@go-mondo/identity-sdk 0.0.1 → 0.0.2-beta.12

package/dist/esm/activity/schema/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../src/activity/schema/utils.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,KAAK;;;;CAIR,CAAC;AAEX,wBAAgB,kBAAkB,WAEjC"}

package/dist/esm/activity/schema/utils.js

@@ -0,0 +1,9 @@
+import KSUID from 'ksuid';
+export const Model = {
+    Activity: {
+        UIDPrefix: 'act',
+    },
+};
+export function generateActivityId() {
+    return `${Model.Activity.UIDPrefix}_${KSUID.randomSync().string}`;
+}

package/dist/esm/activity/schema/utils.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=utils.test.d.ts.map

package/dist/esm/activity/schema/utils.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.test.d.ts","sourceRoot":"","sources":["../../../../src/activity/schema/utils.test.ts"],"names":[],"mappings":""}

package/dist/esm/activity/schema/utils.test.js

@@ -0,0 +1,24 @@
+import { describe, expect, test } from 'vitest';
+import { Model, generateActivityId } from './utils.js';
+describe('Activity Schema - Utils', () => {
+    describe('Model constants', () => {
+        test('should have correct UID prefix', () => {
+            expect(Model.Activity.UIDPrefix).toBe('act');
+        });
+    });
+    describe('generateActivityId', () => {
+        test('should generate ID with correct prefix', () => {
+            const id = generateActivityId();
+            expect(id).toMatch(/^act_[A-Za-z0-9]+$/);
+        });
+        test('should generate unique IDs', () => {
+            const id1 = generateActivityId();
+            const id2 = generateActivityId();
+            expect(id1).not.toBe(id2);
+        });
+        test('should generate IDs with correct length', () => {
+            const id = generateActivityId();
+            expect(id.length).toBeGreaterThan(4); // prefix + underscore + KSUID
+        });
+    });
+});

package/dist/esm/app/authorization/resources.d.ts

@@ -0,0 +1,12 @@
+import type { MondoIdentity } from '../../common/resources/init.js';
+import { type Authorization, type UpsertAuthorizationInput } from './schema.js';
+export declare class AuthorizationResources {
+    private readonly instance;
+    constructor(instance: MondoIdentity);
+    static buildPath(appId: string): string;
+    getItem(id: string): Promise<Authorization>;
+    upsertItem(appId: string, item: UpsertAuthorizationInput): Promise<Authorization>;
+}
+export declare function getAuthorization(instance: MondoIdentity, appId: string): Promise<Authorization>;
+export declare function upsertAuthorization(instance: MondoIdentity, appId: string, item: UpsertAuthorizationInput): Promise<Authorization>;
+//# sourceMappingURL=resources.d.ts.map

package/dist/esm/app/authorization/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../../../src/app/authorization/resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAOpE,OAAO,EACL,KAAK,aAAa,EAElB,KAAK,wBAAwB,EAE9B,MAAM,aAAa,CAAC;AAIrB,qBAAa,sBAAsB;IACd,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAE3D,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIhC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAI3C,UAAU,CACf,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,aAAa,CAAC;CAG1B;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,CAAC,CASxB;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,aAAa,CAAC,CAYxB"}

