@go-mondo/identity-sdk 0.0.2-beta.7 → 0.0.2-beta.71

package/dist/cjs/app/authorization/schema.js

@@ -1,60 +1,96 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpsertAuthorizationPayloadSchema = exports.AuthorizationPayloadSchema = exports.AuthorizationSchema = void 0;
-const arktype_1 = require("arktype");
+const z = __importStar(require("zod/v4"));
 const dates_js_1 = require("../../common/schema/dates.js");
+const jwt_js_1 = require("../../common/schema/jwt.js");
 const metadata_js_1 = require("../../common/schema/metadata.js");
+const sets_js_1 = require("../../common/schema/sets.js");
+const url_js_1 = require("../../common/schema/url.js");
 const schema_js_1 = require("../../oauth/common/schema.js");
-const schema_js_2 = require("../../workspace/authorization/schema.js");
-const StringSetSchema = arktype_1.type.instanceOf((Set));
-const UrlStringSchema = (0, arktype_1.type)('string.url[]').pipe((v) => v.filter((i) => !!i));
-const StringSchema = (0, arktype_1.type)('string[]').pipe((v) => v.filter((i) => !!i));
-const CallbackUrlsSchema = (0, arktype_1.type)('undefined')
-    .or(UrlStringSchema)
-    .or(StringSetSchema)
-    .pipe((v) => (v instanceof Set ? Array.from(v.values()) : v));
-const AvailableAudiencesSchema = (0, arktype_1.type)('undefined')
-    .or(StringSchema)
-    .or(StringSetSchema)
-    .pipe((v) => (v instanceof Set ? Array.from(v.values()) : v));
-const GrantSetSchema = arktype_1.type.instanceOf((Set));
-const GrantArraySchema = arktype_1.type
-    .enumerated(schema_js_1.GrantType.AUTHORIZATION_CODE, schema_js_1.GrantType.CLIENT_CREDENTIALS, schema_js_1.GrantType.IMPLICIT, schema_js_1.GrantType.REFRESH_TOKEN)
-    .array();
-const AvailableGrantsSchema = arktype_1.type.undefined
-    .or(GrantArraySchema)
-    .or(GrantSetSchema)
-    .pipe((v) => (v instanceof Set ? Array.from(v.values()) : v));
-const BaseAuthorization = schema_js_2.AuthorizationPayloadSchema.pick('refreshTokenDuration', 'accessTokenDuration', 'accessTokenSignatureAlgorithm').and({
-    loginUri: (0, arktype_1.type)('string.url | undefined').optional(),
-    callbackUrls: CallbackUrlsSchema.optional(),
-    availableAudiences: AvailableAudiencesSchema.optional(),
+const AudienceArraySchema = sets_js_1.UniqueStringArraySchema;
+const AudienceSetSchema = sets_js_1.UniqueStringSetSchema;
+const GrantSetSchema = z.instanceof((Set));
+const GrantArraySchema = z.array(z.enum([
+    schema_js_1.GrantType.AUTHORIZATION_CODE,
+    schema_js_1.GrantType.CLIENT_CREDENTIALS,
+    schema_js_1.GrantType.IMPLICIT,
+    schema_js_1.GrantType.REFRESH_TOKEN,
+]));
+const AvailableGrantSetSchema = z
+    .union([z.undefined(), GrantArraySchema, GrantSetSchema])
+    .pipe(z.transform((v) => (!v || v instanceof Set ? v : new Set(v))));
+const AvailableGrantArraySchema = z
+    .union([z.undefined(), GrantArraySchema, GrantSetSchema])
+    .pipe(z.transform((v) => (v instanceof Set ? Array.from(v.values()) : v)));
+const BaseAuthorization = z.object({
+    refreshTokenDuration: z.number().optional(),
+    accessTokenDuration: z.number().optional(),
+    accessTokenSignatureAlgorithm: jwt_js_1.AlgorithmSchema.optional(),
+});
+exports.AuthorizationSchema = z.object({
+    ...BaseAuthorization.shape,
+    loginUri: z.union([url_js_1.WebUrlObjectSchema, z.undefined()]).optional(),
+    callbackUrls: url_js_1.UniqueWebUrlObjectSetSchema.optional(),
+    availableAudiences: AudienceSetSchema.optional(),
+    availableGrants: AvailableGrantSetSchema.optional(),
+    defaultAudience: z.union([z.string(), z.undefined()]).optional(),
+    updatedAt: dates_js_1.OptionalDateSchema,
+    ...dates_js_1.DeletedAtPropertySchema.shape,
+    ...dates_js_1.DeactivatedAtPropertySchema.shape,
+    ...metadata_js_1.MetadataMapPropertySchema.shape,
+});
+exports.AuthorizationPayloadSchema = z.object({
+    ...BaseAuthorization.shape,
+    loginUri: z.union([url_js_1.WebUrlStringSchema, z.undefined()]).optional(),
+    callbackUrls: url_js_1.UniqueWebUrlStringArraySchema.optional(),
+    availableAudiences: AudienceArraySchema.optional(),
+    availableGrants: AvailableGrantArraySchema.optional(),
+    defaultAudience: z.union([z.string(), z.undefined()]).optional(),
+    updatedAt: dates_js_1.OptionalDatePayloadSchema,
+    ...dates_js_1.DeletedAtPropertyPayloadSchema.shape,
+    ...dates_js_1.DeactivatedAtPropertyPayloadSchema.shape,
+    ...metadata_js_1.MetadataPayloadPropertySchema.shape,
+});
