@seamless-auth/types 0.1.3 → 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,55 @@
+# @seamless-auth/types
+
+## 0.3.0
+
+### Minor Changes
+
+- f180c99: Add a Zod-free entry point for role matching.
+
+  `ROLE_NAME_PATTERN`, `roleGrantsAccess`, and `hasScopedRole` moved to
+  `src/schemas/role/matching.ts`, which imports nothing at runtime. Two subpath
+  exports expose it: `@seamless-auth/types/role/matching` for the matchers alone,
+  and `@seamless-auth/types/role` for those plus `RoleNameSchema`. Consumers on
+  the authorization path can now match roles without loading Zod or the schema
+  barrel.
+
+  The package also declares `"sideEffects": false` so bundlers can tree-shake the
+  barrel.
+
+  This is additive. The package root still exports everything it did before, and
+  the matching behavior is unchanged.
+
+## 0.2.0
+
+### Minor Changes
+
+- 1ed40c9: Consolidate the domain models and API contracts that were duplicated across the
+  ecosystem repos into this package. New modules: `common`, `role`, `messaging`,
+  `systemConfig`, `oauth`, `webauthn`, `totp`, `stepUp`, `organization`, `me`,
+  `metrics`, and `admin`. The `user`, `credential`, `session`, `authEvent`, and
+  `auth` modules gained the request, response, and query schemas that consumers
+  were previously declaring for themselves.
+
+  Three existing schemas changed. All three accept more than they used to, so they
+  are not breaking at runtime, but each changes an inferred TypeScript type:
+  - `TransportSchema` covers the full WebAuthn `AuthenticatorTransportFuture` set.
+    The old enum rejected `hybrid`, which is what cross-device passkeys report.
+  - `CreateUserSchema` and `UpdateUserSchema` accept a null phone, matching what
+    the auth API already accepts.
+  - `OrganizationSchema` parses `createdAt` and `updatedAt` as ISO date strings
+    rather than `z.any()`.
+
+  `AUTH_EVENT_TYPES` now holds 74 entries: the union of the auth API's and the
+  admin dashboard's lists, minus the `bootstrap_admin_*` pair for functionality
+  that has been removed.
+
+### Patch Changes
+
+- 19cc93c: Correct the published package metadata. The `exports` map now declares its `types`
+  condition explicitly, so consumers on `node16` or `nodenext` module resolution
+  resolve declarations through it rather than falling back. The `license` field uses
+  the current `AGPL-3.0-only` SPDX identifier instead of the deprecated `AGPL-3.0`,
+  and `CHANGELOG.md` ships with the package.
+
+  `npm run build` now clears `dist/` first, so a build no longer carries stale
+  artifacts from a previous branch into the tarball.

package/README.md

@@ -42,6 +42,26 @@ import { UserSchema } from '@seamless-auth/types';
 const user = UserSchema.parse(data);
 ```
 
+User role schemas accept plain roles such as `admin` and colon-separated scoped roles such as
+`admin:read` and `admin:write`. Whitespace, underscores, slashes, and backslashes are rejected.
+
+### Match roles without Zod
+
+`roleGrantsAccess` and `hasScopedRole` are plain string logic, but reaching them through the
+package root loads Zod and every schema in the barrel. Code on the authorization hot path can
+import them from `@seamless-auth/types/role/matching` instead, which has no runtime dependencies:
+
+```ts
+import { hasScopedRole } from '@seamless-auth/types/role/matching';
+
+if (!hasScopedRole(user.roles, 'billing:invoices:read')) {
+  throw new Error('forbidden');
+}
+```
+
+`@seamless-auth/types/role` adds `RoleNameSchema` on top of the same matchers, and the package
+root still exports all of them, so existing imports keep working.
+
 ### Infer types
 