package/dist/esm/app/authorization/resources.js

@@ -0,0 +1,26 @@
+import { getItemWithAuthorization, updateItemWithAuthorization, } from '../../common/resources/operations.js';
+import { parseEgressSchema } from '../../common/resources/utils.js';
+import { PATH } from '../resources.js';
+import { AuthorizationSchema, UpsertAuthorizationPayloadSchema, } from './schema.js';
+const RESOURCE = 'authorization';
+export class AuthorizationResources {
+    instance;
+    constructor(instance) {
+        this.instance = instance;
+    }
+    static buildPath(appId) {
+        return [PATH, appId, RESOURCE].filter(Boolean).join('/');
+    }
+    getItem(id) {
+        return getAuthorization(this.instance, id);
+    }
+    upsertItem(appId, item) {
+        return upsertAuthorization(this.instance, appId, item);
+    }
+}
+export async function getAuthorization(instance, appId) {
+    return parseEgressSchema(AuthorizationSchema(await getItemWithAuthorization(new URL(AuthorizationResources.buildPath(appId), instance.config.host), instance.authorizer)));
+}
+export async function upsertAuthorization(instance, appId, item) {
+    return parseEgressSchema(AuthorizationSchema(await updateItemWithAuthorization(new URL(AuthorizationResources.buildPath(appId), instance.config.host), instance.authorizer, parseEgressSchema(UpsertAuthorizationPayloadSchema.onUndeclaredKey('delete')(item)))));
+}

package/dist/esm/app/authorization/schema.d.ts

@@ -0,0 +1,54 @@
+import { type AnyGrantType } from '../../oauth/common/schema.js';
+export declare const AuthorizationSchema: import("arktype/internal/methods/object.ts").ObjectType<{
+    refreshTokenDuration: import("arktype/internal/attributes.ts").Default<number, number>;
+    accessTokenDuration: import("arktype/internal/attributes.ts").Default<number, number>;
+    accessTokenSignatureAlgorithm: import("arktype/internal/attributes.ts").Default<string, string>;
+    loginUri?: string | undefined;
+    callbackUrls?: ((In: Set<URL> | string[] | undefined) => import("arktype").Out<Set<URL> | undefined>) | undefined;
+    availableAudiences?: ((In: Set<string> | string[] | undefined) => import("arktype").Out<Set<string> | undefined>) | undefined;
+    availableGrants?: ((In: Set<AnyGrantType> | ("client_credentials" | "authorization_code" | "implicit" | "refresh_token")[] | undefined) => import("arktype").Out<Set<AnyGrantType> | undefined>) | undefined;
+    defaultAudience?: string | undefined;
+    updatedAt?: Date | ((In: string) => import("arktype/internal/attributes.ts").To<Date>) | undefined;
+    deletedAt?: Date | ((In: string) => import("arktype/internal/attributes.ts").To<Date>) | undefined;
+    deactivatedAt?: Date | ((In: string) => import("arktype/internal/attributes.ts").To<Date>) | undefined;
+    metadata: (In: import("arktype/internal/attributes.ts").Default<unknown, Map<string, string | number | boolean>>) => import("arktype").Out<Map<string, string | number | boolean>>;
+}, {}>;
+export type AuthorizationProperties = typeof AuthorizationSchema.inferIn;
+export type Authorization = typeof AuthorizationSchema.inferOut;
