@tbs-fitness/contract 0.4.0 → 0.5.0

package/README.md

@@ -11,6 +11,7 @@ It is published as `@tbs-fitness/contract`. The package holds definitions only:
 | `@tbs-fitness/contract/enums`         | `ROLES`, `ACCOUNT_STATUSES`, `TOKEN_TRANSPORTS`, `AUDIT_OUTCOMES`, `APP_ENVIRONMENTS`, `FEATURE_FLAG_RULE_TYPES` and their types |
 | `@tbs-fitness/contract/common`        | Pagination, response envelopes (`{ data }`, `{ data, meta }`, `{ error }`), `emailSchema`, `phoneSchema`, `safeTextSchema`       |
 | `@tbs-fitness/contract/auth`          | Login, sessions, password changes and resets, account administration                                                             |
+| `@tbs-fitness/contract/client`        | Client sign-up, one-time code verification and resend, client sign-in and profile, password recovery                             |
 | `@tbs-fitness/contract/coach`         | Coach sign-up, one-time code verification and resend, coach sign-in and profile, password recovery                               |
 | `@tbs-fitness/contract/audit`         | The audit log query and response                                                                                                 |
 | `@tbs-fitness/contract/feature-flags` | Feature flag requests and responses                                                                                              |
@@ -41,6 +42,15 @@ const result = createFlagSchema.safeParse(input); // The same rules as the API.
 
 Requests have two types. Clients use `*Input`, where fields with a default are optional. The backend uses `*Body`, which is the result after validation. List queries come from the URL as strings, so they have no `*Input`: use `Partial<PaginationQuery>` or `Partial<AuditLogQuery>`.
 
+## Version 0.5.0 (breaking)
+
+- `ROLES` is now `ADMIN`, `COACH` and `CLIENT`: `CUSTOMER` is renamed to `CLIENT`. The backend migrates stored roles in step.
+- `FEATURE_FLAG_RULE_TYPES` renames `customer` to `client`, and `createRuleSchema` accepts `ruleType: 'client'`.
+- New `/client`: `clientSignupSchema` (`fullName`, `email`, `password`, optional detected `timezone`), `clientLoginSchema` (body transport by default, for the mobile app), `clientProfileSchema` and `clientLoginResponseSchema`.
+- The one-time code and recovery schemas (`otpEmailSchema`, `verifyOtpSchema`, `resetPasswordSchema`, `otpDispatchResponseSchema`, `signupVerifiedResponseSchema`, `resetTokenResponseSchema`) now live in `/auth`. `/coach` and `/client` re-export them, so existing imports keep working.
+
+Consumers install `^0.5.0` explicitly, and deploy the backend first.
+
 ## Version 0.4.0
 
 Communication and runtime settings. Additive; consumers install `^0.4.0` explicitly.

package/dist/cjs/auth/auth.dto.d.ts

@@ -45,7 +45,7 @@ export declare const setRoleSchema: z.ZodObject<{
     role: z.ZodEnum<{
         ADMIN: "ADMIN";
         COACH: "COACH";
-        CUSTOMER: "CUSTOMER";
+        CLIENT: "CLIENT";
     }>;
 }, z.core.$strict>;
 export type SetRoleInput = z.input<typeof setRoleSchema>;
@@ -100,7 +100,7 @@ export declare const accountResponseSchema: z.ZodObject<{
     role: z.ZodEnum<{
         ADMIN: "ADMIN";
         COACH: "COACH";
-        CUSTOMER: "CUSTOMER";
+        CLIENT: "CLIENT";
     }>;
     roles: z.ZodArray<z.ZodString>;
     permissions: z.ZodArray<z.ZodString>;
@@ -125,7 +125,7 @@ export declare const loginResponseSchema: z.ZodObject<{
         role: z.ZodEnum<{
             ADMIN: "ADMIN";
             COACH: "COACH";
-            CUSTOMER: "CUSTOMER";
+            CLIENT: "CLIENT";
         }>;
         roles: z.ZodArray<z.ZodString>;
         permissions: z.ZodArray<z.ZodString>;
@@ -162,7 +162,7 @@ export declare const adminAccountResponseSchema: z.ZodObject<{
     role: z.ZodEnum<{
         ADMIN: "ADMIN";
         COACH: "COACH";
-        CUSTOMER: "CUSTOMER";
+        CLIENT: "CLIENT";
     }>;
     status: z.ZodEnum<{
         pending_verification: "pending_verification";

package/dist/cjs/auth/index.d.ts

@@ -1 +1,2 @@
 export * from './auth.dto.js';
+export * from './otp.dto.js';

package/dist/cjs/auth/index.js

@@ -15,3 +15,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./auth.dto.js"), exports);
+__exportStar(require("./otp.dto.js"), exports);

package/dist/cjs/auth/otp.dto.d.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+/**
+ * One-time code and password recovery shapes shared by every role's sign-up
+ * and recovery routes. `/coach` and `/client` re-export them.
+ */
+/** Used by both resend endpoints and by forgot-password. */
+export declare const otpEmailSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+}, z.core.$strict>;
+export type OtpEmailInput = z.input<typeof otpEmailSchema>;
+export type OtpEmailBody = z.output<typeof otpEmailSchema>;
+export declare const verifyOtpSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    code: z.ZodString;
+}, z.core.$strict>;
+export type VerifyOtpInput = z.input<typeof verifyOtpSchema>;
+export type VerifyOtpBody = z.output<typeof verifyOtpSchema>;
+export declare const resetPasswordSchema: z.ZodObject<{
+    resetToken: z.ZodString;
+    newPassword: z.ZodString;
+}, z.core.$strict>;
+export type ResetPasswordInput = z.input<typeof resetPasswordSchema>;
+export type ResetPasswordBody = z.output<typeof resetPasswordSchema>;
+/**
+ * Says what the client needs to drive the code screen, and nothing about
+ * whether the email belongs to an account: the same values are returned either
+ * way.
+ */
+export declare const otpDispatchResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+    otpLength: z.ZodNumber;
+    expiresInSeconds: z.ZodNumber;
+    resendAvailableInSeconds: z.ZodNumber;
+}, z.core.$strip>;
+export type OtpDispatchResponse = z.output<typeof otpDispatchResponseSchema>;
+export declare const signupVerifiedResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>;
+export type SignupVerifiedResponse = z.output<typeof signupVerifiedResponseSchema>;
+/** Issued only after a recovery code is verified. It can reset a password once. */
+export declare const resetTokenResponseSchema: z.ZodObject<{
+    resetToken: z.ZodString;
+    expiresInSeconds: z.ZodNumber;
+}, z.core.$strip>;
+export type ResetTokenResponse = z.output<typeof resetTokenResponseSchema>;

