@go-mondo/identity-sdk 0.0.2-beta.4 → 0.0.2-beta.41

package/dist/esm/app/authorization/schema.test.js

@@ -0,0 +1,376 @@
+import { describe, expect, test } from 'vitest';
+import { AuthorizationPayloadSchema, AuthorizationSchema, UpsertAuthorizationPayloadSchema, } from './schema.js';
+describe('App Authorization - Schema', () => {
+    describe('AuthorizationSchema', () => {
+        test('should accept complete authorization object', () => {
+            const authorization = {
+                refreshTokenDuration: 3600,
+                accessTokenDuration: 900,
+                accessTokenSignatureAlgorithm: 'HS256',
+                loginUri: 'https://app.example.com/login',
+                callbackUrls: [
+                    'https://app.example.com/callback',
+                    'https://app.example.com/oauth/callback',
+                ],
+                availableAudiences: ['api.example.com', 'admin.example.com'],
+                availableGrants: new Set([
+                    'authorization_code',
+                    'refresh_token',
+                ]),
+                defaultAudience: 'api.example.com',
+                updatedAt: new Date(),
+                deletedAt: new Date(),
+                deactivatedAt: new Date(),
+                metadata: {
+                    oauth_version: '2.0',
+                    pkce_required: true,
+                    state_parameter_required: true,
+                },
+            };
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data.availableGrants).toBeInstanceOf(Set);
+            }
+        });
+        test('should accept minimal authorization object', () => {
+            const authorization = {
+                metadata: {},
+            };
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+        });
+        test('should accept authorization with grant array and convert to Set', () => {
+            const authorization = {
+                refreshTokenDuration: 7200,
+                accessTokenDuration: 1800,
+                availableGrants: ['authorization_code', 'client_credentials'],
+                metadata: {
+                    client_type: 'confidential',
+                },
+            };
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data.availableGrants).toBeInstanceOf(Set);
+                expect(result.data.availableGrants?.has('authorization_code')).toBe(true);
+                expect(result.data.availableGrants?.has('client_credentials')).toBe(true);
+            }
+        });
+        test('should accept authorization with Set of grants', () => {
+            const authorization = {
+                accessTokenDuration: 600,
+                availableGrants: new Set(['implicit', 'authorization_code']),
+                callbackUrls: ['https://spa.example.com/callback'],
+                metadata: {
+                    client_type: 'public',
+                    application_type: 'spa',
+                },
+            };
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data.availableGrants).toBeInstanceOf(Set);
+            }
+        });
+        test('should accept authorization with callback URLs as Set', () => {
+            const authorization = {
+                callbackUrls: new Set([
+                    'https://app.example.com/auth',
+                    'https://app.example.com/oauth',
+                ]),
+                availableAudiences: new Set(['api1.example.com', 'api2.example.com']),
+                metadata: {
+                    multi_tenant: true,
+                },
+            };
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data.callbackUrls).toBeInstanceOf(Set);
+                expect(result.data.availableAudiences).toBeInstanceOf(Set);
+            }
+        });
+        test('should accept authorization with optional fields', () => {
+            const authorization = {
+                refreshTokenDuration: 86400,
+                accessTokenDuration: 3600,
+                accessTokenSignatureAlgorithm: 'RS256',
+                loginUri: 'https://auth.example.com/login',
+                defaultAudience: 'https://api.example.com',
+                updatedAt: new Date(),
+                metadata: {
+                    algorithm: 'RS256',
+                    client_name: 'Test App',
+                    description: 'Test authorization with optional fields',
+                },
+            };
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+        });
+        test('should filter empty strings from URLs and audiences', () => {
+            const authorization = {
+                callbackUrls: new Set([
+                    'https://valid.example.com/callback',
+                    'https://another.example.com/auth',
+                ]),
+                availableAudiences: ['api.example.com', 'admin.example.com'],
+                metadata: {},
+            };
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data.callbackUrls).toEqual(new Set([
+                    'https://valid.example.com/callback',
+                    'https://another.example.com/auth',
+                ]));
