@seamless-auth/types 0.27.0 → 0.29.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @seamless-auth/types
 
+## 0.29.0
+
+### Minor Changes
+
+- c386361: Add `binding` to the OAuth start response and the callback request. The auth server returns a
+  random `binding` from `/oauth/:providerId/start` and checks it on `/oauth/:providerId/callback`,
+  so a `state` can only be finished by the client that started the sign-in. Both fields are
+  optional in the schemas so a client can still parse a response from an older auth server.
+
+### Patch Changes
+
+- 14077a9: Raise the `zod` dependency floor from `^4.3.6` to `^4.5.0`. The published declarations use the two-argument `ZodPreprocess` type, which zod 4.3.x does not export and zod 4.4.x declares with a single type parameter, so a consumer resolving zod below 4.5.0 with `skipLibCheck: false` got TS2724 or TS2707 from this package's `.d.ts` files. Consumers pinned to zod 4.4.x or older should upgrade to zod 4.5.0 or later.
+
+## 0.28.0
+
+### Minor Changes
+
+- e2d2a28: Time ranges for the dashboard metrics and security anomalies (fells-code/seamless-auth-api#132).
+  
+  - `DashboardMetricsQuerySchema` (`from`, `to`) and `SecurityAnomaliesQuerySchema` (`from`, `to`, `limit` 1 to 200 with a default of 200, `offset` with a default of 0). The range rules are the same as `MetricsQuerySchema`'s, which now shares them.
+  - `DashboardMetricsResponseSchema` gains optional `window`, `newUsers`, `loginSuccess`, `loginFailed`, `successRate`, `otpUsage` and `passkeyUsage`, which cover the requested window. The `*24h` fields keep meaning the last 24 hours.
+  - `SecurityAnomaliesResponseSchema` gains optional `window`, `limit` and `offset`, and `total` is documented as every matching event in the window.
+  
+  All the new response fields are optional, so a response from a server without ranges still parses.
+
 ## 0.27.0
 
 ### Minor Changes

package/README.md

@@ -19,6 +19,23 @@ contracts built on top of them. Every layer of the stack validates against the s
 Because everything downstream imports these contracts, a change here is treated as
 breaking by default. See [Versioning and stability](#versioning-and-stability).
 
+## Start here
+
+New to Seamless Auth? The [self-hosted quickstart](https://docs.seamlessauth.com/start/quickstart/) runs the full stack locally with Docker. If Seamless hosts your auth instance, follow the [managed quickstart](https://docs.seamlessauth.com/start/managed-quickstart/) instead.
+
+This package is not a node in the diagram below because it sits under all of them: `seamless-auth-api`, the server adapters (through `@seamless-auth/core`), the React and React Native SDKs, the admin dashboard, and the CLI all validate against these schemas.
+
+```mermaid
+flowchart LR
+  browser["Browser<br/>@seamless-auth/react"] -- "signed httpOnly cookies" --> backend
+  native["Native app<br/>@seamless-auth/react-native"] -- "bearer tokens" --> backend
+  backend["Your backend<br/>@seamless-auth/express, fastify, or nextjs<br/>mounted at /auth"] -- "bearer token + service token" --> api
+  api["seamless-auth-api<br/>owns the session"] --> db[("Postgres")]
+  backend -. "verifies tokens with JWKS" .-> api
+```
+
+[How the pieces connect](https://docs.seamlessauth.com/start/overview/#how-the-pieces-connect) explains each hop. [Compatibility matrix](https://docs.seamlessauth.com/build/ecosystem/#compatibility-matrix) lists which package versions work together.
+
 ## Requirements
 
 |                      |                           |
@@ -185,7 +202,7 @@ history.
 ## Security
 
 Do not open a public issue for a vulnerability. Report it privately to
-**security@seamlessauth.com**. See [SECURITY.md](SECURITY.md) for what to include, our
+**security@fellscode.com**. See [SECURITY.md](SECURITY.md) for what to include, our
 acknowledgement window, and the coordinated disclosure process.
 