package/dist/cjs/auth/otp.dto.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetTokenResponseSchema = exports.signupVerifiedResponseSchema = exports.otpDispatchResponseSchema = exports.resetPasswordSchema = exports.verifyOtpSchema = exports.otpEmailSchema = void 0;
+const zod_1 = require("zod");
+const contact_schema_js_1 = require("../common/contact.schema.js");
+const auth_dto_js_1 = require("./auth.dto.js");
+/**
+ * One-time code and password recovery shapes shared by every role's sign-up
+ * and recovery routes. `/coach` and `/client` re-export them.
+ */
+/** Used by both resend endpoints and by forgot-password. */
+exports.otpEmailSchema = zod_1.z.strictObject({ email: contact_schema_js_1.emailSchema });
+exports.verifyOtpSchema = zod_1.z.strictObject({
+    email: contact_schema_js_1.emailSchema,
+    code: auth_dto_js_1.otpCodeSchema,
+});
+exports.resetPasswordSchema = zod_1.z.strictObject({
+    resetToken: auth_dto_js_1.opaqueTokenSchema,
+    newPassword: auth_dto_js_1.newPasswordSchema,
+});
+/**
+ * Says what the client needs to drive the code screen, and nothing about
+ * whether the email belongs to an account: the same values are returned either
+ * way.
+ */
+exports.otpDispatchResponseSchema = zod_1.z.object({
+    message: zod_1.z.string(),
+    otpLength: zod_1.z.number().int(),
+    expiresInSeconds: zod_1.z.number().int(),
+    resendAvailableInSeconds: zod_1.z.number().int(),
+});
+exports.signupVerifiedResponseSchema = zod_1.z.object({
+    message: zod_1.z.string(),
+});
+/** Issued only after a recovery code is verified. It can reset a password once. */
+exports.resetTokenResponseSchema = zod_1.z.object({
+    resetToken: zod_1.z.string(),
+    expiresInSeconds: zod_1.z.number().int(),
+});

package/dist/cjs/client/client-auth.dto.d.ts

@@ -0,0 +1,81 @@
+import { z } from 'zod';
+/**
+ * Client self sign-up: a name, an email address and a password. The account
+ * cannot sign in until the emailed code is verified.
+ */
+export declare const clientSignupSchema: z.ZodObject<{
+    fullName: z.ZodPipe<z.ZodString, z.ZodString>;
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    password: z.ZodString;
+    timezone: z.ZodOptional<z.ZodPipe<z.ZodUnknown, z.ZodTransform<string | undefined, unknown>>>;
+}, z.core.$strict>;
+export type ClientSignupInput = z.input<typeof clientSignupSchema>;
+export type ClientSignupBody = z.output<typeof clientSignupSchema>;
+/**
+ * Clients sign in from the mobile app, so the refresh token comes back in the
+ * body by default. A browser sends `tokenTransport: "cookie"` instead, and
+ * `rememberMe: false` then makes the cookie end with the browser session.
+ */
+export declare const clientLoginSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    password: z.ZodString;
+    deviceName: z.ZodOptional<z.ZodString>;
+    tokenTransport: z.ZodDefault<z.ZodEnum<{
+        body: "body";
+        cookie: "cookie";
+    }>>;
+    rememberMe: z.ZodDefault<z.ZodBoolean>;
+    timezone: z.ZodOptional<z.ZodPipe<z.ZodUnknown, z.ZodTransform<string | undefined, unknown>>>;
+}, z.core.$strict>;
+export type ClientLoginInput = z.input<typeof clientLoginSchema>;
+export type ClientLoginBody = z.output<typeof clientLoginSchema>;
+export declare const clientProfileSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    email: z.ZodString;
+    fullName: z.ZodNullable<z.ZodString>;
+    phone: z.ZodNullable<z.ZodString>;
+    role: z.ZodLiteral<"CLIENT">;
+    status: z.ZodEnum<{
+        pending_verification: "pending_verification";
+        active: "active";
+        disabled: "disabled";
+    }>;
+    emailVerifiedAt: z.ZodNullable<z.ZodISODateTime>;
+    lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+    createdAt: z.ZodISODateTime;
+    timezone: z.ZodString;
+    timezoneSource: z.ZodEnum<{
+        AUTO: "AUTO";
+        MANUAL: "MANUAL";
+    }>;
+}, z.core.$strip>;
+export type ClientProfile = z.output<typeof clientProfileSchema>;
+export declare const clientLoginResponseSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    tokenType: z.ZodLiteral<"Bearer">;
+    expiresInSeconds: z.ZodNumber;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    csrfToken: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodUUID;
+    client: z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodString;
+        fullName: z.ZodNullable<z.ZodString>;
+        phone: z.ZodNullable<z.ZodString>;
+        role: z.ZodLiteral<"CLIENT">;
+        status: z.ZodEnum<{
+            pending_verification: "pending_verification";
+            active: "active";
+            disabled: "disabled";
+        }>;
+        emailVerifiedAt: z.ZodNullable<z.ZodISODateTime>;
+        lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+        createdAt: z.ZodISODateTime;
+        timezone: z.ZodString;
+        timezoneSource: z.ZodEnum<{
+            AUTO: "AUTO";
+            MANUAL: "MANUAL";
+        }>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ClientLoginResponse = z.output<typeof clientLoginResponseSchema>;

