@sylphx/contract 0.2.0

package/dist/schemas/security.d.ts

@@ -0,0 +1,345 @@
+/**
+ * Security Console — schemas for the user's security settings UI
+ * (passkeys, 2FA, sessions, alerts, OAuth, password, email change).
+ * Mirrors `apps/api/src/server/platform/routes/security/*`.
+ *
+ * Plane: `management`. Fresh namespace — no collision with BaaS.
+ *
+ * Shape policy (Wave 3B):
+ *   - WebAuthn credentials stay opaque (`Schema.Record`) — SimpleWebAuthn's
+ *     JSON wire shape evolves with the spec; locking it at the contract
+ *     level would force a contract bump every WebAuthn revision.
+ *   - Query-string coercion (`limit`, `unreadOnly`) stays `Schema.String`
+ *     on the wire; route handlers parse via `toNumber` / `toBoolean`.
+ *   - OAuth provider identifier is `Schema.String` (not an enum) — the
+ *     provider catalog lives in Better-Auth config and can grow freely.
+ */
+import { Schema } from 'effect';
+export declare const SecuritySuccessResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+}>;
+export type SecuritySuccessResult = typeof SecuritySuccessResult.Type;
+export declare const TwoFactorSetupResult: Schema.Struct<{
+    secret: typeof Schema.String;
+    uri: typeof Schema.String;
+    qrCode: Schema.optional<typeof Schema.String>;
+}>;
+export type TwoFactorSetupResult = typeof TwoFactorSetupResult.Type;
+export declare const TwoFactorVerifyInput: Schema.Struct<{
+    code: typeof Schema.String;
+}>;
+export type TwoFactorVerifyInput = typeof TwoFactorVerifyInput.Type;
+export declare const TwoFactorVerifyResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+    backupCodes: Schema.Array$<typeof Schema.String>;
+}>;
+export type TwoFactorVerifyResult = typeof TwoFactorVerifyResult.Type;
+export declare const TwoFactorDisableResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+}>;
+export type TwoFactorDisableResult = typeof TwoFactorDisableResult.Type;
+export declare const TwoFactorStatusResult: Schema.Struct<{
+    enabled: typeof Schema.Boolean;
+    backupCodesRemaining: typeof Schema.Number;
+}>;
+export type TwoFactorStatusResult = typeof TwoFactorStatusResult.Type;
+export declare const BackupCodesViewResult: Schema.Struct<{
+    codes: Schema.Array$<typeof Schema.String>;
+    remaining: typeof Schema.Number;
+}>;
+export type BackupCodesViewResult = typeof BackupCodesViewResult.Type;
+export declare const BackupCodesRegenerateResult: Schema.Struct<{
+    codes: Schema.Array$<typeof Schema.String>;
+}>;
+export type BackupCodesRegenerateResult = typeof BackupCodesRegenerateResult.Type;
+export declare const EmailChangeRequestInput: Schema.Struct<{
+    newEmail: typeof Schema.String;
+}>;
+export type EmailChangeRequestInput = typeof EmailChangeRequestInput.Type;
+export declare const EmailChangeRequestResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+    message: typeof Schema.String;
+    expiresAt: typeof Schema.String;
+}>;
+export type EmailChangeRequestResult = typeof EmailChangeRequestResult.Type;
+export declare const EmailChangeConfirmInput: Schema.Struct<{
+    token: typeof Schema.String;
+}>;
+export type EmailChangeConfirmInput = typeof EmailChangeConfirmInput.Type;
+export declare const EmailChangeConfirmResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+    newEmail: typeof Schema.String;
+}>;
+export type EmailChangeConfirmResult = typeof EmailChangeConfirmResult.Type;
+export declare const OAuthAccount: Schema.Struct<{
+    provider: typeof Schema.String;
+    providerAccountId: typeof Schema.String;
+    email: Schema.NullOr<typeof Schema.String>;
+    connectedAt: typeof Schema.String;
+}>;
+export type OAuthAccount = typeof OAuthAccount.Type;
+export declare const GetOAuthProvidersResult: Schema.Struct<{