+exports.UpsertAuthorizationPayloadSchema = z.object({
+    ...BaseAuthorization.shape,
+    loginUri: z.union([url_js_1.WebUrlStringSchema, z.undefined()]).optional(),
+    callbackUrls: url_js_1.UniqueWebUrlStringArraySchema.optional(),
+    availableAudiences: AudienceArraySchema.optional(),
+    availableGrants: AvailableGrantArraySchema.optional(),
+    defaultAudience: z.union([z.string(), z.undefined()]).optional(),
+    ...metadata_js_1.UpsertMetadataPropertyPayloadSchema.shape,
 });
-exports.AuthorizationSchema = BaseAuthorization.and({
-    availableGrants: arktype_1.type.undefined
-        .or(GrantArraySchema)
-        .or(GrantSetSchema)
-        .pipe((v) => (v instanceof Set ? v : new Set(v)))
-        .optional(),
-    //   availableAudiences: type('string[] | undefined')
-    //     .or(StringSetSchema)
-    //     .pipe((v) => (v instanceof Set ? v : new Set(v)))
-    //     .optional(),
-    defaultAudience: (0, arktype_1.type)('string | undefined').optional(),
-    'updatedAt?': dates_js_1.OptionalDateSchema,
-    'deletedAt?': dates_js_1.OptionalDateSchema,
-    'deactivatedAt?': dates_js_1.OptionalDateSchema,
-}).and(metadata_js_1.MetadataMapPropertySchema);
-exports.AuthorizationPayloadSchema = BaseAuthorization.and({
-    availableGrants: AvailableGrantsSchema.optional(),
-    //   availableAudiences: AvailableAudiencesSchema.optional(),
-    defaultAudience: (0, arktype_1.type)('string | undefined').optional(),
-    'updatedAt?': dates_js_1.OptionalDatePayloadSchema,
-    'deletedAt?': dates_js_1.OptionalDatePayloadSchema,
-    'deactivatedAt?': dates_js_1.OptionalDatePayloadSchema,
-}).and(metadata_js_1.MetadataPayloadPropertySchema);
-exports.UpsertAuthorizationPayloadSchema = BaseAuthorization.and({
-    availableGrants: AvailableGrantsSchema.optional(),
-    //   availableAudiences: type('string').array().optional(),
-    defaultAudience: (0, arktype_1.type)('string | undefined').optional(),
-}).and(metadata_js_1.UpsertMetadataPayloadPropertySchema);

package/dist/cjs/app/authorization/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/cjs/app/authorization/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../src/app/authorization/schema.test.ts"],"names":[],"mappings":""}

package/dist/cjs/app/authorization/schema.test.js

@@ -0,0 +1,378 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const schema_js_1 = require("./schema.js");
+(0, vitest_1.describe)('App Authorization - Schema', () => {
+    (0, vitest_1.describe)('AuthorizationSchema', () => {
+        (0, vitest_1.test)('should accept complete authorization object', () => {
+            const authorization = {
+                refreshTokenDuration: 3600,
+                accessTokenDuration: 900,
+                accessTokenSignatureAlgorithm: 'HS256',
+                loginUri: 'https://app.example.com/login',
+                callbackUrls: [
+                    'https://app.example.com/callback',
+                    'https://app.example.com/oauth/callback',
+                ],
+                availableAudiences: ['api.example.com', 'admin.example.com'],
+                availableGrants: new Set([
+                    'authorization_code',
+                    'refresh_token',
+                ]),
+                defaultAudience: 'api.example.com',
+                updatedAt: new Date(),
+                deletedAt: new Date(),
+                deactivatedAt: new Date(),
+                metadata: {
+                    oauth_version: '2.0',
+                    pkce_required: true,
+                    state_parameter_required: true,
+                },
+            };
+            const result = schema_js_1.AuthorizationSchema.safeParse(authorization);
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                (0, vitest_1.expect)(result.data.availableGrants).toBeInstanceOf(Set);
+            }
+        });
+        (0, vitest_1.test)('should accept minimal authorization object', () => {
+            const authorization = {
+                metadata: {},
+            };
+            const result = schema_js_1.AuthorizationSchema.safeParse(authorization);
+            (0, vitest_1.expect)(result.success).toBe(true);
+        });
+        (0, vitest_1.test)('should accept authorization with grant array and convert to Set', () => {
+            const authorization = {
+                refreshTokenDuration: 7200,
+                accessTokenDuration: 1800,