package/dist/cjs/client/client-auth.dto.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clientLoginResponseSchema = exports.clientProfileSchema = exports.clientLoginSchema = exports.clientSignupSchema = void 0;
+const zod_1 = require("zod");
+const auth_dto_js_1 = require("../auth/auth.dto.js");
+const contact_schema_js_1 = require("../common/contact.schema.js");
+const date_time_schema_js_1 = require("../common/date-time.schema.js");
+const safe_text_schema_js_1 = require("../common/safe-text.schema.js");
+const index_js_1 = require("../enums/index.js");
+/**
+ * Client self sign-up: a name, an email address and a password. The account
+ * cannot sign in until the emailed code is verified.
+ */
+exports.clientSignupSchema = zod_1.z.strictObject({
+    fullName: (0, safe_text_schema_js_1.safeTextSchema)(100).pipe(zod_1.z.string().min(2, { error: 'Enter your full name' })),
+    email: contact_schema_js_1.emailSchema,
+    password: auth_dto_js_1.newPasswordSchema,
+    /** The device's time zone. Missing or unusable becomes UTC on the server. */
+    timezone: date_time_schema_js_1.detectedTimezoneSchema,
+});
+/**
+ * Clients sign in from the mobile app, so the refresh token comes back in the
+ * body by default. A browser sends `tokenTransport: "cookie"` instead, and
+ * `rememberMe: false` then makes the cookie end with the browser session.
+ */
+exports.clientLoginSchema = auth_dto_js_1.loginSchema.extend({
+    rememberMe: zod_1.z.boolean().default(true),
+    /**
+     * The device's time zone. It replaces the saved one only while the client's
+     * preference is `AUTO`; a manual choice is never overwritten.
+     */
+    timezone: date_time_schema_js_1.detectedTimezoneSchema,
+});
+exports.clientProfileSchema = zod_1.z
+    .object({
+    id: zod_1.z.uuid(),
+    email: zod_1.z.string(),
+    fullName: zod_1.z.string().nullable(),
+    phone: zod_1.z.string().nullable(),
+    role: zod_1.z.literal('CLIENT'),
+    status: zod_1.z.enum(index_js_1.ACCOUNT_STATUSES),
+    emailVerifiedAt: date_time_schema_js_1.utcTimestampSchema.nullable(),
+    lastLoginAt: date_time_schema_js_1.utcTimestampSchema.nullable(),
+    createdAt: date_time_schema_js_1.utcTimestampSchema,
+})
+    .extend(auth_dto_js_1.timezonePreferenceSchema.shape);
+exports.clientLoginResponseSchema = auth_dto_js_1.tokenResponseSchema.extend({
+    client: exports.clientProfileSchema,
+});

package/dist/cjs/client/index.d.ts

@@ -0,0 +1,2 @@
+export * from '../auth/otp.dto.js';
+export * from './client-auth.dto.js';

package/dist/cjs/client/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../auth/otp.dto.js"), exports);
+__exportStar(require("./client-auth.dto.js"), exports);

package/dist/cjs/coach/coach-auth.dto.d.ts

@@ -8,18 +8,6 @@ export declare const coachSignupSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type CoachSignupInput = z.input<typeof coachSignupSchema>;
 export type CoachSignupBody = z.output<typeof coachSignupSchema>;
-/** Used by both resend endpoints and by forgot-password. */
-export declare const otpEmailSchema: z.ZodObject<{
-    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
-}, z.core.$strict>;
-export type OtpEmailInput = z.input<typeof otpEmailSchema>;
-export type OtpEmailBody = z.output<typeof otpEmailSchema>;
-export declare const verifyOtpSchema: z.ZodObject<{
-    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
-    code: z.ZodString;
-}, z.core.$strict>;
-export type VerifyOtpInput = z.input<typeof verifyOtpSchema>;
-export type VerifyOtpBody = z.output<typeof verifyOtpSchema>;
 /**
  * Coaches sign in from the browser, so the refresh token always travels in an
  * HttpOnly cookie. `rememberMe: false` makes that cookie end with the browser
@@ -34,34 +22,6 @@ export declare const coachLoginSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type CoachLoginInput = z.input<typeof coachLoginSchema>;
 export type CoachLoginBody = z.output<typeof coachLoginSchema>;
-export declare const resetPasswordSchema: z.ZodObject<{
-    resetToken: z.ZodString;
-    newPassword: z.ZodString;
-}, z.core.$strict>;
-export type ResetPasswordInput = z.input<typeof resetPasswordSchema>;
-export type ResetPasswordBody = z.output<typeof resetPasswordSchema>;
-/**
- * Says what the client needs to drive the code screen, and nothing about
- * whether the email belongs to an account: the same values are returned either
- * way.
- */
-export declare const otpDispatchResponseSchema: z.ZodObject<{
-    message: z.ZodString;
-    otpLength: z.ZodNumber;
-    expiresInSeconds: z.ZodNumber;
-    resendAvailableInSeconds: z.ZodNumber;
-}, z.core.$strip>;
-export type OtpDispatchResponse = z.output<typeof otpDispatchResponseSchema>;
-export declare const signupVerifiedResponseSchema: z.ZodObject<{
-    message: z.ZodString;
-}, z.core.$strip>;
-export type SignupVerifiedResponse = z.output<typeof signupVerifiedResponseSchema>;
-/** Issued only after a recovery code is verified. It can reset a password once. */
-export declare const resetTokenResponseSchema: z.ZodObject<{
-    resetToken: z.ZodString;
-    expiresInSeconds: z.ZodNumber;
-}, z.core.$strip>;
-export type ResetTokenResponse = z.output<typeof resetTokenResponseSchema>;
 export declare const coachProfileSchema: z.ZodObject<{
     id: z.ZodUUID;
     email: z.ZodString;

