@go-mondo/identity-sdk 0.0.2-beta.4 → 0.0.2-beta.41

package/dist/cjs/oauth/token/schema/grants/authorization-code.d.ts

@@ -1,10 +1,13 @@
-export declare const AuthorizationCodeSchema: import("arktype/out/methods/object.js").ObjectType<{
-    grant_type: "authorization_code";
-    code: string;
-    client_id: string;
-    redirect_uri: string;
-    client_secret?: string | undefined;
-    code_verifier?: string | undefined;
-}, {}>;
-export type AuthorizationCodePayload = typeof AuthorizationCodeSchema.inferOut;
+import * as z from 'zod/v4';
+export declare const AuthorizationCodeSchema: z.ZodObject<{
+    code_verifier: z.ZodOptional<z.ZodString>;
+    grant_type: z.ZodEnum<{
+        authorization_code: "authorization_code";
+    }>;
+    code: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+    redirect_uri: z.ZodURL;
+}, z.core.$strip>;
+export type AuthorizationCodePayload = z.output<typeof AuthorizationCodeSchema>;
 //# sourceMappingURL=authorization-code.d.ts.map

package/dist/cjs/oauth/token/schema/grants/authorization-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-code.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/authorization-code.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,uBAAuB;;;;;;;MAMlB,CAAC;AACnB,MAAM,MAAM,wBAAwB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"authorization-code.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/authorization-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAc5B,eAAO,MAAM,uBAAuB;;;;;;;;;iBAOlC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/cjs/oauth/token/schema/grants/authorization-code.js

@@ -1,20 +1,54 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthorizationCodeSchema = void 0;
-const arktype_1 = require("arktype");
+const z = __importStar(require("zod/v4"));
 const schema_js_1 = require("../../../common/schema.js");
 /**
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
  * @see https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.3.1
  */
-const GrantTypeSchema = arktype_1.type.enumerated(schema_js_1.GrantType.AUTHORIZATION_CODE);
-const PKCESchema = (0, arktype_1.type)({
-    code_verifier: (0, arktype_1.type)('string').optional(),
+const GrantTypeSchema = z.enum([schema_js_1.GrantType.AUTHORIZATION_CODE]);
+const PKCESchema = z.object({
+    code_verifier: z.string().optional(),
 });
-exports.AuthorizationCodeSchema = (0, arktype_1.type)({
+exports.AuthorizationCodeSchema = z.object({
     grant_type: GrantTypeSchema,
-    code: (0, arktype_1.type)('string'),
-    client_id: (0, arktype_1.type)('string'),
-    client_secret: (0, arktype_1.type)('string').optional(),
-    redirect_uri: (0, arktype_1.type)('string.url'),
-}).and(PKCESchema);
+    code: z.string(),
+    client_id: z.string(),
+    client_secret: z.string().optional(),
+    redirect_uri: z.url(),
+    ...PKCESchema.shape,
+});

package/dist/cjs/oauth/token/schema/grants/client-credentials.d.ts

@@ -1,21 +1,26 @@
+import * as z from 'zod/v4';
 /**
  * What the incoming body may look like.
  *
  * Note: the client_id and client_secrete may (likely) be in Authorization header
  */
-export declare const ClientCredentialsPayloadSchema: import("arktype/out/methods/object.js").ObjectType<{
-    grant_type: "client_credentials";
-    scope?: string | undefined;
-    client_id?: string | undefined;
-    client_secret?: string | undefined;
-    audience?: string | undefined;
-}, {}>;
-export declare const ClientCredentialsSchema: import("arktype/out/methods/object.js").ObjectType<{
-    grant_type: "client_credentials";
-    scope?: string | undefined;
-    audience?: string | undefined;
-    client_id: string;
-    client_secret: string;
-}, {}>;
-export type ClientCredentialsPayload = typeof ClientCredentialsSchema.inferOut;
+export declare const ClientCredentialsPayloadSchema: z.ZodObject<{
+    audience: z.ZodOptional<z.ZodString>;
+    grant_type: z.ZodEnum<{
+        client_credentials: "client_credentials";
+    }>;
+    scope: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const ClientCredentialsSchema: z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    audience: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    grant_type: z.ZodEnum<{
+        client_credentials: "client_credentials";
+    }>;
+}, z.core.$strip>;
+export type ClientCredentialsPayload = z.output<typeof ClientCredentialsSchema>;
 //# sourceMappingURL=client-credentials.d.ts.map

package/dist/cjs/oauth/token/schema/grants/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/client-credentials.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;MAKrB,CAAC;AAEvB,eAAO,MAAM,uBAAuB;;;;;;MAMlC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/client-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAU5B;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;iBAMzC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;iBAOlC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/cjs/oauth/token/schema/grants/client-credentials.js