+                availableGrants: ['authorization_code', 'client_credentials'],
+                metadata: {
+                    client_type: 'confidential',
+                },
+            };
+            const result = schema_js_1.AuthorizationSchema.safeParse(authorization);
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                (0, vitest_1.expect)(result.data.availableGrants).toBeInstanceOf(Set);
+                (0, vitest_1.expect)(result.data.availableGrants?.has('authorization_code')).toBe(true);
+                (0, vitest_1.expect)(result.data.availableGrants?.has('client_credentials')).toBe(true);
+            }
+        });
+        (0, vitest_1.test)('should accept authorization with Set of grants', () => {
+            const authorization = {
+                accessTokenDuration: 600,
+                availableGrants: new Set(['implicit', 'authorization_code']),
+                callbackUrls: ['https://spa.example.com/callback'],
+                metadata: {
+                    client_type: 'public',
+                    application_type: 'spa',
+                },
+            };
+            const result = schema_js_1.AuthorizationSchema.safeParse(authorization);
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                (0, vitest_1.expect)(result.data.availableGrants).toBeInstanceOf(Set);
+            }
+        });
+        (0, vitest_1.test)('should accept authorization with callback URLs as Set', () => {
+            const authorization = {
+                callbackUrls: new Set([
+                    'https://app.example.com/auth',
+                    'https://app.example.com/oauth',
+                ]),
+                availableAudiences: new Set(['api1.example.com', 'api2.example.com']),
+                metadata: {
+                    multi_tenant: true,
+                },
+            };
+            const result = schema_js_1.AuthorizationSchema.safeParse(authorization);
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                (0, vitest_1.expect)(result.data.callbackUrls).toBeInstanceOf(Set);
+                (0, vitest_1.expect)(result.data.availableAudiences).toBeInstanceOf(Set);
+            }
+        });
+        (0, vitest_1.test)('should accept authorization with optional fields', () => {
+            const authorization = {
+                refreshTokenDuration: 86400,
+                accessTokenDuration: 3600,
+                accessTokenSignatureAlgorithm: 'RS256',
+                loginUri: 'https://auth.example.com/login',
+                defaultAudience: 'https://api.example.com',
+                updatedAt: new Date(),
+                metadata: {
+                    algorithm: 'RS256',
+                    client_name: 'Test App',
+                    description: 'Test authorization with optional fields',
+                },
+            };
+            const result = schema_js_1.AuthorizationSchema.safeParse(authorization);
+            (0, vitest_1.expect)(result.success).toBe(true);
+        });
+        (0, vitest_1.test)('should filter empty strings from URLs and audiences', () => {
+            const authorization = {
+                callbackUrls: new Set([
+                    'https://valid.example.com/callback',
+                    'https://another.example.com/auth',
+                ]),
+                availableAudiences: ['api.example.com', 'admin.example.com'],
+                metadata: {},
+            };
+            const result = schema_js_1.AuthorizationSchema.safeParse(authorization);
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                (0, vitest_1.expect)(result.data.callbackUrls).toEqual(new Set([
+                    'https://valid.example.com/callback',
+                    'https://another.example.com/auth',
+                ]));
+                (0, vitest_1.expect)(result.data.availableAudiences).toEqual(new Set(['api.example.com', 'admin.example.com']));
+            }
+        });
+        (0, vitest_1.test)('should reject invalid grant types', () => {
+            const authorization = {
+                availableGrants: ['invalid_grant_type'],
+                metadata: {},
+            };
+            const result = schema_js_1.AuthorizationSchema.safeParse(authorization);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject invalid URL formats', () => {
+            const authorization = {
+                loginUri: 'not-a-valid-url',
