@spacefast/common 0.0.24 → 0.2.1

package/dist/contracts/application-journal.d.ts

@@ -0,0 +1,216 @@
+import { z } from "zod";
+export declare const APPLICATION_JOURNAL_MAX_DELIVERY_ATTEMPTS = 12;
+export declare const applicationJournalEntryIdSchema: z.core.$ZodBranded<z.ZodString, "ApplicationJournalEntryId", "out">;
+export type ApplicationJournalEntryId = z.infer<typeof applicationJournalEntryIdSchema>;
+export declare const applicationJournalEntryV1Schema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"application-event">;
+    payload: z.ZodObject<{
+        name: z.ZodString;
+        body: z.ZodJSONSchema;
+    }, z.core.$strict>;
+    format: z.ZodLiteral<"spacefast.application-journal">;
+    version: z.ZodLiteral<1>;
+    id: z.core.$ZodBranded<z.ZodString, "ApplicationJournalEntryId", "out">;
+    spaceId: z.ZodTemplateLiteral<`spc_${string}`>;
+    operationId: z.ZodTemplateLiteral<`op_${string}`>;
+    effectOrdinal: z.ZodNumber;
+    store: z.ZodEnum<{
+        wordpress: "wordpress";
+        lakebed: "lakebed";
+    }>;
+    payloadDigest: z.core.$ZodBranded<z.ZodString, "ContentProgramSha256", "out">;
+    createdAt: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"mail">;
+    payload: z.ZodObject<{
+        messageId: z.ZodString;
+        from: z.ZodObject<{
+            email: z.ZodString;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        to: z.ZodArray<z.ZodObject<{
+            email: z.ZodString;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        subject: z.ZodString;
+        body: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            text: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"html">;
+            html: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"multipart">;
+            text: z.ZodString;
+            html: z.ZodString;
+        }, z.core.$strict>], "kind">;
+        replyTo: z.ZodOptional<z.ZodObject<{
+            email: z.ZodString;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    format: z.ZodLiteral<"spacefast.application-journal">;
+    version: z.ZodLiteral<1>;
+    id: z.core.$ZodBranded<z.ZodString, "ApplicationJournalEntryId", "out">;
+    spaceId: z.ZodTemplateLiteral<`spc_${string}`>;
+    operationId: z.ZodTemplateLiteral<`op_${string}`>;
+    effectOrdinal: z.ZodNumber;
+    store: z.ZodEnum<{
+        wordpress: "wordpress";
+        lakebed: "lakebed";
+    }>;
+    payloadDigest: z.core.$ZodBranded<z.ZodString, "ContentProgramSha256", "out">;
+    createdAt: z.ZodString;
+}, z.core.$strict>], "kind">;
+export type ApplicationJournalEntryV1 = z.infer<typeof applicationJournalEntryV1Schema>;
+export declare const applicationJournalDeliveryFenceV1Schema: z.ZodObject<{
+    entryId: z.core.$ZodBranded<z.ZodString, "ApplicationJournalEntryId", "out">;
+    sink: z.ZodString;
+    attempt: z.ZodNumber;
+    leaseId: z.ZodString;
+    leaseExpiresAt: z.ZodString;
+}, z.core.$strict>;
+export type ApplicationJournalDeliveryFenceV1 = z.infer<typeof applicationJournalDeliveryFenceV1Schema>;
+export declare const applicationJournalDeliveryReceiptV1Schema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"delivered">;
+    downstreamReceipt: z.ZodString;
+    format: z.ZodLiteral<"spacefast.application-delivery">;
+    version: z.ZodLiteral<1>;
+    fence: z.ZodObject<{
+        entryId: z.core.$ZodBranded<z.ZodString, "ApplicationJournalEntryId", "out">;
+        sink: z.ZodString;
+        attempt: z.ZodNumber;
+        leaseId: z.ZodString;
+        leaseExpiresAt: z.ZodString;
+    }, z.core.$strict>;
+    idempotencyKey: z.ZodString;
+    recordedAt: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"retry">;
+    problem: z.ZodObject<{
+        code: z.ZodString;
+        detail: z.ZodString;
+        retryable: z.ZodLiteral<true>;
+    }, z.core.$strict>;
+    retryAt: z.ZodString;
+    format: z.ZodLiteral<"spacefast.application-delivery">;
+    version: z.ZodLiteral<1>;
+    fence: z.ZodObject<{
