@tbs-fitness/contract 0.1.0 → 0.3.0

package/dist/cjs/common/date-time.schema.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dateOnlySchema = exports.instantInputSchema = exports.utcTimestampSchema = exports.detectedTimezoneSchema = exports.timezoneSchema = exports.DEFAULT_TIMEZONE = void 0;
+exports.isValidTimezone = isValidTimezone;
+exports.canonicalTimezone = canonicalTimezone;
+const zod_1 = require("zod");
+/**
+ * The platform's date and time rules, shared so the backend and the apps
+ * validate them identically:
+ *
+ * - An instant (something that happened at one moment) travels as ISO 8601.
+ *   Responses always use UTC with `Z`. Requests may use `Z` or an explicit
+ *   offset, but never a bare local time, which would be ambiguous.
+ * - A date-only value (a birthday, an expiry date) travels as `YYYY-MM-DD` and
+ *   is never converted between time zones.
+ * - A time zone is an IANA identifier such as `Asia/Kolkata`. Abbreviations
+ *   (`IST`) and fixed offsets (`+05:30`) are refused, because offsets change
+ *   with daylight saving.
+ */
+exports.DEFAULT_TIMEZONE = 'UTC';
+const MAX_TIMEZONE_LENGTH = 64;
+// The IANA areas used for real places. `Etc/*` and the legacy aliases
+// (`US/Eastern`, `EST`) are left out: the first are fixed offsets, and the
+// second have modern names.
+const AREA_LOCATION = /^(?:Africa|America|Antarctica|Arctic|Asia|Atlantic|Australia|Europe|Indian|Pacific)\/[A-Za-z0-9_+-]+(?:\/[A-Za-z0-9_+-]+)?$/;
+/**
+ * True for `UTC` and for an IANA `Area/Location` name the runtime's time zone
+ * database knows. Runs anywhere `Intl` does, so the browser and the server
+ * agree.
+ */
+function isValidTimezone(value) {
+    if (typeof value !== 'string' || value.length > MAX_TIMEZONE_LENGTH) {
+        return false;
+    }
+    if (value !== exports.DEFAULT_TIMEZONE && !AREA_LOCATION.test(value)) {
+        return false;
+    }
+    try {
+        new Intl.DateTimeFormat('en-US', { timeZone: value });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// Browsers and Node report some zones by names IANA has since replaced, because
+// their Unicode data keeps the old ones. Saving the current name means one
+// place is stored, compared and shown one way everywhere.
+const RENAMED_TIMEZONES = {
+    'Asia/Calcutta': 'Asia/Kolkata',
+    'Asia/Saigon': 'Asia/Ho_Chi_Minh',
+    'Asia/Katmandu': 'Asia/Kathmandu',
+    'Asia/Rangoon': 'Asia/Yangon',
+    'Europe/Kiev': 'Europe/Kyiv',
+    'Europe/Uzhgorod': 'Europe/Kyiv',
+    'Europe/Zaporozhye': 'Europe/Kyiv',
+    'Atlantic/Faeroe': 'Atlantic/Faroe',
+    'America/Godthab': 'America/Nuuk',
+    'Pacific/Enderbury': 'Pacific/Kanton',
+    'Pacific/Truk': 'Pacific/Chuuk',
+    'Pacific/Ponape': 'Pacific/Pohnpei',
+    'America/Buenos_Aires': 'America/Argentina/Buenos_Aires',
+    'America/Catamarca': 'America/Argentina/Catamarca',
+    'America/Cordoba': 'America/Argentina/Cordoba',
+    'America/Jujuy': 'America/Argentina/Jujuy',
+    'America/Mendoza': 'America/Argentina/Mendoza',
+    'America/Indianapolis': 'America/Indiana/Indianapolis',
+    'America/Louisville': 'America/Kentucky/Louisville',
+};
+/** The current IANA name for a zone, such as `Asia/Kolkata` for `Asia/Calcutta`. */
+function canonicalTimezone(value) {
+    return RENAMED_TIMEZONES[value] ?? value;
+}
+exports.timezoneSchema = zod_1.z
+    .string()
+    .trim()
+    .refine(isValidTimezone, {
+    error: 'Choose a time zone such as Asia/Kolkata',
+})
+    .transform(canonicalTimezone);
+/**
+ * A time zone the client detected and suggests, such as at sign-up. A missing
+ * or unusable value becomes `undefined` instead of failing the request, and the
+ * server then applies its default.
+ */
+exports.detectedTimezoneSchema = zod_1.z
+    .unknown()
+    .transform((value) => {
+    const trimmed = typeof value === 'string' ? value.trim() : value;
+    return isValidTimezone(trimmed) ? canonicalTimezone(trimmed) : undefined;
+})
+    .optional();
+/** An instant in a response: ISO 8601 in UTC, ending in `Z`. */
+exports.utcTimestampSchema = zod_1.z.iso.datetime();
+/**
+ * An instant in a request: ISO 8601 with `Z` or an explicit offset, such as
+ * `2026-11-02T15:00:00+05:30`. A local time without either is refused.
+ */
+exports.instantInputSchema = zod_1.z.iso.datetime({ offset: true });
+/** A calendar date with no time and no zone, such as `2026-11-02`. */
+exports.dateOnlySchema = zod_1.z
+    .string()
+    .regex(/^\d{4}-\d{2}-\d{2}$/, { error: 'Use the format YYYY-MM-DD' })
+    .refine(isRealCalendarDate, { error: 'Enter a real calendar date' });
+function isRealCalendarDate(value) {
+    const [year, month, day] = value.split('-').map(Number);
+    // UTC is used only to check the calendar, so no zone can move the date.
+    const date = new Date(Date.UTC(year, month - 1, day));
+    return (date.getUTCFullYear() === year &&
+        date.getUTCMonth() === month - 1 &&
+        date.getUTCDate() === day);
+}