+                expect(result.data.availableAudiences).toEqual(new Set(['api.example.com', 'admin.example.com']));
+            }
+        });
+        test('should reject invalid grant types', () => {
+            const authorization = {
+                availableGrants: ['invalid_grant_type'],
+                metadata: {},
+            };
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(false);
+        });
+        test('should reject invalid URL formats', () => {
+            const authorization = {
+                loginUri: 'not-a-valid-url',
+                metadata: {},
+            };
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(false);
+        });
+    });
+    describe('AuthorizationPayloadSchema', () => {
+        test('should accept complete authorization payload', () => {
+            const payload = {
+                refreshTokenDuration: 3600,
+                accessTokenDuration: 900,
+                accessTokenSignatureAlgorithm: 'HS256',
+                loginUri: 'https://app.example.com/login',
+                callbackUrls: ['https://app.example.com/callback'],
+                availableAudiences: ['api.example.com'],
+                availableGrants: ['authorization_code', 'refresh_token'],
+                defaultAudience: 'api.example.com',
+                updatedAt: new Date().toISOString(),
+                deletedAt: new Date().toISOString(),
+                deactivatedAt: new Date().toISOString(),
+                metadata: {
+                    client_id: 'oauth_client_123',
+                    client_secret_set: true,
+                    token_endpoint_auth_method: 'client_secret_basic',
+                },
+            };
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                // The schema transforms string URLs to URL objects, so we check individual properties
+                expect(result.data).toHaveProperty('refreshTokenDuration', payload.refreshTokenDuration);
+                expect(result.data).toHaveProperty('accessTokenDuration', payload.accessTokenDuration);
+                expect(result.data).toHaveProperty('accessTokenSignatureAlgorithm', payload.accessTokenSignatureAlgorithm);
+                expect(result.data).toHaveProperty('loginUri', payload.loginUri);
+                expect(result.data).toHaveProperty('metadata', payload.metadata);
+                // callbackUrls will be transformed to URL objects
+                expect(result.data.callbackUrls).toBeDefined();
+            }
+        });
+        test('should accept minimal authorization payload', () => {
+            const payload = {
+                metadata: {},
+            };
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data).toHaveProperty('metadata');
+            }
+        });
+        test('should accept payload with grant arrays', () => {
+            const payload = {
+                refreshTokenDuration: 7200,
+                accessTokenDuration: 1800,
+                availableGrants: ['authorization_code', 'client_credentials'],
+                callbackUrls: ['https://server.example.com/oauth/callback'],
+                metadata: {
+                    client_type: 'confidential',
+                    requires_client_secret: true,
+                },
+            };
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+        });
+        test('should accept payload with Set of grants', () => {
+            const payload = {
+                accessTokenDuration: 600,
+                availableGrants: new Set(['implicit']),
+                defaultAudience: 'https://spa-api.example.com',
+                metadata: {
+                    client_type: 'public',
+                    application_type: 'single_page_app',
+                },
+            };
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+        });
+        test('should accept payload with comprehensive OAuth configuration', () => {
+            const payload = {
+                refreshTokenDuration: 2592000, // 30 days
+                accessTokenDuration: 3600, // 1 hour
+                accessTokenSignatureAlgorithm: 'RS256',
+                loginUri: 'https://auth.corporate.com/oauth/authorize',
+                callbackUrls: [
+                    'https://app.corporate.com/auth/callback',
+                    'https://mobile.corporate.com/oauth/callback',
+                    'https://admin.corporate.com/auth/return',
+                ],
+                availableAudiences: [
+                    'https://api.corporate.com',
+                    'https://admin-api.corporate.com',
+                    'https://analytics.corporate.com',
+                ],
+                availableGrants: [
+                    'authorization_code',
+                    'refresh_token',
+                    'client_credentials',
+                ],
+                defaultAudience: 'https://api.corporate.com',
+                updatedAt: new Date().toISOString(),
+                metadata: {
+                    client_name: 'Corporate Application',
+                    client_uri: 'https://corporate.com',
+                    logo_uri: 'https://corporate.com/logo.png',