package/dist/cjs/coach/coach-auth.dto.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.coachLoginResponseSchema = exports.coachProfileSchema = exports.resetTokenResponseSchema = exports.signupVerifiedResponseSchema = exports.otpDispatchResponseSchema = exports.resetPasswordSchema = exports.coachLoginSchema = exports.verifyOtpSchema = exports.otpEmailSchema = exports.coachSignupSchema = void 0;
+exports.coachLoginResponseSchema = exports.coachProfileSchema = exports.coachLoginSchema = exports.coachSignupSchema = void 0;
 const zod_1 = require("zod");
 const auth_dto_js_1 = require("../auth/auth.dto.js");
 const contact_schema_js_1 = require("../common/contact.schema.js");
@@ -15,12 +15,6 @@ exports.coachSignupSchema = zod_1.z.strictObject({
     /** The browser's time zone. Missing or unusable becomes UTC on the server. */
     timezone: date_time_schema_js_1.detectedTimezoneSchema,
 });
-/** Used by both resend endpoints and by forgot-password. */
-exports.otpEmailSchema = zod_1.z.strictObject({ email: contact_schema_js_1.emailSchema });
-exports.verifyOtpSchema = zod_1.z.strictObject({
-    email: contact_schema_js_1.emailSchema,
-    code: auth_dto_js_1.otpCodeSchema,
-});
 /**
  * Coaches sign in from the browser, so the refresh token always travels in an
  * HttpOnly cookie. `rememberMe: false` makes that cookie end with the browser
@@ -36,29 +30,6 @@ exports.coachLoginSchema = auth_dto_js_1.loginSchema
      */
     timezone: date_time_schema_js_1.detectedTimezoneSchema,
 });
-exports.resetPasswordSchema = zod_1.z.strictObject({
-    resetToken: auth_dto_js_1.opaqueTokenSchema,
-    newPassword: auth_dto_js_1.newPasswordSchema,
-});
-/**
- * Says what the client needs to drive the code screen, and nothing about
- * whether the email belongs to an account: the same values are returned either
- * way.
- */
-exports.otpDispatchResponseSchema = zod_1.z.object({
-    message: zod_1.z.string(),
-    otpLength: zod_1.z.number().int(),
-    expiresInSeconds: zod_1.z.number().int(),
-    resendAvailableInSeconds: zod_1.z.number().int(),
-});
-exports.signupVerifiedResponseSchema = zod_1.z.object({
-    message: zod_1.z.string(),
-});
-/** Issued only after a recovery code is verified. It can reset a password once. */
-exports.resetTokenResponseSchema = zod_1.z.object({
-    resetToken: zod_1.z.string(),
-    expiresInSeconds: zod_1.z.number().int(),
-});
 exports.coachProfileSchema = zod_1.z
     .object({
     id: zod_1.z.uuid(),

package/dist/cjs/coach/index.d.ts

@@ -1 +1,2 @@
+export * from '../auth/otp.dto.js';
 export * from './coach-auth.dto.js';

package/dist/cjs/coach/index.js

@@ -14,4 +14,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../auth/otp.dto.js"), exports);
 __exportStar(require("./coach-auth.dto.js"), exports);

package/dist/cjs/enums/index.d.ts

@@ -1,7 +1,7 @@
 export declare const APP_ENVIRONMENTS: readonly ["development", "staging", "production"];
 export type AppEnvironment = (typeof APP_ENVIRONMENTS)[number];
 /** Each user has exactly one role. A new role is added here and nowhere else. */
-export declare const ROLES: readonly ["ADMIN", "COACH", "CUSTOMER"];
+export declare const ROLES: readonly ["ADMIN", "COACH", "CLIENT"];
 export type Role = (typeof ROLES)[number];
 /**
  * `pending_verification` is a self-registered user who has not yet proved they
@@ -23,7 +23,7 @@ export declare const TOKEN_TRANSPORTS: readonly ["body", "cookie"];
 export type TokenTransport = (typeof TOKEN_TRANSPORTS)[number];
 export declare const AUDIT_OUTCOMES: readonly ["success", "failure"];
 export type AuditOutcome = (typeof AUDIT_OUTCOMES)[number];
-export declare const FEATURE_FLAG_RULE_TYPES: readonly ["user", "customer", "trainer", "role"];
+export declare const FEATURE_FLAG_RULE_TYPES: readonly ["user", "client", "trainer", "role"];
 export type FeatureFlagRuleType = (typeof FEATURE_FLAG_RULE_TYPES)[number];
 /**
  * The ways a message can reach someone. WhatsApp and push are added here when

package/dist/cjs/enums/index.js

@@ -9,7 +9,7 @@ exports.APP_ENVIRONMENTS = [
     'production',
 ];
 /** Each user has exactly one role. A new role is added here and nowhere else. */
-exports.ROLES = ['ADMIN', 'COACH', 'CUSTOMER'];
+exports.ROLES = ['ADMIN', 'COACH', 'CLIENT'];
 /**
  * `pending_verification` is a self-registered user who has not yet proved they
  * own their email address. Such a user cannot sign in.
@@ -31,7 +31,7 @@ exports.TOKEN_TRANSPORTS = ['body', 'cookie'];
 exports.AUDIT_OUTCOMES = ['success', 'failure'];
 exports.FEATURE_FLAG_RULE_TYPES = [
     'user',
-    'customer',
+    'client',
     'trainer',
     'role',
 ];