@@ -1,25 +1,63 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClientCredentialsSchema = exports.ClientCredentialsPayloadSchema = void 0;
-const arktype_1 = require("arktype");
-const app_js_1 = require("../../../../app/schema/app.js");
-const schema_js_1 = require("../../../common/schema.js");
+const z = __importStar(require("zod/v4"));
+const schema_js_1 = require("../../../../app/schema.js");
+const schema_js_2 = require("../../../common/schema.js");
 /**
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.2
  */
-const GrantTypeSchema = arktype_1.type.enumerated(schema_js_1.GrantType.CLIENT_CREDENTIALS);
+const GrantTypeSchema = z.enum([schema_js_2.GrantType.CLIENT_CREDENTIALS]);
 /**
  * What the incoming body may look like.
  *
  * Note: the client_id and client_secrete may (likely) be in Authorization header
  */
-exports.ClientCredentialsPayloadSchema = (0, arktype_1.type)({
+exports.ClientCredentialsPayloadSchema = z.object({
     grant_type: GrantTypeSchema,
-    scope: (0, arktype_1.type)('string').optional(),
-    client_id: app_js_1.AppIdSchema.optional(),
-    client_secret: (0, arktype_1.type)('string').optional(),
-}).and(schema_js_1.OptionalSchema);
-exports.ClientCredentialsSchema = exports.ClientCredentialsPayloadSchema.omit('client_id', 'client_secret').and({
-    client_id: app_js_1.AppIdSchema,
-    client_secret: (0, arktype_1.type)('string'),
+    scope: z.string().optional(),
+    client_id: schema_js_1.AppIdSchema.optional(),
+    client_secret: z.string().optional(),
+    ...schema_js_2.OptionalSchema.shape,
+});
+exports.ClientCredentialsSchema = z.object({
+    ...exports.ClientCredentialsPayloadSchema.omit({
+        client_id: true,
+        client_secret: true,
+    }).shape,
+    client_id: schema_js_1.AppIdSchema,
+    client_secret: z.string(),
 });

package/dist/cjs/oauth/token/schema/grants/refresh-token.d.ts

@@ -1,9 +1,12 @@
-export declare const RefreshTokenSchema: import("arktype/out/methods/object.js").ObjectType<{
-    grant_type: "refresh_token";
-    refresh_token: string;
-    client_id: string;
-    client_secret: string;
-    scope?: string | undefined;
-}, {}>;
-export type RefreshTokenPayload = typeof RefreshTokenSchema.inferOut;
+import * as z from 'zod/v4';
+export declare const RefreshTokenSchema: z.ZodObject<{
+    grant_type: z.ZodEnum<{
+        refresh_token: "refresh_token";
+    }>;
+    refresh_token: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+}, z.core.$strip>;
+export type RefreshTokenPayload = z.output<typeof RefreshTokenSchema>;
 //# sourceMappingURL=refresh-token.d.ts.map

package/dist/cjs/oauth/token/schema/grants/refresh-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/refresh-token.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,kBAAkB;;;;;;MAM7B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,kBAAkB,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/refresh-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAS5B,eAAO,MAAM,kBAAkB;;;;;;;;iBAM7B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/cjs/oauth/token/schema/grants/refresh-token.js

