@tula-tech/contract 0.0.0-stage → 0.1.0-alpha.1

package/dist/issuer.d.ts

@@ -0,0 +1,31 @@
+/**
+* The issuer (`iss`) of an environment's access tokens: its URL under the API.
+*
+* Standard JWKS clients fetch keys from a URL with no custom headers, so the environment is part
+* of the path, and the key set lives at {@link jwksUrl} of the issuer (OIDC-style discovery).
+*
+* @param apiUrl - The API's public base URL, e.g. `https://auth.example.com`.
+* @param environmentId - The environment id.
+* @returns The issuer URL, without a trailing slash.
+*
+* @example
+* ```ts
+* environmentIssuer('https://auth.example.com/', 'env_1')
+* // 'https://auth.example.com/v1/environments/env_1'
+* ```
+*/
+declare function environmentIssuer(apiUrl: string, environmentId: string): string;
+/**
+* Where an issuer publishes its public signing keys.
+*
+* @param issuer - The token's `iss` claim.
+* @returns The JWKS URL.
+*
+* @example
+* ```ts
+* jwksUrl('https://auth.example.com/v1/environments/env_1')
+* // 'https://auth.example.com/v1/environments/env_1/.well-known/jwks.json'
+* ```
+*/
+declare function jwksUrl(issuer: string): string;
+export { environmentIssuer, jwksUrl };

package/dist/issuer.js

@@ -0,0 +1,8 @@
+import {
+  environmentIssuer2,
+  jwksUrl2
+} from "./shared/chunk-9pvdavrw.js";
+export {
+  environmentIssuer2 as environmentIssuer,
+  jwksUrl2 as jwksUrl
+};