+        entryId: z.core.$ZodBranded<z.ZodString, "ApplicationJournalEntryId", "out">;
+        sink: z.ZodString;
+        attempt: z.ZodNumber;
+        leaseId: z.ZodString;
+        leaseExpiresAt: z.ZodString;
+    }, z.core.$strict>;
+    idempotencyKey: z.ZodString;
+    recordedAt: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"dead-letter">;
+    problem: z.ZodObject<{
+        code: z.ZodString;
+        detail: z.ZodString;
+        retryable: z.ZodLiteral<false>;
+    }, z.core.$strict>;
+    format: z.ZodLiteral<"spacefast.application-delivery">;
+    version: z.ZodLiteral<1>;
+    fence: z.ZodObject<{
+        entryId: z.core.$ZodBranded<z.ZodString, "ApplicationJournalEntryId", "out">;
+        sink: z.ZodString;
+        attempt: z.ZodNumber;
+        leaseId: z.ZodString;
+        leaseExpiresAt: z.ZodString;
+    }, z.core.$strict>;
+    idempotencyKey: z.ZodString;
+    recordedAt: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"ambiguous">;
+    problem: z.ZodObject<{
+        code: z.ZodString;
+        detail: z.ZodString;
+        retryable: z.ZodLiteral<false>;
+    }, z.core.$strict>;
+    operatorActionRequired: z.ZodLiteral<true>;
+    format: z.ZodLiteral<"spacefast.application-delivery">;
+    version: z.ZodLiteral<1>;
+    fence: z.ZodObject<{
+        entryId: z.core.$ZodBranded<z.ZodString, "ApplicationJournalEntryId", "out">;
+        sink: z.ZodString;
+        attempt: z.ZodNumber;
+        leaseId: z.ZodString;
+        leaseExpiresAt: z.ZodString;
+    }, z.core.$strict>;
+    idempotencyKey: z.ZodString;
+    recordedAt: z.ZodString;
+}, z.core.$strict>], "status">;
+export type ApplicationJournalDeliveryReceiptV1 = z.infer<typeof applicationJournalDeliveryReceiptV1Schema>;
+export declare const applicationJournalDeliveryClaimV1Schema: z.ZodObject<{
+    entry: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"application-event">;
+        payload: z.ZodObject<{
+            name: z.ZodString;
+            body: z.ZodJSONSchema;
+        }, z.core.$strict>;
+        format: z.ZodLiteral<"spacefast.application-journal">;
+        version: z.ZodLiteral<1>;
+        id: z.core.$ZodBranded<z.ZodString, "ApplicationJournalEntryId", "out">;
+        spaceId: z.ZodTemplateLiteral<`spc_${string}`>;
+        operationId: z.ZodTemplateLiteral<`op_${string}`>;
+        effectOrdinal: z.ZodNumber;
+        store: z.ZodEnum<{
+            wordpress: "wordpress";
+            lakebed: "lakebed";
+        }>;
+        payloadDigest: z.core.$ZodBranded<z.ZodString, "ContentProgramSha256", "out">;
+        createdAt: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"mail">;
+        payload: z.ZodObject<{
+            messageId: z.ZodString;
+            from: z.ZodObject<{
+                email: z.ZodString;
+                name: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            to: z.ZodArray<z.ZodObject<{
+                email: z.ZodString;
+                name: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            subject: z.ZodString;
+            body: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"text">;
+                text: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"html">;
+                html: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"multipart">;
+                text: z.ZodString;
+                html: z.ZodString;
+            }, z.core.$strict>], "kind">;
+            replyTo: z.ZodOptional<z.ZodObject<{
+                email: z.ZodString;
+                name: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        format: z.ZodLiteral<"spacefast.application-journal">;
+        version: z.ZodLiteral<1>;
+        id: z.core.$ZodBranded<z.ZodString, "ApplicationJournalEntryId", "out">;
+        spaceId: z.ZodTemplateLiteral<`spc_${string}`>;
+        operationId: z.ZodTemplateLiteral<`op_${string}`>;
+        effectOrdinal: z.ZodNumber;
+        store: z.ZodEnum<{
+            wordpress: "wordpress";
+            lakebed: "lakebed";