+export declare const AuthorizationPayloadSchema: import("arktype/internal/methods/object.ts").ObjectType<{
+    refreshTokenDuration: import("arktype/internal/attributes.ts").Default<number, number>;
+    accessTokenDuration: import("arktype/internal/attributes.ts").Default<number, number>;
+    accessTokenSignatureAlgorithm: import("arktype/internal/attributes.ts").Default<string, string>;
+    loginUri?: string | undefined;
+    callbackUrls?: ((In: Set<URL> | string[] | undefined) => import("arktype").Out<URL[] | undefined>) | undefined;
+    availableAudiences?: ((In: Set<string> | string[] | undefined) => import("arktype").Out<string[] | undefined>) | undefined;
+    availableGrants?: ((In: Set<AnyGrantType> | ("client_credentials" | "authorization_code" | "implicit" | "refresh_token")[] | undefined) => import("arktype").Out<("client_credentials" | "authorization_code" | "implicit" | "refresh_token")[] | undefined>) | undefined;
+    defaultAudience?: string | undefined;
+    updatedAt?: ((In: string | Date | undefined) => import("arktype").Out<string | undefined>) | undefined;
+    deletedAt?: ((In: string | Date | undefined) => import("arktype").Out<string | undefined>) | undefined;
+    deactivatedAt?: ((In: string | Date | undefined) => import("arktype").Out<string | undefined>) | undefined;
+    metadata?: ((In: {
+        [x: string]: string | number | boolean;
+    } | Map<string, string | number | boolean> | null | undefined) => import("arktype").Out<{
+        [x: string]: string | number | boolean;
+    } | undefined>) | undefined;
+}, {}>;
+export type AuthorizationPayload = typeof AuthorizationPayloadSchema.inferOut;
+export declare const UpsertAuthorizationPayloadSchema: import("arktype/internal/methods/object.ts").ObjectType<{
+    refreshTokenDuration: import("arktype/internal/attributes.ts").Default<number, number>;
+    accessTokenDuration: import("arktype/internal/attributes.ts").Default<number, number>;
+    accessTokenSignatureAlgorithm: import("arktype/internal/attributes.ts").Default<string, string>;
+    loginUri?: string | undefined;
+    callbackUrls?: ((In: Set<URL> | string[] | undefined) => import("arktype").Out<URL[] | undefined>) | undefined;
+    availableAudiences?: ((In: Set<string> | string[] | undefined) => import("arktype").Out<string[] | undefined>) | undefined;
+    availableGrants?: ((In: Set<AnyGrantType> | ("client_credentials" | "authorization_code" | "implicit" | "refresh_token")[] | undefined) => import("arktype").Out<("client_credentials" | "authorization_code" | "implicit" | "refresh_token")[] | undefined>) | undefined;
+    defaultAudience?: string | undefined;
+    metadata?: ((In: {
+        [x: string]: string | number | boolean;
+    } | Map<string, string | number | boolean> | null | undefined) => import("arktype").Out<{
+        [x: string]: string | number | boolean;
+    } | null>) | undefined;
+}, {}>;
+export type UpsertAuthorizationInput = typeof UpsertAuthorizationPayloadSchema.inferIn;
+export type UpsertAuthorizationPayload = typeof UpsertAuthorizationPayloadSchema.inferOut;
+//# sourceMappingURL=schema.d.ts.map

