@tbs-fitness/contract 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,134 @@
-# Temporary Holding Version
+# TBS_contract
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The contract between the TBS platforms. The backend, web and mobile apps all import their API schemas, DTO types and enums from this package, so a request or response has one definition and a breaking change shows up as a compile error.
+
+It is published as `@tbs-fitness/contract`. The package holds definitions only: no database code, no framework code and no secrets, because it ends up in client bundles.
+
+## What is in it
+
+| Import                                | Contents                                                                                                                         |
+| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| `@tbs-fitness/contract/enums`         | `ROLES`, `ACCOUNT_STATUSES`, `TOKEN_TRANSPORTS`, `AUDIT_OUTCOMES`, `APP_ENVIRONMENTS`, `FEATURE_FLAG_RULE_TYPES` and their types |
+| `@tbs-fitness/contract/common`        | Pagination, response envelopes (`{ data }`, `{ data, meta }`, `{ error }`), `emailSchema`, `phoneSchema`, `safeTextSchema`       |
+| `@tbs-fitness/contract/auth`          | Login, sessions, password changes and resets, account administration                                                             |
+| `@tbs-fitness/contract/coach`         | Coach sign-up, one-time code verification and resend, coach sign-in and profile, password recovery                               |
+| `@tbs-fitness/contract/audit`         | The audit log query and response                                                                                                 |
+| `@tbs-fitness/contract/feature-flags` | Feature flag requests and responses                                                                                              |
+
+Each domain has its own entry point, so names only need to be unique within a domain. `auditLogResponseSchema`, for example, exists in both `/audit` and `/feature-flags`.
+
+## Using it
+
+The package needs `zod` 4 from the app, so that every app has a single copy of it.
+
+```ts
+import type { PaginatedResponse } from '@tbs-fitness/contract/common';
+import {
+  type CreateFlagInput,
+  createFlagSchema,
+  type FlagResponse,
+  flagResponseSchema,
+} from '@tbs-fitness/contract/feature-flags';
+
+const input: CreateFlagInput = {
+  key: 'new-checkout',
+  name: 'New checkout',
+  environment: 'staging',
+};
+
+const result = createFlagSchema.safeParse(input); // The same rules as the API.
+```
+
+Requests have two types. Clients use `*Input`, where fields with a default are optional. The backend uses `*Body`, which is the result after validation. List queries come from the URL as strings, so they have no `*Input`: use `Partial<PaginationQuery>` or `Partial<AuditLogQuery>`.
+
+## Version 0.2.0 (breaking)
+
+- `ROLES` is now `ADMIN`, `COACH` and `CUSTOMER`. A user has exactly one role.
+- `ACCOUNT_STATUSES` adds `pending_verification`. Administrators set only `ADMIN_SETTABLE_ACCOUNT_STATUSES`.
+- `setRolesSchema` is replaced by `setRoleSchema` (`{ role }`), and `adminAccountResponseSchema` has `role` instead of `roles`. `accountResponseSchema` adds `role` and keeps `roles` as `[role]`.
+- New: `@tbs-fitness/contract/coach`, and `OTP_LENGTH`, `otpCodeSchema`, `opaqueTokenSchema` and `submittedPasswordSchema` in `/auth`.
+
+A caret range on 0.x does not cross minor versions, so consumers must install `^0.2.0` explicitly.
+
+## Installing it
+
+The package is public on npm, so installing it needs no token:
+
+```bash
+npm install @tbs-fitness/contract
+```
+
+## Adding to it
+
+1. Put a domain's schemas in a `.dto.ts` file in `src/<domain>`, and export its types with `z.input` and `z.output`.
+2. Put values shared by several domains in `src/enums` or `src/common`.
+3. For a new domain, add `src/<domain>/index.ts` and an entry to `exports` in `package.json`.
+4. Add tests next to the schema.
+
+Keep validation that needs a server, such as a uniqueness check, in the backend.
+
+The package is public, so anyone can read everything in it, permanently. Add only what clients can already see in API traffic: never secrets, internal hostnames or customer data.
+
+## Development
+
+You need Node 24.
+
+```bash
+nvm install
+```
+
+```bash
+npm install
+```
+
+| Command          | What it does                                  |
+| ---------------- | --------------------------------------------- |
+| `npm run build`  | Builds ESM and CommonJS into `dist`           |
+| `npm test`       | Runs the unit tests                           |
+| `npm run check`  | Runs the typecheck, lint, format check, tests |
+| `npm run format` | Formats the code                              |
+
+### Trying a change in the backend
+
+The backend installs this package from a sibling checkout until the first version is published. After changing it, run this in `TBS_backend`, which rebuilds the package and installs it as a published copy would be. `npm install ../TBS_contract` alone keeps the old copy while the version is unchanged.
+
+```bash
+rm -rf node_modules/@tbs-fitness/contract && npm install
+```
+
+## Versioning
+
+Versions follow semver, and every app pins the version it was tested with.
+
+| Change                                                              | Version |
+| ------------------------------------------------------------------- | ------- |
+| Removing or renaming anything exported, or a field in a response    | Major   |
+| A stricter rule, a new required request field, a removed enum value | Major   |
+| A new schema, a new optional request field, a new response field    | Minor   |
+| A fix that accepts and returns the same data                        | Patch   |
+
+A new enum value can break a client with an exhaustive `switch`, so treat it as a major version unless the clients are known to handle it.
+
+## Publishing
+
+Log in to npm as a user who can publish to the `tbs-fitness` organisation:
+
+```bash
+npm login
+```
+
+Then, from an up-to-date `main`, set the new version and publish it. The first release is already `0.1.0`, so skip `npm version` for that one.
+
+```bash
+npm version minor
+```
+
+```bash
+npm publish
+```
+
+```bash
+git push --follow-tags
+```
+
+`npm publish` runs all the checks and a fresh build first. `publishConfig` in `package.json` sets `access` to `public`, because npm otherwise treats a scoped package as private, which needs a paid plan.