+    providers: Schema.Array$<Schema.Struct<{
+        provider: typeof Schema.String;
+        providerAccountId: typeof Schema.String;
+        email: Schema.NullOr<typeof Schema.String>;
+        connectedAt: typeof Schema.String;
+    }>>;
+}>;
+export type GetOAuthProvidersResult = typeof GetOAuthProvidersResult.Type;
+export declare const OAuthConnectInput: Schema.Struct<{
+    provider: typeof Schema.String;
+}>;
+export type OAuthConnectInput = typeof OAuthConnectInput.Type;
+export declare const OAuthConnectResult: Schema.Struct<{
+    url: typeof Schema.String;
+}>;
+export type OAuthConnectResult = typeof OAuthConnectResult.Type;
+export declare const OAuthDisconnectInput: Schema.Struct<{
+    provider: typeof Schema.String;
+}>;
+export type OAuthDisconnectInput = typeof OAuthDisconnectInput.Type;
+export declare const OAuthDisconnectResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+}>;
+export type OAuthDisconnectResult = typeof OAuthDisconnectResult.Type;
+export declare const PasswordStatusResult: Schema.Struct<{
+    hasPassword: typeof Schema.Boolean;
+}>;
+export type PasswordStatusResult = typeof PasswordStatusResult.Type;
+export declare const SetPasswordInput: Schema.Struct<{
+    password: typeof Schema.String;
+}>;
+export type SetPasswordInput = typeof SetPasswordInput.Type;
+export declare const SetPasswordResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+}>;
+export type SetPasswordResult = typeof SetPasswordResult.Type;
+export declare const Passkey: Schema.Struct<{
+    id: typeof Schema.String;
+    name: Schema.NullOr<typeof Schema.String>;
+    createdAt: typeof Schema.String;
+    lastUsedAt: Schema.NullOr<typeof Schema.String>;
+}>;
+export type Passkey = typeof Passkey.Type;
+export declare const PasskeyListResult: Schema.Struct<{
+    passkeys: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        name: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+        lastUsedAt: Schema.NullOr<typeof Schema.String>;
+    }>>;
+}>;
+export type PasskeyListResult = typeof PasskeyListResult.Type;
+/**
+ * WebAuthn PublicKeyCredentialCreationOptions. Kept wide because
+ * SimpleWebAuthn's shape evolves with the WebAuthn spec revisions — the
+ * contract mirrors the wire, and the handler passes it through unchanged.
+ */
+export declare const PasskeyRegisterStartResult: Schema.Struct<{
+    challenge: typeof Schema.String;
+    rp: Schema.Struct<{
+        name: typeof Schema.String;
+        id: typeof Schema.String;
+    }>;
+    user: Schema.Struct<{
+        id: typeof Schema.String;
+        name: typeof Schema.String;
+        displayName: typeof Schema.String;
+    }>;
+    pubKeyCredParams: Schema.Array$<Schema.Struct<{
+        type: Schema.Literal<["public-key"]>;
+        alg: typeof Schema.Number;
+    }>>;
+    timeout: Schema.optional<typeof Schema.Number>;
+    attestation: Schema.optional<typeof Schema.String>;
+    excludeCredentials: Schema.optional<Schema.Array$<Schema.Struct<{
+        type: Schema.Literal<["public-key"]>;
+        id: typeof Schema.String;
+        transports: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    }>>>;
+    authenticatorSelection: Schema.optional<Schema.Struct<{
+        authenticatorAttachment: Schema.optional<Schema.Literal<["platform", "cross-platform"]>>;
+        requireResidentKey: Schema.optional<typeof Schema.Boolean>;
+        residentKey: Schema.optional<Schema.Literal<["discouraged", "preferred", "required"]>>;
+        userVerification: Schema.optional<Schema.Literal<["discouraged", "preferred", "required"]>>;
+    }>>;
+}>;
+export type PasskeyRegisterStartResult = typeof PasskeyRegisterStartResult.Type;
+/**
+ * WebAuthn `AuthenticatorAttestationResponseJSON` (SimpleWebAuthn).