+        }>;
+        payloadDigest: z.core.$ZodBranded<z.ZodString, "ContentProgramSha256", "out">;
+        createdAt: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    fence: z.ZodObject<{
+        entryId: z.core.$ZodBranded<z.ZodString, "ApplicationJournalEntryId", "out">;
+        sink: z.ZodString;
+        attempt: z.ZodNumber;
+        leaseId: z.ZodString;
+        leaseExpiresAt: z.ZodString;
+    }, z.core.$strict>;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>;
+export type ApplicationJournalDeliveryClaimV1 = z.infer<typeof applicationJournalDeliveryClaimV1Schema>;

package/dist/contracts/application-journal.js

@@ -0,0 +1,167 @@
+import { z } from "zod";
+import { contentProgramSha256Schema } from "./content-program.js";
+import { registeredIdSchema } from "./ids.js";
+export const APPLICATION_JOURNAL_MAX_DELIVERY_ATTEMPTS = 12;
+export const applicationJournalEntryIdSchema = z
+    .string()
+    .min(1)
+    .max(512)
+    .regex(/^spc_[A-Za-z0-9]+:op_[A-Za-z0-9]+:[0-9]+$/)
+    .brand();
+const journalEmailAddressSchema = z
+    .object({
+    email: z.string().email(),
+    name: z.string().trim().min(1).max(200).optional(),
+})
+    .strict();
+const journalMailBodySchema = z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("text"), text: z.string().max(1_000_000) }).strict(),
+    z.object({ kind: z.literal("html"), html: z.string().max(1_000_000) }).strict(),
+    z
+        .object({
+        kind: z.literal("multipart"),
+        text: z.string().max(1_000_000),
+        html: z.string().max(1_000_000),
+    })
+        .strict(),
+]);
+const journalEntryFields = {
+    format: z.literal("spacefast.application-journal"),
+    version: z.literal(1),
+    id: applicationJournalEntryIdSchema,
+    spaceId: registeredIdSchema("spc"),
+    operationId: registeredIdSchema("op"),
+    effectOrdinal: z.number().int().nonnegative(),
+    store: z.enum(["wordpress", "lakebed"]),
+    payloadDigest: contentProgramSha256Schema,
+    createdAt: z.string().datetime({ offset: true }),
+};
+export const applicationJournalEntryV1Schema = z
+    .discriminatedUnion("kind", [
+    z
+        .object({
+        ...journalEntryFields,
+        kind: z.literal("application-event"),
+        payload: z
+            .object({
+            name: z.string().min(1).max(255),
+            body: z.json(),
+        })
+            .strict(),
+    })
+        .strict(),
+    z
+        .object({
+        ...journalEntryFields,
+        kind: z.literal("mail"),
+        payload: z
+            .object({
+            messageId: z.string().min(1).max(255),
+            from: journalEmailAddressSchema,
+            to: z.array(journalEmailAddressSchema).min(1).max(100),
+            subject: z.string().min(1).max(998),
+            body: journalMailBodySchema,
+            replyTo: journalEmailAddressSchema.optional(),
+        })
+            .strict(),
+    })
+        .strict(),
+])
+    .refine((entry) => entry.id === `${entry.spaceId}:${entry.operationId}:${entry.effectOrdinal}`, {
+    path: ["id"],
+    message: "journal entry id must be the space, operation, and effect ordinal",
+});
+const deliveryProblemSchema = z
+    .object({
+    code: z.string().min(1).max(160),
+    detail: z.string().min(1).max(4_000),
+    retryable: z.boolean(),
+})
+    .strict();
+export const applicationJournalDeliveryFenceV1Schema = z
+    .object({
+    entryId: applicationJournalEntryIdSchema,
+    sink: z.string().min(1).max(160),
+    attempt: z.number().int().positive().max(APPLICATION_JOURNAL_MAX_DELIVERY_ATTEMPTS),
+    leaseId: z.string().min(1).max(255),
+    leaseExpiresAt: z.string().datetime({ offset: true }),
+})
+    .strict();
+const journalDeliveryReceiptFields = {
+    format: z.literal("spacefast.application-delivery"),
+    version: z.literal(1),
+    // Recording completion must atomically compare this entire tuple with the
+    // delivery row that granted the claim. Matching only the lease id is unsafe.