package/dist/esm/app/authorization/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/app/authorization/schema.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,YAAY,EAAa,MAAM,8BAA8B,CAAC;AA4D5E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;MASC,CAAC;AAClC,MAAM,MAAM,uBAAuB,GAAG,OAAO,mBAAmB,CAAC,OAAO,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,OAAO,mBAAmB,CAAC,QAAQ,CAAC;AAEhE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;MASF,CAAC;AACtC,MAAM,MAAM,oBAAoB,GAAG,OAAO,0BAA0B,CAAC,QAAQ,CAAC;AAE9E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;MAMF,CAAC;AAC5C,MAAM,MAAM,wBAAwB,GAClC,OAAO,gCAAgC,CAAC,OAAO,CAAC;AAClD,MAAM,MAAM,0BAA0B,GACpC,OAAO,gCAAgC,CAAC,QAAQ,CAAC"}

package/dist/esm/app/authorization/schema.js

@@ -0,0 +1,70 @@
+import { type } from 'arktype';
+import { OptionalDatePayloadSchema, OptionalDateSchema, } from '../../common/schema/dates.js';
+import { MetadataMapPropertySchema, MetadataPayloadPropertySchema, UpsertMetadataPropertyPayloadSchema, } from '../../common/schema/metadata.js';
+import { GrantType } from '../../oauth/common/schema.js';
+import { AuthorizationPayloadSchema as WorkspaceAuthorizationPayloadSchema } from '../../workspace/authorization/schema.js';
+const UrlSetSchema = type.instanceOf((Set));
+const UrlArrayScheama = type('string.url.parse').array();
+const StringSetSchema = type.instanceOf((Set));
+// const UrlStringSchema = type('string.url[]').pipe((v) => v?.filter((i) => !!i));
+const StringSchema = type('string[]').pipe((v) => v?.filter((i) => !!i));
+// const CallbackUrlsSchema = type('undefined')
+//   .or(UrlArrayScheama)
+//   .or(UrlSetSchema)
+//   .pipe((v) => (v instanceof Set ? Array.from(v.values()) : v));
+const CallbackUrlArraySchema = type('undefined')
+    .or(UrlArrayScheama)
+    .or(UrlSetSchema)
+    .pipe((v) => (v instanceof Set ? Array.from(v.values()) : v));
+const CallbackUrlSetSchema = type('undefined')
+    .or(UrlArrayScheama)
+    .or(UrlSetSchema)
+    .pipe((v) => (!v || v instanceof Set ? v : new Set(v)));
+const AvailableAudienceArraySchema = type('undefined')
+    .or(StringSchema)
+    .or(StringSetSchema)
+    .pipe((v) => (v instanceof Set ? Array.from(v.values()) : v));
+const AvailableAudienceSetSchema = type('undefined')
+    .or(StringSchema)
+    .or(StringSetSchema)
+    .pipe((v) => (!v || v instanceof Set ? v : new Set(v)));
+const GrantSetSchema = type.instanceOf((Set));
+const GrantArraySchema = type
+    .enumerated(GrantType.AUTHORIZATION_CODE, GrantType.CLIENT_CREDENTIALS, GrantType.IMPLICIT, GrantType.REFRESH_TOKEN)
+    .array();
+const AvailableGrantSetSchema = type('undefined')
+    .or(GrantArraySchema)
+    .or(GrantSetSchema)
+    .pipe((v) => (!v || v instanceof Set ? v : new Set(v)));
+const AvailableGrantArraySchema = type('undefined')
+    .or(GrantArraySchema)
+    .or(GrantSetSchema)
+    .pipe((v) => (v instanceof Set ? Array.from(v.values()) : v));
+const BaseAuthorization = WorkspaceAuthorizationPayloadSchema.pick('refreshTokenDuration', 'accessTokenDuration', 'accessTokenSignatureAlgorithm');
+export const AuthorizationSchema = BaseAuthorization.and({
+    loginUri: type('string.url | undefined').optional(),
+    callbackUrls: CallbackUrlSetSchema.optional(),
+    availableAudiences: AvailableAudienceSetSchema.optional(),
+    availableGrants: AvailableGrantSetSchema.optional(),
+    defaultAudience: type('string | undefined').optional(),
+    'updatedAt?': OptionalDateSchema,
+    'deletedAt?': OptionalDateSchema,
+    'deactivatedAt?': OptionalDateSchema,
+}).and(MetadataMapPropertySchema);
+export const AuthorizationPayloadSchema = BaseAuthorization.and({
+    loginUri: type('string.url | undefined').optional(),
+    callbackUrls: CallbackUrlArraySchema.optional(),
+    availableAudiences: AvailableAudienceArraySchema.optional(),
+    availableGrants: AvailableGrantArraySchema.optional(),
+    defaultAudience: type('string | undefined').optional(),
+    'updatedAt?': OptionalDatePayloadSchema,
+    'deletedAt?': OptionalDatePayloadSchema,
+    'deactivatedAt?': OptionalDatePayloadSchema,
+}).and(MetadataPayloadPropertySchema);
+export const UpsertAuthorizationPayloadSchema = BaseAuthorization.and({
+    loginUri: type('string.url | undefined').optional(),
+    callbackUrls: CallbackUrlArraySchema.optional(),
+    availableAudiences: AvailableAudienceArraySchema.optional(),
+    availableGrants: AvailableGrantArraySchema.optional(),
+    defaultAudience: type('string | undefined').optional(),
+}).and(UpsertMetadataPropertyPayloadSchema);

package/dist/esm/app/authorization/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/esm/app/authorization/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../src/app/authorization/schema.test.ts"],"names":[],"mappings":""}