+ * Kept opaque because the spec evolves — contract consumers forward the
+ * envelope verbatim to the server.
+ */
+export declare const AuthenticatorAttestationResponse: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+export type AuthenticatorAttestationResponse = typeof AuthenticatorAttestationResponse.Type;
+/**
+ * WebAuthn `RegistrationResponseJSON` — the client-side credential that
+ * the browser returns from `navigator.credentials.create()`. Opaque by
+ * design (SimpleWebAuthn validates the wire shape).
+ */
+export declare const RegistrationResponse: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+export type RegistrationResponse = typeof RegistrationResponse.Type;
+/**
+ * WebAuthn `credential` envelope stays opaque — the server forwards to
+ * SimpleWebAuthn which validates the on-the-wire shape.
+ */
+export declare const PasskeyRegisterVerifyInput: Schema.Struct<{
+    credential: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+    deviceName: Schema.optional<typeof Schema.String>;
+}>;
+export type PasskeyRegisterVerifyInput = typeof PasskeyRegisterVerifyInput.Type;
+export declare const PasskeyRegisterVerifyResult: Schema.Struct<{
+    id: typeof Schema.String;
+    name: Schema.NullOr<typeof Schema.String>;
+    createdAt: typeof Schema.String;
+    lastUsedAt: Schema.NullOr<typeof Schema.String>;
+}>;
+export type PasskeyRegisterVerifyResult = typeof PasskeyRegisterVerifyResult.Type;
+export declare const PasskeyRenameInput: Schema.Struct<{
+    passkeyId: typeof Schema.String;
+    name: typeof Schema.String;
+}>;
+export type PasskeyRenameInput = typeof PasskeyRenameInput.Type;
+export declare const PasskeyRenameResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+}>;
+export type PasskeyRenameResult = typeof PasskeyRenameResult.Type;
+export declare const PasskeyDeleteInput: Schema.Struct<{
+    passkeyId: typeof Schema.String;
+}>;
+export type PasskeyDeleteInput = typeof PasskeyDeleteInput.Type;
+export declare const PasskeyDeleteResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+}>;
+export type PasskeyDeleteResult = typeof PasskeyDeleteResult.Type;
+export declare const SecuritySession: Schema.Struct<{
+    id: typeof Schema.String;
+    name: Schema.NullOr<typeof Schema.String>;
+    ipAddress: Schema.NullOr<typeof Schema.String>;
+    userAgent: Schema.NullOr<typeof Schema.String>;
+    createdAt: typeof Schema.String;
+    lastActiveAt: Schema.NullOr<typeof Schema.String>;
+    isCurrent: typeof Schema.Boolean;
+}>;
+export type SecuritySession = typeof SecuritySession.Type;
+export declare const GetSessionsResult: Schema.Struct<{
+    sessions: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        name: Schema.NullOr<typeof Schema.String>;
+        ipAddress: Schema.NullOr<typeof Schema.String>;
+        userAgent: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+        lastActiveAt: Schema.NullOr<typeof Schema.String>;
+        isCurrent: typeof Schema.Boolean;
+    }>>;
+}>;
+export type GetSessionsResult = typeof GetSessionsResult.Type;
+export declare const RevokeSessionInput: Schema.Struct<{
+    sessionId: typeof Schema.String;
+}>;
+export type RevokeSessionInput = typeof RevokeSessionInput.Type;
+export declare const RevokeSessionResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+}>;
+export type RevokeSessionResult = typeof RevokeSessionResult.Type;
+export declare const RevokeOtherSessionsResult: Schema.Struct<{
+    revokedCount: typeof Schema.Number;
+}>;
+export type RevokeOtherSessionsResult = typeof RevokeOtherSessionsResult.Type;
+export declare const RenameSessionInput: Schema.Struct<{
+    sessionId: typeof Schema.String;
+    name: typeof Schema.String;
+}>;
+export type RenameSessionInput = typeof RenameSessionInput.Type;