package/dist/cjs/audit/audit-log.dto.d.ts

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+export declare const auditLogQuerySchema: z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    actorId: z.ZodOptional<z.ZodUUID>;
+    action: z.ZodOptional<z.ZodString>;
+    resourceType: z.ZodOptional<z.ZodString>;
+    resourceId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuditLogQuery = z.output<typeof auditLogQuerySchema>;
+export declare const auditLogResponseSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    actorId: z.ZodNullable<z.ZodUUID>;
+    action: z.ZodString;
+    outcome: z.ZodEnum<{
+        success: "success";
+        failure: "failure";
+    }>;
+    resourceType: z.ZodString;
+    resourceId: z.ZodNullable<z.ZodString>;
+    requestId: z.ZodNullable<z.ZodString>;
+    correlationId: z.ZodNullable<z.ZodString>;
+    metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    createdAt: z.ZodISODateTime;
+}, z.core.$strip>;
+export type AuditLogResponse = z.output<typeof auditLogResponseSchema>;

package/dist/cjs/audit/audit-log.dto.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditLogResponseSchema = exports.auditLogQuerySchema = void 0;
+const zod_1 = require("zod");
+const pagination_schema_js_1 = require("../common/pagination.schema.js");
+const index_js_1 = require("../enums/index.js");
+exports.auditLogQuerySchema = pagination_schema_js_1.paginationQuerySchema.extend({
+    actorId: zod_1.z.uuid().optional(),
+    action: zod_1.z.string().max(100).optional(),
+    resourceType: zod_1.z.string().max(100).optional(),
+    resourceId: zod_1.z.string().max(100).optional(),
+});
+exports.auditLogResponseSchema = zod_1.z.object({
+    id: zod_1.z.uuid(),
+    actorId: zod_1.z.uuid().nullable(),
+    action: zod_1.z.string(),
+    outcome: zod_1.z.enum(index_js_1.AUDIT_OUTCOMES),
+    resourceType: zod_1.z.string(),
+    resourceId: zod_1.z.string().nullable(),
+    requestId: zod_1.z.string().nullable(),
+    correlationId: zod_1.z.string().nullable(),
+    metadata: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).nullable(),
+    createdAt: zod_1.z.iso.datetime(),
+});