 ## Development
@@ -224,6 +241,10 @@ existing schema as breaking until you can argue otherwise.
 
 [Apache-2.0](LICENSE) © Fells Code, LLC
 
+Project governance, including the
+[Seamless Auth License Pledge](https://github.com/fells-code/.github/blob/main/GOVERNANCE.md#the-seamless-auth-license-pledge),
+is in the fells-code [GOVERNANCE.md](https://github.com/fells-code/.github/blob/main/GOVERNANCE.md).
+
 ## Links
 
 - [npm package](https://www.npmjs.com/package/@seamless-auth/types)

package/dist/schemas/metrics/schema.d.ts

@@ -68,6 +68,25 @@ export declare const PartialAuthEventSchema: z.ZodObject<{
     updated_at: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
 }, z.core.$strip>;
 export type PartialAuthEvent = z.infer<typeof PartialAuthEventSchema>;
+/** The window a ranged response covers, as resolved by the server. */
+export declare const MetricsWindowSchema: z.ZodObject<{
+    from: z.ZodString;
+    to: z.ZodString;
+}, z.core.$strip>;
+export type MetricsWindow = z.infer<typeof MetricsWindowSchema>;
+/** `from`/`to` default to the last 24 hours, as the endpoints did before they took a range. */
+export declare const DashboardMetricsQuerySchema: z.ZodObject<{
+    from: z.ZodOptional<z.ZodString>;
+    to: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DashboardMetricsQuery = z.infer<typeof DashboardMetricsQuerySchema>;
+export declare const SecurityAnomaliesQuerySchema: z.ZodObject<{
+    from: z.ZodOptional<z.ZodString>;
+    to: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodOptional<z.ZodCoercedNumber<unknown>>>;
+    offset: z.ZodDefault<z.ZodOptional<z.ZodCoercedNumber<unknown>>>;
+}, z.core.$strip>;
+export type SecurityAnomaliesQuery = z.infer<typeof SecurityAnomaliesQuerySchema>;
 export declare const SecurityAnomaliesResponseSchema: z.ZodObject<{
     suspiciousEvents: z.ZodArray<z.ZodObject<{
         id: z.ZodOptional<z.ZodString>;
@@ -87,6 +106,12 @@ export declare const SecurityAnomaliesResponseSchema: z.ZodObject<{
         updated_at: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
     }, z.core.$strip>>;
     total: z.ZodNumber;
+    window: z.ZodOptional<z.ZodObject<{
+        from: z.ZodString;
+        to: z.ZodString;
+    }, z.core.$strip>>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    offset: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type SecurityAnomaliesResponse = z.infer<typeof SecurityAnomaliesResponseSchema>;
 export declare const DashboardMetricsResponseSchema: z.ZodObject<{
@@ -99,6 +124,16 @@ export declare const DashboardMetricsResponseSchema: z.ZodObject<{
     otpUsage24h: z.ZodNumber;
     passkeyUsage24h: z.ZodNumber;
     databaseSize: z.ZodNumber;
+    window: z.ZodOptional<z.ZodObject<{
+        from: z.ZodString;
+        to: z.ZodString;
+    }, z.core.$strip>>;
+    newUsers: z.ZodOptional<z.ZodNumber>;
+    loginSuccess: z.ZodOptional<z.ZodNumber>;
+    loginFailed: z.ZodOptional<z.ZodNumber>;
+    successRate: z.ZodOptional<z.ZodNumber>;
+    otpUsage: z.ZodOptional<z.ZodNumber>;
+    passkeyUsage: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type DashboardMetricsResponse = z.infer<typeof DashboardMetricsResponseSchema>;
 //# sourceMappingURL=schema.d.ts.map

package/dist/schemas/metrics/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/metrics/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,qBAAqB;;;EAA0B,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,kBAAkB;;;;;;;;iBAuC3B,CAAC;AAEL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,8BAA8B;;;;;iBAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,8BAA8B;;;;iBAIzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,iCAAiC;;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;iBAG1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;iBAUzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/metrics/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,qBAAqB;;;EAA0B,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAiDpE,eAAO,MAAM,kBAAkB;;;;;;;;iBAO0B,CAAC;AAE1D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,8BAA8B;;;;;iBAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,8BAA8B;;;;iBAIzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,iCAAiC;;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,sEAAsE;AACtE,eAAO,MAAM,mBAAmB;;;iBAAiD,CAAC;AAElF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,+FAA+F;AAC/F,eAAO,MAAM,2BAA2B;;;iBAKiB,CAAC;AAE1D,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,4BAA4B;;;;;iBAOgB,CAAC;AAE1D,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;iBAU1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;iBAsBzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/schemas/metrics/schema.js