package/dist/cjs/feature-flags/feature-flag.dto.d.ts

@@ -31,7 +31,7 @@ export declare const createRuleSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     ruleValue: z.ZodPipe<z.ZodString, z.ZodUUID>;
     enabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>, z.ZodObject<{
-    ruleType: z.ZodLiteral<"customer">;
+    ruleType: z.ZodLiteral<"client">;
     ruleValue: z.ZodPipe<z.ZodString, z.ZodUUID>;
     enabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>, z.ZodObject<{
@@ -43,7 +43,7 @@ export declare const createRuleSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     ruleValue: z.ZodEnum<{
         ADMIN: "ADMIN";
         COACH: "COACH";
-        CUSTOMER: "CUSTOMER";
+        CLIENT: "CLIENT";
     }>;
     enabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>], "ruleType">;
@@ -68,7 +68,7 @@ export declare const ruleResponseSchema: z.ZodObject<{
     id: z.ZodUUID;
     ruleType: z.ZodEnum<{
         user: "user";
-        customer: "customer";
+        client: "client";
         trainer: "trainer";
         role: "role";
     }>;
@@ -101,7 +101,7 @@ export declare const flagResponseSchema: z.ZodObject<{
         id: z.ZodUUID;
         ruleType: z.ZodEnum<{
             user: "user";
-            customer: "customer";
+            client: "client";
             trainer: "trainer";
             role: "role";
         }>;

package/dist/cjs/feature-flags/feature-flag.dto.js

@@ -65,7 +65,7 @@ exports.createRuleSchema = zod_1.z.discriminatedUnion('ruleType', [
         enabled: zod_1.z.boolean().default(true),
     }),
     zod_1.z.strictObject({
-        ruleType: zod_1.z.literal('customer'),
+        ruleType: zod_1.z.literal('client'),
         ruleValue: accountIdSchema,
         enabled: zod_1.z.boolean().default(true),
     }),

package/dist/esm/auth/auth.dto.d.ts

@@ -45,7 +45,7 @@ export declare const setRoleSchema: z.ZodObject<{
     role: z.ZodEnum<{
         ADMIN: "ADMIN";
         COACH: "COACH";
-        CUSTOMER: "CUSTOMER";
+        CLIENT: "CLIENT";
     }>;
 }, z.core.$strict>;
 export type SetRoleInput = z.input<typeof setRoleSchema>;
@@ -100,7 +100,7 @@ export declare const accountResponseSchema: z.ZodObject<{
     role: z.ZodEnum<{
         ADMIN: "ADMIN";
         COACH: "COACH";
-        CUSTOMER: "CUSTOMER";
+        CLIENT: "CLIENT";
     }>;
     roles: z.ZodArray<z.ZodString>;
     permissions: z.ZodArray<z.ZodString>;
@@ -125,7 +125,7 @@ export declare const loginResponseSchema: z.ZodObject<{
         role: z.ZodEnum<{
             ADMIN: "ADMIN";
             COACH: "COACH";
-            CUSTOMER: "CUSTOMER";
+            CLIENT: "CLIENT";
         }>;
         roles: z.ZodArray<z.ZodString>;
         permissions: z.ZodArray<z.ZodString>;
@@ -162,7 +162,7 @@ export declare const adminAccountResponseSchema: z.ZodObject<{
     role: z.ZodEnum<{
         ADMIN: "ADMIN";
         COACH: "COACH";
-        CUSTOMER: "CUSTOMER";
+        CLIENT: "CLIENT";
     }>;
     status: z.ZodEnum<{
         pending_verification: "pending_verification";

package/dist/esm/auth/index.d.ts

@@ -1 +1,2 @@
 export * from './auth.dto.js';
+export * from './otp.dto.js';

package/dist/esm/auth/index.js

@@ -1 +1,2 @@
 export * from './auth.dto.js';
+export * from './otp.dto.js';

package/dist/esm/auth/otp.dto.d.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+/**
+ * One-time code and password recovery shapes shared by every role's sign-up
+ * and recovery routes. `/coach` and `/client` re-export them.
+ */
+/** Used by both resend endpoints and by forgot-password. */
+export declare const otpEmailSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+}, z.core.$strict>;
+export type OtpEmailInput = z.input<typeof otpEmailSchema>;
+export type OtpEmailBody = z.output<typeof otpEmailSchema>;
+export declare const verifyOtpSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    code: z.ZodString;
+}, z.core.$strict>;
+export type VerifyOtpInput = z.input<typeof verifyOtpSchema>;
+export type VerifyOtpBody = z.output<typeof verifyOtpSchema>;
+export declare const resetPasswordSchema: z.ZodObject<{
+    resetToken: z.ZodString;
+    newPassword: z.ZodString;
+}, z.core.$strict>;
+export type ResetPasswordInput = z.input<typeof resetPasswordSchema>;
+export type ResetPasswordBody = z.output<typeof resetPasswordSchema>;
+/**
+ * Says what the client needs to drive the code screen, and nothing about
+ * whether the email belongs to an account: the same values are returned either
+ * way.
+ */
+export declare const otpDispatchResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+    otpLength: z.ZodNumber;
+    expiresInSeconds: z.ZodNumber;
+    resendAvailableInSeconds: z.ZodNumber;
+}, z.core.$strip>;
+export type OtpDispatchResponse = z.output<typeof otpDispatchResponseSchema>;
+export declare const signupVerifiedResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>;
+export type SignupVerifiedResponse = z.output<typeof signupVerifiedResponseSchema>;
+/** Issued only after a recovery code is verified. It can reset a password once. */
+export declare const resetTokenResponseSchema: z.ZodObject<{
+    resetToken: z.ZodString;
+    expiresInSeconds: z.ZodNumber;
+}, z.core.$strip>;
+export type ResetTokenResponse = z.output<typeof resetTokenResponseSchema>;