package/dist/cjs/audit/index.d.ts

@@ -0,0 +1 @@
+export * from './audit-log.dto.js';

package/dist/cjs/audit/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./audit-log.dto.js"), exports);

package/dist/cjs/auth/auth.dto.d.ts

@@ -0,0 +1,142 @@
+import { z } from 'zod';
+export declare const MIN_PASSWORD_LENGTH = 12;
+export declare const MAX_PASSWORD_LENGTH = 128;
+/** Every one-time code the API sends has this many digits. */
+export declare const OTP_LENGTH = 6;
+export declare const otpCodeSchema: z.ZodString;
+export declare const newPasswordSchema: z.ZodString;
+/** No minimum at login, so an old short password fails like any wrong password. */
+export declare const submittedPasswordSchema: z.ZodString;
+export declare const opaqueTokenSchema: z.ZodString;
+export declare const loginSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    password: z.ZodString;
+    deviceName: z.ZodOptional<z.ZodString>;
+    tokenTransport: z.ZodDefault<z.ZodEnum<{
+        body: "body";
+        cookie: "cookie";
+    }>>;
+}, z.core.$strict>;
+export type LoginInput = z.input<typeof loginSchema>;
+export type LoginBody = z.output<typeof loginSchema>;
+export declare const refreshSchema: z.ZodDefault<z.ZodObject<{
+    refreshToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>>;
+export type RefreshInput = z.input<typeof refreshSchema>;
+export type RefreshBody = z.output<typeof refreshSchema>;
+export declare const changePasswordSchema: z.ZodObject<{
+    currentPassword: z.ZodString;
+    newPassword: z.ZodString;
+}, z.core.$strict>;
+export type ChangePasswordInput = z.input<typeof changePasswordSchema>;
+export type ChangePasswordBody = z.output<typeof changePasswordSchema>;
+export declare const passwordResetRequestSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+}, z.core.$strict>;
+export type PasswordResetRequestInput = z.input<typeof passwordResetRequestSchema>;
+export type PasswordResetRequestBody = z.output<typeof passwordResetRequestSchema>;
+export declare const passwordResetConfirmSchema: z.ZodObject<{
+    token: z.ZodString;
+    newPassword: z.ZodString;
+}, z.core.$strict>;
+export type PasswordResetConfirmInput = z.input<typeof passwordResetConfirmSchema>;
+export type PasswordResetConfirmBody = z.output<typeof passwordResetConfirmSchema>;
+export declare const setRoleSchema: z.ZodObject<{
+    role: z.ZodEnum<{
+        ADMIN: "ADMIN";
+        COACH: "COACH";
+        CUSTOMER: "CUSTOMER";
+    }>;
+}, z.core.$strict>;
+export type SetRoleInput = z.input<typeof setRoleSchema>;
+export type SetRoleBody = z.output<typeof setRoleSchema>;
+export declare const setStatusSchema: z.ZodObject<{
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>;
+}, z.core.$strict>;
+export type SetStatusInput = z.input<typeof setStatusSchema>;
+export type SetStatusBody = z.output<typeof setStatusSchema>;
+export declare const idParamSchema: z.ZodUUID;
+export declare const tokenResponseSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    tokenType: z.ZodLiteral<"Bearer">;
+    expiresInSeconds: z.ZodNumber;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    csrfToken: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodUUID;
+}, z.core.$strip>;
+export type TokenResponse = z.output<typeof tokenResponseSchema>;
+export declare const accountResponseSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    email: z.ZodString;
+    role: z.ZodEnum<{
+        ADMIN: "ADMIN";
+        COACH: "COACH";
+        CUSTOMER: "CUSTOMER";
+    }>;
+    roles: z.ZodArray<z.ZodString>;
+    permissions: z.ZodArray<z.ZodString>;
+    lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type AccountResponse = z.output<typeof accountResponseSchema>;
+export declare const loginResponseSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    tokenType: z.ZodLiteral<"Bearer">;
+    expiresInSeconds: z.ZodNumber;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    csrfToken: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodUUID;
+    account: z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodString;
+        role: z.ZodEnum<{
+            ADMIN: "ADMIN";
+            COACH: "COACH";
+            CUSTOMER: "CUSTOMER";
+        }>;
+        roles: z.ZodArray<z.ZodString>;
+        permissions: z.ZodArray<z.ZodString>;
+        lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type LoginResponse = z.output<typeof loginResponseSchema>;
+export declare const sessionResponseSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    deviceName: z.ZodNullable<z.ZodString>;
+    userAgent: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodISODateTime;
+    lastUsedAt: z.ZodISODateTime;
+    expiresAt: z.ZodISODateTime;
+    current: z.ZodBoolean;
+}, z.core.$strip>;
+export type SessionResponse = z.output<typeof sessionResponseSchema>;
+export declare const logoutAllResponseSchema: z.ZodObject<{
+    revokedSessions: z.ZodNumber;
+}, z.core.$strip>;
+export type LogoutAllResponse = z.output<typeof logoutAllResponseSchema>;
+export declare const passwordResetRequestedResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>;
+export type PasswordResetRequestedResponse = z.output<typeof passwordResetRequestedResponseSchema>;
+export declare const adminAccountResponseSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    email: z.ZodString;
+    role: z.ZodEnum<{
+        ADMIN: "ADMIN";
+        COACH: "COACH";
+        CUSTOMER: "CUSTOMER";
+    }>;
+    status: z.ZodEnum<{
+        pending_verification: "pending_verification";
+        active: "active";
+        disabled: "disabled";
+    }>;
+    lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type AdminAccountResponse = z.output<typeof adminAccountResponseSchema>;
+export declare const revokedSessionsResponseSchema: z.ZodObject<{
+    revokedSessions: z.ZodNumber;
+}, z.core.$strip>;
+export type RevokedSessionsResponse = z.output<typeof revokedSessionsResponseSchema>;