 ```ts
@@ -54,6 +74,40 @@ function handleUser(user: User) {
 
 ---
 
+## Modules
+
+Every module is re-exported from the package root, so import from
+`@seamless-auth/types` unless one of the subpath exports below fits better.
+
+| Module         | Covers                                                              |
+| -------------- | ------------------------------------------------------------------- |
+| `common`       | Pagination, message and error envelopes, metadata                   |
+| `role`         | Role name rules plus the scoped-role matcher (`roleGrantsAccess`)   |
+| `user`         | User domain model, wire shape, create and update requests           |
+| `credential`   | WebAuthn credentials and their API responses                        |
+| `session`      | Sessions and session listings                                       |
+| `authEvent`    | Auth event model, the event type enum, and event queries            |
+| `messaging`    | Email and SMS message shapes plus auth delivery instructions        |
+| `systemConfig` | System config, login methods, lockout policy, OAuth provider config |
+| `auth`         | Login, refresh, registration, OTP, magic link, and logout contracts |
+| `oauth`        | Public provider listings and the OAuth login handshake              |
+| `webauthn`     | Registration and assertion request and response contracts           |
+| `totp`         | TOTP enrollment, status, and verification                           |
+| `stepUp`       | Step-up freshness status                                            |
+| `organization` | Organizations, memberships, and the org switch response             |
+| `me`           | The caller's own user and `GET /users/me`                           |
+| `metrics`      | Dashboard metrics, timeseries, and security anomalies               |
+| `admin`        | Admin-only user detail, anomalies, and device replacement recovery  |
+
+### Subpath exports
+
+| Subpath                              | Covers                                 |
+| ------------------------------------ | -------------------------------------- |
+| `@seamless-auth/types/role`          | Role name schema plus the matchers     |
+| `@seamless-auth/types/role/matching` | The matchers alone, with no Zod import |
+
+---
+
 ## Zod as the Source of Truth
 
 All models are defined using Zod:

package/dist/index.d.ts

@@ -1,6 +1,19 @@
+export * from './shared.js';
+export * from './schemas/common/schema.js';
+export * from './schemas/role/schema.js';
 export * from './schemas/user/schema.js';
 export * from './schemas/credential/schema.js';
-export * from './schemas/auth/auth.schema.js';
-export * from './schemas/authEvent/schema.js';
 export * from './schemas/session/schema.js';
+export * from './schemas/authEvent/schema.js';
+export * from './schemas/messaging/schema.js';
+export * from './schemas/systemConfig/schema.js';
+export * from './schemas/auth/auth.schema.js';
+export * from './schemas/oauth/schema.js';
+export * from './schemas/webauthn/schema.js';
+export * from './schemas/totp/schema.js';
+export * from './schemas/stepUp/schema.js';
+export * from './schemas/organization/schema.js';
+export * from './schemas/me/schema.js';
+export * from './schemas/metrics/schema.js';
+export * from './schemas/admin/schema.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAE5B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kCAAkC,CAAC;AACjD,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC"}

package/dist/index.js

@@ -1,6 +1,19 @@
+export * from './shared.js';
+export * from './schemas/common/schema.js';
+export * from './schemas/role/schema.js';
 export * from './schemas/user/schema.js';
 export * from './schemas/credential/schema.js';
-export * from './schemas/auth/auth.schema.js';
-export * from './schemas/authEvent/schema.js';
 export * from './schemas/session/schema.js';
+export * from './schemas/authEvent/schema.js';
+export * from './schemas/messaging/schema.js';
+export * from './schemas/systemConfig/schema.js';
+export * from './schemas/auth/auth.schema.js';
+export * from './schemas/oauth/schema.js';
+export * from './schemas/webauthn/schema.js';
+export * from './schemas/totp/schema.js';
+export * from './schemas/stepUp/schema.js';
+export * from './schemas/organization/schema.js';
+export * from './schemas/me/schema.js';
+export * from './schemas/metrics/schema.js';
+export * from './schemas/admin/schema.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAE5B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kCAAkC,CAAC;AACjD,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC"}

