n  if (!raw) return null;\n  const text = decode(raw.trim());\n  if (!text) return null;\n\n  if (!text.startsWith(\"{\")) {\n    return isValidIdentityId(text) ? { deviceId: text } : null;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    return null;\n  }\n  if (typeof parsed !== \"object\" || parsed === null) return null;\n\n  const candidate = parsed as Record<string, unknown>;\n  if (!isValidIdentityId(candidate.deviceId)) return null;\n\n  const state: DeviceCookieState = { deviceId: candidate.deviceId };\n  if (isValidIdentityId(candidate.sessionId)) state.sessionId = candidate.sessionId;\n  if (isValidIdentityId(candidate.profileId)) state.profileId = candidate.profileId;\n  return state;\n}\n\n/**\n * Cookie values may not contain `;`, `,` or whitespace, and JSON contains\n * quotes and commas. The envelope is therefore URI-encoded; `parseDeviceCookie`\n * reverses it. Optional fields are omitted rather than written as `null` so\n * the cookie stays as small as the state it carries.\n */\nexport function serializeDeviceCookie(state: DeviceCookieState): string {\n  if (!isValidIdentityId(state.deviceId)) {\n    throw new Error(\"[reopt] deviceId must be a non-empty string without control characters\");\n  }\n  const envelope: DeviceCookieState = { deviceId: state.deviceId };\n  if (isValidIdentityId(state.sessionId)) envelope.sessionId = state.sessionId;\n  if (isValidIdentityId(state.profileId)) envelope.profileId = state.profileId;\n  return encodeURIComponent(JSON.stringify(envelope));\n}\n\n/**\n * Reads a consent cookie. Only boolean entries survive; anything else in the\n * object is dropped rather than failing the whole cookie, because one odd key\n * must not erase a user's recorded opt-out.\n */\nexport function parseConsentCookie(raw: string | null | undefined): ConsentCookieState | null {\n  if (!raw) return null;\n  const text = decode(raw.trim());\n  if (!text.startsWith(\"{\")) return null;\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    return null;\n  }\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) return null;\n\n  const state: ConsentCookieState = {};\n  for (const [category, decision] of Object.entries(parsed as Record<string, unknown>)) {\n    if (typeof decision === \"boolean\" && isValidIdentityId(category)) {\n      state[category] = decision;\n    }\n  }\n  return state;\n}\n\nexport function serializeConsentCookie(state: ConsentCookieState): string {\n  const clean: ConsentCookieState = {};\n  for (const [category, decision] of Object.entries(state)) {\n    if (typeof decision === \"boolean\" && isValidIdentityId(category)) {\n      clean[category] = decision;\n    }\n  }\n  return encodeURIComponent(JSON.stringify(clean));\n}\n\n/**\n * \"Opted out\" means the visitor refused the `analytics` category. An absent\n * cookie or an undecided category is *not* an opt-out — it is the default\n * state of every first visit, and treating it as refusal would make consent\n * banners mandatory for every integration.\n */\nexport function isOptedOut(consent: ConsentCookieState | null | undefined): boolean {\n  return consent?.[OPT_OUT_CONSENT_CATEGORY] === false;\n}\n\n// ─── Session tokens ───────────────────────────────────────────────────────────\n\n/**\n * Sessions are assigned by ingest, not by the browser. To let a later request\n * — from the same browser, or from a server acting for it — join that session\n * with authority, ingest hands the browser its session id together with an\n * HMAC over it, and the browser sends both back as `reopt-session-id`. An\n * unsigned or wrongly signed value is a hint at most: ingest falls back to\n * deciding the session from the device, exactly as if the header were absent.\n *\n * The token is `base64url(HMAC-SHA256(secret, sessionId))`. The secret is\n * per project and never leaves the server. WebCrypto only, so this runs in\n * browsers, edge runtimes and Node alike.\n */\nexport const SESSION_HEADER_SEPARATOR = \".\";\n\nexport interface SessionCredential {\n  id: string;\n  token: string;\n}\n\n/** `<id>.