+                metadata: {},
+            };
+            const result = schema_js_1.AuthorizationSchema.safeParse(authorization);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+    });
+    (0, vitest_1.describe)('AuthorizationPayloadSchema', () => {
+        (0, vitest_1.test)('should accept complete authorization payload', () => {
+            const payload = {
+                refreshTokenDuration: 3600,
+                accessTokenDuration: 900,
+                accessTokenSignatureAlgorithm: 'HS256',
+                loginUri: 'https://app.example.com/login',
+                callbackUrls: ['https://app.example.com/callback'],
+                availableAudiences: ['api.example.com'],
+                availableGrants: ['authorization_code', 'refresh_token'],
+                defaultAudience: 'api.example.com',
+                updatedAt: new Date().toISOString(),
+                deletedAt: new Date().toISOString(),
+                deactivatedAt: new Date().toISOString(),
+                metadata: {
+                    client_id: 'oauth_client_123',
+                    client_secret_set: true,
+                    token_endpoint_auth_method: 'client_secret_basic',
+                },
+            };
+            const result = schema_js_1.AuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                // The schema transforms string URLs to URL objects, so we check individual properties
+                (0, vitest_1.expect)(result.data).toHaveProperty('refreshTokenDuration', payload.refreshTokenDuration);
+                (0, vitest_1.expect)(result.data).toHaveProperty('accessTokenDuration', payload.accessTokenDuration);
+                (0, vitest_1.expect)(result.data).toHaveProperty('accessTokenSignatureAlgorithm', payload.accessTokenSignatureAlgorithm);
+                (0, vitest_1.expect)(result.data).toHaveProperty('loginUri', payload.loginUri);
+                (0, vitest_1.expect)(result.data).toHaveProperty('metadata', payload.metadata);
+                // callbackUrls will be transformed to URL objects
+                (0, vitest_1.expect)(result.data.callbackUrls).toBeDefined();
+            }
+        });
+        (0, vitest_1.test)('should accept minimal authorization payload', () => {
+            const payload = {
+                metadata: {},
+            };
+            const result = schema_js_1.AuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                (0, vitest_1.expect)(result.data).toHaveProperty('metadata');
+            }
+        });
+        (0, vitest_1.test)('should accept payload with grant arrays', () => {
+            const payload = {
+                refreshTokenDuration: 7200,
+                accessTokenDuration: 1800,
+                availableGrants: ['authorization_code', 'client_credentials'],
+                callbackUrls: ['https://server.example.com/oauth/callback'],
+                metadata: {
+                    client_type: 'confidential',
+                    requires_client_secret: true,
+                },
+            };
+            const result = schema_js_1.AuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(true);
+        });
+        (0, vitest_1.test)('should accept payload with Set of grants', () => {
+            const payload = {
+                accessTokenDuration: 600,
+                availableGrants: new Set(['implicit']),
+                defaultAudience: 'https://spa-api.example.com',
+                metadata: {
+                    client_type: 'public',
+                    application_type: 'single_page_app',
+                },
+            };
+            const result = schema_js_1.AuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(true);
+        });
+        (0, vitest_1.test)('should accept payload with comprehensive OAuth configuration', () => {
+            const payload = {
+                refreshTokenDuration: 2592000, // 30 days
+                accessTokenDuration: 3600, // 1 hour
+                accessTokenSignatureAlgorithm: 'RS256',
+                loginUri: 'https://auth.corporate.com/oauth/authorize',
+                callbackUrls: [
+                    'https://app.corporate.com/auth/callback',
+                    'https://mobile.corporate.com/oauth/callback',
+                    'https://admin.corporate.com/auth/return',
+                ],
+                availableAudiences: [