package/dist/cjs/common/index.d.ts

@@ -1,4 +1,5 @@
 export * from './api-response.schema.js';
 export * from './contact.schema.js';
+export * from './date-time.schema.js';
 export * from './pagination.schema.js';
 export * from './safe-text.schema.js';

package/dist/cjs/common/index.js

@@ -16,5 +16,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./api-response.schema.js"), exports);
 __exportStar(require("./contact.schema.js"), exports);
+__exportStar(require("./date-time.schema.js"), exports);
 __exportStar(require("./pagination.schema.js"), exports);
 __exportStar(require("./safe-text.schema.js"), exports);

package/dist/cjs/enums/index.d.ts

@@ -1,9 +1,24 @@
 export declare const APP_ENVIRONMENTS: readonly ["development", "staging", "production"];
 export type AppEnvironment = (typeof APP_ENVIRONMENTS)[number];
-export declare const ROLES: readonly ["admin", "trainer", "customer"];
+/** Each user has exactly one role. A new role is added here and nowhere else. */
+export declare const ROLES: readonly ["ADMIN", "COACH", "CUSTOMER"];
 export type Role = (typeof ROLES)[number];
-export declare const ACCOUNT_STATUSES: readonly ["active", "disabled"];
+/**
+ * `pending_verification` is a self-registered user who has not yet proved they
+ * own their email address. Such a user cannot sign in.
+ */
+export declare const ACCOUNT_STATUSES: readonly ["pending_verification", "active", "disabled"];
 export type AccountStatus = (typeof ACCOUNT_STATUSES)[number];
+/** The statuses an administrator may set. Verification is never set by hand. */
+export declare const ADMIN_SETTABLE_ACCOUNT_STATUSES: readonly ["active", "disabled"];
+export type AdminSettableAccountStatus = (typeof ADMIN_SETTABLE_ACCOUNT_STATUSES)[number];
+/**
+ * Where a user's time zone came from. `AUTO` was detected from their browser
+ * and may be updated when they sign in elsewhere. `MANUAL` was chosen by the
+ * user, and only the user changes it.
+ */
+export declare const TIMEZONE_SOURCES: readonly ["AUTO", "MANUAL"];
+export type TimezoneSource = (typeof TIMEZONE_SOURCES)[number];
 export declare const TOKEN_TRANSPORTS: readonly ["body", "cookie"];
 export type TokenTransport = (typeof TOKEN_TRANSPORTS)[number];
 export declare const AUDIT_OUTCOMES: readonly ["success", "failure"];