<token>` — what travels in `reopt-session-id`. */\nexport function formatSessionHeader(credential: SessionCredential): string {\n  return `${credential.id}${SESSION_HEADER_SEPARATOR}${credential.token}`;\n}\n\n/** Splits a `reopt-session-id` value. `null` unless both parts are well-formed. */\nexport function parseSessionHeader(value: string | null | undefined): SessionCredential | null {\n  if (!value) return null;\n  const at = value.lastIndexOf(SESSION_HEADER_SEPARATOR);\n  if (at <= 0 || at === value.length - 1) return null;\n  const id = value.slice(0, at);\n  const token = value.slice(at + 1);\n  return isValidIdentityId(id) && /^[A-Za-z0-9_-]{43}$/.test(token) ? { id, token } : null;\n}\n\nconst encoder = new TextEncoder();\n\nfunction base64url(bytes: ArrayBuffer): string {\n  let binary = \"\";\n  for (const byte of new Uint8Array(bytes)) binary += String.fromCharCode(byte);\n  const b64 = typeof btoa === \"function\" ? btoa(binary) : Buffer.from(binary, \"binary\").toString(\"base64\");\n  return b64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmacKey(secret: string): Promise<CryptoKey> {\n  return crypto.subtle.importKey(\"raw\", encoder.encode(secret), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n}\n\n/** Issues the token for `sessionId`. Server-side only — needs the project secret. */\nexport async function signSessionToken(secret: string, sessionId: string): Promise<string> {\n  if (!secret) throw new Error(\"[reopt] a session signing secret is required\");\n  const signature = await crypto.subtle.sign(\"HMAC\", await hmacKey(secret), encoder.encode(sessionId));\n  return base64url(signature);\n}\n\n/**\n * Constant-time check of a presented token. Recomputes and compares the\n * digests byte by byte rather than using `subtle.verify` with a decoded\n * token, so a malformed token can never throw its way past the check.\n */\nexport async function verifySessionToken(secret: string, credential: SessionCredential): Promise<boolean> {\n  if (!secret || !credential) return false;\n  const expected = await signSessionToken(secret, credential.id);\n  if (expected.length !== credential.token.length) return false;\n  let diff = 0;\n  for (let index = 0; index < expected.length; index++) {\n    diff |= expected.charCodeAt(index) ^ credential.token.charCodeAt(index);\n  }\n  return diff === 0;\n}\n"],"mappings":";;AAoCA,MAAa,oBAAoB;AAGjC,MAAa,2BAA2B,CAAC,kBAAkB,iBAAiB;AAM5E,MAAa,yBAAyB;AAGtC,MAAa,2BAA2B;AAExC,MAAM,gBAAgB;AAOtB,SAAS,WAAW,UAA0B;CAC5C,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,qDAAqD;CAEvE,OAAO,SAAS,QAAQ,mBAAmB,GAAG;AAChD;AAUA,SAAgB,iBAAiB,UAA0B;CACzD,OAAO,GAAG,gBAAgB,WAAW,QAAQ,EAAE;AACjD;AAGA,SAAgB,kBAAkB,UAA0B;CAC1D,OAAO,GAAG,gBAAgB,WAAW,QAAQ,EAAE;AACjD;AAsCA,MAAa,sBAAsB;AAEnC,SAAgB,kBAAkB,OAAiC;CACjE,OAAO,OAAO,UAAU,YAAY,oBAAoB,KAAK,KAAK;AACpE;AAOA,SAAS,OAAO,KAAqB;CACnC,IAAI,OAAO;CACX,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,kBAAkB,KAAK,IAAI,GAAG,SAAS;EACtE,IAAI;GACF,MAAM,OAAO,mBAAmB,IAAI;GACpC,IAAI,SAAS,MAAM;GACnB,OAAO;EACT,QAAQ;GACN;EACF;EACA,IAAI,KAAK,WAAW,GAAG,GAAG;CAC5B;CACA,OAAO;AACT;AASA,SAAgB,kBAAkB,KAA0D;CAC1F,IAAI,CAAC,KAAK,OAAO;CACjB,MAAM,OAAO,OAAO,IAAI,KAAK,CAAC;CAC9B,IAAI,CAAC,MAAM,OAAO;CAElB,IAAI,CAAC,KAAK,WAAW,GAAG,GACtB,OAAO,kBAAkB,IAAI,IAAI,EAAE,UAAU,KAAK,IAAI;CAGxD,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,IAAI;CAC1B,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM,OAAO;CAE1D,MAAM,YAAY;CAClB,IAAI,CAAC,kBAAkB,UAAU,QAAQ,GAAG,OAAO;CAEnD,MAAM,QAA2B,EAAE,UAAU,UAAU,SAAS;CAChE,IAAI,kBAAkB,UAAU,SAAS,GAAG,MAAM,YAAY,UAAU;CACxE,IAAI,kBAAkB,UAAU,SAAS,GAAG,MAAM,YAAY,UAAU;CACxE,OAAO;AACT;AAQA,SAAgB,sBAAsB,OAAkC;CACtE,IAAI,CAAC,kBAAkB,MAAM,QAAQ,GACnC,MAAM,IAAI,MAAM,wEAAwE;CAE1F,MAAM,WAA8B,EAAE,UAAU,MAAM,SAAS;CAC/D,IAAI,kBAAkB,MAAM,SAAS,GAAG,SAAS,YAAY,MAAM;CACnE,IAAI,kBAAkB,MAAM,SAAS,GAAG,SAAS,YAAY,MAAM;CACnE,OAAO,mBAAmB,KAAK,UAAU,QAAQ,CAAC;AACpD;AAOA,SAAgB,mBAAmB,KAA2D;CAC5F,IAAI,CAAC,KAAK,OAAO;CACjB,MAAM,OAAO,OAAO,IAAI,KAAK,CAAC;CAC9B,IAAI,CAAC,KAAK,WAAW,GAAG,GAAG,OAAO;CAElC,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,IAAI;CAC1B,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG,OAAO;CAEnF,MAAM,QAA4B,CAAC;CACnC,KAAK,MAAM,CAAC,UAAU,aAAa,OAAO,QAAQ,MAAiC,GACjF,IAAI,OAAO,aAAa,aAAa,kBAAkB,QAAQ,GAC7D,MAAM,YAAY;CAGtB,OAAO;AACT;AAEA,SAAgB,uBAAuB,OAAmC;CACxE,MAAM,QAA4B,CAAC;CACnC,KAAK,MAAM,CAAC,UAAU,aAAa,OAAO,QAAQ,KAAK,GACrD,IAAI,OAAO,aAAa,aAAa,kBAAkB,QAAQ,GAC7D,MAAM,YAAY;CAGtB,OAAO,mBAAmB,KAAK,UAAU,KAAK,CAAC;AACjD;AAQA,SAAgB,WAAW,SAAyD;CAClF,OAAO,UAAU,8BAA8B;AACjD;AAgBA,MAAa,2BAA2B;AAQxC,SAAgB,oBAAoB,YAAuC;CACzE,OAAO,GAAG,WAAW,MAAgC,WAAW;AAClE;AAGA,SAAgB,mBAAmB,OAA4D;CAC7F,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,KAAK,MAAM,YAAA,GAAoC;CACrD,IAAI,MAAM,KAAK,OAAO,MAAM,SAAS,GAAG,OAAO;CAC/C,MAAM,KAAK,MAAM,MAAM,GAAG,EAAE;CAC5B,MAAM,QAAQ,MAAM,MAAM,KAAK,CAAC;CAChC,OAAO,kBAAkB,EAAE,KAAK,sBAAsB,KAAK,KAAK,IAAI;EAAE;EAAI;CAAM,IAAI;AACtF;AAEA,MAAM,UAAU,IAAI,YAAY;AAEhC,SAAS,UAAU,OAA4B;CAC7C,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,IAAI,WAAW,KAAK,GAAG,UAAU,OAAO,aAAa,IAAI;CAE5E,QADY,OAAO,SAAS,aAAa,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAAA,CAC5F,