+export declare const RenameSessionResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+}>;
+export type RenameSessionResult = typeof RenameSessionResult.Type;
+export declare const SecurityFactor: Schema.Struct<{
+    name: typeof Schema.String;
+    enabled: typeof Schema.Boolean;
+    points: typeof Schema.Number;
+    maxPoints: typeof Schema.Number;
+}>;
+export type SecurityFactor = typeof SecurityFactor.Type;
+export declare const SecurityRecommendation: Schema.Struct<{
+    id: typeof Schema.String;
+    title: typeof Schema.String;
+    description: typeof Schema.String;
+    priority: Schema.Literal<["low", "medium", "high"]>;
+    action: typeof Schema.String;
+}>;
+export type SecurityRecommendation = typeof SecurityRecommendation.Type;
+export declare const SecurityScoreResult: Schema.Struct<{
+    score: typeof Schema.Number;
+    factors: Schema.Array$<Schema.Struct<{
+        name: typeof Schema.String;
+        enabled: typeof Schema.Boolean;
+        points: typeof Schema.Number;
+        maxPoints: typeof Schema.Number;
+    }>>;
+    recommendations: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        title: typeof Schema.String;
+        description: typeof Schema.String;
+        priority: Schema.Literal<["low", "medium", "high"]>;
+        action: typeof Schema.String;
+    }>>;
+}>;
+export type SecurityScoreResult = typeof SecurityScoreResult.Type;
+export declare const SecurityStatusQuickResult: Schema.Struct<{
+    score: typeof Schema.Number;
+    level: Schema.Literal<["low", "medium", "high", "excellent"]>;
+    hasPassword: typeof Schema.Boolean;
+    hasTwoFactor: typeof Schema.Boolean;
+    hasPasskeys: typeof Schema.Boolean;
+    sessionCount: typeof Schema.Number;
+}>;
+export type SecurityStatusQuickResult = typeof SecurityStatusQuickResult.Type;
+export declare const SecurityAlertType: Schema.Literal<["password_changed", "email_changed", "two_factor_enabled", "two_factor_disabled", "new_device", "suspicious_login", "account_locked", "account_unlocked"]>;
+export type SecurityAlertType = typeof SecurityAlertType.Type;
+export declare const SecurityAlert: Schema.Struct<{
+    id: typeof Schema.String;
+    type: Schema.Literal<["password_changed", "email_changed", "two_factor_enabled", "two_factor_disabled", "new_device", "suspicious_login", "account_locked", "account_unlocked"]>;
+    title: typeof Schema.String;
+    description: Schema.NullOr<typeof Schema.String>;
+    metadata: Schema.NullOr<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    read: typeof Schema.Boolean;
+    createdAt: typeof Schema.String;
+}>;
+export type SecurityAlert = typeof SecurityAlert.Type;
+export declare const GetSecurityAlertsQuery: Schema.Struct<{
+    limit: Schema.optional<typeof Schema.String>;
+    unreadOnly: Schema.optional<typeof Schema.String>;
+}>;
+export type GetSecurityAlertsQuery = typeof GetSecurityAlertsQuery.Type;
+export declare const GetSecurityAlertsResult: Schema.Struct<{
+    alerts: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        type: Schema.Literal<["password_changed", "email_changed", "two_factor_enabled", "two_factor_disabled", "new_device", "suspicious_login", "account_locked", "account_unlocked"]>;
+        title: typeof Schema.String;
+        description: Schema.NullOr<typeof Schema.String>;
+        metadata: Schema.NullOr<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+        read: typeof Schema.Boolean;
+        createdAt: typeof Schema.String;
+    }>>;
+}>;
+export type GetSecurityAlertsResult = typeof GetSecurityAlertsResult.Type;
+export declare const UnreadAlertCountResult: Schema.Struct<{
+    count: typeof Schema.Number;
+}>;
+export type UnreadAlertCountResult = typeof UnreadAlertCountResult.Type;