package/dist/esm/app/authorization/schema.test.js

@@ -0,0 +1,351 @@
+import { type } from 'arktype';
+import { describe, expect, test } from 'vitest';
+import { AuthorizationPayloadSchema, AuthorizationSchema, UpsertAuthorizationPayloadSchema, } from './schema.js';
+describe('App Authorization - Schema', () => {
+    describe('AuthorizationSchema', () => {
+        test('should accept complete authorization object', () => {
+            const authorization = {
+                refreshTokenDuration: 3600,
+                accessTokenDuration: 900,
+                accessTokenSignatureAlgorithm: 'HS256',
+                loginUri: 'https://app.example.com/login',
+                callbackUrls: [
+                    'https://app.example.com/callback',
+                    'https://app.example.com/oauth/callback',
+                ],
+                availableAudiences: ['api.example.com', 'admin.example.com'],
+                availableGrants: new Set([
+                    'authorization_code',
+                    'refresh_token',
+                ]),
+                defaultAudience: 'api.example.com',
+                updatedAt: new Date(),
+                deletedAt: new Date(),
+                deactivatedAt: new Date(),
+                metadata: {
+                    oauth_version: '2.0',
+                    pkce_required: true,
+                    state_parameter_required: true,
+                },
+            };
+            const result = AuthorizationSchema(authorization);
+            expect(result).not.toBeInstanceOf(type.errors);
+            expect(result.availableGrants).toBeInstanceOf(Set);
+        });
+        test('should accept minimal authorization object', () => {
+            const authorization = {
+                metadata: {},
+            };
+            const result = AuthorizationSchema(authorization);
+            expect(result).not.toBeInstanceOf(type.errors);
+        });
+        test('should accept authorization with grant array and convert to Set', () => {
+            const authorization = {
+                refreshTokenDuration: 7200,
+                accessTokenDuration: 1800,
+                availableGrants: ['authorization_code', 'client_credentials'],
+                metadata: {
+                    client_type: 'confidential',
+                },
+            };
+            const result = AuthorizationSchema(authorization);
+            expect(result).not.toBeInstanceOf(type.errors);
+            expect(result.availableGrants).toBeInstanceOf(Set);
+            expect(result.availableGrants?.has('authorization_code')).toBe(true);
+            expect(result.availableGrants?.has('client_credentials')).toBe(true);
+        });
+        test('should accept authorization with Set of grants', () => {
+            const authorization = {
+                accessTokenDuration: 600,
+                availableGrants: new Set(['implicit', 'authorization_code']),
+                callbackUrls: ['https://spa.example.com/callback'],
+                metadata: {
+                    client_type: 'public',
+                    application_type: 'spa',
+                },
+            };
+            const result = AuthorizationSchema(authorization);
+            expect(result).not.toBeInstanceOf(type.errors);
+            expect(result.availableGrants).toBeInstanceOf(Set);
+        });
+        test('should accept authorization with callback URLs as Set', () => {
+            const authorization = {
+                callbackUrls: new Set([
+                    'https://app.example.com/auth',
+                    'https://app.example.com/oauth',
+                ]),
+                availableAudiences: new Set(['api1.example.com', 'api2.example.com']),
+                metadata: {
+                    multi_tenant: true,
+                },
+            };
+            const result = AuthorizationSchema(authorization);
+            expect(result).not.toBeInstanceOf(type.errors);
+            expect(result.callbackUrls).toBeInstanceOf(Set);
+            expect(result.availableAudiences).toBeInstanceOf(Set);
+        });
+        test('should accept authorization with optional fields', () => {
+            const authorization = {
+                refreshTokenDuration: 86400,
+                accessTokenDuration: 3600,
+                accessTokenSignatureAlgorithm: 'RS256',
+                loginUri: 'https://auth.example.com/login',
+                defaultAudience: 'https://api.example.com',
+                updatedAt: new Date(),
+                metadata: {
+                    jwt_configuration: {
+                        algorithm: 'RS256',
+                        public_key: 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...',
+                    },
+                    scopes: ['read:users', 'write:users', 'admin:all'],
+                },
+            };
+            const result = AuthorizationSchema(authorization);
+            expect(result).not.toBeInstanceOf(type.errors);
+        });
+        test('should filter empty strings from URLs and audiences', () => {
+            const authorization = {
+                callbackUrls: new Set([
+                    'https://valid.example.com/callback',
+                    'https://another.example.com/auth',
+                ]),