+                    tos_uri: 'https://corporate.com/terms',
+                    policy_uri: 'https://corporate.com/privacy',
+                },
+            };
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+        });
+        test('should reject invalid date format', () => {
+            const payload = {
+                updatedAt: 'invalid-date',
+                metadata: {},
+            };
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(false);
+        });
+        test('should reject invalid signature algorithm', () => {
+            const payload = {
+                accessTokenSignatureAlgorithm: 'INVALID_ALG',
+                metadata: {},
+            };
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(false);
+        });
+    });
+    describe('UpsertAuthorizationPayloadSchema', () => {
+        test('should accept upsert with all fields', () => {
+            const payload = {
+                refreshTokenDuration: 3600,
+                accessTokenDuration: 900,
+                accessTokenSignatureAlgorithm: 'HS256',
+                loginUri: 'https://updated.example.com/login',
+                callbackUrls: ['https://updated.example.com/callback'],
+                availableAudiences: ['updated-api.example.com'],
+                availableGrants: ['authorization_code'],
+                defaultAudience: 'updated-api.example.com',
+                metadata: {
+                    update_reason: 'security_enhancement',
+                    updated_by: 'admin@example.com',
+                },
+            };
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                // The schema transforms string URLs to URL objects, so we check individual properties
+                expect(result.data).toHaveProperty('refreshTokenDuration', payload.refreshTokenDuration);
+                expect(result.data).toHaveProperty('accessTokenDuration', payload.accessTokenDuration);
+                expect(result.data).toHaveProperty('accessTokenSignatureAlgorithm', payload.accessTokenSignatureAlgorithm);
+                expect(result.data).toHaveProperty('loginUri', payload.loginUri);
+                expect(result.data).toHaveProperty('metadata', payload.metadata);
+                // callbackUrls will be transformed to URL objects
+                expect(result.data.callbackUrls).toBeDefined();
+            }
+        });
+        test('should accept partial upsert payload', () => {
+            const payload = {
+                accessTokenDuration: 1800,
+                callbackUrls: ['https://new-callback.example.com'],
+                metadata: {
+                    fields_updated: 'accessTokenDuration',
+                },
+            };
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+        });
+        test('should accept upsert with undefined values', () => {
+            const payload = {
+                loginUri: undefined,
+                defaultAudience: undefined,
+                metadata: {
+                    reset_fields: 'loginUri',
+                },
+            };
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+        });
+        test('should accept empty metadata upsert', () => {
+            const payload = {
+                refreshTokenDuration: 7200,
+                metadata: {},
+            };
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+        });
+        test('should accept upsert with grant types modification', () => {
+            const payload = {
+                availableGrants: [
+                    'authorization_code',
+                    'refresh_token',
+                    'client_credentials',
+                ],
+                metadata: {
+                    added_grants: 'client_credentials',
+                },
+            };
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+        });
+        test('should accept upsert with complex callback URL updates', () => {
+            const payload = {
+                callbackUrls: [
+                    'https://prod.example.com/oauth/callback',
+                    'https://staging.example.com/oauth/callback',
+                    'https://dev.example.com/oauth/callback',
+                ],
+                availableAudiences: [
+                    'https://api.example.com',
+                    'https://staging-api.example.com',
+                ],
+                metadata: {
+                    environment: 'production',
+                },
+            };
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+        });
+        test('should reject invalid grant types in upsert', () => {
+            const payload = {
+                availableGrants: ['invalid_grant'],
+                metadata: {},
+            };
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(false);
+        });
+        test('should reject invalid URL in upsert', () => {
+            const payload = {
+                loginUri: 'not-a-valid-url',
+                metadata: {},
+            };
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(false);
+        });
+    });
+});