package/dist/schemas/admin/schema.d.ts

@@ -0,0 +1,99 @@
+import { z } from 'zod';
+export declare const UserIdParamSchema: z.ZodObject<{
+    userId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * What an operator clears when a user replaces a lost device. Each step is
+ * opt-out rather than opt-in so a hurried recovery does not leave the old
+ * device's credentials in place.
+ */
+export declare const DeviceReplacementRecoverySchema: z.ZodObject<{
+    revokeSessions: z.ZodDefault<z.ZodBoolean>;
+    removePasskeys: z.ZodDefault<z.ZodBoolean>;
+    disableTotp: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export type DeviceReplacementRecoveryRequest = z.infer<typeof DeviceReplacementRecoverySchema>;
+export declare const DeviceReplacementRecoveryResponseSchema: z.ZodObject<{
+    userId: z.ZodString;
+    revokedSessions: z.ZodNumber;
+    removedCredentials: z.ZodNumber;
+    disabledTotpCredentials: z.ZodNumber;
+}, z.core.$strip>;
+export type DeviceReplacementRecoveryResponse = z.infer<typeof DeviceReplacementRecoveryResponseSchema>;
+export declare const AdminUserDetailResponseSchema: z.ZodObject<{
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodEmail;
+        phone: z.ZodNullable<z.ZodString>;
+        roles: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        revoked: z.ZodOptional<z.ZodBoolean>;
+        emailVerified: z.ZodOptional<z.ZodBoolean>;
+        phoneVerified: z.ZodOptional<z.ZodBoolean>;
+        verified: z.ZodOptional<z.ZodBoolean>;
+        lastLogin: z.ZodOptional<z.ZodNullable<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>>;
+        createdAt: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
+        updatedAt: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
+    }, z.core.$strict>;
+    sessions: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        deviceName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        ipAddress: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        userAgent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        lastUsedAt: z.ZodString;
+        expiresAt: z.ZodString;
+        current: z.ZodBoolean;
+    }, z.core.$strip>>;
+    credentials: z.ZodArray<z.ZodObject<{
+        platform: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        id: z.ZodString;
+        browser: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        createdAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+        counter: z.ZodNumber;
+        transports: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            ble: "ble";
+            hybrid: "hybrid";
+            internal: "internal";
+            nfc: "nfc";
+            usb: "usb";
+            cable: "cable";
+            "smart-card": "smart-card";
+        }>>>;
+        deviceType: z.ZodOptional<z.ZodEnum<{
+            singleDevice: "singleDevice";
+            multiDevice: "multiDevice";
+        }>>;
+        friendlyName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>>;
+        deviceInfo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        backedup: z.ZodBoolean;
+        backedUp: z.ZodBoolean;
+        prfCapable: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    events: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        type: z.ZodString;
+        ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        created_at: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+        updated_at: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AdminUserDetailResponse = z.infer<typeof AdminUserDetailResponseSchema>;
+export declare const AdminUserAnomaliesResponseSchema: z.ZodObject<{
+    suspiciousEvents: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        type: z.ZodString;
+        ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        created_at: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+        updated_at: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+    }, z.core.$strip>>;
+    relatedIps: z.ZodArray<z.ZodString>;
+    relatedAgents: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type AdminUserAnomaliesResponse = z.infer<typeof AdminUserAnomaliesResponseSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schemas/admin/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,+BAA+B;;;;kBAMjC,CAAC;AAEZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE/F,eAAO,MAAM,uCAAuC;;;;;iBAKlD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;iBAI3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}