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AACtE;AAEA,eAAe,QAAQ,QAAoC;CACzD,OAAO,OAAO,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG;EAAE,MAAM;EAAQ,MAAM;CAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AAClH;AAGA,eAAsB,iBAAiB,QAAgB,WAAoC;CACzF,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,8CAA8C;CAE3E,OAAO,UAAU,MADO,OAAO,OAAO,KAAK,QAAQ,MAAM,QAAQ,MAAM,GAAG,QAAQ,OAAO,SAAS,CAAC,CACzE;AAC5B;AAOA,eAAsB,mBAAmB,QAAgB,YAAiD;CACxG,IAAI,CAAC,UAAU,CAAC,YAAY,OAAO;CACnC,MAAM,WAAW,MAAM,iBAAiB,QAAQ,WAAW,EAAE;CAC7D,IAAI,SAAS,WAAW,WAAW,MAAM,QAAQ,OAAO;CACxD,IAAI,OAAO;CACX,KAAK,IAAI,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAC3C,QAAQ,SAAS,WAAW,KAAK,IAAI,WAAW,MAAM,WAAW,KAAK;CAExE,OAAO,SAAS;AAClB"}

package/dist/index.cjs

@@ -1,27 +1,48 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_version = require("./version-B_0qb1_K.cjs");
+let zod = require("zod");
+//#region src/index.ts
+const zDate = zod.z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "expected YYYY-MM-DD").refine(isRealCalendarDate, "date does not exist");
+function isRealCalendarDate(value) {
+	if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) return false;
+	const [year, month, day] = value.split("-").map(Number);
+	const instant = new Date(Date.UTC(year, month - 1, day));
+	return instant.getUTCFullYear() === year && instant.getUTCMonth() === month - 1 && instant.getUTCDate() === day;
+}
+const zInstant = zod.z.string().min(20);
+var DataApiError = class DataApiError extends Error {
+	isDataApiError = true;
+	status;
+	code;
+	requestId;
+	retryAfterMs;
+	details;
+	constructor(init) {
+		super(init.message);
+		this.name = "DataApiError";
+		this.status = init.status;
+		this.code = init.code;
+		this.requestId = init.requestId;
+		this.retryAfterMs = init.retryAfterMs;
+		this.details = init.details;
+	}
+	get retryable() {
+		return this.status === 429 || this.status >= 500;
+	}
+	static is(value) {
+		return value instanceof DataApiError || typeof value === "object" && value !== null && value.isDataApiError === true;
+	}
+};
+//#endregion
+exports.CLIENT_ID_HEADER = require_version.CLIENT_ID_HEADER;
+exports.CLIENT_SECRET_HEADER = require_version.CLIENT_SECRET_HEADER;
+exports.CONTRACT_VERSION = require_version.CONTRACT_VERSION;
+exports.CONTRACT_VERSION_HEADER = require_version.CONTRACT_VERSION_HEADER;
+exports.DEVICE_ID_HEADER = require_version.DEVICE_ID_HEADER;
+exports.DataApiError = DataApiError;
+exports.REQUEST_ID_HEADER = require_version.REQUEST_ID_HEADER;
+exports.WRITE_KEY_HEADER = require_version.WRITE_KEY_HEADER;
+exports.zDate = zDate;
+exports.zInstant = zInstant;
 
-
-
-var _chunkYSAEOYPDcjs = require('./chunk-YSAEOYPD.cjs');
-
-
-
-
-
-
-
-
-var _chunkAOS53KAVcjs = require('./chunk-AOS53KAV.cjs');
-
-
-
-
-
-
-
-
-
-
-
-exports.CLIENT_ID_HEADER = _chunkAOS53KAVcjs.CLIENT_ID_HEADER; exports.CLIENT_SECRET_HEADER = _chunkAOS53KAVcjs.CLIENT_SECRET_HEADER; exports.CONTRACT_VERSION = _chunkAOS53KAVcjs.CONTRACT_VERSION; exports.CONTRACT_VERSION_HEADER = _chunkAOS53KAVcjs.CONTRACT_VERSION_HEADER; exports.DEVICE_ID_HEADER = _chunkAOS53KAVcjs.DEVICE_ID_HEADER; exports.DataApiError = _chunkYSAEOYPDcjs.DataApiError; exports.REQUEST_ID_HEADER = _chunkAOS53KAVcjs.REQUEST_ID_HEADER; exports.WRITE_KEY_HEADER = _chunkAOS53KAVcjs.WRITE_KEY_HEADER; exports.zDate = _chunkYSAEOYPDcjs.zDate; exports.zInstant = _chunkYSAEOYPDcjs.zInstant;
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/eric/reopt-ai/reopt-data/packages/data-contract/dist/index.cjs"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,+lBAAC","file":"/Users/eric/reopt-ai/reopt-data/packages/data-contract/dist/index.cjs"}
+{"version":3,"file":"index.cjs","names":["z"],"sources":["../src/index.ts"],"sourcesContent":["/**\n * `@reopt-ai/data-contract` — the wire contract between reopt-data and its\n * server-credential consumers (RFC-0023).\n *\n * Subpaths:\n *   `@reopt-ai/data-contract`         this module — version, shared primitives, errors\n *   `@reopt-ai/data-contract/ingest`  POST /api/track request + response schemas\n *   `@reopt-ai/data-contract/query`   POST /api/v1/query/* request + response schemas\n *   `@reopt-ai/data-contract/control` provisioning request + response schemas\n *   `@reopt-ai/data-contract/client`  createDataClient() — typed fetch over all\n *   `@reopt-ai/data-contract/events`   event names + property keys (no zod)\n *   `@reopt-ai/data-contract/identity` cookie/header names and encodings shared by\n *                                     the SDKs, the Next.js proxy and ingest\n *\n * Only `/client` touches `fetch`; everything else is pure zod. The single\n * runtime dependency is zod, deliberately — consumers bundle this.