+    fence: applicationJournalDeliveryFenceV1Schema,
+    idempotencyKey: z.string().min(1).max(512),
+    recordedAt: z.string().datetime({ offset: true }),
+};
+export const applicationJournalDeliveryReceiptV1Schema = z
+    .discriminatedUnion("status", [
+    z
+        .object({
+        ...journalDeliveryReceiptFields,
+        status: z.literal("delivered"),
+        downstreamReceipt: z.string().min(1).max(2_000),
+    })
+        .strict(),
+    z
+        .object({
+        ...journalDeliveryReceiptFields,
+        status: z.literal("retry"),
+        problem: deliveryProblemSchema.extend({ retryable: z.literal(true) }),
+        retryAt: z.string().datetime({ offset: true }),
+    })
+        .strict(),
+    z
+        .object({
+        ...journalDeliveryReceiptFields,
+        status: z.literal("dead-letter"),
+        problem: deliveryProblemSchema.extend({ retryable: z.literal(false) }),
+    })
+        .strict(),
+    z
+        .object({
+        ...journalDeliveryReceiptFields,
+        status: z.literal("ambiguous"),
+        problem: deliveryProblemSchema.extend({ retryable: z.literal(false) }),
+        operatorActionRequired: z.literal(true),
+    })
+        .strict(),
+])
+    .refine((receipt) => receipt.idempotencyKey === `${receipt.fence.entryId}:${receipt.fence.sink}`, {
+    path: ["idempotencyKey"],
+    message: "delivery idempotency key must bind the journal entry and sink",
+})
+    .refine((receipt) => receipt.status !== "retry" ||
+    receipt.fence.attempt < APPLICATION_JOURNAL_MAX_DELIVERY_ATTEMPTS, {
+    path: ["status"],
+    message: "the final delivery attempt must terminate as dead-letter or ambiguous",
+})
+    .refine((receipt) => Date.parse(receipt.recordedAt) <= Date.parse(receipt.fence.leaseExpiresAt), {
+    path: ["recordedAt"],
+    message: "delivery completion must be recorded before its lease expires",
+});
+export const applicationJournalDeliveryClaimV1Schema = z
+    .object({
+    entry: applicationJournalEntryV1Schema,
+    fence: applicationJournalDeliveryFenceV1Schema,
+    idempotencyKey: z.string().min(1).max(512),
+})
+    .strict()
+    .superRefine((claim, context) => {
+    if (claim.fence.entryId !== claim.entry.id) {
+        context.addIssue({
+            code: "custom",
+            path: ["fence", "entryId"],
+            message: "delivery fence must bind the claimed journal entry",
+        });
+    }
+    if (claim.idempotencyKey !== `${claim.entry.id}:${claim.fence.sink}`) {
+        context.addIssue({
+            code: "custom",
+            path: ["idempotencyKey"],
+            message: "delivery claim idempotency key must bind the journal entry and sink",
+        });
+    }
+});

package/dist/contracts/auth.d.ts

@@ -1,3 +1,4 @@
+import { z } from "zod";
 export declare const betterAuthAdditionalFields: {
     readonly user: {
         readonly tenantId: {
@@ -12,18 +13,6 @@ export declare const betterAuthAdditionalFields: {
             readonly returned: true;
             readonly input: false;
         };
-        readonly username: {
-            readonly type: "string";
-            readonly required: false;
-            readonly returned: true;
-            readonly input: false;
-        };
-        readonly displayUsername: {
-            readonly type: "string";
-            readonly required: false;
-            readonly returned: true;
-            readonly input: false;
-        };
         readonly isAutomattician: {
             readonly type: "boolean";
             readonly required: false;
@@ -31,17 +20,17 @@ export declare const betterAuthAdditionalFields: {
             readonly returned: true;
             readonly input: false;
         };
-        readonly wpcomProfileJson: {
-            readonly type: "json";
+        readonly automatticianCheckedAt: {
+            readonly type: "string";
             readonly required: false;
-            readonly returned: false;
+            readonly returned: true;
             readonly input: false;
         };
-        readonly wpcom: {
+        readonly automatticBetaGrant: {
             readonly type: "boolean";
             readonly required: false;
             readonly defaultValue: false;
-            readonly returned: true;
+            readonly returned: false;
             readonly input: false;
         };
         readonly betaEnrolledAt: {
@@ -84,3 +73,87 @@ export type BetterAuthCustomSessionUser = {
     wpcomUserId?: string | null;
     isSuperadmin?: boolean;
 };
+/**
+ * What this deployment can sign people in with. The sign-in page renders its
+ * available controls from this response; the account-specific email lane is a
+ * separate Better Auth decision after the person presses Continue. Everything
+ * here is public by construction: presence booleans, and client ids and site
+ * keys the browser gets by design. No secret ever widens this shape.