package/dist/password-rules.d.ts

@@ -0,0 +1,452 @@
+/**
+* Every machine-readable error code the API can return, keyed `area.reason`.
+*
+* Codes are part of the public contract: SDKs switch on them and translate them, so they are
+* append-only. Removing or renaming one is a breaking change.
+*
+* Sign-up deliberately has no "email already taken" code: an existing address still receives
+* `needs_email_verification` (and a notice email) so sign-up can't be used to enumerate accounts.
+*/
+declare const ERROR_DEFINITIONS: {
+	readonly "auth.invalid_credentials": {
+		readonly status: 401;
+		readonly message: "The email or password is incorrect.";
+	};
+	readonly "auth.unauthenticated": {
+		readonly status: 401;
+		readonly message: "You need to sign in to do that.";
+	};
+	readonly "auth.invalid_key": {
+		readonly status: 401;
+		readonly message: "The API key is missing, invalid or revoked.";
+	};
+	readonly "auth.forbidden": {
+		readonly status: 403;
+		readonly message: "You do not have permission to do that.";
+	};
+	readonly "auth.user_banned": {
+		readonly status: 403;
+		readonly message: "This account has been disabled.";
+	};
+	readonly "auth.method_disabled": {
+		readonly status: 403;
+		readonly message: "This sign-in method is not available.";
+	};
+	readonly "auth.step_up_required": {
+		readonly status: 403;
+		readonly message: "Confirm it is you to continue.";
+	};
+	readonly "flow.not_found": {
+		readonly status: 404;
+		readonly message: "This attempt does not exist or has expired.";
+	};
+	readonly "flow.invalid_step": {
+		readonly status: 409;
+		readonly message: "That action is not valid at this step. Please start again.";
+	};
+	readonly "email.invalid": {
+		readonly status: 422;
+		readonly message: "Enter a valid email address.";
+	};
+	readonly "email.already_set": {
+		readonly status: 409;
+		readonly message: "This account already has an email address.";
+	};
+	readonly "password.too_short": {
+		readonly status: 422;
+		readonly message: "Password is too short.";
+	};
+	readonly "password.too_long": {
+		readonly status: 422;
+		readonly message: "Password is too long.";
+	};
+	readonly "password.missing_lowercase": {
+		readonly status: 422;
+		readonly message: "Add a lowercase letter.";
+	};
+	readonly "password.missing_uppercase": {
+		readonly status: 422;
+		readonly message: "Add an uppercase letter.";
+	};
+	readonly "password.missing_number": {
+		readonly status: 422;
+		readonly message: "Add a number.";
+	};
+	readonly "password.missing_special": {
+		readonly status: 422;
+		readonly message: "Add a special character.";
+	};
+	readonly "password.too_few_character_classes": {
+		readonly status: 422;
+		readonly message: "Use a wider mix of letters, numbers and symbols.";
+	};
+	readonly "password.contains_user_info": {
+		readonly status: 422;
+		readonly message: "Password must not contain your name or email.";
+	};
+	readonly "password.common": {
+		readonly status: 422;
+		readonly message: "This password is too common.";
+	};
+	readonly "password.breached": {
+		readonly status: 422;
+		readonly message: "This password appeared in a data breach. Choose a different one.";
+	};
+	readonly "password.repeated_characters": {
+		readonly status: 422;
+		readonly message: "Avoid repeating the same character.";
+	};
+	readonly "password.sequence": {
+		readonly status: 422;
+		readonly message: "Avoid sequences like \"abcd\" or \"1234\".";
+	};
+	readonly "password.reused": {
+		readonly status: 422;
+		readonly message: "You have used this password recently. Choose a different one.";
+	};
+	readonly "password.not_set": {
+		readonly status: 409;
+		readonly message: "This account has no password yet. Use \"forgot password\" to set one.";
+	};
+	readonly "verification.invalid_code": {
+		readonly status: 422;
+		readonly message: "That code is incorrect.";
+	};
+	readonly "verification.expired": {
+		readonly status: 410;
+		readonly message: "That code has expired. Request a new one.";
+	};
+	readonly "verification.too_many_attempts": {
+		readonly status: 429;
+		readonly message: "Too many incorrect codes. Request a new one.";
+	};
+	readonly "verification.different_browser": {
+		readonly status: 409;
+		readonly message: "Open this link in the browser where you started signing in, or enter the code from the email there.";
+	};
+	readonly "mfa.invalid_code": {
+		readonly status: 422;
+		readonly message: "That code is incorrect.";
+	};
+	readonly "mfa.already_enabled": {
+		readonly status: 409;
+		readonly message: "Two-step verification is already on for this account.";
+	};
+	readonly "mfa.not_enabled": {
+		readonly status: 409;
+		readonly message: "Two-step verification is not on for this account.";
+	};
+	readonly "mfa.enrolment_expired": {
+		readonly status: 410;
+		readonly message: "This setup has expired. Start again.";
+	};
+	readonly "mfa.not_available": {
+		readonly status: 403;
+		readonly message: "Two-step verification is not available for this app.";
+	};
+	readonly "mfa.enrolment_needs_other_sign_in": {
+		readonly status: 403;
+		readonly message: "Sign in another way to set up two-step verification.";
+	};
+	readonly "mfa.needs_other_sign_in": {
+		readonly status: 403;
+		readonly message: "Sign in another way. A texted code cannot be both steps.";
+	};
+	readonly "mfa.sms_not_allowed": {
+		readonly status: 409;
+		readonly message: "This account already has a stronger second step than a texted code.";
+	};
+	readonly "mfa.phone_number_required": {
+		readonly status: 409;