\n */\nimport { z } from \"zod\";\n\nexport {\n  CONTRACT_VERSION,\n  CONTRACT_VERSION_HEADER,\n  CLIENT_ID_HEADER,\n  CLIENT_SECRET_HEADER,\n  WRITE_KEY_HEADER,\n  DEVICE_ID_HEADER,\n  REQUEST_ID_HEADER,\n} from \"./version.js\";\n\n/**\n * A real calendar date. The query's resolved IANA zone decides which instants\n * its inclusive day covers.\n */\nexport const zDate = z\n  .string()\n  .regex(/^\\d{4}-\\d{2}-\\d{2}$/, \"expected YYYY-MM-DD\")\n  .refine(isRealCalendarDate, \"date does not exist\");\n\nfunction isRealCalendarDate(value: string): boolean {\n  if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(value)) return false;\n  const [year, month, day] = value.split(\"-\").map(Number);\n  const instant = new Date(Date.UTC(year!, month! - 1, day!));\n  return instant.getUTCFullYear() === year && instant.getUTCMonth() === month! - 1 && instant.getUTCDate() === day;\n}\n\n/** ISO-8601 instant, as produced by `Date#toISOString()`. */\nexport const zInstant = z.string().min(20);\n\n/**\n * Client credentials. The same pair authenticates both planes; what a given\n * client may reach is decided server-side by `Client.scopes`\n * (`\"ingest\"` / `\"query\"` / `\"provision\"`).\n */\nexport interface ClientCredentials {\n  clientId: string;\n  clientSecret: string;\n}\n\n/**\n * Credentials are optional on the client itself because the provisioning\n * surface does not use them — it authenticates per call with a platform or\n * organization key. A caller that only provisions should not have to invent an\n * empty client id to satisfy a constructor.\n *\n * Reaching ingest or query without them fails with `credentials_missing`\n * rather than sending an unauthenticated request and reporting the 401 as a\n * server problem.\n */\nexport type OptionalClientCredentials = Partial<ClientCredentials>;\n\n/**\n * Every non-2xx response from either plane, plus the two failures the client\n * itself raises (`contract_mismatch`, `network_error`).\n */\nexport class DataApiError extends Error {\n  /**\n   * Brand for {@link DataApiError.is}. A bundler that inlines this module into\n   * more than one entry point produces two distinct classes, and `instanceof`\n   * silently stops matching — the brand survives that, and realm boundaries.\n   */\n  readonly isDataApiError = true as const;\n\n  readonly status: number;\n  readonly code: string;\n  readonly requestId?: string | undefined;\n  /** Parsed from `Retry-After`, in milliseconds. Only set on 429. */\n  readonly retryAfterMs?: number | undefined;\n  /** zod issues for `validation_failed`, or the raw body when unparseable. */\n  readonly details?: unknown | undefined;\n\n  constructor(init: {\n    message: string;\n    status: number;\n    code: string;\n    requestId?: string | undefined;\n    retryAfterMs?: number | undefined;\n    details?: unknown | undefined;\n  }) {\n    super(init.message);\n    this.name = \"DataApiError\";\n    this.status = init.status;\n    this.code = init.code;\n    this.requestId = init.requestId;\n    this.retryAfterMs = init.retryAfterMs;\n    this.details = init.details;\n  }\n\n  /** 429 and 5xx are worth retrying; 4xx are the caller's fault and are not. */\n  get retryable(): boolean {\n    return this.status === 429 || this.status >= 500;\n  }\n\n  /**\n   * Prefer this over `instanceof` in a `catch`. It holds even when the class\n   * has been duplicated — across CJS entry points, across bundler chunks, or\n   * across realms — where `instanceof` quietly returns false.\n   */\n  static is(value: unknown): value is DataApiError {\n    return (\n      value instanceof DataApiError ||\n      (typeof value === \"object\" && value !== null && (value as { isDataApiError?: unknown }).isDataApiError === true)\n    );\n  }\n}\n"],"mappings":";;;;AAiCA,MAAa,QAAQA,IAAAA,EAClB,OAAO,CAAC,CACR,MAAM,uBAAuB,qBAAqB,CAAC,CACnD,OAAO,oBAAoB,qBAAqB;AAEnD,SAAS,mBAAmB,OAAwB;CAClD,IAAI,CAAC,sBAAsB,KAAK,KAAK,GAAG,OAAO;CAC/C,MAAM,CAAC,MAAM,OAAO,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;CACtD,MAAM,UAAU,IAAI,KAAK,KAAK,IAAI,MAAO,QAAS,GAAG,GAAI,CAAC;CAC1D,OAAO,QAAQ,eAAe,MAAM,QAAQ,QAAQ,YAAY,MAAM,QAAS,KAAK,QAAQ,WAAW,MAAM;AAC/G;AAGA,MAAa,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE;AA4BzC,IAAa,eAAb,MAAa,qBAAqB,MAAM;CAMtC,iBAA0B;CAE1B;CACA;CACA;CAEA;CAEA;CAEA,YAAY,MAOT;EACD,MAAM,KAAK,OAAO;EAClB,KAAK,OAAO;EACZ,KAAK,SAAS,KAAK;EACnB,KAAK,OAAO,KAAK;EACjB,KAAK,YAAY,KAAK;EACtB,KAAK,eAAe,KAAK;EACzB,KAAK,UAAU,KAAK;CACtB;CAGA,IAAI,YAAqB;EACvB,OAAO,KAAK,WAAW,OAAO,KAAK,UAAU;CAC/C;CAOA,OAAO,GAAG,OAAuC;EAC/C,OACE,iBAAiB,gBAChB,OAAO,UAAU,YAAY,UAAU,QAAS,MAAuC,mBAAmB;CAE/G;AACF"}