package/dist/schemas/admin/schema.js

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+import { AuthEventSchema } from '../authEvent/schema.js';
+import { CredentialResponseSchema } from '../credential/schema.js';
+import { SessionSchema } from '../session/schema.js';
+import { ApiUserSchema } from '../user/schema.js';
+export const UserIdParamSchema = z.object({
+    userId: z.string(),
+});
+/**
+ * What an operator clears when a user replaces a lost device. Each step is
+ * opt-out rather than opt-in so a hurried recovery does not leave the old
+ * device's credentials in place.
+ */
+export const DeviceReplacementRecoverySchema = z
+    .object({
+    revokeSessions: z.boolean().default(true),
+    removePasskeys: z.boolean().default(true),
+    disableTotp: z.boolean().default(true),
+})
+    .strict();
+export const DeviceReplacementRecoveryResponseSchema = z.object({
+    userId: z.string(),
+    revokedSessions: z.number().int().nonnegative(),
+    removedCredentials: z.number().int().nonnegative(),
+    disabledTotpCredentials: z.number().int().nonnegative(),
+});
+export const AdminUserDetailResponseSchema = z.object({
+    user: ApiUserSchema,
+    sessions: z.array(SessionSchema),
+    credentials: z.array(CredentialResponseSchema),
+    events: z.array(AuthEventSchema),
+});
+export const AdminUserAnomaliesResponseSchema = z.object({
+    suspiciousEvents: z.array(AuthEventSchema),
+    relatedIps: z.array(z.string()),
+    relatedAgents: z.array(z.string()),
+});
+//# sourceMappingURL=schema.js.map

package/dist/schemas/admin/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAClD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxD,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC"}