package/dist/esm/auth/otp.dto.js

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+import { emailSchema } from '../common/contact.schema.js';
+import { newPasswordSchema, opaqueTokenSchema, otpCodeSchema, } from './auth.dto.js';
+/**
+ * One-time code and password recovery shapes shared by every role's sign-up
+ * and recovery routes. `/coach` and `/client` re-export them.
+ */
+/** Used by both resend endpoints and by forgot-password. */
+export const otpEmailSchema = z.strictObject({ email: emailSchema });
+export const verifyOtpSchema = z.strictObject({
+    email: emailSchema,
+    code: otpCodeSchema,
+});
+export const resetPasswordSchema = z.strictObject({
+    resetToken: opaqueTokenSchema,
+    newPassword: newPasswordSchema,
+});
+/**
+ * Says what the client needs to drive the code screen, and nothing about
+ * whether the email belongs to an account: the same values are returned either
+ * way.
+ */
+export const otpDispatchResponseSchema = z.object({
+    message: z.string(),
+    otpLength: z.number().int(),
+    expiresInSeconds: z.number().int(),
+    resendAvailableInSeconds: z.number().int(),
+});
+export const signupVerifiedResponseSchema = z.object({
+    message: z.string(),
+});
+/** Issued only after a recovery code is verified. It can reset a password once. */
+export const resetTokenResponseSchema = z.object({
+    resetToken: z.string(),
+    expiresInSeconds: z.number().int(),
+});

package/dist/esm/client/client-auth.dto.d.ts

@@ -0,0 +1,81 @@
+import { z } from 'zod';
+/**
+ * Client self sign-up: a name, an email address and a password. The account
+ * cannot sign in until the emailed code is verified.
+ */
+export declare const clientSignupSchema: z.ZodObject<{
+    fullName: z.ZodPipe<z.ZodString, z.ZodString>;
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    password: z.ZodString;
+    timezone: z.ZodOptional<z.ZodPipe<z.ZodUnknown, z.ZodTransform<string | undefined, unknown>>>;
+}, z.core.$strict>;
+export type ClientSignupInput = z.input<typeof clientSignupSchema>;
+export type ClientSignupBody = z.output<typeof clientSignupSchema>;
+/**
+ * Clients sign in from the mobile app, so the refresh token comes back in the
+ * body by default. A browser sends `tokenTransport: "cookie"` instead, and
+ * `rememberMe: false` then makes the cookie end with the browser session.
+ */
+export declare const clientLoginSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    password: z.ZodString;
+    deviceName: z.ZodOptional<z.ZodString>;
+    tokenTransport: z.ZodDefault<z.ZodEnum<{
+        body: "body";
+        cookie: "cookie";
+    }>>;
+    rememberMe: z.ZodDefault<z.ZodBoolean>;
+    timezone: z.ZodOptional<z.ZodPipe<z.ZodUnknown, z.ZodTransform<string | undefined, unknown>>>;
+}, z.core.$strict>;
+export type ClientLoginInput = z.input<typeof clientLoginSchema>;
+export type ClientLoginBody = z.output<typeof clientLoginSchema>;
+export declare const clientProfileSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    email: z.ZodString;
+    fullName: z.ZodNullable<z.ZodString>;
+    phone: z.ZodNullable<z.ZodString>;
+    role: z.ZodLiteral<"CLIENT">;
+    status: z.ZodEnum<{
+        pending_verification: "pending_verification";
+        active: "active";
+        disabled: "disabled";
+    }>;
+    emailVerifiedAt: z.ZodNullable<z.ZodISODateTime>;
+    lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+    createdAt: z.ZodISODateTime;
+    timezone: z.ZodString;
+    timezoneSource: z.ZodEnum<{
+        AUTO: "AUTO";
+        MANUAL: "MANUAL";
+    }>;
+}, z.core.$strip>;
+export type ClientProfile = z.output<typeof clientProfileSchema>;
+export declare const clientLoginResponseSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    tokenType: z.ZodLiteral<"Bearer">;
+    expiresInSeconds: z.ZodNumber;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    csrfToken: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodUUID;
+    client: z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodString;
+        fullName: z.ZodNullable<z.ZodString>;
+        phone: z.ZodNullable<z.ZodString>;
+        role: z.ZodLiteral<"CLIENT">;
+        status: z.ZodEnum<{
+            pending_verification: "pending_verification";
+            active: "active";
+            disabled: "disabled";
+        }>;
+        emailVerifiedAt: z.ZodNullable<z.ZodISODateTime>;
+        lastLoginAt: z.ZodNullable<z.ZodISODateTime>;
+        createdAt: z.ZodISODateTime;
+        timezone: z.ZodString;
+        timezoneSource: z.ZodEnum<{
+            AUTO: "AUTO";
+            MANUAL: "MANUAL";
+        }>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ClientLoginResponse = z.output<typeof clientLoginResponseSchema>;