package/dist/esm/app/index.d.ts

@@ -1,2 +1,14 @@
-export * from './schema/schema.js';
+export * from './resources.js';
+export * from './schema.js';
+export * from './authorization/resources.js';
+export * from './authorization/schema.js';
+export * from './oauth/resources.js';
+export * from './oauth/schema.js';
+export * from './oidc/resources.js';
+export * from './oidc/schema.js';
+export * from './registration/resources.js';
+export * from './registration/schema.js';
+export * from './saml/resources.js';
+export * from './saml/schema.js';
+export * from './utils.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/app/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/app/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/app/index.ts"],"names":[],"mappings":"AACA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAG5B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAG1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AAGzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,YAAY,CAAC"}

package/dist/esm/app/index.js

@@ -1 +1,20 @@
-export * from './schema/schema.js';
+// Apps
+export * from './resources.js';
+export * from './schema.js';
+// Authorization
+export * from './authorization/resources.js';
+export * from './authorization/schema.js';
+// Oauth
+export * from './oauth/resources.js';
+export * from './oauth/schema.js';
+// OIDC
+export * from './oidc/resources.js';
+export * from './oidc/schema.js';
+// Registration
+export * from './registration/resources.js';
+export * from './registration/schema.js';
+// SAML
+export * from './saml/resources.js';
+export * from './saml/schema.js';
+// Misc
+export * from './utils.js';

package/dist/esm/app/oauth/resources.d.ts

@@ -0,0 +1,12 @@
+import type { MondoIdentity } from '../../common/resources/init.js';
+import { type InsertOAuthInput, type OAuth } from './schema.js';
+export declare class OAuthResources {
+    private readonly instance;
+    constructor(instance: MondoIdentity);
+    static buildPath(appId: string): string;
+    getItem(id: string): Promise<OAuth>;
+    rotateItemSecret(id: string): Promise<OAuth>;
+}
+export declare function getOAuth(instance: MondoIdentity, appId: string): Promise<OAuth>;
+export declare function rotateOAuthSecret(instance: MondoIdentity, appId: string, item?: InsertOAuthInput): Promise<OAuth>;
+//# sourceMappingURL=resources.d.ts.map

package/dist/esm/app/oauth/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../../../src/app/oauth/resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAMpE,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,KAAK,EAEX,MAAM,aAAa,CAAC;AAIrB,qBAAa,cAAc;IACN,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAE3D,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAQhC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAInC,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;CAGpD;AAED,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC,CAOhB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,KAAK,CAAC,CAQhB"}

package/dist/esm/app/oauth/resources.js

@@ -0,0 +1,28 @@
+import { getItemWithAuthorization, postItemWithAuthorization, } from '../../common/resources/operations.js';
+import { PATH } from '../resources.js';
+import { InsertOAuthPayloadSchema, OAuthSchema, } from './schema.js';
+const RESOURCE = 'oauth';
+export class OAuthResources {
+    instance;
+    constructor(instance) {
+        this.instance = instance;
+    }
+    static buildPath(appId) {
+        if (appId?.startsWith(PATH)) {
+            return appId;
+        }
+        return [PATH, appId, RESOURCE].filter(Boolean).join('/');
+    }
+    getItem(id) {
+        return getOAuth(this.instance, id);
+    }
+    rotateItemSecret(id) {
+        return rotateOAuthSecret(this.instance, id);
+    }
+}
+export async function getOAuth(instance, appId) {
+    return OAuthSchema.parse(await getItemWithAuthorization(new URL(OAuthResources.buildPath(appId), instance.config.host), instance.authorizer));
+}
+export async function rotateOAuthSecret(instance, appId, item) {
+    return OAuthSchema.parse(await postItemWithAuthorization(new URL(OAuthResources.buildPath(appId), instance.config.host), instance.authorizer, InsertOAuthPayloadSchema.parse(item)));
+}