package/dist/cjs/auth/auth.dto.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.revokedSessionsResponseSchema = exports.adminAccountResponseSchema = exports.passwordResetRequestedResponseSchema = exports.logoutAllResponseSchema = exports.sessionResponseSchema = exports.loginResponseSchema = exports.accountResponseSchema = exports.tokenResponseSchema = exports.idParamSchema = exports.setStatusSchema = exports.setRoleSchema = exports.passwordResetConfirmSchema = exports.passwordResetRequestSchema = exports.changePasswordSchema = exports.refreshSchema = exports.loginSchema = exports.opaqueTokenSchema = exports.submittedPasswordSchema = exports.newPasswordSchema = exports.otpCodeSchema = exports.OTP_LENGTH = exports.MAX_PASSWORD_LENGTH = exports.MIN_PASSWORD_LENGTH = void 0;
+const zod_1 = require("zod");
+const contact_schema_js_1 = require("../common/contact.schema.js");
+const safe_text_schema_js_1 = require("../common/safe-text.schema.js");
+const index_js_1 = require("../enums/index.js");
+// Per OWASP: length is what matters, with no composition rules. The upper limit
+// stops very long inputs from being used to exhaust the hashing function.
+exports.MIN_PASSWORD_LENGTH = 12;
+exports.MAX_PASSWORD_LENGTH = 128;
+const MAX_OPAQUE_TOKEN_LENGTH = 512;
+/** Every one-time code the API sends has this many digits. */
+exports.OTP_LENGTH = 6;
+exports.otpCodeSchema = zod_1.z
+    .string()
+    .trim()
+    .regex(new RegExp(`^\\d{${exports.OTP_LENGTH}}$`), {
+    error: `Enter the ${exports.OTP_LENGTH}-digit code`,
+});
+exports.newPasswordSchema = zod_1.z
+    .string()
+    .min(exports.MIN_PASSWORD_LENGTH)
+    .max(exports.MAX_PASSWORD_LENGTH);
+/** No minimum at login, so an old short password fails like any wrong password. */
+exports.submittedPasswordSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(exports.MAX_PASSWORD_LENGTH);
+exports.opaqueTokenSchema = zod_1.z.string().min(1).max(MAX_OPAQUE_TOKEN_LENGTH);
+// Strict objects reject unknown fields, so an attempt to send `roles` or
+// `status` fails loudly rather than being silently ignored.
+exports.loginSchema = zod_1.z.strictObject({
+    email: contact_schema_js_1.emailSchema,
+    password: exports.submittedPasswordSchema,
+    deviceName: (0, safe_text_schema_js_1.safeTextSchema)(100).optional(),
+    tokenTransport: zod_1.z.enum(index_js_1.TOKEN_TRANSPORTS).default('body'),
+});
+exports.refreshSchema = zod_1.z