+                availableAudiences: ['api.example.com', 'admin.example.com'],
+                metadata: {},
+            };
+            const result = AuthorizationSchema(authorization);
+            expect(result).not.toBeInstanceOf(type.errors);
+            expect(result.callbackUrls).toEqual(new Set([
+                'https://valid.example.com/callback',
+                'https://another.example.com/auth',
+            ]));
+            expect(result.availableAudiences).toEqual(new Set(['api.example.com', 'admin.example.com']));
+        });
+        test('should reject invalid grant types', () => {
+            const authorization = {
+                availableGrants: ['invalid_grant_type'],
+                metadata: {},
+            };
+            const result = AuthorizationSchema(authorization);
+            expect(result).toBeInstanceOf(type.errors);
+        });
+        test('should reject invalid URL formats', () => {
+            const authorization = {
+                loginUri: 'not-a-valid-url',
+                metadata: {},
+            };
+            const result = AuthorizationSchema(authorization);
+            expect(result).toBeInstanceOf(type.errors);
+        });
+    });
+    describe('AuthorizationPayloadSchema', () => {
+        test('should accept complete authorization payload', () => {
+            const payload = {
+                refreshTokenDuration: 3600,
+                accessTokenDuration: 900,
+                accessTokenSignatureAlgorithm: 'HS256',
+                loginUri: 'https://app.example.com/login',
+                callbackUrls: ['https://app.example.com/callback'],
+                availableAudiences: ['api.example.com'],
+                availableGrants: ['authorization_code', 'refresh_token'],
+                defaultAudience: 'api.example.com',
+                updatedAt: new Date().toISOString(),
+                deletedAt: new Date().toISOString(),
+                deactivatedAt: new Date().toISOString(),
+                metadata: {
+                    client_id: 'oauth_client_123',
+                    client_secret_set: true,
+                    token_endpoint_auth_method: 'client_secret_basic',
+                },
+            };
+            const result = AuthorizationPayloadSchema(payload);
+            expect(result).not.toBeInstanceOf(type.errors);
+            expect(result).toEqual(payload);
+        });
+        test('should accept minimal authorization payload', () => {
+            const payload = {
+                metadata: {},
+            };
+            const result = AuthorizationPayloadSchema(payload);
+            expect(result).not.toBeInstanceOf(type.errors);
+            expect(result).toHaveProperty('accessTokenDuration');
+            expect(result).toHaveProperty('accessTokenSignatureAlgorithm');
+            expect(result).toHaveProperty('refreshTokenDuration');
+        });
+        test('should accept payload with grant arrays', () => {
+            const payload = {
+                refreshTokenDuration: 7200,
+                accessTokenDuration: 1800,
+                availableGrants: ['authorization_code', 'client_credentials'],
+                callbackUrls: ['https://server.example.com/oauth/callback'],
+                metadata: {
+                    client_type: 'confidential',
+                    requires_client_secret: true,
+                },
+            };
+            const result = AuthorizationPayloadSchema(payload);
+            expect(result).not.toBeInstanceOf(type.errors);
+        });
+        test('should accept payload with Set of grants', () => {
+            const payload = {
+                accessTokenDuration: 600,
+                availableGrants: new Set(['implicit']),
+                defaultAudience: 'https://spa-api.example.com',
+                metadata: {
+                    client_type: 'public',
+                    application_type: 'single_page_app',
+                },
+            };
+            const result = AuthorizationPayloadSchema(payload);
+            expect(result).not.toBeInstanceOf(type.errors);
+        });
+        test('should accept payload with comprehensive OAuth configuration', () => {
+            const payload = {
+                refreshTokenDuration: 2592000, // 30 days
+                accessTokenDuration: 3600, // 1 hour
+                accessTokenSignatureAlgorithm: 'RS256',
+                loginUri: 'https://auth.corporate.com/oauth/authorize',
+                callbackUrls: [
+                    'https://app.corporate.com/auth/callback',
+                    'https://mobile.corporate.com/oauth/callback',
+                    'https://admin.corporate.com/auth/return',
+                ],
+                availableAudiences: [
+                    'https://api.corporate.com',
+                    'https://admin-api.corporate.com',
+                    'https://analytics.corporate.com',
+                ],
+                availableGrants: [
+                    'authorization_code',
+                    'refresh_token',
+                    'client_credentials',
+                ],
+                defaultAudience: 'https://api.corporate.com',
+                updatedAt: new Date().toISOString(),
+                metadata: {
+                    client_name: 'Corporate Application',