package/dist/cjs/enums/index.js

@@ -2,14 +2,31 @@
 // These values are stored in the database and sent over the API. Renaming or
 // removing one is a breaking change, so it needs a major version.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FEATURE_FLAG_RULE_TYPES = exports.AUDIT_OUTCOMES = exports.TOKEN_TRANSPORTS = exports.ACCOUNT_STATUSES = exports.ROLES = exports.APP_ENVIRONMENTS = void 0;
+exports.FEATURE_FLAG_RULE_TYPES = exports.AUDIT_OUTCOMES = exports.TOKEN_TRANSPORTS = exports.TIMEZONE_SOURCES = exports.ADMIN_SETTABLE_ACCOUNT_STATUSES = exports.ACCOUNT_STATUSES = exports.ROLES = exports.APP_ENVIRONMENTS = void 0;
 exports.APP_ENVIRONMENTS = [
     'development',
     'staging',
     'production',
 ];
-exports.ROLES = ['admin', 'trainer', 'customer'];
-exports.ACCOUNT_STATUSES = ['active', 'disabled'];
+/** Each user has exactly one role. A new role is added here and nowhere else. */
+exports.ROLES = ['ADMIN', 'COACH', 'CUSTOMER'];
+/**
+ * `pending_verification` is a self-registered user who has not yet proved they
+ * own their email address. Such a user cannot sign in.
+ */
+exports.ACCOUNT_STATUSES = [
+    'pending_verification',
+    'active',
+    'disabled',
+];
+/** The statuses an administrator may set. Verification is never set by hand. */
+exports.ADMIN_SETTABLE_ACCOUNT_STATUSES = ['active', 'disabled'];
+/**
+ * Where a user's time zone came from. `AUTO` was detected from their browser
+ * and may be updated when they sign in elsewhere. `MANUAL` was chosen by the
+ * user, and only the user changes it.
+ */
+exports.TIMEZONE_SOURCES = ['AUTO', 'MANUAL'];
 exports.TOKEN_TRANSPORTS = ['body', 'cookie'];
 exports.AUDIT_OUTCOMES = ['success', 'failure'];
 exports.FEATURE_FLAG_RULE_TYPES = [

package/dist/cjs/feature-flags/feature-flag.dto.d.ts

@@ -41,9 +41,9 @@ export declare const createRuleSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
 }, z.core.$strict>, z.ZodObject<{
     ruleType: z.ZodLiteral<"role">;
     ruleValue: z.ZodEnum<{
-        admin: "admin";
-        trainer: "trainer";
-        customer: "customer";
+        ADMIN: "ADMIN";
+        COACH: "COACH";
+        CUSTOMER: "CUSTOMER";
     }>;
     enabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>], "ruleType">;
@@ -67,9 +67,9 @@ export declare const flagListQuerySchema: z.ZodObject<{
 export declare const ruleResponseSchema: z.ZodObject<{
     id: z.ZodUUID;
     ruleType: z.ZodEnum<{
-        trainer: "trainer";
-        customer: "customer";
         user: "user";
+        customer: "customer";
+        trainer: "trainer";
         role: "role";
     }>;
     ruleValue: z.ZodString;
@@ -100,9 +100,9 @@ export declare const flagResponseSchema: z.ZodObject<{
     rules: z.ZodArray<z.ZodObject<{
         id: z.ZodUUID;
         ruleType: z.ZodEnum<{
-            trainer: "trainer";
-            customer: "customer";
             user: "user";
+            customer: "customer";
+            trainer: "trainer";
             role: "role";
         }>;
         ruleValue: z.ZodString;