@@ -2,40 +2,44 @@ import { z } from 'zod';
 import { AuthEventSchema } from '../authEvent/schema.js';
 const MAX_METRICS_WINDOW_MS = 1000 * 60 * 60 * 24 * 366; // ~1 year
 export const MetricsIntervalSchema = z.enum(['hour', 'day']);
-export const MetricsQuerySchema = z
-    .object({
-    userId: z.string().optional(),
-    from: z.string().optional(),
-    to: z.string().optional(),
-    interval: MetricsIntervalSchema.optional().default('hour'),
-})
-    .superRefine((data, ctx) => {
+// Shared by every metrics query that takes a range, so they agree on what a valid window is.
+function timeRangeIssues(data) {
     const fromDate = data.from ? new Date(data.from) : undefined;
     const toDate = data.to ? new Date(data.to) : undefined;
     const fromValid = fromDate !== undefined && !Number.isNaN(fromDate.getTime());
     const toValid = toDate !== undefined && !Number.isNaN(toDate.getTime());
+    const issues = [];
     if (data.from !== undefined && !fromValid) {
-        ctx.addIssue({ code: 'custom', path: ['from'], message: 'Invalid from date' });
+        issues.push({ path: ['from'], message: 'Invalid from date' });
     }
     if (data.to !== undefined && !toValid) {
-        ctx.addIssue({ code: 'custom', path: ['to'], message: 'Invalid to date' });
+        issues.push({ path: ['to'], message: 'Invalid to date' });
     }
     if (!fromValid || !toValid || !fromDate || !toDate) {
-        return;
+        return issues;
     }
     if (fromDate.getTime() > toDate.getTime()) {
-        ctx.addIssue({ code: 'custom', path: ['to'], message: 'from must be on or before to' });
-        return;
+        return [{ path: ['to'], message: 'from must be on or before to' }];
     }
     // Unbounded windows let a single request scan the whole event table.
     if (toDate.getTime() - fromDate.getTime() > MAX_METRICS_WINDOW_MS) {
-        ctx.addIssue({
-            code: 'custom',
-            path: ['to'],
-            message: 'time range exceeds the maximum window',
-        });
+        return [{ path: ['to'], message: 'time range exceeds the maximum window' }];
     }
-});
+    return issues;
+}
+function refineTimeRange(data, ctx) {
+    for (const issue of timeRangeIssues(data)) {
+        ctx.addIssue({ code: 'custom', ...issue });
+    }
+}
+export const MetricsQuerySchema = z
+    .object({
+    userId: z.string().optional(),
+    from: z.string().optional(),
+    to: z.string().optional(),
+    interval: MetricsIntervalSchema.optional().default('hour'),
+})
+    .superRefine((data, ctx) => refineTimeRange(data, ctx));
 export const AuthEventSummaryItemSchema = z.object({
     type: z.string(),
     count: z.number(),
@@ -61,9 +65,33 @@ export const LoginStatsResponseSchema = z.object({
  * event is still worth surfacing, so every field is optional here.
  */
 export const PartialAuthEventSchema = AuthEventSchema.partial();
+/** The window a ranged response covers, as resolved by the server. */
+export const MetricsWindowSchema = z.object({ from: z.string(), to: z.string() });
+/** `from`/`to` default to the last 24 hours, as the endpoints did before they took a range. */
+export const DashboardMetricsQuerySchema = z
+    .object({
+    from: z.string().optional(),
+    to: z.string().optional(),
+})
+    .superRefine((data, ctx) => refineTimeRange(data, ctx));
+export const SecurityAnomaliesQuerySchema = z
+    .object({
+    from: z.string().optional(),
+    to: z.string().optional(),
+    limit: z.coerce.number().int().min(1).max(200).optional().default(200),
+    offset: z.coerce.number().int().min(0).optional().default(0),
+})
+    .superRefine((data, ctx) => refineTimeRange(data, ctx));
 export const SecurityAnomaliesResponseSchema = z.object({
     suspiciousEvents: z.array(PartialAuthEventSchema),
+    /**
+     * Every matching event in the window. Servers before the range was added reported
+     * the number returned, at most 200, here instead.
+     */
     total: z.number().int().nonnegative(),
+    window: MetricsWindowSchema.optional(),
+    limit: z.number().int().optional(),
+    offset: z.number().int().optional(),
 });
 export const DashboardMetricsResponseSchema = z.object({
     totalUsers: z.number(),
@@ -75,5 +103,17 @@ export const DashboardMetricsResponseSchema = z.object({
     otpUsage24h: z.number(),
     passkeyUsage24h: z.number(),
     databaseSize: z.number(),
+    /**
+     * The same figures as the `*24h` fields, over the requested window instead of the
+     * last 24 hours. The `*24h` fields keep their meaning whatever window is asked for.
+     * Optional because servers before the range was added do not send them.
+     */
+    window: MetricsWindowSchema.optional(),
+    newUsers: z.number().optional(),
+    loginSuccess: z.number().optional(),
+    loginFailed: z.number().optional(),
+    successRate: z.number().optional(),
+    otpUsage: z.number().optional(),
+    passkeyUsage: z.number().optional(),
 });
 //# sourceMappingURL=schema.js.map