@@ -1,17 +1,50 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RefreshTokenSchema = void 0;
-const arktype_1 = require("arktype");
-const app_js_1 = require("../../../../app/schema/app.js");
-const schema_js_1 = require("../../../common/schema.js");
+const z = __importStar(require("zod/v4"));
+const schema_js_1 = require("../../../../app/schema.js");
+const schema_js_2 = require("../../../common/schema.js");
 /**
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
  */
-const GrantTypeSchema = arktype_1.type.enumerated(schema_js_1.GrantType.REFRESH_TOKEN);
-exports.RefreshTokenSchema = (0, arktype_1.type)({
+const GrantTypeSchema = z.enum([schema_js_2.GrantType.REFRESH_TOKEN]);
+exports.RefreshTokenSchema = z.object({
     grant_type: GrantTypeSchema,
-    refresh_token: (0, arktype_1.type)('string'),
-    scope: (0, arktype_1.type)('string').optional(),
-    client_id: app_js_1.AppIdSchema,
-    client_secret: (0, arktype_1.type)('string'),
+    refresh_token: z.string(),
+    scope: z.string().optional(),
+    client_id: schema_js_1.AppIdSchema,
+    client_secret: z.string(),
 });

package/dist/cjs/oauth/token/schema/schema.d.ts

@@ -1,28 +1,35 @@
+import * as z from 'zod/v4';
 export * from './grants/authorization-code.js';
 export * from './grants/client-credentials.js';
 export * from './grants/refresh-token.js';
 /**
  * Union(s)
  */
-export declare const Schema: import("arktype/out/methods/object.js").ObjectType<{
-    grant_type: "authorization_code";
-    code: string;
-    client_id: string;
-    redirect_uri: string;
-    client_secret?: string | undefined;
-    code_verifier?: string | undefined;
-} | {
-    grant_type: "client_credentials";
-    scope?: string | undefined;
-    audience?: string | undefined;
-    client_id: string;
-    client_secret: string;
-} | {
-    grant_type: "refresh_token";
-    refresh_token: string;
-    client_id: string;
-    client_secret: string;
-    scope?: string | undefined;
-}, {}>;
-export type Payload = typeof Schema.inferOut;
+export declare const Schema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    code_verifier: z.ZodOptional<z.ZodString>;
+    grant_type: z.ZodEnum<{
+        authorization_code: "authorization_code";
+    }>;
+    code: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+    redirect_uri: z.ZodURL;
+}, z.core.$strip>, z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    audience: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    grant_type: z.ZodEnum<{
+        client_credentials: "client_credentials";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodEnum<{
+        refresh_token: "refresh_token";
+    }>;
+    refresh_token: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+}, z.core.$strip>], "grant_type">;
+export type Payload = z.output<typeof Schema>;
 //# sourceMappingURL=schema.d.ts.map

package/dist/cjs/oauth/token/schema/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../src/oauth/token/schema/schema.ts"],"names":[],"mappings":"AAIA,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;MAElB,CAAC;AACF,MAAM,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../src/oauth/token/schema/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAM5B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;iCAIjB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,CAAC"}

package/dist/cjs/oauth/token/schema/schema.js

@@ -10,11 +10,34 @@ var __createBinding = (this && this.__createBinding) || (Object.create ? (functi
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];
 }));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Schema = void 0;
+const z = __importStar(require("zod/v4"));
 const authorization_code_js_1 = require("./grants/authorization-code.js");
 const client_credentials_js_1 = require("./grants/client-credentials.js");
 const refresh_token_js_1 = require("./grants/refresh-token.js");
@@ -24,4 +47,8 @@ __exportStar(require("./grants/refresh-token.js"), exports);
 /**
  * Union(s)
  */
-exports.Schema = authorization_code_js_1.AuthorizationCodeSchema.or(client_credentials_js_1.ClientCredentialsSchema).or(refresh_token_js_1.RefreshTokenSchema);
+exports.Schema = z.discriminatedUnion('grant_type', [
+    authorization_code_js_1.AuthorizationCodeSchema,
+    client_credentials_js_1.ClientCredentialsSchema,
+    refresh_token_js_1.RefreshTokenSchema,
+]);

package/dist/cjs/oauth/token/schema/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/cjs/oauth/token/schema/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../../src/oauth/token/schema/schema.test.ts"],"names":[],"mappings":""}