+    .strictObject({ refreshToken: exports.opaqueTokenSchema.optional() })
+    .default({});
+exports.changePasswordSchema = zod_1.z.strictObject({
+    currentPassword: exports.submittedPasswordSchema,
+    newPassword: exports.newPasswordSchema,
+});
+exports.passwordResetRequestSchema = zod_1.z.strictObject({
+    email: contact_schema_js_1.emailSchema,
+});
+exports.passwordResetConfirmSchema = zod_1.z.strictObject({
+    token: exports.opaqueTokenSchema,
+    newPassword: exports.newPasswordSchema,
+});
+exports.setRoleSchema = zod_1.z.strictObject({
+    role: zod_1.z.enum(index_js_1.ROLES),
+});
+exports.setStatusSchema = zod_1.z.strictObject({
+    status: zod_1.z.enum(index_js_1.ADMIN_SETTABLE_ACCOUNT_STATUSES),
+});
+exports.idParamSchema = zod_1.z.uuid();
+exports.tokenResponseSchema = zod_1.z.object({
+    accessToken: zod_1.z.string(),
+    tokenType: zod_1.z.literal('Bearer'),
+    expiresInSeconds: zod_1.z.number().int(),
+    refreshToken: zod_1.z.string().optional(),
+    csrfToken: zod_1.z.string().optional(),
+    sessionId: zod_1.z.uuid(),
+});
+exports.accountResponseSchema = zod_1.z.object({
+    id: zod_1.z.uuid(),
+    email: zod_1.z.string(),
+    role: zod_1.z.enum(index_js_1.ROLES),
+    /** @deprecated Always `[role]`. Kept for clients written before `role`. */
+    roles: zod_1.z.array(zod_1.z.string()),
+    permissions: zod_1.z.array(zod_1.z.string()),
+    lastLoginAt: zod_1.z.iso.datetime().nullable(),
+});
+exports.loginResponseSchema = exports.tokenResponseSchema.extend({
+    account: exports.accountResponseSchema,
+});
+exports.sessionResponseSchema = zod_1.z.object({
+    id: zod_1.z.uuid(),
+    deviceName: zod_1.z.string().nullable(),
+    userAgent: zod_1.z.string().nullable(),
+    createdAt: zod_1.z.iso.datetime(),
+    lastUsedAt: zod_1.z.iso.datetime(),
+    expiresAt: zod_1.z.iso.datetime(),
+    current: zod_1.z.boolean(),
+});
+exports.logoutAllResponseSchema = zod_1.z.object({
+    revokedSessions: zod_1.z.number().int(),
+});
+exports.passwordResetRequestedResponseSchema = zod_1.z.object({
+    message: zod_1.z.string(),
+});
+exports.adminAccountResponseSchema = zod_1.z.object({
+    id: zod_1.z.uuid(),
+    email: zod_1.z.string(),
+    role: zod_1.z.enum(index_js_1.ROLES),
+    status: zod_1.z.enum(index_js_1.ACCOUNT_STATUSES),
+    lastLoginAt: zod_1.z.iso.datetime().nullable(),
+});
+exports.revokedSessionsResponseSchema = zod_1.z.object({
+    revokedSessions: zod_1.z.number().int(),
+});