+export declare const MarkAlertReadInput: Schema.Struct<{
+    alertId: typeof Schema.String;
+}>;
+export type MarkAlertReadInput = typeof MarkAlertReadInput.Type;
+export declare const MarkAlertReadResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+}>;
+export type MarkAlertReadResult = typeof MarkAlertReadResult.Type;
+export declare const MarkAllAlertsReadResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+}>;
+export type MarkAllAlertsReadResult = typeof MarkAllAlertsReadResult.Type;
+//# sourceMappingURL=security.d.ts.map

package/dist/schemas/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/schemas/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAI/B,eAAO,MAAM,qBAAqB;;EAEhC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAIrE,eAAO,MAAM,oBAAoB;;;;EAI/B,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAEnE,eAAO,MAAM,oBAAoB;;EAE/B,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAEnE,eAAO,MAAM,qBAAqB;;;EAGhC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAErE,eAAO,MAAM,sBAAsB;;EAAwB,CAAA;AAC3D,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;AAEvE,eAAO,MAAM,qBAAqB;;;EAGhC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAErE,eAAO,MAAM,qBAAqB;;;EAGhC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAErE,eAAO,MAAM,2BAA2B;;EAEtC,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA;AAIjF,eAAO,MAAM,uBAAuB;;EAElC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AAEzE,eAAO,MAAM,wBAAwB;;;;EAInC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAE3E,eAAO,MAAM,uBAAuB;;EAElC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AAEzE,eAAO,MAAM,wBAAwB;;;EAGnC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAI3E,eAAO,MAAM,YAAY;;;;;EAKvB,CAAA;AACF,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAA;AAEnD,eAAO,MAAM,uBAAuB;;;;;;;EAElC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AAEzE,eAAO,MAAM,iBAAiB;;EAE5B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAE7D,eAAO,MAAM,kBAAkB;;EAE7B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAE/D,eAAO,MAAM,oBAAoB;;EAE/B,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAEnE,eAAO,MAAM,qBAAqB;;EAAwB,CAAA;AAC1D,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAIrE,eAAO,MAAM,oBAAoB;;EAE/B,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAEnE,eAAO,MAAM,gBAAgB;;EAE3B,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAE3D,eAAO,MAAM,iBAAiB;;EAAwB,CAAA;AACtD,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAI7D,eAAO,MAAM,OAAO;;;;;EAKlB,CAAA;AACF,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,CAAA;AAEzC,eAAO,MAAM,iBAAiB;;;;;;;EAE5B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAE7D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoCrC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAE/E;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,6DAG3C,CAAA;AACF,MAAM,MAAM,gCAAgC,GAAG,OAAO,gCAAgC,CAAC,IAAI,CAAA;AAE3F;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,6DAG/B,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAEnE;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;EAGrC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAE/E,eAAO,MAAM,2BAA2B;;;;;EAAU,CAAA;AAClD,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA;AAEjF,eAAO,MAAM,kBAAkB;;;EAG7B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAE/D,eAAO,MAAM,mBAAmB;;EAAwB,CAAA;AACxD,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;AAEjE,eAAO,MAAM,kBAAkB;;EAE7B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAE/D,eAAO,MAAM,mBAAmB;;EAAwB,CAAA;AACxD,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;AAIjE,eAAO,MAAM,eAAe;;;;;;;;EAQ1B,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAA;AAEzD,eAAO,MAAM,iBAAiB;;;;;;;;;;EAE5B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAE7D,eAAO,MAAM,kBAAkB;;EAE7B