package/dist/index.d.cts

@@ -1,24 +1,6 @@
-import { z } from 'zod';
-export { C as CLIENT_ID_HEADER, a as CLIENT_SECRET_HEADER, b as CONTRACT_VERSION, c as CONTRACT_VERSION_HEADER, D as DEVICE_ID_HEADER, R as REQUEST_ID_HEADER, W as WRITE_KEY_HEADER } from './version-BANKB6Og.cjs';
-
-/**
- * `@reopt-ai/data-contract` — the wire contract between reopt-data and its
- * server-credential consumers (RFC-0023).
- *
- * Subpaths:
- *   `@reopt-ai/data-contract`         this module — version, shared primitives, errors
- *   `@reopt-ai/data-contract/ingest`  POST /api/track request + response schemas
- *   `@reopt-ai/data-contract/query`   POST /api/v1/query/* request + response schemas
- *   `@reopt-ai/data-contract/control` provisioning request + response schemas
- *   `@reopt-ai/data-contract/client`  createDataClient() — typed fetch over all
- *   `@reopt-ai/data-contract/events`   event names + property keys (no zod)
- *   `@reopt-ai/data-contract/identity` cookie/header names and encodings shared by
- *                                     the SDKs, the Next.js proxy and ingest
- *
- * Only `/client` touches `fetch`; everything else is pure zod. The single
- * runtime dependency is zod, deliberately — consumers bundle this.
- */
-
+import { a as DEVICE_ID_HEADER, i as CONTRACT_VERSION_HEADER, n as CLIENT_SECRET_HEADER, o as REQUEST_ID_HEADER, r as CONTRACT_VERSION, s as WRITE_KEY_HEADER, t as CLIENT_ID_HEADER } from "./version-CGujUGWd.cjs";
+import { z } from "zod";
+//#region src/index.d.ts
 /**
  * A real calendar date. The query's resolved IANA zone decides which instants
  * its inclusive day covers.
@@ -32,8 +14,8 @@ declare const zInstant: z.ZodString;
  * (`"ingest"` / `"query"` / `"provision"`).
  */
 interface ClientCredentials {
-    clientId: string;
-    clientSecret: string;
+  clientId: string;
+  clientSecret: string;
 }
 /**
  * Credentials are optional on the client itself because the provisioning
@@ -51,35 +33,36 @@ type OptionalClientCredentials = Partial<ClientCredentials>;
  * itself raises (`contract_mismatch`, `network_error`).
  */
 declare class DataApiError extends Error {
-    /**
-     * Brand for {@link DataApiError.is}. A bundler that inlines this module into
-     * more than one entry point produces two distinct classes, and `instanceof`
-     * silently stops matching — the brand survives that, and realm boundaries.
-     */
-    readonly isDataApiError: true;
-    readonly status: number;
-    readonly code: string;
-    readonly requestId?: string;
-    /** Parsed from `Retry-After`, in milliseconds. Only set on 429. */
-    readonly retryAfterMs?: number;
-    /** zod issues for `validation_failed`, or the raw body when unparseable. */
-    readonly details?: unknown;
-    constructor(init: {
-        message: string;
-        status: number;
-        code: string;
-        requestId?: string;
-        retryAfterMs?: number;
-        details?: unknown;
-    });
-    /** 429 and 5xx are worth retrying; 4xx are the caller's fault and are not. */
-    get retryable(): boolean;
-    /**
-     * Prefer this over `instanceof` in a `catch`. It holds even when the class
-     * has been duplicated — across CJS entry points, across bundler chunks, or
-     * across realms — where `instanceof` quietly returns false.
-     */
-    static is(value: unknown): value is DataApiError;
+  /**
+   * Brand for {@link DataApiError.is}. A bundler that inlines this module into
+   * more than one entry point produces two distinct classes, and `instanceof`
+   * silently stops matching — the brand survives that, and realm boundaries.
+   */
+  readonly isDataApiError: true;
+  readonly status: number;
+  readonly code: string;
+  readonly requestId?: string | undefined;
+  /** Parsed from `Retry-After`, in milliseconds. Only set on 429. */
+  readonly retryAfterMs?: number | undefined;
+  /** zod issues for `validation_failed`, or the raw body when unparseable. */
+  readonly details?: unknown | undefined;
+  constructor(init: {
+    message: string;
+    status: number;
+    code: string;
+    requestId?: string | undefined;
+    retryAfterMs?: number | undefined;
+    details?: unknown | undefined;
+  });
+  /** 429 and 5xx are worth retrying; 4xx are the caller's fault and are not. */
+  get retryable(): boolean;
+  /**
+   * Prefer this over `instanceof` in a `catch`. It holds even when the class
+   * has been duplicated — across CJS entry points, across bundler chunks, or
+   * across realms — where `instanceof` quietly returns false.