package/dist/schemas/metrics/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/metrics/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,UAAU;AAEnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAI7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvD,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAExE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACnD,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACxF,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,uCAAuC;SACjD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;CAC7C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;CACpD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC;AAIhE,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACtC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/metrics/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,UAAU;AAEnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAM7D,6FAA6F;AAC7F,SAAS,eAAe,CAAC,IAGxB;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvD,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAiB,EAAE,CAAC;IAEhC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,qEAAqE;IACrE,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;QAClE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CACtB,IAAO,EACP,GAAuB;IAEvB,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAI1D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;CAC7C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;CACpD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC;AAIhE,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAIlF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAI1D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACtE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC7D,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAI1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACjD;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB;;;;OAIG;IACH,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC"}

package/dist/schemas/oauth/schema.d.ts

@@ -31,11 +31,13 @@ export declare const StartOAuthLoginResponseSchema: z.ZodObject<{
     }, z.core.$strip>;
     state: z.ZodString;
     authorizationUrl: z.ZodURL;
+    binding: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type StartOAuthLoginResponse = z.infer<typeof StartOAuthLoginResponseSchema>;
 export declare const FinishOAuthLoginRequestSchema: z.ZodObject<{
     code: z.ZodString;
     state: z.ZodString;
+    binding: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type FinishOAuthLoginRequest = z.infer<typeof FinishOAuthLoginRequestSchema>;
 export declare const OAuthLoginSuccessResponseSchema: z.ZodObject<{

package/dist/schemas/oauth/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,wBAAwB;;iBAEnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wFAAwF;AACxF,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;iBAoB1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,iBAAiB,2IAOpB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;;;EAA4B,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,6BAA6B;;;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,wBAAwB;;iBAEnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wFAAwF;AACxF,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;;iBAUxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,6BAA6B;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;iBAoB1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,iBAAiB,2IAOpB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;;;EAA4B,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,6BAA6B;;;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}

package/dist/schemas/oauth/schema.js

@@ -22,10 +22,18 @@ export const StartOAuthLoginResponseSchema = z.object({
     provider: PublicOAuthProviderSchema,
     state: z.string(),
     authorizationUrl: z.url(),
+    /**
+     * Binds `state` to the client that started the sign-in. The client keeps it and sends
+     * it back with the callback; it never goes to the provider. Optional only so a client
+     * can parse a response from an auth server that predates it.
+     */
+    binding: z.string().optional(),
 });
 export const FinishOAuthLoginRequestSchema = z.object({
     code: z.string().trim().min(1),
     state: z.string().trim().min(1),
+    /** The `binding` the start response returned to this client. */
+    binding: z.string().trim().min(1).optional(),
 });
 export const OAuthLoginSuccessResponseSchema = RefreshSuccessResponseSchema.omit({
     sessionId: true,