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAE/D,eAAO,MAAM,mBAAmB;;EAAwB,CAAA;AACxD,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;AAEjE,eAAO,MAAM,yBAAyB;;EAEpC,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA;AAE7E,eAAO,MAAM,kBAAkB;;;EAG7B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAE/D,eAAO,MAAM,mBAAmB;;EAAwB,CAAA;AACxD,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;AAIjE,eAAO,MAAM,cAAc;;;;;EAKzB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;AAEvD,eAAO,MAAM,sBAAsB;;;;;;EAMjC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;AAEvE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAI9B,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;AAEjE,eAAO,MAAM,yBAAyB;;;;;;;EAOpC,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA;AAI7E,eAAO,MAAM,iBAAiB,4KAS7B,CAAA;AACD,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAE7D,eAAO,MAAM,aAAa;;;;;;;;EAQxB,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAA;AAErD,eAAO,MAAM,sBAAsB;;;EAGjC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;AAEvE,eAAO,MAAM,uBAAuB;;;;;;;;;;EAElC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AAEzE,eAAO,MAAM,sBAAsB;;EAEjC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;AAEvE,eAAO,MAAM,kBAAkB;;EAE7B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAE/D,eAAO,MAAM,mBAAmB;;EAAwB,CAAA;AACxD,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;AAEjE,eAAO,MAAM,uBAAuB;;EAAwB,CAAA;AAC5D,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA"}

package/dist/schemas/security.js

@@ -0,0 +1,248 @@
+/**
+ * Security Console — schemas for the user's security settings UI
+ * (passkeys, 2FA, sessions, alerts, OAuth, password, email change).
+ * Mirrors `apps/api/src/server/platform/routes/security/*`.
+ *
+ * Plane: `management`. Fresh namespace — no collision with BaaS.
+ *
+ * Shape policy (Wave 3B):
+ *   - WebAuthn credentials stay opaque (`Schema.Record`) — SimpleWebAuthn's
+ *     JSON wire shape evolves with the spec; locking it at the contract
+ *     level would force a contract bump every WebAuthn revision.
+ *   - Query-string coercion (`limit`, `unreadOnly`) stays `Schema.String`
+ *     on the wire; route handlers parse via `toNumber` / `toBoolean`.
+ *   - OAuth provider identifier is `Schema.String` (not an enum) — the
+ *     provider catalog lives in Better-Auth config and can grow freely.
+ */
+import { Schema } from 'effect';
+// ── Common ─────────────────────────────────────────────────────────────────
+export const SecuritySuccessResult = Schema.Struct({
+    success: Schema.Boolean,
+});
+// ── Two-Factor Authentication ──────────────────────────────────────────────
+export const TwoFactorSetupResult = Schema.Struct({
+    secret: Schema.String,
+    uri: Schema.String,
+    qrCode: Schema.optional(Schema.String),
+});
+export const TwoFactorVerifyInput = Schema.Struct({
+    code: Schema.String,
+});
+export const TwoFactorVerifyResult = Schema.Struct({
+    success: Schema.Boolean,
+    backupCodes: Schema.Array(Schema.String),
+});
+export const TwoFactorDisableResult = SecuritySuccessResult;
+export const TwoFactorStatusResult = Schema.Struct({
+    enabled: Schema.Boolean,
+    backupCodesRemaining: Schema.Number,
+});
+export const BackupCodesViewResult = Schema.Struct({
+    codes: Schema.Array(Schema.String),
+    remaining: Schema.Number,
+});
+export const BackupCodesRegenerateResult = Schema.Struct({
+    codes: Schema.Array(Schema.String),
+});
+// ── Email Change ───────────────────────────────────────────────────────────
+export const EmailChangeRequestInput = Schema.Struct({
+    newEmail: Schema.String,
+});
+export const EmailChangeRequestResult = Schema.Struct({
+    success: Schema.Boolean,
+    message: Schema.String,
+    expiresAt: Schema.String,