package/dist/schemas/auth/auth.schema.d.ts

@@ -1,6 +1,164 @@
 import z from 'zod';
+export declare const IdentifierTypeSchema: z.ZodEnum<{
+    email: "email";
+    phone: "phone";
+}>;
+export type IdentifierType = z.infer<typeof IdentifierTypeSchema>;
 export declare const LoginRequestSchema: z.ZodObject<{
     identifier: z.ZodString;
+    passkeyAvailable: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
+export type LoginRequest = z.infer<typeof LoginRequestSchema>;
+export declare const LoginSuccessResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+    sub: z.ZodOptional<z.ZodString>;
+    identifierType: z.ZodOptional<z.ZodEnum<{
+        email: "email";
+        phone: "phone";
+    }>>;
+    loginMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        passkey: "passkey";
+        magic_link: "magic_link";
+        email_otp: "email_otp";
+        phone_otp: "phone_otp";
+        oauth: "oauth";
+    }>>>;
+    ttl: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type LoginSuccessResponse = z.infer<typeof LoginSuccessResponseSchema>;
 export declare const RefreshTokenRequestSchema: z.ZodObject<{}, z.core.$strip>;
+/** @deprecated Use {@link RefreshTokenRequestSchema}. */
+export declare const RefreshRequestSchema: z.ZodObject<{}, z.core.$strip>;
+/**
+ * The token envelope every completed authentication returns, whatever the
+ * method. `sessionId` is only present where the flow names the session it
+ * created; OTP, magic link, and OAuth completions omit it.
+ */
+export declare const RefreshSuccessResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    sub: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    email: z.ZodOptional<z.ZodString>;
+    phone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    ttl: z.ZodOptional<z.ZodNumber>;
+    refreshTtl: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type RefreshSuccessResponse = z.infer<typeof RefreshSuccessResponseSchema>;
+export declare const LogoutScopeSchema: z.ZodEnum<{
+    current_session: "current_session";
+    all_sessions: "all_sessions";
+}>;
+export type LogoutScope = z.infer<typeof LogoutScopeSchema>;
+export declare const RegistrationRequestSchema: z.ZodObject<{
+    email: z.ZodEmail;
+    phone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type RegistrationRequest = z.infer<typeof RegistrationRequestSchema>;
+export declare const RegistrationSuccessSchema: z.ZodObject<{
+    message: z.ZodString;
+    sub: z.ZodOptional<z.ZodString>;
+    token: z.ZodOptional<z.ZodString>;
+    ttl: z.ZodOptional<z.ZodString>;
+    delivery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"otp_email">;
+        to: z.ZodString;
+        token: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"otp_sms">;
+        to: z.ZodString;
+        token: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"magic_link_email">;
+        to: z.ZodString;
+        token: z.ZodOptional<z.ZodString>;
+        magicLinkUrl: z.ZodString;
+    }, z.core.$strip>], "kind">>;
+}, z.core.$strip>;
+export type RegistrationSuccessResponse = z.infer<typeof RegistrationSuccessSchema>;
+export declare const RegisterPhoneRequestSchema: z.ZodObject<{
+    phone: z.ZodString;
+}, z.core.$strip>;
+export declare const RegisterPhoneSuccessSchema: z.ZodObject<{
+    message: z.ZodString;
+    phone: z.ZodString;
+    delivery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"otp_email">;
+        to: z.ZodString;
+        token: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"otp_sms">;
+        to: z.ZodString;
+        token: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"magic_link_email">;
+        to: z.ZodString;
+        token: z.ZodOptional<z.ZodString>;
+        magicLinkUrl: z.ZodString;
+    }, z.core.$strip>], "kind">>;
+}, z.core.$strip>;
+export declare const VerifyOTPRequestSchema: z.ZodObject<{
+    verificationToken: z.ZodString;
+}, z.core.$strip>;
+export declare const OTPVerifyTokenSuccessSchema: z.ZodObject<{
+    sub: z.ZodOptional<z.ZodString>;
+    message: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    phone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token: z.ZodOptional<z.ZodString>;
+    ttl: z.ZodOptional<z.ZodNumber>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    refreshTtl: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare const MagicLinkVerifyParamsSchema: z.ZodObject<{
+    token: z.ZodString;
+}, z.core.$strip>;
+export declare const MagicLinkPollSuccessSchema: z.ZodObject<{
+    sub: z.ZodOptional<z.ZodString>;
+    message: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    phone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token: z.ZodOptional<z.ZodString>;
+    ttl: z.ZodOptional<z.ZodNumber>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    refreshTtl: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/** Body for endpoints that acknowledge a request and may hand back a delivery. */
+export declare const AuthMessageResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+    delivery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"otp_email">;
+        to: z.ZodString;
+        token: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"otp_sms">;
+        to: z.ZodString;
+        token: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"magic_link_email">;
+        to: z.ZodString;
+        token: z.ZodOptional<z.ZodString>;
+        magicLinkUrl: z.ZodString;
+    }, z.core.$strip>], "kind">>;
+}, z.core.$strip>;
+export type AuthMessageResponse = z.infer<typeof AuthMessageResponseSchema>;
+/** The access token's claims, as a resource server reads them off a request. */
+export declare const SeamlessAuthUserSchema: z.ZodObject<{
+    id: z.ZodString;
+    roles: z.ZodArray<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    phone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    iat: z.ZodOptional<z.ZodNumber>;
+    exp: z.ZodOptional<z.ZodNumber>;
+    token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SeamlessAuthUser = z.infer<typeof SeamlessAuthUserSchema>;
 //# sourceMappingURL=auth.schema.d.ts.map

package/dist/schemas/auth/auth.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/auth/auth.schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AAEH,eAAO,MAAM,yBAAyB,gCAAe,CAAC"}
+{"version":3,"file":"auth.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/auth/auth.schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAIpB,eAAO,MAAM,oBAAoB;;;EAA6B,CAAC;AAE/D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;iBAOrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,yBAAyB,gCAAe,CAAC;AAEtD,yDAAyD;AACzD,eAAO,MAAM,oBAAoB,gCAA4B,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;iBAYvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,iBAAiB;;;EAA8C,CAAC;AAE7E,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,yBAAyB;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;iBAMpC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEpF,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;iBAIrC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;iBAEtC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;;;;;;;;iBAGrC,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,gFAAgF;AAChF,eAAO,MAAM,sBAAsB;;;;;;;;iBAQjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/schemas/auth/auth.schema.js