package/dist/cjs/feature-flags/feature-flag.dto.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.killSwitchResponseSchema = exports.auditLogResponseSchema = exports.flagResponseSchema = exports.ruleResponseSchema = exports.flagListQuerySchema = exports.setKillSwitchSchema = exports.updateRuleSchema = exports.createRuleSchema = exports.updateFlagSchema = exports.createFlagSchema = exports.flagIdParamSchema = void 0;
 const zod_1 = require("zod");
+const date_time_schema_js_1 = require("../common/date-time.schema.js");
 const pagination_schema_js_1 = require("../common/pagination.schema.js");
 const safe_text_schema_js_1 = require("../common/safe-text.schema.js");
 const index_js_1 = require("../enums/index.js");
@@ -17,7 +18,7 @@ const keySchema = zod_1.z
 const nameSchema = (0, safe_text_schema_js_1.safeTextSchema)(120);
 const descriptionSchema = (0, safe_text_schema_js_1.safeTextSchema)(500);
 const percentageSchema = zod_1.z.number().int().min(0).max(100);
-const timestampSchema = zod_1.z.iso.datetime({ offset: true });
+const timestampSchema = date_time_schema_js_1.instantInputSchema;
 /** Lower-cased, so that it matches IDs as they come from the database. */
 const accountIdSchema = zod_1.z.string().toLowerCase().pipe(zod_1.z.uuid());
 const scheduleIsOrdered = ({ activationAt, expiresAt, }) => !activationAt || !expiresAt || new Date(activationAt) < new Date(expiresAt);
@@ -95,8 +96,8 @@ exports.ruleResponseSchema = zod_1.z.object({
     ruleType: zod_1.z.enum(index_js_1.FEATURE_FLAG_RULE_TYPES),
     ruleValue: zod_1.z.string(),
     enabled: zod_1.z.boolean(),
-    createdAt: zod_1.z.iso.datetime(),
-    updatedAt: zod_1.z.iso.datetime(),
+    createdAt: date_time_schema_js_1.utcTimestampSchema,
+    updatedAt: date_time_schema_js_1.utcTimestampSchema,
 });
 exports.flagResponseSchema = zod_1.z.object({
     id: zod_1.z.uuid(),
@@ -106,13 +107,13 @@ exports.flagResponseSchema = zod_1.z.object({
     environment: zod_1.z.enum(index_js_1.APP_ENVIRONMENTS),
     enabled: zod_1.z.boolean(),
     rolloutPercentage: zod_1.z.number().int(),
-    activationAt: zod_1.z.iso.datetime().nullable(),
-    expiresAt: zod_1.z.iso.datetime().nullable(),
+    activationAt: date_time_schema_js_1.utcTimestampSchema.nullable(),
+    expiresAt: date_time_schema_js_1.utcTimestampSchema.nullable(),
     version: zod_1.z.number().int(),
     createdBy: zod_1.z.uuid(),
     updatedBy: zod_1.z.uuid(),
-    createdAt: zod_1.z.iso.datetime(),
-    updatedAt: zod_1.z.iso.datetime(),
+    createdAt: date_time_schema_js_1.utcTimestampSchema,
+    updatedAt: date_time_schema_js_1.utcTimestampSchema,
     rules: zod_1.z.array(exports.ruleResponseSchema),
 });
 exports.auditLogResponseSchema = zod_1.z.object({
@@ -124,12 +125,12 @@ exports.auditLogResponseSchema = zod_1.z.object({
     action: zod_1.z.string(),
     previousValue: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).nullable(),
     newValue: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).nullable(),
-    createdAt: zod_1.z.iso.datetime(),
+    createdAt: date_time_schema_js_1.utcTimestampSchema,
 });
 exports.killSwitchResponseSchema = zod_1.z.object({
     environment: zod_1.z.enum(index_js_1.APP_ENVIRONMENTS),
     engaged: zod_1.z.boolean(),
     reason: zod_1.z.string().nullable(),
     updatedBy: zod_1.z.uuid().nullable(),
-    updatedAt: zod_1.z.iso.datetime().nullable(),
+    updatedAt: date_time_schema_js_1.utcTimestampSchema.nullable(),
 });