+});
+export const EmailChangeConfirmInput = Schema.Struct({
+    token: Schema.String,
+});
+export const EmailChangeConfirmResult = Schema.Struct({
+    success: Schema.Boolean,
+    newEmail: Schema.String,
+});
+// ── OAuth ──────────────────────────────────────────────────────────────────
+export const OAuthAccount = Schema.Struct({
+    provider: Schema.String,
+    providerAccountId: Schema.String,
+    email: Schema.NullOr(Schema.String),
+    connectedAt: Schema.String,
+});
+export const GetOAuthProvidersResult = Schema.Struct({
+    providers: Schema.Array(OAuthAccount),
+});
+export const OAuthConnectInput = Schema.Struct({
+    provider: Schema.String,
+});
+export const OAuthConnectResult = Schema.Struct({
+    url: Schema.String,
+});
+export const OAuthDisconnectInput = Schema.Struct({
+    provider: Schema.String,
+});
+export const OAuthDisconnectResult = SecuritySuccessResult;
+// ── Password ───────────────────────────────────────────────────────────────
+export const PasswordStatusResult = Schema.Struct({
+    hasPassword: Schema.Boolean,
+});
+export const SetPasswordInput = Schema.Struct({
+    password: Schema.String,
+});
+export const SetPasswordResult = SecuritySuccessResult;
+// ── Passkeys ───────────────────────────────────────────────────────────────
+export const Passkey = Schema.Struct({
+    id: Schema.String,
+    name: Schema.NullOr(Schema.String),
+    createdAt: Schema.String,
+    lastUsedAt: Schema.NullOr(Schema.String),
+});
+export const PasskeyListResult = Schema.Struct({
+    passkeys: Schema.Array(Passkey),
+});
+/**
+ * WebAuthn PublicKeyCredentialCreationOptions. Kept wide because
+ * SimpleWebAuthn's shape evolves with the WebAuthn spec revisions — the
+ * contract mirrors the wire, and the handler passes it through unchanged.
+ */
+export const PasskeyRegisterStartResult = Schema.Struct({
+    challenge: Schema.String,
+    rp: Schema.Struct({
+        name: Schema.String,
+        id: Schema.String,
+    }),
+    user: Schema.Struct({
+        id: Schema.String,
+        name: Schema.String,
+        displayName: Schema.String,
+    }),
+    pubKeyCredParams: Schema.Array(Schema.Struct({
+        type: Schema.Literal('public-key'),
+        alg: Schema.Number,
+    })),
+    timeout: Schema.optional(Schema.Number),
+    attestation: Schema.optional(Schema.String),
+    excludeCredentials: Schema.optional(Schema.Array(Schema.Struct({
+        type: Schema.Literal('public-key'),
+        id: Schema.String,
+        transports: Schema.optional(Schema.Array(Schema.String)),
+    }))),
+    authenticatorSelection: Schema.optional(Schema.Struct({
+        authenticatorAttachment: Schema.optional(Schema.Literal('platform', 'cross-platform')),
+        requireResidentKey: Schema.optional(Schema.Boolean),
+        residentKey: Schema.optional(Schema.Literal('discouraged', 'preferred', 'required')),
+        userVerification: Schema.optional(Schema.Literal('discouraged', 'preferred', 'required')),
+    })),
+});
+/**
+ * WebAuthn `AuthenticatorAttestationResponseJSON` (SimpleWebAuthn).
+ * Kept opaque because the spec evolves — contract consumers forward the
+ * envelope verbatim to the server.
+ */
+export const AuthenticatorAttestationResponse = Schema.Record({
+    key: Schema.String,
+    value: Schema.Unknown,
+});
+/**
+ * WebAuthn `RegistrationResponseJSON` — the client-side credential that
+ * the browser returns from `navigator.credentials.create()`. Opaque by
+ * design (SimpleWebAuthn validates the wire shape).
+ */
+export const RegistrationResponse = Schema.Record({
+    key: Schema.String,
+    value: Schema.Unknown,
+});
+/**
+ * WebAuthn `credential` envelope stays opaque — the server forwards to
+ * SimpleWebAuthn which validates the on-the-wire shape.