package/dist/esm/app/oauth/schema.d.ts

@@ -0,0 +1,35 @@
+import * as z from 'zod/v4';
+export declare const OAuthIdSchema: z.ZodString;
+export type OAuthId = z.output<typeof OAuthIdSchema>;
+export declare const OAuthIdPropertySchema: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export type OAuthIdProperty = z.output<typeof OAuthIdPropertySchema>;
+export declare const OAuthSchema: z.ZodObject<{
+    metadata: z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodNull, z.ZodCustom<Map<string, string | number | boolean>, Map<string, string | number | boolean>>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>, z.ZodTransform<Map<string, string | number | boolean>, Record<string, string | number | boolean> | Map<string, string | number | boolean> | null | undefined>>;
+    deactivatedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>;
+    deletedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>;
+    updatedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    id: z.ZodString;
+}, z.core.$strip>;
+export type OAuthProperties = z.input<typeof OAuthSchema>;
+export type OAuth = z.output<typeof OAuthSchema>;
+export declare const OAuthPayloadSchema: z.ZodObject<{
+    metadata: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodNull, z.ZodCustom<Map<string, string | number | boolean>, Map<string, string | number | boolean>>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>, z.ZodTransform<Record<string, string | number | boolean> | undefined, Record<string, string | number | boolean> | Map<string, string | number | boolean> | null | undefined>>>;
+    deactivatedAt: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>, z.ZodTransform<string | undefined, Date | undefined>>>;
+    deletedAt: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>, z.ZodTransform<string | undefined, Date | undefined>>>;
+    updatedAt: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>, z.ZodTransform<string | undefined, Date | undefined>>>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    id: z.ZodString;
+}, z.core.$strip>;
+export type OAuthPayload = z.output<typeof OAuthPayloadSchema>;
+export declare const InsertOAuthPayloadSchema: z.ZodObject<{
+    metadata: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodNull, z.ZodCustom<Map<string, string | number | boolean>, Map<string, string | number | boolean>>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>, z.ZodTransform<Record<string, string | number | boolean> | undefined, Record<string, string | number | boolean> | Map<string, string | number | boolean> | null | undefined>>>;
+    id: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type InsertOAuthInput = z.input<typeof InsertOAuthPayloadSchema>;
+export type InsertOAuthPayload = z.output<typeof InsertOAuthPayloadSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/esm/app/oauth/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/app/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAgB5B,eAAO,MAAM,aAAa,aAAqC,CAAC;AAChE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAErD,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAQrE,eAAO,MAAM,WAAW;;;;;;;;iBAMtB,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAC1D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAEjD,eAAO,MAAM,kBAAkB;;;;;;;;iBAM7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE/D,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AACxE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/app/oauth/schema.js

@@ -0,0 +1,32 @@
+import * as z from 'zod/v4';
+import { DeactivatedAtPropertyPayloadSchema, DeactivatedAtPropertySchema, DeletedAtPropertyPayloadSchema, DeletedAtPropertySchema, OptionalDatePayloadSchema, OptionalDateSchema, } from '../../common/schema/dates.js';
+import { KSUIDSchema } from '../../common/schema/id.js';
+import { MetadataMapPropertySchema, MetadataPayloadPropertySchema, } from '../../common/schema/metadata.js';
+import { Model, generateOAuthId } from '../utils.js';
+export const OAuthIdSchema = KSUIDSchema(Model.OAuth.UIDPrefix);
+export const OAuthIdPropertySchema = z.object({
+    id: OAuthIdSchema,
+});
+const BaseOAuth = z.object({
+    ...OAuthIdPropertySchema.shape,
+    clientId: z.string(),
+    clientSecret: z.string(),
+});
+export const OAuthSchema = z.object({
+    ...BaseOAuth.shape,
+    updatedAt: OptionalDateSchema,
+    ...DeletedAtPropertySchema.shape,
+    ...DeactivatedAtPropertySchema.shape,
+    ...MetadataMapPropertySchema.shape,
+});
+export const OAuthPayloadSchema = z.object({
+    ...BaseOAuth.shape,
+    updatedAt: OptionalDatePayloadSchema,
+    ...DeletedAtPropertyPayloadSchema.shape,
+    ...DeactivatedAtPropertyPayloadSchema.shape,
+    ...MetadataPayloadPropertySchema.shape,
+});
+export const InsertOAuthPayloadSchema = z.object({
+    id: OAuthIdSchema.default(() => generateOAuthId()),
+    ...MetadataPayloadPropertySchema.shape,
+});

package/dist/esm/app/oauth/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/esm/app/oauth/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../src/app/oauth/schema.test.ts"],"names":[],"mappings":""}