package/dist/esm/audit/audit-log.dto.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { utcTimestampSchema } from '../common/date-time.schema.js';
 import { paginationQuerySchema } from '../common/pagination.schema.js';
 import { AUDIT_OUTCOMES } from '../enums/index.js';
 export const auditLogQuerySchema = paginationQuerySchema.extend({
@@ -17,5 +18,5 @@ export const auditLogResponseSchema = z.object({
     requestId: z.string().nullable(),
     correlationId: z.string().nullable(),
     metadata: z.record(z.string(), z.unknown()).nullable(),
-    createdAt: z.iso.datetime(),
+    createdAt: utcTimestampSchema,
 });

package/dist/esm/auth/auth.dto.d.ts

@@ -1,7 +1,13 @@
 import { z } from 'zod';
 export declare const MIN_PASSWORD_LENGTH = 12;
 export declare const MAX_PASSWORD_LENGTH = 128;
+/** Every one-time code the API sends has this many digits. */
+export declare const OTP_LENGTH = 6;
+export declare const otpCodeSchema: z.ZodString;
 export declare const newPasswordSchema: z.ZodString;
+/** No minimum at login, so an old short password fails like any wrong password. */
+export declare const submittedPasswordSchema: z.ZodString;
+export declare const opaqueTokenSchema: z.ZodString;
 export declare const loginSchema: z.ZodObject<{
     email: z.ZodPipe<z.ZodString, z.ZodEmail>;
     password: z.ZodString;
@@ -35,15 +41,15 @@ export declare const passwordResetConfirmSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type PasswordResetConfirmInput = z.input<typeof passwordResetConfirmSchema>;
 export type PasswordResetConfirmBody = z.output<typeof passwordResetConfirmSchema>;
-export declare const setRolesSchema: z.ZodObject<{
-    roles: z.ZodArray<z.ZodEnum<{
-        admin: "admin";
-        trainer: "trainer";
-        customer: "customer";
-    }>>;
+export declare const setRoleSchema: z.ZodObject<{
+    role: z.ZodEnum<{
+        ADMIN: "ADMIN";
+        COACH: "COACH";
+        CUSTOMER: "CUSTOMER";
+    }>;
 }, z.core.$strict>;
-export type SetRolesInput = z.input<typeof setRolesSchema>;
-export type SetRolesBody = z.output<typeof setRolesSchema>;
+export type SetRoleInput = z.input<typeof setRoleSchema>;
+export type SetRoleBody = z.output<typeof setRoleSchema>;
 export declare const setStatusSchema: z.ZodObject<{
     status: z.ZodEnum<{
         active: "active";
@@ -62,12 +68,48 @@ export declare const tokenResponseSchema: z.ZodObject<{
     sessionId: z.ZodUUID;
 }, z.core.$strip>;
 export type TokenResponse = z.output<typeof tokenResponseSchema>;
+/**
+ * A user's time zone preference: an IANA zone, and whether it was detected
+ * (`AUTO`) or chosen (`MANUAL`).
+ */
+export declare const timezonePreferenceSchema: z.ZodObject<{