+		readonly message: "Add a phone number to your account first.";
+	};
+	readonly "mfa.required_by_policy": {
+		readonly status: 403;
+		readonly message: "This app requires two-step verification. It cannot be turned off.";
+	};
+	readonly "oauth.access_denied": {
+		readonly status: 403;
+		readonly message: "Sign-in was cancelled. Try again or choose another way to sign in.";
+	};
+	readonly "oauth.provider_error": {
+		readonly status: 502;
+		readonly message: "The sign-in provider could not complete the request. Try again.";
+	};
+	readonly "oauth.state_invalid": {
+		readonly status: 400;
+		readonly message: "This sign-in could not be completed. Start again.";
+	};
+	readonly "oauth.ticket_invalid": {
+		readonly status: 410;
+		readonly message: "This sign-in has expired. Start again.";
+	};
+	readonly "oauth.different_browser": {
+		readonly status: 409;
+		readonly message: "Finish signing in in the browser where you started, or start again here.";
+	};
+	readonly "oauth.email_missing": {
+		readonly status: 403;
+		readonly message: "This provider did not share an email address. Allow access to your email and try again.";
+	};
+	readonly "oauth.email_unverified": {
+		readonly status: 403;
+		readonly message: "Your email address is not verified with this provider. Verify it there and try again.";
+	};
+	readonly "oauth.account_exists": {
+		readonly status: 409;
+		readonly message: "An account with this email already exists. Sign in the way you usually do, then connect this provider from your account.";
+	};
+	readonly "oauth.identity_in_use": {
+		readonly status: 409;
+		readonly message: "This provider account is already connected to another user.";
+	};
+	readonly "oauth.already_linked": {
+		readonly status: 409;
+		readonly message: "An account of this provider is already connected. Disconnect it first.";
+	};
+	readonly "identity.last_sign_in_method": {
+		readonly status: 409;
+		readonly message: "This is your only way to sign in. Add a password or connect another account first.";
+	};
+	readonly "webhook.url_not_allowed": {
+		readonly status: 422;
+		readonly message: "The server cannot deliver to that address.";
+	};
+	readonly "webhook.cannot_redeliver": {
+		readonly status: 409;
+		readonly message: "This delivery cannot be sent again.";
+	};
+	readonly "webhook.rotation_refused": {
+		readonly status: 409;
+		readonly message: "The signing secret cannot be changed now.";
+	};
+	readonly "hook.denied": {
+		readonly status: 403;
+		readonly message: "This was not allowed.";
+	};
+	readonly "hook.unavailable": {
+		readonly status: 503;
+		readonly message: "This is unavailable right now. Try again later.";
+	};
+	readonly "hook.url_not_allowed": {
+		readonly status: 422;
+		readonly message: "The server cannot call that address.";
+	};
+	readonly "passkey.registration_failed": {
+		readonly status: 422;
+		readonly message: "That passkey could not be saved. Try again.";
+	};
+	readonly "passkey.already_registered": {
+		readonly status: 409;
+		readonly message: "This passkey is already saved to an account.";
+	};
+	readonly "passkey.limit_reached": {
+		readonly status: 409;
+		readonly message: "You have reached the number of passkeys an account can have. Remove one first.";
+	};
+	readonly "passkey.last_sign_in_method": {
+		readonly status: 409;
+		readonly message: "This is your only way to sign in. Add a password or connect an account first.";
+	};
+	readonly "phone.invalid": {
+		readonly status: 422;
+		readonly message: "Enter a phone number with its country code, such as +14155550100.";
+	};
+	readonly "sms.disabled": {
+		readonly status: 403;
+		readonly message: "Text messages are not available.";
+	};
+	readonly "sms.country_not_allowed": {
+		readonly status: 422;
+		readonly message: "Text messages cannot be sent to that country.";
+	};
+	readonly "sms.unavailable": {
+		readonly status: 503;
+		readonly message: "The text message could not be sent. Try again later.";
+	};
+	readonly "session.invalid_token": {
+		readonly status: 401;
+		readonly message: "Your session is invalid. Sign in again.";
+	};
+	readonly "session.expired": {
+		readonly status: 401;
+		readonly message: "Your session has expired. Sign in again.";
+	};
+	readonly "session.revoked": {
+		readonly status: 401;
+		readonly message: "Your session was signed out. Sign in again.";
+	};
+	readonly "session.reuse_detected": {
+		readonly status: 401;
+		readonly message: "For your security this session was signed out. Sign in again.";
+	};
+	readonly "session.limit_reached": {
+		readonly status: 403;
+		readonly message: "You are signed in on too many devices. Sign out on another device, or reset your password to sign out everywhere, then try again.";
+	};
+	readonly "device.proof_invalid": {
+		readonly status: 401;
+		readonly message: "This session is bound to a device key, and the request did not prove that key.";
+	};
+	readonly "device.nonce_required": {
+		readonly status: 400;
+		readonly message: "The proof needs a fresh nonce. Send the request again with the nonce provided.";
+	};
+	readonly "device.binding_not_supported": {
+		readonly status: 400;
+		readonly message: "A session of this kind of client cannot be bound to a device key.";
+	};
+	readonly "device.binding_required": {
+		readonly status: 400;
+		readonly message: "Signing in here needs a device key.";
+	};
+	readonly rate_limited: {
+		readonly status: 429;
+		readonly message: "Too many requests. Try again shortly.";
+	};
+	readonly "request.malformed": {
+		readonly status: 400;