+ */
+export declare const authMethodsResponseSchema: z.ZodObject<{
+    providers: z.ZodObject<{
+        wpcom: z.ZodBoolean;
+        google: z.ZodBoolean;
+        github: z.ZodBoolean;
+    }, z.core.$strip>;
+    emailOtp: z.ZodBoolean;
+    password: z.ZodBoolean;
+    captcha: z.ZodNullable<z.ZodObject<{
+        provider: z.ZodLiteral<"turnstile">;
+        siteKey: z.ZodString;
+    }, z.core.$strip>>;
+    googleOneTapClientId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type AuthMethodsResponse = z.infer<typeof authMethodsResponseSchema>;
+/** The email-first sign-in decision made by Better Auth after email entry. */
+export declare const authEmailContinueRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+}, z.core.$strip>;
+export declare const authEmailContinueResponseSchema: z.ZodObject<{
+    method: z.ZodEnum<{
+        password: "password";
+        "email-otp": "email-otp";
+    }>;
+}, z.core.$strip>;
+export type AuthEmailContinueRequest = z.infer<typeof authEmailContinueRequestSchema>;
+export type AuthEmailContinueResponse = z.infer<typeof authEmailContinueResponseSchema>;
+/** How a verified address earned its place on the account. */
+export declare const AUTH_EMAIL_VERIFICATION_METHODS: readonly ["email_code", "oauth", "admin", "migration"];
+/**
+ * One verified address on an account. Unverified addresses are never listed.
+ * A pending one is a code challenge, not a row, until its code is entered.
+ */
+export declare const authAccountEmailSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    isPrimary: z.ZodBoolean;
+    verifiedAt: z.ZodString;
+    verificationMethod: z.ZodEnum<{
+        oauth: "oauth";
+        email_code: "email_code";
+        admin: "admin";
+        migration: "migration";
+    }>;
+}, z.core.$strip>;
+export declare const authAccountEmailListResponseSchema: z.ZodObject<{
+    emails: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        isPrimary: z.ZodBoolean;
+        verifiedAt: z.ZodString;
+        verificationMethod: z.ZodEnum<{
+            oauth: "oauth";
+            email_code: "email_code";
+            admin: "admin";
+            migration: "migration";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const authAccountEmailAddRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+}, z.core.$strip>;
+export declare const authAccountEmailAddResponseSchema: z.ZodObject<{
+    email: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export declare const authAccountEmailVerifyRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+    code: z.ZodString;
+}, z.core.$strip>;
+export declare const authSetPasswordRequestSchema: z.ZodObject<{
+    password: z.ZodString;
+}, z.core.$strip>;
+export declare const authSetPasswordResponseSchema: z.ZodObject<{
+    passwordSet: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export type AuthAccountEmail = z.infer<typeof authAccountEmailSchema>;

package/dist/contracts/auth.js

@@ -1,3 +1,4 @@
+import { z } from "zod";
 export const betterAuthAdditionalFields = {
     user: {
         tenantId: {
@@ -12,18 +13,6 @@ export const betterAuthAdditionalFields = {
             returned: true,
             input: false,
         },
-        username: {
-            type: "string",
-            required: false,
-            returned: true,
-            input: false,
-        },
-        displayUsername: {
-            type: "string",
-            required: false,
-            returned: true,
-            input: false,
-        },
         isAutomattician: {
             type: "boolean",
             required: false,
@@ -31,17 +20,18 @@ export const betterAuthAdditionalFields = {
             returned: true,
             input: false,
         },
-        wpcomProfileJson: {
-            type: "json",
+        automatticianCheckedAt: {
+            type: "string",
             required: false,
-            returned: false,
+            returned: true,
             input: false,
         },
-        wpcom: {
+        // Automattic-domain beta-admission provenance, never employee identity.
+        automatticBetaGrant: {
             type: "boolean",
             required: false,
             defaultValue: false,
-            returned: true,
+            returned: false,
             input: false,
         },
         betaEnrolledAt: {
@@ -66,6 +56,11 @@ export const betterAuthAdditionalFields = {
         },
     },
     session: {
+        // Deliberate alias, not a second field: the organization plugin's schema
+        // remap (`activeOrganizationId` → column `activeTeamId`) owns the WRITE
+        // path, while this declaration exposes the same column to clients under
+        // the product's "team" naming. One column, two logical names — sessions
+        // may carry either spelling depending on which side serialized them.
         activeTeamId: {
             type: "string",
             required: false,
@@ -80,3 +75,77 @@ export const betterAuthAdditionalFields = {
         },
     },
 };
+/**
+ * What this deployment can sign people in with. The sign-in page renders its
+ * available controls from this response; the account-specific email lane is a
+ * separate Better Auth decision after the person presses Continue. Everything
+ * here is public by construction: presence booleans, and client ids and site
+ * keys the browser gets by design. No secret ever widens this shape.