package/dist/schemas/oauth/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,qBAAqB;CAClC,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,yBAAyB;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;CAC1B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+BAA+B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC/E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC,MAAM,CAAC;IACR;;;;;;;;OAQG;IACH,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACzC;;;;;OAKG;IACH,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qBAAqB;IACrB,0BAA0B;IAC1B,uBAAuB;IACvB,wBAAwB;IACxB,iFAAiF;IACjF,wBAAwB;CAChB,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAI9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,qBAAqB;CAClC,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,yBAAyB;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gEAAgE;IAChE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+BAA+B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC/E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC,MAAM,CAAC;IACR;;;;;;;;OAQG;IACH,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACzC;;;;;OAKG;IACH,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qBAAqB;IACrB,0BAA0B;IAC1B,uBAAuB;IACvB,wBAAwB;IACxB,iFAAiF;IACjF,wBAAwB;CAChB,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAI9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/types",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
   "author": "Fells Code, LLC",
   "license": "Apache-2.0",
@@ -60,6 +60,7 @@
     "prepublishOnly": "npm run build",
     "test": "vitest run",
     "test:watch": "vitest",
+    "test:zod-floor": "node scripts/check-zod-floor.mjs",
     "changeset": "changeset",
     "version-packages": "changeset version",
     "release:stable": "npm run build && changeset publish",
@@ -75,7 +76,7 @@
     ]
   },
   "dependencies": {
-    "zod": "^4.3.6"
+    "zod": "^4.5.0"
   },
   "devDependencies": {
     "@changesets/cli": "^3.0.2",
@@ -87,7 +88,7 @@
     "eslint-config-prettier": "^10.1.8",
     "husky": "^9.1.7",
     "lint-staged": "^17.2.0",
-    "prettier": "3.9.9",
+    "prettier": "3.9.10",
     "typescript": "^5.9.3",
     "vitest": "^5.0.3"
   },

package/src/schemas/metrics/schema.ts

@@ -7,6 +7,53 @@ export const MetricsIntervalSchema = z.enum(['hour', 'day']);
 
 export type MetricsInterval = z.infer<typeof MetricsIntervalSchema>;
 
+type RangeIssue = { path: ['from'] | ['to']; message: string };
+
+// Shared by every metrics query that takes a range, so they agree on what a valid window is.
+function timeRangeIssues(data: {
+  from?: string | undefined;
+  to?: string | undefined;
+}): RangeIssue[] {
+  const fromDate = data.from ? new Date(data.from) : undefined;
+  const toDate = data.to ? new Date(data.to) : undefined;
+
+  const fromValid = fromDate !== undefined && !Number.isNaN(fromDate.getTime());
+  const toValid = toDate !== undefined && !Number.isNaN(toDate.getTime());
+  const issues: RangeIssue[] = [];
+
+  if (data.from !== undefined && !fromValid) {
+    issues.push({ path: ['from'], message: 'Invalid from date' });
+  }
+
+  if (data.to !== undefined && !toValid) {
+    issues.push({ path: ['to'], message: 'Invalid to date' });
+  }
+
+  if (!fromValid || !toValid || !fromDate || !toDate) {
+    return issues;
+  }
+
+  if (fromDate.getTime() > toDate.getTime()) {
+    return [{ path: ['to'], message: 'from must be on or before to' }];
+  }
+
+  // Unbounded windows let a single request scan the whole event table.
+  if (toDate.getTime() - fromDate.getTime() > MAX_METRICS_WINDOW_MS) {
+    return [{ path: ['to'], message: 'time range exceeds the maximum window' }];
+  }
+
+  return issues;
+}
+
+function refineTimeRange<T extends { from?: string | undefined; to?: string | undefined }>(
+  data: T,
+  ctx: z.RefinementCtx<T>,
+) {
+  for (const issue of timeRangeIssues(data)) {
+    ctx.addIssue({ code: 'custom', ...issue });
+  }
+}
+
 export const MetricsQuerySchema = z
   .object({
     userId: z.string().optional(),
@@ -14,39 +61,7 @@ export const MetricsQuerySchema = z
     to: z.string().optional(),
     interval: MetricsIntervalSchema.optional().default('hour'),
   })
-  .superRefine((data, ctx) => {
-    const fromDate = data.from ? new Date(data.from) : undefined;
-    const toDate = data.to ? new Date(data.to) : undefined;
-
-    const fromValid = fromDate !== undefined && !Number.isNaN(fromDate.getTime());
-    const toValid = toDate !== undefined && !Number.isNaN(toDate.getTime());
-
-    if (data.from !== undefined && !fromValid) {
-      ctx.addIssue({ code: 'custom', path: ['from'], message: 'Invalid from date' });
-    }
-
-    if (data.to !== undefined && !toValid) {
-      ctx.addIssue({ code: 'custom', path: ['to'], message: 'Invalid to date' });
-    }
-
-    if (!fromValid || !toValid || !fromDate || !toDate) {
-      return;
-    }
-
-    if (fromDate.getTime() > toDate.getTime()) {
-      ctx.addIssue({ code: 'custom', path: ['to'], message: 'from must be on or before to' });
-      return;
-    }
-
-    // Unbounded windows let a single request scan the whole event table.
-    if (toDate.getTime() - fromDate.getTime() > MAX_METRICS_WINDOW_MS) {
-      ctx.addIssue({
-        code: 'custom',
-        path: ['to'],
-        message: 'time range exceeds the maximum window',
-      });
-    }
-  });
+  .superRefine((data, ctx) => refineTimeRange(data, ctx));
 
 export type MetricsQuery = z.infer<typeof MetricsQuerySchema>;
 