+		readonly message: "The request could not be read.";
+	};
+	readonly "request.too_large": {
+		readonly status: 413;
+		readonly message: "The request body is too large.";
+	};
+	readonly "request.origin_not_allowed": {
+		readonly status: 403;
+		readonly message: "This origin is not allowed to sign in to this app.";
+	};
+	readonly "request.redirect_not_allowed": {
+		readonly status: 400;
+		readonly message: "This redirect URL is not allowed for this app.";
+	};
+	readonly "validation.failed": {
+		readonly status: 422;
+		readonly message: "Some fields are invalid.";
+	};
+	readonly "resource.not_found": {
+		readonly status: 404;
+		readonly message: "The requested resource does not exist.";
+	};
+	readonly "resource.conflict": {
+		readonly status: 409;
+		readonly message: "The resource conflicts with existing data.";
+	};
+	readonly "precondition.required": {
+		readonly status: 428;
+		readonly message: "Send the revision you are changing in an If-Match header.";
+	};
+	readonly "precondition.failed": {
+		readonly status: 412;
+		readonly message: "The resource changed since you read it. Read it again and retry.";
+	};
+	readonly not_implemented: {
+		readonly status: 501;
+		readonly message: "This capability is not available yet.";
+	};
+	readonly "service.unavailable": {
+		readonly status: 503;
+		readonly message: "The service is temporarily unavailable. Try again shortly.";
+	};
+	readonly internal: {
+		readonly status: 500;
+		readonly message: "Something went wrong on our side.";
+	};
+};
+/** A stable, machine-readable error code (e.g. `password.too_short`). */
+type ErrorCode = keyof typeof ERROR_DEFINITIONS;
+import { z } from "zod";
+/**
+* A project's password rules (business plan §4.7).
+*
+* The same object is enforced by the server and rendered as a live checklist by every SDK, so
+* web, iOS and Android can never disagree about what's valid.
+*/
+declare const PasswordPolicySchema: z.ZodObject<{
+	preset: z.ZodEnum<{
+		custom: "custom";
+		legacy: "legacy";
+		recommended: "recommended";
+		strict: "strict";
+	}>;
+	minLength: z.ZodNumber;
+	maxLength: z.ZodNumber;
+	requireLowercase: z.ZodBoolean;
+	requireUppercase: z.ZodBoolean;
+	requireNumber: z.ZodBoolean;
+	requireSpecial: z.ZodBoolean;
+	minCharacterClasses: z.ZodNumber;
+	specialChars: z.ZodString;
+	disallowUserInfo: z.ZodBoolean;
+	disallowCommon: z.ZodBoolean;
+	breachCheck: z.ZodEnum<{
+		block: "block";
+		off: "off";
+		warn: "warn";
+	}>;
+	maxRepeatedChars: z.ZodNullable<z.ZodNumber>;
+	blockSequences: z.ZodBoolean;
+	history: z.ZodNumber;
+	expiryDays: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
+/** Password policy. */
+type PasswordPolicy = z.infer<typeof PasswordPolicySchema>;
+/** ASCII punctuation counted as "special" by default. */
+declare const DEFAULT_SPECIAL_CHARS = "!@#$%^&*()-_=+[]{};:,.?/\\|'\"`~<>";
+/** Rule identifiers shown in the live checklist. */
+type PasswordRule = "min_length" | "max_length" | "lowercase" | "uppercase" | "number" | "special" | "character_classes" | "user_info" | "common" | "repeated_characters" | "sequence";
+/** The result of one rule. */
+interface PasswordCheck {
+	/** Which rule this is. */
+	rule: PasswordRule;
+	/** The error code to report when the rule fails. */
+	code: ErrorCode;
+	/** Whether the password satisfies the rule. */
+	passed: boolean;
+	/** Rule parameters for rendering, e.g. `{ min: 10 }`. */
+	params?: Record<string, string | number | boolean>;
+}
+/** Result of evaluating a password against a policy (breach check excluded; it's async). */
+interface PasswordEvaluation {
+	/** True when every rule passed. */
+	ok: boolean;
+	/** Every applicable rule, in checklist order. */
+	checks: PasswordCheck[];
+}
+/** Personal details a password must not contain when `disallowUserInfo` is on. */
+interface PasswordUserInfo {
+	email?: string;
+	firstName?: string;
+	lastName?: string;
+	username?: string;
+}
+/**
+* Normalize a password before measuring or hashing it.
+*
+* NFC keeps visually identical Unicode passphrases (e.g. composed vs decomposed "é") equal on
+* every platform.
+*
+* @param password - The raw password.
+* @returns The NFC-normalized password.
+*/
+declare function normalizePassword(password: string): string;
+/**
+* Evaluate a password against a policy and return every rule's result.
+*
+* Pure and synchronous so it runs identically on the server and inside SDKs (live checklist).
+* Length is measured in Unicode code points after NFC normalization, so emoji and accented
+* passphrases count the way users expect. The breached-password check is not included; the server
+* runs it separately.
+*
+* @param policy - The active password policy.
+* @param password - The candidate password.
+* @param userInfo - Personal details the password must not contain.
+* @returns `ok` plus the result of each applicable rule.
+*
+* @example
+* ```ts
+* const { ok, checks } = evaluatePassword(PASSWORD_POLICY_PRESETS.recommended, 'correct horse')
+* ```
+*/
+declare function evaluatePassword(policy: PasswordPolicy, password: string, userInfo?: PasswordUserInfo): PasswordEvaluation;
+export { DEFAULT_SPECIAL_CHARS, PasswordCheck, PasswordEvaluation, PasswordRule, PasswordUserInfo, evaluatePassword, normalizePassword };

package/dist/password-rules.js

@@ -0,0 +1,10 @@
+import {
+  DEFAULT_SPECIAL_CHARS2,
+  normalizePassword2,
+  evaluatePassword2
+} from "./shared/chunk-sc6qg3d2.js";
+export {
+  DEFAULT_SPECIAL_CHARS2 as DEFAULT_SPECIAL_CHARS,
+  evaluatePassword2 as evaluatePassword,
+  normalizePassword2 as normalizePassword
+};