+    timezone: z.ZodString;
+    timezoneSource: z.ZodEnum<{
+        AUTO: "AUTO";
+        MANUAL: "MANUAL";
+    }>;
+}, z.core.$strip>;
+export type TimezonePreference = z.output<typeof timezonePreferenceSchema>;
+/**
+ * Sets the signed-in user's own time zone. `MANUAL` (the default) is a choice
+ * the user made. `AUTO` records a detected zone that a later sign-in may
+ * replace.
+ */
+export declare const updateTimezoneSchema: z.ZodObject<{
+    timezone: z.ZodPipe<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>, z.ZodTransform<string, string>>;
+    source: z.ZodDefault<z.ZodEnum<{
+        AUTO: "AUTO";
+        MANUAL: "MANUAL";
+    }>>;
+}, z.core.$strict>;
+export type UpdateTimezoneInput = z.input<typeof updateTimezoneSchema>;
+export type UpdateTimezoneBody = z.output<typeof updateTimezoneSchema>;
 export declare const accountResponseSchema: z.ZodObject<{
     id: z.ZodUUID;
     email: z.ZodString;
+    role: z.ZodEnum<{
+        ADMIN: "ADMIN";
+        COACH: "COACH";
+        CUSTOMER: "CUSTOMER";
+    }>;
     roles: z.ZodArray<z.ZodString>;
     permissions: z.ZodArray<z.ZodString>;
     lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+    timezone: z.ZodString;
+    timezoneSource: z.ZodEnum<{
+        AUTO: "AUTO";
+        MANUAL: "MANUAL";
+    }>;
 }, z.core.$strip>;
 export type AccountResponse = z.output<typeof accountResponseSchema>;
 export declare const loginResponseSchema: z.ZodObject<{
@@ -80,9 +122,19 @@ export declare const loginResponseSchema: z.ZodObject<{
     account: z.ZodObject<{
         id: z.ZodUUID;
         email: z.ZodString;
+        role: z.ZodEnum<{
+            ADMIN: "ADMIN";
+            COACH: "COACH";
+            CUSTOMER: "CUSTOMER";
+        }>;
         roles: z.ZodArray<z.ZodString>;
         permissions: z.ZodArray<z.ZodString>;
         lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+        timezone: z.ZodString;
+        timezoneSource: z.ZodEnum<{
+            AUTO: "AUTO";
+            MANUAL: "MANUAL";
+        }>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type LoginResponse = z.output<typeof loginResponseSchema>;
@@ -107,8 +159,13 @@ export type PasswordResetRequestedResponse = z.output<typeof passwordResetReques
 export declare const adminAccountResponseSchema: z.ZodObject<{
     id: z.ZodUUID;
     email: z.ZodString;
-    roles: z.ZodArray<z.ZodString>;
+    role: z.ZodEnum<{
+        ADMIN: "ADMIN";
+        COACH: "COACH";
+        CUSTOMER: "CUSTOMER";
+    }>;
     status: z.ZodEnum<{
+        pending_verification: "pending_verification";
         active: "active";
         disabled: "disabled";
     }>;