+   */
+  static is(value: unknown): value is DataApiError;
 }
-
-export { type ClientCredentials, DataApiError, type OptionalClientCredentials, zDate, zInstant };
+//#endregion
+export { CLIENT_ID_HEADER, CLIENT_SECRET_HEADER, CONTRACT_VERSION, CONTRACT_VERSION_HEADER, ClientCredentials, DEVICE_ID_HEADER, DataApiError, OptionalClientCredentials, REQUEST_ID_HEADER, WRITE_KEY_HEADER, zDate, zInstant };
+//# sourceMappingURL=index.d.cts.map

package/dist/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../src/index.ts"],"mappings":";;;;;;;cAiCa,OAAK,EAAA;;cAaL,UAAQ,EAAA;;;;;;UAOJ;EACf;EACA;;;;;;;;;;;;KAaU,4BAA4B,QAAQ;;;;;cAMnC,qBAAqB;;;;;;WAMvB;WAEA;WACA;WACA;;WAEA;;WAEA;EAEG,YAAA;IACV;IACA;IACA;IACA;IACA;IACA;;;MAYE;;;;;;SASG,GAAG,iBAAiB,SAAS"}

package/dist/index.d.ts

@@ -1,24 +1,6 @@
-import { z } from 'zod';
-export { C as CLIENT_ID_HEADER, a as CLIENT_SECRET_HEADER, b as CONTRACT_VERSION, c as CONTRACT_VERSION_HEADER, D as DEVICE_ID_HEADER, R as REQUEST_ID_HEADER, W as WRITE_KEY_HEADER } from './version-BANKB6Og.js';
-
-/**
- * `@reopt-ai/data-contract` — the wire contract between reopt-data and its
- * server-credential consumers (RFC-0023).
- *
- * Subpaths:
- *   `@reopt-ai/data-contract`         this module — version, shared primitives, errors
- *   `@reopt-ai/data-contract/ingest`  POST /api/track request + response schemas
- *   `@reopt-ai/data-contract/query`   POST /api/v1/query/* request + response schemas
- *   `@reopt-ai/data-contract/control` provisioning request + response schemas
- *   `@reopt-ai/data-contract/client`  createDataClient() — typed fetch over all
- *   `@reopt-ai/data-contract/events`   event names + property keys (no zod)
- *   `@reopt-ai/data-contract/identity` cookie/header names and encodings shared by
- *                                     the SDKs, the Next.js proxy and ingest
- *
- * Only `/client` touches `fetch`; everything else is pure zod. The single
- * runtime dependency is zod, deliberately — consumers bundle this.
- */
-
+import { a as DEVICE_ID_HEADER, i as CONTRACT_VERSION_HEADER, n as CLIENT_SECRET_HEADER, o as REQUEST_ID_HEADER, r as CONTRACT_VERSION, s as WRITE_KEY_HEADER, t as CLIENT_ID_HEADER } from "./version-CGujUGWd.js";
+import { z } from "zod";
+//#region src/index.d.ts
 /**
  * A real calendar date. The query's resolved IANA zone decides which instants
  * its inclusive day covers.
@@ -32,8 +14,8 @@ declare const zInstant: z.ZodString;
  * (`"ingest"` / `"query"` / `"provision"`).
  */
 interface ClientCredentials {
-    clientId: string;
-    clientSecret: string;
+  clientId: string;
+  clientSecret: string;
 }
 /**
  * Credentials are optional on the client itself because the provisioning
@@ -51,35 +33,36 @@ type OptionalClientCredentials = Partial<ClientCredentials>;
  * itself raises (`contract_mismatch`, `network_error`).
  */
 declare class DataApiError extends Error {
-    /**
-     * Brand for {@link DataApiError.is}. A bundler that inlines this module into
-     * more than one entry point produces two distinct classes, and `instanceof`
-     * silently stops matching — the brand survives that, and realm boundaries.
-     */
-    readonly isDataApiError: true;
-    readonly status: number;
-    readonly code: string;
-    readonly requestId?: string;
-    /** Parsed from `Retry-After`, in milliseconds. Only set on 429. */
-    readonly retryAfterMs?: number;
-    /** zod issues for `validation_failed`, or the raw body when unparseable. */
-    readonly details?: unknown;
-    constructor(init: {
-        message: string;
-        status: number;
-        code: string;
-        requestId?: string;
-        retryAfterMs?: number;
-        details?: unknown;
-    });
-    /** 429 and 5xx are worth retrying; 4xx are the caller's fault and are not. */
-    get retryable(): boolean;
-    /**
-     * Prefer this over `instanceof` in a `catch`. It holds even when the class
-     * has been duplicated — across CJS entry points, across bundler chunks, or
-     * across realms — where `instanceof` quietly returns false.
-     */
-    static is(value: unknown): value is DataApiError;
+  /**
+   * Brand for {@link DataApiError.is}. A bundler that inlines this module into
+   * more than one entry point produces two distinct classes, and `instanceof`
+   * silently stops matching — the brand survives that, and realm boundaries.