package/dist/esm/client/client-auth.dto.js

@@ -0,0 +1,46 @@
+import { z } from 'zod';
+import { loginSchema, newPasswordSchema, timezonePreferenceSchema, tokenResponseSchema, } from '../auth/auth.dto.js';
+import { emailSchema } from '../common/contact.schema.js';
+import { detectedTimezoneSchema, utcTimestampSchema, } from '../common/date-time.schema.js';
+import { safeTextSchema } from '../common/safe-text.schema.js';
+import { ACCOUNT_STATUSES } from '../enums/index.js';
+/**
+ * Client self sign-up: a name, an email address and a password. The account
+ * cannot sign in until the emailed code is verified.
+ */
+export const clientSignupSchema = z.strictObject({
+    fullName: safeTextSchema(100).pipe(z.string().min(2, { error: 'Enter your full name' })),
+    email: emailSchema,
+    password: newPasswordSchema,
+    /** The device's time zone. Missing or unusable becomes UTC on the server. */
+    timezone: detectedTimezoneSchema,
+});
+/**
+ * Clients sign in from the mobile app, so the refresh token comes back in the
+ * body by default. A browser sends `tokenTransport: "cookie"` instead, and
+ * `rememberMe: false` then makes the cookie end with the browser session.
+ */
+export const clientLoginSchema = loginSchema.extend({
+    rememberMe: z.boolean().default(true),
+    /**
+     * The device's time zone. It replaces the saved one only while the client's
+     * preference is `AUTO`; a manual choice is never overwritten.
+     */
+    timezone: detectedTimezoneSchema,
+});
+export const clientProfileSchema = z
+    .object({
+    id: z.uuid(),
+    email: z.string(),
+    fullName: z.string().nullable(),
+    phone: z.string().nullable(),
+    role: z.literal('CLIENT'),
+    status: z.enum(ACCOUNT_STATUSES),
+    emailVerifiedAt: utcTimestampSchema.nullable(),
+    lastLoginAt: utcTimestampSchema.nullable(),
+    createdAt: utcTimestampSchema,
+})
+    .extend(timezonePreferenceSchema.shape);
+export const clientLoginResponseSchema = tokenResponseSchema.extend({
+    client: clientProfileSchema,
+});

package/dist/esm/client/index.d.ts

@@ -0,0 +1,2 @@
+export * from '../auth/otp.dto.js';
+export * from './client-auth.dto.js';

package/dist/esm/client/index.js

@@ -0,0 +1,2 @@
+export * from '../auth/otp.dto.js';
+export * from './client-auth.dto.js';

package/dist/esm/coach/coach-auth.dto.d.ts

@@ -8,18 +8,6 @@ export declare const coachSignupSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type CoachSignupInput = z.input<typeof coachSignupSchema>;
 export type CoachSignupBody = z.output<typeof coachSignupSchema>;
-/** Used by both resend endpoints and by forgot-password. */
-export declare const otpEmailSchema: z.ZodObject<{
-    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
-}, z.core.$strict>;
-export type OtpEmailInput = z.input<typeof otpEmailSchema>;
-export type OtpEmailBody = z.output<typeof otpEmailSchema>;
-export declare const verifyOtpSchema: z.ZodObject<{
-    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
-    code: z.ZodString;
-}, z.core.$strict>;
-export type VerifyOtpInput = z.input<typeof verifyOtpSchema>;
-export type VerifyOtpBody = z.output<typeof verifyOtpSchema>;
 /**
  * Coaches sign in from the browser, so the refresh token always travels in an
  * HttpOnly cookie. `rememberMe: false` makes that cookie end with the browser
@@ -34,34 +22,6 @@ export declare const coachLoginSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type CoachLoginInput = z.input<typeof coachLoginSchema>;
 export type CoachLoginBody = z.output<typeof coachLoginSchema>;
-export declare const resetPasswordSchema: z.ZodObject<{
-    resetToken: z.ZodString;
-    newPassword: z.ZodString;
-}, z.core.$strict>;
-export type ResetPasswordInput = z.input<typeof resetPasswordSchema>;
-export type ResetPasswordBody = z.output<typeof resetPasswordSchema>;
-/**
- * Says what the client needs to drive the code screen, and nothing about
- * whether the email belongs to an account: the same values are returned either
- * way.
- */
-export declare const otpDispatchResponseSchema: z.ZodObject<{
-    message: z.ZodString;
-    otpLength: z.ZodNumber;
-    expiresInSeconds: z.ZodNumber;
-    resendAvailableInSeconds: z.ZodNumber;
-}, z.core.$strip>;
-export type OtpDispatchResponse = z.output<typeof otpDispatchResponseSchema>;
-export declare const signupVerifiedResponseSchema: z.ZodObject<{
-    message: z.ZodString;
-}, z.core.$strip>;
-export type SignupVerifiedResponse = z.output<typeof signupVerifiedResponseSchema>;
-/** Issued only after a recovery code is verified. It can reset a password once. */
-export declare const resetTokenResponseSchema: z.ZodObject<{
-    resetToken: z.ZodString;
-    expiresInSeconds: z.ZodNumber;
-}, z.core.$strip>;
-export type ResetTokenResponse = z.output<typeof resetTokenResponseSchema>;
 export declare const coachProfileSchema: z.ZodObject<{
     id: z.ZodUUID;
     email: z.ZodString;

package/dist/esm/coach/coach-auth.dto.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { loginSchema, newPasswordSchema, opaqueTokenSchema, otpCodeSchema, timezonePreferenceSchema, tokenResponseSchema, } from '../auth/auth.dto.js';
+import { loginSchema, newPasswordSchema, timezonePreferenceSchema, tokenResponseSchema, } from '../auth/auth.dto.js';
 import { emailSchema, phoneSchema } from '../common/contact.schema.js';
 import { detectedTimezoneSchema, utcTimestampSchema, } from '../common/date-time.schema.js';
 import { safeTextSchema } from '../common/safe-text.schema.js';
@@ -12,12 +12,6 @@ export const coachSignupSchema = z.strictObject({
     /** The browser's time zone. Missing or unusable becomes UTC on the server. */
     timezone: detectedTimezoneSchema,
 });
-/** Used by both resend endpoints and by forgot-password. */
-export const otpEmailSchema = z.strictObject({ email: emailSchema });
-export const verifyOtpSchema = z.strictObject({
-    email: emailSchema,
-    code: otpCodeSchema,
-});
 /**
  * Coaches sign in from the browser, so the refresh token always travels in an
  * HttpOnly cookie. `rememberMe: false` makes that cookie end with the browser
@@ -33,29 +27,6 @@ export const coachLoginSchema = loginSchema
      */
     timezone: detectedTimezoneSchema,
 });
-export const resetPasswordSchema = z.strictObject({
-    resetToken: opaqueTokenSchema,
-    newPassword: newPasswordSchema,
-});
-/**
- * Says what the client needs to drive the code screen, and nothing about
- * whether the email belongs to an account: the same values are returned either
- * way.
- */
-export const otpDispatchResponseSchema = z.object({
-    message: z.string(),
-    otpLength: z.number().int(),
-    expiresInSeconds: z.number().int(),
-    resendAvailableInSeconds: z.number().int(),
-});
-export const signupVerifiedResponseSchema = z.object({
-    message: z.string(),
-});
-/** Issued only after a recovery code is verified. It can reset a password once. */
-export const resetTokenResponseSchema = z.object({
-    resetToken: z.string(),
-    expiresInSeconds: z.number().int(),
-});
 export const coachProfileSchema = z
     .object({
     id: z.uuid(),