package/dist/esm/auth/auth.dto.js

@@ -1,19 +1,31 @@
 import { z } from 'zod';
 import { emailSchema } from '../common/contact.schema.js';
+import { timezoneSchema, utcTimestampSchema, } from '../common/date-time.schema.js';
 import { safeTextSchema } from '../common/safe-text.schema.js';
-import { ACCOUNT_STATUSES, ROLES, TOKEN_TRANSPORTS } from '../enums/index.js';
+import { ACCOUNT_STATUSES, ADMIN_SETTABLE_ACCOUNT_STATUSES, ROLES, TIMEZONE_SOURCES, TOKEN_TRANSPORTS, } from '../enums/index.js';
 // Per OWASP: length is what matters, with no composition rules. The upper limit
 // stops very long inputs from being used to exhaust the hashing function.
 export const MIN_PASSWORD_LENGTH = 12;
 export const MAX_PASSWORD_LENGTH = 128;
 const MAX_OPAQUE_TOKEN_LENGTH = 512;
+/** Every one-time code the API sends has this many digits. */
+export const OTP_LENGTH = 6;
+export const otpCodeSchema = z
+    .string()
+    .trim()
+    .regex(new RegExp(`^\\d{${OTP_LENGTH}}$`), {
+    error: `Enter the ${OTP_LENGTH}-digit code`,
+});
 export const newPasswordSchema = z
     .string()
     .min(MIN_PASSWORD_LENGTH)
     .max(MAX_PASSWORD_LENGTH);
 /** No minimum at login, so an old short password fails like any wrong password. */
-const submittedPasswordSchema = z.string().min(1).max(MAX_PASSWORD_LENGTH);
-const opaqueTokenSchema = z.string().min(1).max(MAX_OPAQUE_TOKEN_LENGTH);
+export const submittedPasswordSchema = z
+    .string()
+    .min(1)
+    .max(MAX_PASSWORD_LENGTH);
+export const opaqueTokenSchema = z.string().min(1).max(MAX_OPAQUE_TOKEN_LENGTH);
 // Strict objects reject unknown fields, so an attempt to send `roles` or
 // `status` fails loudly rather than being silently ignored.
 export const loginSchema = z.strictObject({
@@ -36,11 +48,11 @@ export const passwordResetConfirmSchema = z.strictObject({
     token: opaqueTokenSchema,
     newPassword: newPasswordSchema,
 });
-export const setRolesSchema = z.strictObject({
-    roles: z.array(z.enum(ROLES)).max(ROLES.length),
+export const setRoleSchema = z.strictObject({
+    role: z.enum(ROLES),
 });
 export const setStatusSchema = z.strictObject({
-    status: z.enum(ACCOUNT_STATUSES),
+    status: z.enum(ADMIN_SETTABLE_ACCOUNT_STATUSES),
 });
 export const idParamSchema = z.uuid();
 export const tokenResponseSchema = z.object({
@@ -51,13 +63,34 @@ export const tokenResponseSchema = z.object({
     csrfToken: z.string().optional(),
     sessionId: z.uuid(),
 });
-export const accountResponseSchema = z.object({
+/**
+ * A user's time zone preference: an IANA zone, and whether it was detected
+ * (`AUTO`) or chosen (`MANUAL`).
+ */
+export const timezonePreferenceSchema = z.object({
+    timezone: z.string(),
+    timezoneSource: z.enum(TIMEZONE_SOURCES),
+});
+/**
+ * Sets the signed-in user's own time zone. `MANUAL` (the default) is a choice
+ * the user made. `AUTO` records a detected zone that a later sign-in may
+ * replace.
+ */
+export const updateTimezoneSchema = z.strictObject({
+    timezone: timezoneSchema,
+    source: z.enum(TIMEZONE_SOURCES).default('MANUAL'),
+});
+export const accountResponseSchema = z
+    .object({
     id: z.uuid(),
     email: z.string(),
+    role: z.enum(ROLES),
+    /** @deprecated Always `[role]`. Kept for clients written before `role`. */
     roles: z.array(z.string()),
     permissions: z.array(z.string()),
-    lastLoginAt: z.iso.datetime().nullable(),
-});
+    lastLoginAt: utcTimestampSchema.nullable(),
+})
+    .extend(timezonePreferenceSchema.shape);
 export const loginResponseSchema = tokenResponseSchema.extend({
     account: accountResponseSchema,
 });
@@ -65,9 +98,9 @@ export const sessionResponseSchema = z.object({
     id: z.uuid(),
     deviceName: z.string().nullable(),
     userAgent: z.string().nullable(),
-    createdAt: z.iso.datetime(),
-    lastUsedAt: z.iso.datetime(),
-    expiresAt: z.iso.datetime(),
+    createdAt: utcTimestampSchema,
+    lastUsedAt: utcTimestampSchema,
+    expiresAt: utcTimestampSchema,
     current: z.boolean(),
 });
 export const logoutAllResponseSchema = z.object({
@@ -79,9 +112,9 @@ export const passwordResetRequestedResponseSchema = z.object({
 export const adminAccountResponseSchema = z.object({
     id: z.uuid(),
     email: z.string(),
-    roles: z.array(z.string()),
+    role: z.enum(ROLES),
     status: z.enum(ACCOUNT_STATUSES),
-    lastLoginAt: z.iso.datetime().nullable(),
+    lastLoginAt: utcTimestampSchema.nullable(),
 });
 export const revokedSessionsResponseSchema = z.object({
     revokedSessions: z.number().int(),