+                    'https://api.corporate.com',
+                    'https://admin-api.corporate.com',
+                    'https://analytics.corporate.com',
+                ],
+                availableGrants: [
+                    'authorization_code',
+                    'refresh_token',
+                    'client_credentials',
+                ],
+                defaultAudience: 'https://api.corporate.com',
+                updatedAt: new Date().toISOString(),
+                metadata: {
+                    client_name: 'Corporate Application',
+                    client_uri: 'https://corporate.com',
+                    logo_uri: 'https://corporate.com/logo.png',
+                    tos_uri: 'https://corporate.com/terms',
+                    policy_uri: 'https://corporate.com/privacy',
+                },
+            };
+            const result = schema_js_1.AuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(true);
+        });
+        (0, vitest_1.test)('should reject invalid date format', () => {
+            const payload = {
+                updatedAt: 'invalid-date',
+                metadata: {},
+            };
+            const result = schema_js_1.AuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject invalid signature algorithm', () => {
+            const payload = {
+                accessTokenSignatureAlgorithm: 'INVALID_ALG',
+                metadata: {},
+            };
+            const result = schema_js_1.AuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+    });
+    (0, vitest_1.describe)('UpsertAuthorizationPayloadSchema', () => {
+        (0, vitest_1.test)('should accept upsert with all fields', () => {
+            const payload = {
+                refreshTokenDuration: 3600,
+                accessTokenDuration: 900,
+                accessTokenSignatureAlgorithm: 'HS256',
+                loginUri: 'https://updated.example.com/login',
+                callbackUrls: ['https://updated.example.com/callback'],
+                availableAudiences: ['updated-api.example.com'],
+                availableGrants: ['authorization_code'],
+                defaultAudience: 'updated-api.example.com',
+                metadata: {
+                    update_reason: 'security_enhancement',
+                    updated_by: 'admin@example.com',
+                },
+            };
+            const result = schema_js_1.UpsertAuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(true);
+            if (result.success) {
+                // The schema transforms string URLs to URL objects, so we check individual properties
+                (0, vitest_1.expect)(result.data).toHaveProperty('refreshTokenDuration', payload.refreshTokenDuration);
+                (0, vitest_1.expect)(result.data).toHaveProperty('accessTokenDuration', payload.accessTokenDuration);
+                (0, vitest_1.expect)(result.data).toHaveProperty('accessTokenSignatureAlgorithm', payload.accessTokenSignatureAlgorithm);
+                (0, vitest_1.expect)(result.data).toHaveProperty('loginUri', payload.loginUri);
+                (0, vitest_1.expect)(result.data).toHaveProperty('metadata', payload.metadata);
+                // callbackUrls will be transformed to URL objects
+                (0, vitest_1.expect)(result.data.callbackUrls).toBeDefined();
+            }
+        });
+        (0, vitest_1.test)('should accept partial upsert payload', () => {
+            const payload = {
+                accessTokenDuration: 1800,
+                callbackUrls: ['https://new-callback.example.com'],
+                metadata: {
+                    fields_updated: 'accessTokenDuration',
+                },
+            };
+            const result = schema_js_1.UpsertAuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(true);
+        });
+        (0, vitest_1.test)('should accept upsert with undefined values', () => {
+            const payload = {
+                loginUri: undefined,
+                defaultAudience: undefined,
+                metadata: {
+                    reset_fields: 'loginUri',
+                },
+            };
+            const result = schema_js_1.UpsertAuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(true);
+        });
+        (0, vitest_1.test)('should accept empty metadata upsert', () => {
+            const payload = {
+                refreshTokenDuration: 7200,
+                metadata: {},
+            };