package/dist/esm/coach/index.d.ts

@@ -1 +1,2 @@
+export * from '../auth/otp.dto.js';
 export * from './coach-auth.dto.js';

package/dist/esm/coach/index.js

@@ -1 +1,2 @@
+export * from '../auth/otp.dto.js';
 export * from './coach-auth.dto.js';

package/dist/esm/enums/index.d.ts

@@ -1,7 +1,7 @@
 export declare const APP_ENVIRONMENTS: readonly ["development", "staging", "production"];
 export type AppEnvironment = (typeof APP_ENVIRONMENTS)[number];
 /** Each user has exactly one role. A new role is added here and nowhere else. */
-export declare const ROLES: readonly ["ADMIN", "COACH", "CUSTOMER"];
+export declare const ROLES: readonly ["ADMIN", "COACH", "CLIENT"];
 export type Role = (typeof ROLES)[number];
 /**
  * `pending_verification` is a self-registered user who has not yet proved they
@@ -23,7 +23,7 @@ export declare const TOKEN_TRANSPORTS: readonly ["body", "cookie"];
 export type TokenTransport = (typeof TOKEN_TRANSPORTS)[number];
 export declare const AUDIT_OUTCOMES: readonly ["success", "failure"];
 export type AuditOutcome = (typeof AUDIT_OUTCOMES)[number];
-export declare const FEATURE_FLAG_RULE_TYPES: readonly ["user", "customer", "trainer", "role"];
+export declare const FEATURE_FLAG_RULE_TYPES: readonly ["user", "client", "trainer", "role"];
 export type FeatureFlagRuleType = (typeof FEATURE_FLAG_RULE_TYPES)[number];
 /**
  * The ways a message can reach someone. WhatsApp and push are added here when

package/dist/esm/enums/index.js

@@ -6,7 +6,7 @@ export const APP_ENVIRONMENTS = [
     'production',
 ];
 /** Each user has exactly one role. A new role is added here and nowhere else. */
-export const ROLES = ['ADMIN', 'COACH', 'CUSTOMER'];
+export const ROLES = ['ADMIN', 'COACH', 'CLIENT'];
 /**
  * `pending_verification` is a self-registered user who has not yet proved they
  * own their email address. Such a user cannot sign in.
@@ -28,7 +28,7 @@ export const TOKEN_TRANSPORTS = ['body', 'cookie'];
 export const AUDIT_OUTCOMES = ['success', 'failure'];
 export const FEATURE_FLAG_RULE_TYPES = [
     'user',
-    'customer',
+    'client',
     'trainer',
     'role',
 ];

package/dist/esm/feature-flags/feature-flag.dto.d.ts

@@ -31,7 +31,7 @@ export declare const createRuleSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     ruleValue: z.ZodPipe<z.ZodString, z.ZodUUID>;
     enabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>, z.ZodObject<{
-    ruleType: z.ZodLiteral<"customer">;
+    ruleType: z.ZodLiteral<"client">;
     ruleValue: z.ZodPipe<z.ZodString, z.ZodUUID>;
     enabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>, z.ZodObject<{
@@ -43,7 +43,7 @@ export declare const createRuleSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     ruleValue: z.ZodEnum<{
         ADMIN: "ADMIN";
         COACH: "COACH";
-        CUSTOMER: "CUSTOMER";
+        CLIENT: "CLIENT";
     }>;
     enabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>], "ruleType">;
@@ -68,7 +68,7 @@ export declare const ruleResponseSchema: z.ZodObject<{
     id: z.ZodUUID;
     ruleType: z.ZodEnum<{
         user: "user";
-        customer: "customer";
+        client: "client";
         trainer: "trainer";
         role: "role";
     }>;
@@ -101,7 +101,7 @@ export declare const flagResponseSchema: z.ZodObject<{
         id: z.ZodUUID;
         ruleType: z.ZodEnum<{
             user: "user";
-            customer: "customer";
+            client: "client";
             trainer: "trainer";
             role: "role";
         }>;

package/dist/esm/feature-flags/feature-flag.dto.js

@@ -62,7 +62,7 @@ export const createRuleSchema = z.discriminatedUnion('ruleType', [
         enabled: z.boolean().default(true),
     }),
     z.strictObject({
-        ruleType: z.literal('customer'),
+        ruleType: z.literal('client'),
         ruleValue: accountIdSchema,
         enabled: z.boolean().default(true),
     }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tbs-fitness/contract",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "TBS API contract: Zod schemas, DTO types and enums shared by the backend, web and mobile apps",
   "license": "UNLICENSED",
   "type": "module",
@@ -43,6 +43,16 @@
         "default": "./dist/cjs/auth/index.js"
       }
     },
+    "./client": {
+      "import": {
+        "types": "./dist/esm/client/index.d.ts",
+        "default": "./dist/esm/client/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/client/index.d.ts",
+        "default": "./dist/cjs/client/index.js"
+      }
+    },
     "./coach": {
       "import": {
         "types": "./dist/esm/coach/index.d.ts",