package/dist/cjs/auth/index.d.ts

@@ -0,0 +1 @@
+export * from './auth.dto.js';

package/dist/cjs/auth/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth.dto.js"), exports);

package/dist/cjs/coach/coach-auth.dto.d.ts

@@ -0,0 +1,102 @@
+import { z } from 'zod';
+export declare const coachSignupSchema: z.ZodObject<{
+    fullName: z.ZodPipe<z.ZodString, z.ZodString>;
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    phone: z.ZodOptional<z.ZodString>;
+    password: z.ZodString;
+}, z.core.$strict>;
+export type CoachSignupInput = z.input<typeof coachSignupSchema>;
+export type CoachSignupBody = z.output<typeof coachSignupSchema>;
+/** Used by both resend endpoints and by forgot-password. */
+export declare const otpEmailSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+}, z.core.$strict>;
+export type OtpEmailInput = z.input<typeof otpEmailSchema>;
+export type OtpEmailBody = z.output<typeof otpEmailSchema>;
+export declare const verifyOtpSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    code: z.ZodString;
+}, z.core.$strict>;
+export type VerifyOtpInput = z.input<typeof verifyOtpSchema>;
+export type VerifyOtpBody = z.output<typeof verifyOtpSchema>;
+/**
+ * Coaches sign in from the browser, so the refresh token always travels in an
+ * HttpOnly cookie. `rememberMe: false` makes that cookie end with the browser
+ * session instead of persisting.
+ */
+export declare const coachLoginSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    password: z.ZodString;
+    deviceName: z.ZodOptional<z.ZodString>;
+    rememberMe: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export type CoachLoginInput = z.input<typeof coachLoginSchema>;
+export type CoachLoginBody = z.output<typeof coachLoginSchema>;
+export declare const resetPasswordSchema: z.ZodObject<{
+    resetToken: z.ZodString;
+    newPassword: z.ZodString;
+}, z.core.$strict>;
+export type ResetPasswordInput = z.input<typeof resetPasswordSchema>;
+export type ResetPasswordBody = z.output<typeof resetPasswordSchema>;
+/**
+ * Says what the client needs to drive the code screen, and nothing about
+ * whether the email belongs to an account: the same values are returned either
+ * way.
+ */
+export declare const otpDispatchResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+    otpLength: z.ZodNumber;
+    expiresInSeconds: z.ZodNumber;
+    resendAvailableInSeconds: z.ZodNumber;
+}, z.core.$strip>;
+export type OtpDispatchResponse = z.output<typeof otpDispatchResponseSchema>;
+export declare const signupVerifiedResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>;
+export type SignupVerifiedResponse = z.output<typeof signupVerifiedResponseSchema>;
+/** Issued only after a recovery code is verified. It can reset a password once. */
+export declare const resetTokenResponseSchema: z.ZodObject<{
+    resetToken: z.ZodString;
+    expiresInSeconds: z.ZodNumber;
+}, z.core.$strip>;
+export type ResetTokenResponse = z.output<typeof resetTokenResponseSchema>;
+export declare const coachProfileSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    email: z.ZodString;
+    fullName: z.ZodNullable<z.ZodString>;
+    phone: z.ZodNullable<z.ZodString>;
+    role: z.ZodLiteral<"COACH">;
+    status: z.ZodEnum<{
+        pending_verification: "pending_verification";
+        active: "active";
+        disabled: "disabled";
+    }>;
+    emailVerifiedAt: z.ZodNullable<z.ZodISODateTime>;
+    lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+    createdAt: z.ZodISODateTime;
+}, z.core.$strip>;
+export type CoachProfile = z.output<typeof coachProfileSchema>;
+export declare const coachLoginResponseSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    tokenType: z.ZodLiteral<"Bearer">;
+    expiresInSeconds: z.ZodNumber;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    csrfToken: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodUUID;
+    coach: z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodString;
+        fullName: z.ZodNullable<z.ZodString>;
+        phone: z.ZodNullable<z.ZodString>;
+        role: z.ZodLiteral<"COACH">;
+        status: z.ZodEnum<{
+            pending_verification: "pending_verification";
+            active: "active";
+            disabled: "disabled";
+        }>;
+        emailVerifiedAt: z.ZodNullable<z.ZodISODateTime>;
+        lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+        createdAt: z.ZodISODateTime;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type CoachLoginResponse = z.output<typeof coachLoginResponseSchema>;