@@ -1,6 +1,88 @@
 import z from 'zod';
+import { AuthDeliverySchema } from '../messaging/schema.js';
+import { LoginMethodSchema } from '../systemConfig/schema.js';
+export const IdentifierTypeSchema = z.enum(['email', 'phone']);
 export const LoginRequestSchema = z.object({
     identifier: z.string(),
+    passkeyAvailable: z.boolean().optional(),
+});
+export const LoginSuccessResponseSchema = z.object({
+    message: z.string(),
+    token: z.string().optional(),
+    sub: z.string().optional(),
+    identifierType: IdentifierTypeSchema.optional(),
+    loginMethods: z.array(LoginMethodSchema).optional(),
+    ttl: z.number().optional(),
 });
 export const RefreshTokenRequestSchema = z.object({});
+/** @deprecated Use {@link RefreshTokenRequestSchema}. */
+export const RefreshRequestSchema = RefreshTokenRequestSchema;
+/**
+ * The token envelope every completed authentication returns, whatever the
+ * method. `sessionId` is only present where the flow names the session it
+ * created; OTP, magic link, and OAuth completions omit it.
+ */
+export const RefreshSuccessResponseSchema = z.object({
+    message: z.string(),
+    token: z.string().optional(),
+    refreshToken: z.string().optional(),
+    sub: z.string().optional(),
+    sessionId: z.string().optional(),
+    organizationId: z.string().nullable().optional(),
+    roles: z.array(z.string()).optional(),
+    email: z.string().optional(),
+    phone: z.string().nullable().optional(),
+    ttl: z.number().optional(),
+    refreshTtl: z.number().optional(),
+});
+export const LogoutScopeSchema = z.enum(['current_session', 'all_sessions']);
+export const RegistrationRequestSchema = z.object({
+    email: z.email(),
+    // Registration only needs an email. A phone can be added and verified later.
+    phone: z.string().nullish(),
+});
+export const RegistrationSuccessSchema = z.object({
+    message: z.string(),
+    sub: z.string().optional(),
+    token: z.string().optional(),
+    ttl: z.string().optional(),
+    delivery: AuthDeliverySchema.optional(),
+});
+export const RegisterPhoneRequestSchema = z.object({
+    phone: z.string(),
+});
+export const RegisterPhoneSuccessSchema = z.object({
+    message: z.string(),
+    phone: z.string(),
+    delivery: AuthDeliverySchema.optional(),
+});
+export const VerifyOTPRequestSchema = z.object({
+    verificationToken: z.string(),
+});
+export const OTPVerifyTokenSuccessSchema = RefreshSuccessResponseSchema.omit({
+    sessionId: true,
+});
+export const MagicLinkVerifyParamsSchema = z.object({
+    token: z.string(),
+});
+export const MagicLinkPollSuccessSchema = RefreshSuccessResponseSchema.omit({
+    sessionId: true,
+    organizationId: true,
+});
+/** Body for endpoints that acknowledge a request and may hand back a delivery. */
+export const AuthMessageResponseSchema = z.object({
+    message: z.string(),
+    token: z.string().optional(),
+    delivery: AuthDeliverySchema.optional(),
+});
+/** The access token's claims, as a resource server reads them off a request. */
+export const SeamlessAuthUserSchema = z.object({
+    id: z.string(),
+    roles: z.array(z.string()),
+    email: z.string().optional(),
+    phone: z.string().nullable().optional(),
+    iat: z.number().optional(),
+    exp: z.number().optional(),
+    token: z.string().optional(),
+});
 //# sourceMappingURL=auth.schema.js.map

package/dist/schemas/auth/auth.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.schema.js","sourceRoot":"","sources":["../../../src/schemas/auth/auth.schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC"}
+{"version":3,"file":"auth.schema.js","sourceRoot":"","sources":["../../../src/schemas/auth/auth.schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAI/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC/C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEtD,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;AAI7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,6EAA6E;IAC7E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC3E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC1E,SAAS,EAAE,IAAI;IACf,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC"}