+   */
+  readonly isDataApiError: true;
+  readonly status: number;
+  readonly code: string;
+  readonly requestId?: string | undefined;
+  /** Parsed from `Retry-After`, in milliseconds. Only set on 429. */
+  readonly retryAfterMs?: number | undefined;
+  /** zod issues for `validation_failed`, or the raw body when unparseable. */
+  readonly details?: unknown | undefined;
+  constructor(init: {
+    message: string;
+    status: number;
+    code: string;
+    requestId?: string | undefined;
+    retryAfterMs?: number | undefined;
+    details?: unknown | undefined;
+  });
+  /** 429 and 5xx are worth retrying; 4xx are the caller's fault and are not. */
+  get retryable(): boolean;
+  /**
+   * Prefer this over `instanceof` in a `catch`. It holds even when the class
+   * has been duplicated — across CJS entry points, across bundler chunks, or
+   * across realms — where `instanceof` quietly returns false.
+   */
+  static is(value: unknown): value is DataApiError;
 }
-
-export { type ClientCredentials, DataApiError, type OptionalClientCredentials, zDate, zInstant };
+//#endregion
+export { CLIENT_ID_HEADER, CLIENT_SECRET_HEADER, CONTRACT_VERSION, CONTRACT_VERSION_HEADER, ClientCredentials, DEVICE_ID_HEADER, DataApiError, OptionalClientCredentials, REQUEST_ID_HEADER, WRITE_KEY_HEADER, zDate, zInstant };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";;;;;;;cAiCa,OAAK,EAAA;;cAaL,UAAQ,EAAA;;;;;;UAOJ;EACf;EACA;;;;;;;;;;;;KAaU,4BAA4B,QAAQ;;;;;cAMnC,qBAAqB;;;;;;WAMvB;WAEA;WACA;WACA;;WAEA;;WAEA;EAEG,YAAA;IACV;IACA;IACA;IACA;IACA;IACA;;;MAYE;;;;;;SASG,GAAG,iBAAiB,SAAS"}

package/dist/index.js

@@ -1,27 +1,38 @@
-import {
-  DataApiError,
-  zDate,
-  zInstant
-} from "./chunk-33BCA2LH.js";
-import {
-  CLIENT_ID_HEADER,
-  CLIENT_SECRET_HEADER,
-  CONTRACT_VERSION,
-  CONTRACT_VERSION_HEADER,
-  DEVICE_ID_HEADER,
-  REQUEST_ID_HEADER,
-  WRITE_KEY_HEADER
-} from "./chunk-ZCKVMUIQ.js";
-export {
-  CLIENT_ID_HEADER,
-  CLIENT_SECRET_HEADER,
-  CONTRACT_VERSION,
-  CONTRACT_VERSION_HEADER,
-  DEVICE_ID_HEADER,
-  DataApiError,
-  REQUEST_ID_HEADER,
-  WRITE_KEY_HEADER,
-  zDate,
-  zInstant
+import { a as DEVICE_ID_HEADER, i as CONTRACT_VERSION_HEADER, n as CLIENT_SECRET_HEADER, o as REQUEST_ID_HEADER, r as CONTRACT_VERSION, s as WRITE_KEY_HEADER, t as CLIENT_ID_HEADER } from "./version-C09Cyf4R.js";
+import { z } from "zod";
+//#region src/index.ts
+const zDate = z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "expected YYYY-MM-DD").refine(isRealCalendarDate, "date does not exist");
+function isRealCalendarDate(value) {
+	if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) return false;
+	const [year, month, day] = value.split("-").map(Number);
+	const instant = new Date(Date.UTC(year, month - 1, day));
+	return instant.getUTCFullYear() === year && instant.getUTCMonth() === month - 1 && instant.getUTCDate() === day;
+}
+const zInstant = z.string().min(20);
+var DataApiError = class DataApiError extends Error {
+	isDataApiError = true;
+	status;
+	code;
+	requestId;
+	retryAfterMs;
+	details;
+	constructor(init) {
+		super(init.message);
+		this.name = "DataApiError";
+		this.status = init.status;
+		this.code = init.code;
+		this.requestId = init.requestId;
+		this.retryAfterMs = init.retryAfterMs;
+		this.details = init.details;
+	}
+	get retryable() {
+		return this.status === 429 || this.status >= 500;
+	}
+	static is(value) {
+		return value instanceof DataApiError || typeof value === "object" && value !== null && value.isDataApiError === true;
+	}
 };
+//#endregion
+export { CLIENT_ID_HEADER, CLIENT_SECRET_HEADER, CONTRACT_VERSION, CONTRACT_VERSION_HEADER, DEVICE_ID_HEADER, DataApiError, REQUEST_ID_HEADER, WRITE_KEY_HEADER, zDate, zInstant };
+
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * `@reopt-ai/data-contract` — the wire contract between reopt-data and its\n * server-credential consumers (RFC-0023).\n *\n * Subpaths:\n *   `@reopt-ai/data-contract`         this module — version, shared primitives, errors\n *   `@reopt-ai/data-contract/ingest`  POST /api/track request + response schemas\n *   `@reopt-ai/data-contract/query`   POST /api/v1/query/* request + response schemas\n *   `@reopt-ai/data-contract/control` provisioning request + response schemas\n *   `@reopt-ai/data-contract/client`  createDataClient() — typed fetch over all\n *   `@reopt-ai/data-contract/events`   event names + property keys (no zod)\n *   `@reopt-ai/data-contract/identity` cookie/header names and encodings shared by\n *                                     the SDKs, the Next.js proxy and ingest\n *\n * Only `/client` touches `fetch`; everything else is pure zod. The single\n * runtime dependency is zod, deliberately — consumers bundle this.