+                    client_uri: 'https://corporate.com',
+                    logo_uri: 'https://corporate.com/logo.png',
+                    tos_uri: 'https://corporate.com/terms',
+                    policy_uri: 'https://corporate.com/privacy',
+                },
+            };
+            const result = AuthorizationPayloadSchema(payload);
+            expect(result).not.toBeInstanceOf(type.errors);
+        });
+        test('should reject invalid date format', () => {
+            const payload = {
+                updatedAt: 'invalid-date',
+                metadata: {},
+            };
+            const result = AuthorizationPayloadSchema(payload);
+            expect(result).toBeInstanceOf(type.errors);
+        });
+        test('should reject invalid signature algorithm', () => {
+            const payload = {
+                accessTokenSignatureAlgorithm: 'INVALID_ALG',
+                metadata: {},
+            };
+            const result = AuthorizationPayloadSchema(payload);
+            expect(result).toBeInstanceOf(type.errors);
+        });
+    });
+    describe('UpsertAuthorizationPayloadSchema', () => {
+        test('should accept upsert with all fields', () => {
+            const payload = {
+                refreshTokenDuration: 3600,
+                accessTokenDuration: 900,
+                accessTokenSignatureAlgorithm: 'HS256',
+                loginUri: 'https://updated.example.com/login',
+                callbackUrls: ['https://updated.example.com/callback'],
+                availableAudiences: ['updated-api.example.com'],
+                availableGrants: ['authorization_code'],
+                defaultAudience: 'updated-api.example.com',
+                metadata: {
+                    update_reason: 'security_enhancement',
+                    updated_by: 'admin@example.com',
+                },
+            };
+            const result = UpsertAuthorizationPayloadSchema(payload);
+            expect(result).not.toBeInstanceOf(type.errors);
+            expect(result).toEqual(payload);
+        });
+        test('should accept partial upsert payload', () => {
+            const payload = {
+                accessTokenDuration: 1800,
+                callbackUrls: ['https://new-callback.example.com'],
+                metadata: {
+                    fields_updated: 'accessTokenDuration',
+                },
+            };
+            const result = UpsertAuthorizationPayloadSchema(payload);
+            expect(result).not.toBeInstanceOf(type.errors);
+        });
+        test('should accept upsert with undefined values', () => {
+            const payload = {
+                loginUri: undefined,
+                defaultAudience: undefined,
+                metadata: {
+                    reset_fields: 'loginUri',
+                },
+            };
+            const result = UpsertAuthorizationPayloadSchema(payload);
+            expect(result).not.toBeInstanceOf(type.errors);
+        });
+        test('should accept empty metadata upsert', () => {
+            const payload = {
+                refreshTokenDuration: 7200,
+                metadata: {},
+            };
+            const result = UpsertAuthorizationPayloadSchema(payload);
+            expect(result).not.toBeInstanceOf(type.errors);
+        });
+        test('should accept upsert with grant types modification', () => {
+            const payload = {
+                availableGrants: [
+                    'authorization_code',
+                    'refresh_token',
+                    'client_credentials',
+                ],
+                metadata: {
+                    added_grants: 'client_credentials',
+                },
+            };
+            const result = UpsertAuthorizationPayloadSchema(payload);
+            expect(result).not.toBeInstanceOf(type.errors);
+        });
+        test('should accept upsert with complex callback URL updates', () => {
+            const payload = {
+                callbackUrls: [
+                    'https://prod.example.com/oauth/callback',
+                    'https://staging.example.com/oauth/callback',
+                    'https://dev.example.com/oauth/callback',
+                ],
+                availableAudiences: [
+                    'https://api.example.com',
+                    'https://staging-api.example.com',
+                ],
+                metadata: {
+                    environment: 'production',
+                },
+            };
+            const result = UpsertAuthorizationPayloadSchema(payload);
+            expect(result).not.toBeInstanceOf(type.errors);
+        });
+        test('should reject invalid grant types in upsert', () => {
+            const payload = {
+                availableGrants: ['invalid_grant'],
+                metadata: {},
+            };
+            const result = UpsertAuthorizationPayloadSchema(payload);
+            expect(result).toBeInstanceOf(type.errors);
+        });
+        test('should reject invalid URL in upsert', () => {
+            const payload = {
+                loginUri: 'not-a-valid-url',
+                metadata: {},
+            };
+            const result = UpsertAuthorizationPayloadSchema(payload);
+            expect(result).toBeInstanceOf(type.errors);
+        });
+    });
+});