+ */
+export const authMethodsResponseSchema = z.object({
+    providers: z.object({
+        wpcom: z.boolean(),
+        google: z.boolean(),
+        github: z.boolean(),
+    }),
+    /** Sign in with a mailed one-time code. Off when auth mail has no sender. */
+    emailOtp: z.boolean(),
+    /** A password may be used to sign in (never to sign up). */
+    password: z.boolean(),
+    /** Turnstile widget config for the unauthenticated forms, or null when off. */
+    captcha: z
+        .object({
+        provider: z.literal("turnstile"),
+        siteKey: z.string(),
+    })
+        .nullable(),
+    /** Google's public client id, needed by the One Tap script. */
+    googleOneTapClientId: z.string().nullable(),
+});
+/** The email-first sign-in decision made by Better Auth after email entry. */
+export const authEmailContinueRequestSchema = z.object({
+    email: z.string().trim().email(),
+});
+export const authEmailContinueResponseSchema = z.object({
+    method: z.enum(["password", "email-otp"]),
+});
+/** How a verified address earned its place on the account. */
+export const AUTH_EMAIL_VERIFICATION_METHODS = [
+    "email_code",
+    "oauth",
+    "admin",
+    "migration",
+];
+/**
+ * One verified address on an account. Unverified addresses are never listed.
+ * A pending one is a code challenge, not a row, until its code is entered.
+ */
+export const authAccountEmailSchema = z.object({
+    id: z.string(),
+    email: z.string(),
+    /** The address the account is addressed by: notices, Gravatar, sign-in mail. */
+    isPrimary: z.boolean(),
+    verifiedAt: z.string(),
+    verificationMethod: z.enum(AUTH_EMAIL_VERIFICATION_METHODS),
+});
+export const authAccountEmailListResponseSchema = z.object({
+    emails: z.array(authAccountEmailSchema),
+});
+export const authAccountEmailAddRequestSchema = z.object({
+    email: z.string().min(3).max(320),
+});
+export const authAccountEmailAddResponseSchema = z.object({
+    /** Where the code went, as typed. */
+    email: z.string(),
+    expiresAt: z.string(),
+});
+export const authAccountEmailVerifyRequestSchema = z.object({
+    email: z.string().min(3).max(320),
+    code: z.string().min(1).max(16),
+});
+export const authSetPasswordRequestSchema = z.object({
+    password: z.string().min(8).max(128),
+});
+export const authSetPasswordResponseSchema = z.object({
+    passwordSet: z.literal(true),
+});

package/dist/contracts/beta.d.ts

@@ -26,6 +26,13 @@ export declare const betaSignupCreateSchema: z.ZodObject<{
 export declare const betaSignupReceiptSchema: z.ZodObject<{
     ok: z.ZodLiteral<true>;
 }, z.core.$strip>;
+export declare const betaVisitorResponseSchema: z.ZodObject<{
+    earlyAccessGranted: z.ZodBoolean;
+    source: z.ZodNullable<z.ZodEnum<{
+        network: "network";
+        account: "account";
+    }>>;
+}, z.core.$strip>;
 export declare const betaAcceptSchema: z.ZodObject<{
     token: z.ZodString;
 }, z.core.$strip>;
@@ -60,8 +67,7 @@ export declare const SuperadminBetaSignupSchema: z.ZodObject<{
         invited: "invited";
         enrolled: "enrolled";
     }>;
-    isAutomattician: z.ZodBoolean;
-    wpcom: z.ZodBoolean;
+    automatticDomain: z.ZodBoolean;
     invitedAt: z.ZodNullable<z.ZodString>;
     tokenExpiresAt: z.ZodNullable<z.ZodString>;
     invitedBy: z.ZodNullable<z.ZodString>;
@@ -87,8 +93,7 @@ export declare const SuperadminBetaSignupListSchema: z.ZodObject<{
             invited: "invited";
             enrolled: "enrolled";
         }>;
-        isAutomattician: z.ZodBoolean;
-        wpcom: z.ZodBoolean;
+        automatticDomain: z.ZodBoolean;
         invitedAt: z.ZodNullable<z.ZodString>;
         tokenExpiresAt: z.ZodNullable<z.ZodString>;
         invitedBy: z.ZodNullable<z.ZodString>;