@@ -93,9 +108,42 @@ export const PartialAuthEventSchema = AuthEventSchema.partial();
 
 export type PartialAuthEvent = z.infer<typeof PartialAuthEventSchema>;
 
+/** The window a ranged response covers, as resolved by the server. */
+export const MetricsWindowSchema = z.object({ from: z.string(), to: z.string() });
+
+export type MetricsWindow = z.infer<typeof MetricsWindowSchema>;
+
+/** `from`/`to` default to the last 24 hours, as the endpoints did before they took a range. */
+export const DashboardMetricsQuerySchema = z
+  .object({
+    from: z.string().optional(),
+    to: z.string().optional(),
+  })
+  .superRefine((data, ctx) => refineTimeRange(data, ctx));
+
+export type DashboardMetricsQuery = z.infer<typeof DashboardMetricsQuerySchema>;
+
+export const SecurityAnomaliesQuerySchema = z
+  .object({
+    from: z.string().optional(),
+    to: z.string().optional(),
+    limit: z.coerce.number().int().min(1).max(200).optional().default(200),
+    offset: z.coerce.number().int().min(0).optional().default(0),
+  })
+  .superRefine((data, ctx) => refineTimeRange(data, ctx));
+
+export type SecurityAnomaliesQuery = z.infer<typeof SecurityAnomaliesQuerySchema>;
+
 export const SecurityAnomaliesResponseSchema = z.object({
   suspiciousEvents: z.array(PartialAuthEventSchema),
+  /**
+   * Every matching event in the window. Servers before the range was added reported
+   * the number returned, at most 200, here instead.
+   */
   total: z.number().int().nonnegative(),
+  window: MetricsWindowSchema.optional(),
+  limit: z.number().int().optional(),
+  offset: z.number().int().optional(),
 });
 
 export type SecurityAnomaliesResponse = z.infer<typeof SecurityAnomaliesResponseSchema>;
@@ -110,6 +158,18 @@ export const DashboardMetricsResponseSchema = z.object({
   otpUsage24h: z.number(),
   passkeyUsage24h: z.number(),
   databaseSize: z.number(),
+  /**
+   * The same figures as the `*24h` fields, over the requested window instead of the
+   * last 24 hours. The `*24h` fields keep their meaning whatever window is asked for.
+   * Optional because servers before the range was added do not send them.
+   */
+  window: MetricsWindowSchema.optional(),
+  newUsers: z.number().optional(),
+  loginSuccess: z.number().optional(),
+  loginFailed: z.number().optional(),
+  successRate: z.number().optional(),
+  otpUsage: z.number().optional(),
+  passkeyUsage: z.number().optional(),
 });
 
 export type DashboardMetricsResponse = z.infer<typeof DashboardMetricsResponseSchema>;

package/src/schemas/oauth/schema.ts

@@ -35,6 +35,12 @@ export const StartOAuthLoginResponseSchema = z.object({
   provider: PublicOAuthProviderSchema,
   state: z.string(),
   authorizationUrl: z.url(),
+  /**
+   * Binds `state` to the client that started the sign-in. The client keeps it and sends
+   * it back with the callback; it never goes to the provider. Optional only so a client
+   * can parse a response from an auth server that predates it.
+   */
+  binding: z.string().optional(),
 });
 
 export type StartOAuthLoginResponse = z.infer<typeof StartOAuthLoginResponseSchema>;
@@ -42,6 +48,8 @@ export type StartOAuthLoginResponse = z.infer<typeof StartOAuthLoginResponseSche
 export const FinishOAuthLoginRequestSchema = z.object({
   code: z.string().trim().min(1),
   state: z.string().trim().min(1),
+  /** The `binding` the start response returned to this client. */
+  binding: z.string().trim().min(1).optional(),
 });
 
 export type FinishOAuthLoginRequest = z.infer<typeof FinishOAuthLoginRequestSchema>;