package/dist/esm/app/index.d.ts

@@ -0,0 +1,14 @@
+export * from './resources.js';
+export * from './schema.js';
+export * from './authorization/resources.js';
+export * from './authorization/schema.js';
+export * from './oauth/resources.js';
+export * from './oauth/schema.js';
+export * from './oidc/resources.js';
+export * from './oidc/schema.js';
+export * from './registration/resources.js';
+export * from './registration/schema.js';
+export * from './saml/resources.js';
+export * from './saml/schema.js';
+export * from './utils.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/app/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/app/index.ts"],"names":[],"mappings":"AACA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAG5B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAG1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AAGzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,YAAY,CAAC"}

package/dist/esm/app/index.js

@@ -0,0 +1,20 @@
+// Apps
+export * from './resources.js';
+export * from './schema.js';
+// Authorization
+export * from './authorization/resources.js';
+export * from './authorization/schema.js';
+// Oauth
+export * from './oauth/resources.js';
+export * from './oauth/schema.js';
+// OIDC
+export * from './oidc/resources.js';
+export * from './oidc/schema.js';
+// Registration
+export * from './registration/resources.js';
+export * from './registration/schema.js';
+// SAML
+export * from './saml/resources.js';
+export * from './saml/schema.js';
+// Misc
+export * from './utils.js';

package/dist/esm/app/oauth/resources.d.ts

@@ -0,0 +1,12 @@
+import type { MondoIdentity } from '../../common/resources/init.js';
+import { type InsertOAuthInput, type OAuth } from './schema.js';
+export declare class OAuthResources {
+    private readonly instance;
+    constructor(instance: MondoIdentity);
+    static buildPath(appId: string): string;
+    getItem(id: string): Promise<OAuth>;
+    rotateItemSecret(id: string): Promise<OAuth>;
+}
+export declare function getOAuth(instance: MondoIdentity, appId: string): Promise<OAuth>;
+export declare function rotateOAuthSecret(instance: MondoIdentity, appId: string, item?: InsertOAuthInput): Promise<OAuth>;
+//# sourceMappingURL=resources.d.ts.map

package/dist/esm/app/oauth/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../../../src/app/oauth/resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAOpE,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,KAAK,EAEX,MAAM,aAAa,CAAC;AAIrB,qBAAa,cAAc;IACN,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAE3D,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAQhC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAInC,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;CAGpD;AAED,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC,CAShB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,KAAK,CAAC,CAYhB"}