package/dist/cjs/oauth/token/schema/schema.test.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const utils_js_1 = require("../../../app/utils.js");
+const schema_js_1 = require("./schema.js");
+(0, vitest_1.describe)('OAuth Token - Schema', () => {
+    (0, vitest_1.describe)('Schema union', () => {
+        (0, vitest_1.test)('should accept authorization code grant', () => {
+            const payload = {
+                grant_type: 'authorization_code',
+                code: 'auth_code_123',
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://example.com/callback',
+            };
+            const result = schema_js_1.Schema.safeParse(payload);
+            // Parse succeeds for valid data
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                (0, vitest_1.expect)(result.data).toEqual(payload);
+            }
+        });
+        (0, vitest_1.test)('should accept authorization code with PKCE', () => {
+            const payload = {
+                grant_type: 'authorization_code',
+                code: 'auth_code_123',
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://example.com/callback',
+                code_verifier: 'pkce_verifier_123',
+            };
+            const result = schema_js_1.Schema.safeParse(payload);
+            // Parse succeeds for valid data
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                (0, vitest_1.expect)(result.data).toEqual(payload);
+            }
+        });
+        (0, vitest_1.test)('should accept authorization code with client secret', () => {
+            const payload = {
+                grant_type: 'authorization_code',
+                code: 'auth_code_123',
+                client_id: (0, utils_js_1.generateAppId)(),
+                client_secret: 'secret_123',
+                redirect_uri: 'https://example.com/callback',
+            };
+            const result = schema_js_1.Schema.safeParse(payload);
+            // Parse succeeds for valid data
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                (0, vitest_1.expect)(result.data).toEqual(payload);
+            }
+        });
+        (0, vitest_1.test)('should accept client credentials grant', () => {
+            const payload = {
+                grant_type: 'client_credentials',
+                client_id: (0, utils_js_1.generateAppId)(),
+                client_secret: 'secret_123',
+                scope: 'read write',
+            };
+            const result = schema_js_1.Schema.safeParse(payload);
+            // Parse succeeds for valid data
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                (0, vitest_1.expect)(result.data).toEqual(payload);
+            }
+        });
+        (0, vitest_1.test)('should accept refresh token grant', () => {
+            const payload = {
+                grant_type: 'refresh_token',
+                refresh_token: 'refresh_token_123',
+                client_id: (0, utils_js_1.generateAppId)(),
+                client_secret: 'secret_123',
+                scope: 'read',
+            };
+            const result = schema_js_1.Schema.safeParse(payload);
+            // Parse succeeds for valid data
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                (0, vitest_1.expect)(result.data).toEqual(payload);
+            }
+        });
+        (0, vitest_1.test)('should reject invalid grant type', () => {
+            const payload = {
+                grant_type: 'invalid_grant',
+                code: 'auth_code_123',
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://example.com/callback',
+            };
+            const result = schema_js_1.Schema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject authorization code without required fields', () => {
+            const payload = {
+                grant_type: 'authorization_code',
+                client_id: (0, utils_js_1.generateAppId)(),
+                // missing code and redirect_uri
+            };
+            const result = schema_js_1.Schema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject invalid redirect URI', () => {
+            const payload = {
+                grant_type: 'authorization_code',
+                code: 'auth_code_123',
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'not-a-valid-url',
+            };
+            const result = schema_js_1.Schema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject client credentials without required fields', () => {
+            const payload = {
+                grant_type: 'client_credentials',
+                client_id: (0, utils_js_1.generateAppId)(),
+                // missing client_secret
+            };
+            const result = schema_js_1.Schema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject refresh token without required fields', () => {
+            const payload = {
+                grant_type: 'refresh_token',
+                client_id: 'app_123',
+                // missing refresh_token and client_secret
+            };
+            const result = schema_js_1.Schema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject completely invalid payload', () => {
+            const payload = {
+                invalid: 'data',
+            };
+            const result = schema_js_1.Schema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+    });
+});