package/dist/esm/coach/coach-auth.dto.d.ts

@@ -0,0 +1,114 @@
+import { z } from 'zod';
+export declare const coachSignupSchema: z.ZodObject<{
+    fullName: z.ZodPipe<z.ZodString, z.ZodString>;
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    phone: z.ZodOptional<z.ZodString>;
+    password: z.ZodString;
+    timezone: z.ZodOptional<z.ZodPipe<z.ZodUnknown, z.ZodTransform<string | undefined, unknown>>>;
+}, z.core.$strict>;
+export type CoachSignupInput = z.input<typeof coachSignupSchema>;
+export type CoachSignupBody = z.output<typeof coachSignupSchema>;
+/** Used by both resend endpoints and by forgot-password. */
+export declare const otpEmailSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+}, z.core.$strict>;
+export type OtpEmailInput = z.input<typeof otpEmailSchema>;
+export type OtpEmailBody = z.output<typeof otpEmailSchema>;
+export declare const verifyOtpSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    code: z.ZodString;
+}, z.core.$strict>;
+export type VerifyOtpInput = z.input<typeof verifyOtpSchema>;
+export type VerifyOtpBody = z.output<typeof verifyOtpSchema>;
+/**
+ * Coaches sign in from the browser, so the refresh token always travels in an
+ * HttpOnly cookie. `rememberMe: false` makes that cookie end with the browser
+ * session instead of persisting.
+ */
+export declare const coachLoginSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    password: z.ZodString;
+    deviceName: z.ZodOptional<z.ZodString>;
+    rememberMe: z.ZodDefault<z.ZodBoolean>;
+    timezone: z.ZodOptional<z.ZodPipe<z.ZodUnknown, z.ZodTransform<string | undefined, unknown>>>;
+}, z.core.$strict>;
+export type CoachLoginInput = z.input<typeof coachLoginSchema>;
+export type CoachLoginBody = z.output<typeof coachLoginSchema>;
+export declare const resetPasswordSchema: z.ZodObject<{
+    resetToken: z.ZodString;
+    newPassword: z.ZodString;
+}, z.core.$strict>;
+export type ResetPasswordInput = z.input<typeof resetPasswordSchema>;
+export type ResetPasswordBody = z.output<typeof resetPasswordSchema>;
+/**
+ * Says what the client needs to drive the code screen, and nothing about
+ * whether the email belongs to an account: the same values are returned either
+ * way.
+ */
+export declare const otpDispatchResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+    otpLength: z.ZodNumber;
+    expiresInSeconds: z.ZodNumber;
+    resendAvailableInSeconds: z.ZodNumber;
+}, z.core.$strip>;
+export type OtpDispatchResponse = z.output<typeof otpDispatchResponseSchema>;
+export declare const signupVerifiedResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>;
+export type SignupVerifiedResponse = z.output<typeof signupVerifiedResponseSchema>;
+/** Issued only after a recovery code is verified. It can reset a password once. */
+export declare const resetTokenResponseSchema: z.ZodObject<{
+    resetToken: z.ZodString;
+    expiresInSeconds: z.ZodNumber;
+}, z.core.$strip>;
+export type ResetTokenResponse = z.output<typeof resetTokenResponseSchema>;
+export declare const coachProfileSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    email: z.ZodString;
+    fullName: z.ZodNullable<z.ZodString>;
+    phone: z.ZodNullable<z.ZodString>;
+    role: z.ZodLiteral<"COACH">;
+    status: z.ZodEnum<{
+        pending_verification: "pending_verification";
+        active: "active";
+        disabled: "disabled";
+    }>;
+    emailVerifiedAt: z.ZodNullable<z.ZodISODateTime>;
+    lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+    createdAt: z.ZodISODateTime;
+    timezone: z.ZodString;
+    timezoneSource: z.ZodEnum<{
+        AUTO: "AUTO";
+        MANUAL: "MANUAL";
+    }>;
+}, z.core.$strip>;
+export type CoachProfile = z.output<typeof coachProfileSchema>;
+export declare const coachLoginResponseSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    tokenType: z.ZodLiteral<"Bearer">;
+    expiresInSeconds: z.ZodNumber;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    csrfToken: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodUUID;
+    coach: z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodString;
+        fullName: z.ZodNullable<z.ZodString>;
+        phone: z.ZodNullable<z.ZodString>;
+        role: z.ZodLiteral<"COACH">;
+        status: z.ZodEnum<{
+            pending_verification: "pending_verification";
+            active: "active";
+            disabled: "disabled";
+        }>;
+        emailVerifiedAt: z.ZodNullable<z.ZodISODateTime>;
+        lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+        createdAt: z.ZodISODateTime;
+        timezone: z.ZodString;
+        timezoneSource: z.ZodEnum<{
+            AUTO: "AUTO";
+            MANUAL: "MANUAL";
+        }>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type CoachLoginResponse = z.output<typeof coachLoginResponseSchema>;