Fix auth JSON datetime decoding

[Callanplays]

Summary

• Decode auth contract timestamp fields from JSON ISO strings using Schema.DateTimeUtcFromString
• Add regression coverage for remote bearer bootstrap/session/auth access payloads

Testing

• bun run --filter @t3tools/contracts test -- auth.test.ts
• bun run --filter @t3tools/contracts test
• bun run --filter @t3tools/contracts typecheck
• bun fmt
• bun lint
• bun typecheck

Context

Desktop SSH environment bootstrap can receive a successful /api/auth/bootstrap/bearer response with an ISO string expiresAt, then fail local schema decoding with Expected DateTime.Utc. The auth response contracts are JSON boundaries, so these timestamp fields should use the string codec.

---

Note

Low Risk
Contract-layer codec alignment for JSON timestamps; low risk with targeted tests and no auth logic changes.

Overview
Auth contract schemas now decode and encode UTC timestamps from ISO 8601 strings at JSON boundaries, fixing failures (e.g. bearer bootstrap expiresAt) where remote HTTP responses were valid but local decoding expected DateTime.Utc objects.

A shared AuthDateTimeUtc codec replaces direct Schema.DateTimeUtc on bootstrap, session, WebSocket token, pairing, and access snapshot fields. Regression tests cover bearer bootstrap round-trip encoding and session/access payloads with string timestamps.

^{Reviewed by Cursor Bugbot for commit c0d60ed. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix auth JSON datetime decoding by using Schema.DateTimeUtcFromString for all timestamp fields

All datetime fields in the auth contract schemas (expiresAt, createdAt, issuedAt, lastConnectedAt) now decode from and encode to ISO-8601 strings instead of requiring Date instances. A shared AuthDateTimeUtc alias for Schema.DateTimeUtcFromString is introduced in auth.ts and applied across AuthBootstrapResult, AuthBearerBootstrapResult, AuthWebSocketTokenResult, AuthPairingLink, AuthClientSession, and AuthSessionState. Tests in auth.test.ts cover round-trip encode/decode for all affected schemas.

^{Macroscope summarized c0d60ed.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 49add04a-da82-430b-bb2f-055b373d7c64

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates auth contract timestamp handling to decode/encode UTC timestamps as ISO strings (suitable for JSON over HTTP), and adds contract-level tests to validate round-tripping and cross-payload decoding.

Changes:

• Introduce a shared AuthDateTimeUtc schema alias using Schema.DateTimeUtcFromString.
• Replace Schema.DateTimeUtc usages in auth contract structs with the new string-based UTC datetime schema.
• Add Vitest coverage for decoding/encoding timestamp fields in multiple auth-related payloads.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
packages/contracts/src/auth.ts	Switches auth contract datetime fields to a shared DateTimeUtcFromString schema for JSON-friendly timestamps.
packages/contracts/src/auth.test.ts	Adds tests to ensure timestamp fields decode/encode correctly across auth payloads.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[macroscopeapp]

Approvability

Verdict: Needs human review

This is a straightforward schema fix for datetime parsing, but it modifies auth contract schemas which are treated as sensitive. Human review recommended to verify the schema type change has no unintended effects on auth validation.

^{You can customize Macroscope's approvability policy. Learn more.}