package/dist/cjs/coach/coach-auth.dto.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coachLoginResponseSchema = exports.coachProfileSchema = exports.resetTokenResponseSchema = exports.signupVerifiedResponseSchema = exports.otpDispatchResponseSchema = exports.resetPasswordSchema = exports.coachLoginSchema = exports.verifyOtpSchema = exports.otpEmailSchema = exports.coachSignupSchema = void 0;
+const zod_1 = require("zod");
+const auth_dto_js_1 = require("../auth/auth.dto.js");
+const contact_schema_js_1 = require("../common/contact.schema.js");
+const safe_text_schema_js_1 = require("../common/safe-text.schema.js");
+const index_js_1 = require("../enums/index.js");
+exports.coachSignupSchema = zod_1.z.strictObject({
+    fullName: (0, safe_text_schema_js_1.safeTextSchema)(100).pipe(zod_1.z.string().min(2, { error: 'Enter your full name' })),
+    email: contact_schema_js_1.emailSchema,
+    phone: contact_schema_js_1.phoneSchema.optional(),
+    password: auth_dto_js_1.newPasswordSchema,
+});
+/** Used by both resend endpoints and by forgot-password. */
+exports.otpEmailSchema = zod_1.z.strictObject({ email: contact_schema_js_1.emailSchema });
+exports.verifyOtpSchema = zod_1.z.strictObject({
+    email: contact_schema_js_1.emailSchema,
+    code: auth_dto_js_1.otpCodeSchema,
+});
+/**
+ * Coaches sign in from the browser, so the refresh token always travels in an
+ * HttpOnly cookie. `rememberMe: false` makes that cookie end with the browser
+ * session instead of persisting.
+ */
+exports.coachLoginSchema = auth_dto_js_1.loginSchema
+    .omit({ tokenTransport: true })
+    .extend({ rememberMe: zod_1.z.boolean().default(true) });
+exports.resetPasswordSchema = zod_1.z.strictObject({
+    resetToken: auth_dto_js_1.opaqueTokenSchema,
+    newPassword: auth_dto_js_1.newPasswordSchema,
+});
+/**
+ * Says what the client needs to drive the code screen, and nothing about
+ * whether the email belongs to an account: the same values are returned either
+ * way.
+ */
+exports.otpDispatchResponseSchema = zod_1.z.object({
+    message: zod_1.z.string(),
+    otpLength: zod_1.z.number().int(),
+    expiresInSeconds: zod_1.z.number().int(),
+    resendAvailableInSeconds: zod_1.z.number().int(),
+});
+exports.signupVerifiedResponseSchema = zod_1.z.object({
+    message: zod_1.z.string(),
+});
+/** Issued only after a recovery code is verified. It can reset a password once. */
+exports.resetTokenResponseSchema = zod_1.z.object({
+    resetToken: zod_1.z.string(),
+    expiresInSeconds: zod_1.z.number().int(),
+});
+exports.coachProfileSchema = zod_1.z.object({
+    id: zod_1.z.uuid(),
+    email: zod_1.z.string(),
+    fullName: zod_1.z.string().nullable(),
+    phone: zod_1.z.string().nullable(),
+    role: zod_1.z.literal('COACH'),
+    status: zod_1.z.enum(index_js_1.ACCOUNT_STATUSES),
+    emailVerifiedAt: zod_1.z.iso.datetime().nullable(),
+    lastLoginAt: zod_1.z.iso.datetime().nullable(),
+    createdAt: zod_1.z.iso.datetime(),
+});
+exports.coachLoginResponseSchema = auth_dto_js_1.tokenResponseSchema.extend({
+    coach: exports.coachProfileSchema,
+});

package/dist/cjs/coach/index.d.ts

@@ -0,0 +1 @@
+export * from './coach-auth.dto.js';

package/dist/cjs/coach/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./coach-auth.dto.js"), exports);