package/dist/cjs/workspace/authorization/schema.d.ts

@@ -0,0 +1,75 @@
+import * as z from 'zod/v4';
+export declare const DEFAULT_SESSION_DURATION: number;
+export declare const DEFAULT_REFRESH_TOKEN_DURATION: number;
+export declare const DEFAULT_ACCESS_TOKEN_DURATION: number;
+export declare const AuthorizationSchema: z.ZodObject<{
+    metadata: z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodNull, z.ZodCustom<Map<string, string | number | boolean>, Map<string, string | number | boolean>>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>, z.ZodTransform<Map<string, string | number | boolean>, Record<string, string | number | boolean> | Map<string, string | number | boolean> | null | undefined>>;
+    deactivatedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>;
+    deletedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>;
+    updatedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>;
+    sessionDuration: z.ZodDefault<z.ZodNumber>;
+    refreshTokenDuration: z.ZodDefault<z.ZodNumber>;
+    accessTokenDuration: z.ZodDefault<z.ZodNumber>;
+    accessTokenSignatureAlgorithm: z.ZodDefault<z.ZodEnum<{
+        HS256: "HS256";
+        HS384: "HS384";
+        HS512: "HS512";
+        RS256: "RS256";
+        RS384: "RS384";
+        RS512: "RS512";
+        ES256: "ES256";
+        ES384: "ES384";
+        ES512: "ES512";
+        PS256: "PS256";
+        PS384: "PS384";
+        PS512: "PS512";
+    }>>;
+}, z.core.$strip>;
+export type AuthorizationProperties = z.input<typeof AuthorizationSchema>;
+export type Authorization = z.output<typeof AuthorizationSchema>;
+export declare const AuthorizationPayloadSchema: z.ZodObject<{
+    metadata: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodNull, z.ZodCustom<Map<string, string | number | boolean>, Map<string, string | number | boolean>>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>, z.ZodTransform<Record<string, string | number | boolean> | undefined, Record<string, string | number | boolean> | Map<string, string | number | boolean> | null | undefined>>>;
+    deactivatedAt: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>, z.ZodTransform<string | undefined, Date | undefined>>>;
+    deletedAt: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>, z.ZodTransform<string | undefined, Date | undefined>>>;
+    updatedAt: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>, z.ZodTransform<string | undefined, Date | undefined>>>;
+    sessionDuration: z.ZodDefault<z.ZodNumber>;
+    refreshTokenDuration: z.ZodDefault<z.ZodNumber>;
+    accessTokenDuration: z.ZodDefault<z.ZodNumber>;
+    accessTokenSignatureAlgorithm: z.ZodDefault<z.ZodEnum<{
+        HS256: "HS256";
+        HS384: "HS384";
+        HS512: "HS512";
+        RS256: "RS256";
+        RS384: "RS384";
+        RS512: "RS512";
+        ES256: "ES256";
+        ES384: "ES384";
+        ES512: "ES512";
+        PS256: "PS256";
+        PS384: "PS384";
+        PS512: "PS512";
+    }>>;
+}, z.core.$strip>;
+export type AuthorizationPayload = z.output<typeof AuthorizationPayloadSchema>;
+export declare const UpsertAuthorizationPayloadSchema: z.ZodObject<{
+    metadata: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodNull, z.ZodCustom<Map<string, string | number | boolean>, Map<string, string | number | boolean>>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>, z.ZodTransform<Record<string, string | number | boolean> | undefined, Record<string, string | number | boolean> | Map<string, string | number | boolean> | null | undefined>>>;
+    sessionDuration: z.ZodDefault<z.ZodNumber>;
+    refreshTokenDuration: z.ZodDefault<z.ZodNumber>;
+    accessTokenDuration: z.ZodDefault<z.ZodNumber>;
+    accessTokenSignatureAlgorithm: z.ZodDefault<z.ZodEnum<{
+        HS256: "HS256";
+        HS384: "HS384";
+        HS512: "HS512";
+        RS256: "RS256";
+        RS384: "RS384";
+        RS512: "RS512";
+        ES256: "ES256";
+        ES384: "ES384";
+        ES512: "ES512";
+        PS256: "PS256";
+        PS384: "PS384";
+        PS512: "PS512";
+    }>>;
+}, z.core.$strip>;
+export type UpsertAuthorizationPayload = z.output<typeof UpsertAuthorizationPayloadSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/cjs/workspace/authorization/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/workspace/authorization/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAe5B,eAAO,MAAM,wBAAwB,QAAc,CAAC;AACpD,eAAO,MAAM,8BAA8B,QAAoB,CAAC;AAChE,eAAO,MAAM,6BAA6B,QAAc,CAAC;AASzD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;iBAM9B,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAC1E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEjE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;iBAMrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE/E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;iBAG3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAC/C,OAAO,gCAAgC,CACxC,CAAC"}