\n */\nimport { z } from \"zod\";\n\nexport {\n  CONTRACT_VERSION,\n  CONTRACT_VERSION_HEADER,\n  CLIENT_ID_HEADER,\n  CLIENT_SECRET_HEADER,\n  WRITE_KEY_HEADER,\n  DEVICE_ID_HEADER,\n  REQUEST_ID_HEADER,\n} from \"./version.js\";\n\n/**\n * A real calendar date. The query's resolved IANA zone decides which instants\n * its inclusive day covers.\n */\nexport const zDate = z\n  .string()\n  .regex(/^\\d{4}-\\d{2}-\\d{2}$/, \"expected YYYY-MM-DD\")\n  .refine(isRealCalendarDate, \"date does not exist\");\n\nfunction isRealCalendarDate(value: string): boolean {\n  if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(value)) return false;\n  const [year, month, day] = value.split(\"-\").map(Number);\n  const instant = new Date(Date.UTC(year!, month! - 1, day!));\n  return instant.getUTCFullYear() === year && instant.getUTCMonth() === month! - 1 && instant.getUTCDate() === day;\n}\n\n/** ISO-8601 instant, as produced by `Date#toISOString()`. */\nexport const zInstant = z.string().min(20);\n\n/**\n * Client credentials. The same pair authenticates both planes; what a given\n * client may reach is decided server-side by `Client.scopes`\n * (`\"ingest\"` / `\"query\"` / `\"provision\"`).\n */\nexport interface ClientCredentials {\n  clientId: string;\n  clientSecret: string;\n}\n\n/**\n * Credentials are optional on the client itself because the provisioning\n * surface does not use them — it authenticates per call with a platform or\n * organization key. A caller that only provisions should not have to invent an\n * empty client id to satisfy a constructor.\n *\n * Reaching ingest or query without them fails with `credentials_missing`\n * rather than sending an unauthenticated request and reporting the 401 as a\n * server problem.\n */\nexport type OptionalClientCredentials = Partial<ClientCredentials>;\n\n/**\n * Every non-2xx response from either plane, plus the two failures the client\n * itself raises (`contract_mismatch`, `network_error`).\n */\nexport class DataApiError extends Error {\n  /**\n   * Brand for {@link DataApiError.is}. A bundler that inlines this module into\n   * more than one entry point produces two distinct classes, and `instanceof`\n   * silently stops matching — the brand survives that, and realm boundaries.\n   */\n  readonly isDataApiError = true as const;\n\n  readonly status: number;\n  readonly code: string;\n  readonly requestId?: string | undefined;\n  /** Parsed from `Retry-After`, in milliseconds. Only set on 429. */\n  readonly retryAfterMs?: number | undefined;\n  /** zod issues for `validation_failed`, or the raw body when unparseable. */\n  readonly details?: unknown | undefined;\n\n  constructor(init: {\n    message: string;\n    status: number;\n    code: string;\n    requestId?: string | undefined;\n    retryAfterMs?: number | undefined;\n    details?: unknown | undefined;\n  }) {\n    super(init.message);\n    this.name = \"DataApiError\";\n    this.status = init.status;\n    this.code = init.code;\n    this.requestId = init.requestId;\n    this.retryAfterMs = init.retryAfterMs;\n    this.details = init.details;\n  }\n\n  /** 429 and 5xx are worth retrying; 4xx are the caller's fault and are not. */\n  get retryable(): boolean {\n    return this.status === 429 || this.status >= 500;\n  }\n\n  /**\n   * Prefer this over `instanceof` in a `catch`. It holds even when the class\n   * has been duplicated — across CJS entry points, across bundler chunks, or\n   * across realms — where `instanceof` quietly returns false.\n   */\n  static is(value: unknown): value is DataApiError {\n    return (\n      value instanceof DataApiError ||\n      (typeof value === \"object\" && value !== null && (value as { isDataApiError?: unknown }).isDataApiError === true)\n    );\n  }\n}\n"],"mappings":";;;AAiCA,MAAa,QAAQ,EAClB,OAAO,CAAC,CACR,MAAM,uBAAuB,qBAAqB,CAAC,CACnD,OAAO,oBAAoB,qBAAqB;AAEnD,SAAS,mBAAmB,OAAwB;CAClD,IAAI,CAAC,sBAAsB,KAAK,KAAK,GAAG,OAAO;CAC/C,MAAM,CAAC,MAAM,OAAO,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;CACtD,MAAM,UAAU,IAAI,KAAK,KAAK,IAAI,MAAO,QAAS,GAAG,GAAI,CAAC;CAC1D,OAAO,QAAQ,eAAe,MAAM,QAAQ,QAAQ,YAAY,MAAM,QAAS,KAAK,QAAQ,WAAW,MAAM;AAC/G;AAGA,MAAa,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE;AA4BzC,IAAa,eAAb,MAAa,qBAAqB,MAAM;CAMtC,iBAA0B;CAE1B;CACA;CACA;CAEA;CAEA;CAEA,YAAY,MAOT;EACD,MAAM,KAAK,OAAO;EAClB,KAAK,OAAO;EACZ,KAAK,SAAS,KAAK;EACnB,KAAK,OAAO,KAAK;EACjB,KAAK,YAAY,KAAK;EACtB,KAAK,eAAe,KAAK;EACzB,KAAK,UAAU,KAAK;CACtB;CAGA,IAAI,YAAqB;EACvB,OAAO,KAAK,WAAW,OAAO,KAAK,UAAU;CAC/C;CAOA,OAAO,GAAG,OAAuC;EAC/C,OACE,iBAAiB,gBAChB,OAAO,UAAU,YAAY,UAAU,QAAS,MAAuC,mBAAmB;CAE/G;AACF"}