+ */
+export const PasskeyRegisterVerifyInput = Schema.Struct({
+    credential: Schema.Record({ key: Schema.String, value: Schema.Unknown }),
+    deviceName: Schema.optional(Schema.String),
+});
+export const PasskeyRegisterVerifyResult = Passkey;
+export const PasskeyRenameInput = Schema.Struct({
+    passkeyId: Schema.String,
+    name: Schema.String,
+});
+export const PasskeyRenameResult = SecuritySuccessResult;
+export const PasskeyDeleteInput = Schema.Struct({
+    passkeyId: Schema.String,
+});
+export const PasskeyDeleteResult = SecuritySuccessResult;
+// ── Sessions ───────────────────────────────────────────────────────────────
+export const SecuritySession = Schema.Struct({
+    id: Schema.String,
+    name: Schema.NullOr(Schema.String),
+    ipAddress: Schema.NullOr(Schema.String),
+    userAgent: Schema.NullOr(Schema.String),
+    createdAt: Schema.String,
+    lastActiveAt: Schema.NullOr(Schema.String),
+    isCurrent: Schema.Boolean,
+});
+export const GetSessionsResult = Schema.Struct({
+    sessions: Schema.Array(SecuritySession),
+});
+export const RevokeSessionInput = Schema.Struct({
+    sessionId: Schema.String,
+});
+export const RevokeSessionResult = SecuritySuccessResult;
+export const RevokeOtherSessionsResult = Schema.Struct({
+    revokedCount: Schema.Number,
+});
+export const RenameSessionInput = Schema.Struct({
+    sessionId: Schema.String,
+    name: Schema.String,
+});
+export const RenameSessionResult = SecuritySuccessResult;
+// ── Security Score ─────────────────────────────────────────────────────────
+export const SecurityFactor = Schema.Struct({
+    name: Schema.String,
+    enabled: Schema.Boolean,
+    points: Schema.Number,
+    maxPoints: Schema.Number,
+});
+export const SecurityRecommendation = Schema.Struct({
+    id: Schema.String,
+    title: Schema.String,
+    description: Schema.String,
+    priority: Schema.Literal('low', 'medium', 'high'),
+    action: Schema.String,
+});
+export const SecurityScoreResult = Schema.Struct({
+    score: Schema.Number,
+    factors: Schema.Array(SecurityFactor),
+    recommendations: Schema.Array(SecurityRecommendation),
+});
+export const SecurityStatusQuickResult = Schema.Struct({
+    score: Schema.Number,
+    level: Schema.Literal('low', 'medium', 'high', 'excellent'),
+    hasPassword: Schema.Boolean,
+    hasTwoFactor: Schema.Boolean,
+    hasPasskeys: Schema.Boolean,
+    sessionCount: Schema.Number,
+});
+// ── Alerts ─────────────────────────────────────────────────────────────────
+export const SecurityAlertType = Schema.Literal('password_changed', 'email_changed', 'two_factor_enabled', 'two_factor_disabled', 'new_device', 'suspicious_login', 'account_locked', 'account_unlocked');
+export const SecurityAlert = Schema.Struct({
+    id: Schema.String,
+    type: SecurityAlertType,
+    title: Schema.String,
+    description: Schema.NullOr(Schema.String),
+    metadata: Schema.NullOr(Schema.Record({ key: Schema.String, value: Schema.Unknown })),
+    read: Schema.Boolean,
+    createdAt: Schema.String,
+});
+export const GetSecurityAlertsQuery = Schema.Struct({
+    limit: Schema.optional(Schema.String),
+    unreadOnly: Schema.optional(Schema.String),
+});
+export const GetSecurityAlertsResult = Schema.Struct({
+    alerts: Schema.Array(SecurityAlert),
+});
+export const UnreadAlertCountResult = Schema.Struct({
+    count: Schema.Number,
+});
+export const MarkAlertReadInput = Schema.Struct({
+    alertId: Schema.String,
+});
+export const MarkAlertReadResult = SecuritySuccessResult;
+export const MarkAllAlertsReadResult = SecuritySuccessResult;