+            const result = schema_js_1.UpsertAuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(true);
+        });
+        (0, vitest_1.test)('should accept upsert with grant types modification', () => {
+            const payload = {
+                availableGrants: [
+                    'authorization_code',
+                    'refresh_token',
+                    'client_credentials',
+                ],
+                metadata: {
+                    added_grants: 'client_credentials',
+                },
+            };
+            const result = schema_js_1.UpsertAuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(true);
+        });
+        (0, vitest_1.test)('should accept upsert with complex callback URL updates', () => {
+            const payload = {
+                callbackUrls: [
+                    'https://prod.example.com/oauth/callback',
+                    'https://staging.example.com/oauth/callback',
+                    'https://dev.example.com/oauth/callback',
+                ],
+                availableAudiences: [
+                    'https://api.example.com',
+                    'https://staging-api.example.com',
+                ],
+                metadata: {
+                    environment: 'production',
+                },
+            };
+            const result = schema_js_1.UpsertAuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(true);
+        });
+        (0, vitest_1.test)('should reject invalid grant types in upsert', () => {
+            const payload = {
+                availableGrants: ['invalid_grant'],
+                metadata: {},
+            };
+            const result = schema_js_1.UpsertAuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject invalid URL in upsert', () => {
+            const payload = {
+                loginUri: 'not-a-valid-url',
+                metadata: {},
+            };
+            const result = schema_js_1.UpsertAuthorizationPayloadSchema.safeParse(payload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+    });
+});

package/dist/cjs/app/oauth/resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../../../src/app/oauth/resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAOpE,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,KAAK,EAEX,MAAM,aAAa,CAAC;AAIrB,qBAAa,cAAc;IACN,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAE3D,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAQhC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAInC,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;CAGpD;AAED,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC,CAShB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,KAAK,CAAC,CAYhB"}
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../../../src/app/oauth/resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAMpE,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,KAAK,EAEX,MAAM,aAAa,CAAC;AAIrB,qBAAa,cAAc;IACN,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAE3D,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAQhC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAInC,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;CAGpD;AAED,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC,CAOhB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,KAAK,CAAC,CAQhB"}

package/dist/cjs/app/oauth/resources.js

@@ -4,7 +4,6 @@ exports.OAuthResources = void 0;
 exports.getOAuth = getOAuth;
 exports.rotateOAuthSecret = rotateOAuthSecret;
 const operations_js_1 = require("../../common/resources/operations.js");
-const utils_js_1 = require("../../common/resources/utils.js");
 const resources_js_1 = require("../resources.js");
 const schema_js_1 = require("./schema.js");
 const RESOURCE = 'oauth';
@@ -28,8 +27,8 @@ class OAuthResources {
 }
 exports.OAuthResources = OAuthResources;
 async function getOAuth(instance, appId) {
-    return (0, utils_js_1.parseEgressSchema)((0, schema_js_1.OAuthSchema)(await (0, operations_js_1.getItemWithAuthorization)(new URL(OAuthResources.buildPath(appId), instance.config.host), instance.authorizer)));
+    return schema_js_1.OAuthSchema.parse(await (0, operations_js_1.getItemWithAuthorization)(new URL(OAuthResources.buildPath(appId), instance.config.host), instance.authorizer));
 }
 async function rotateOAuthSecret(instance, appId, item) {
-    return (0, utils_js_1.parseEgressSchema)((0, schema_js_1.OAuthSchema)(await (0, operations_js_1.insertItemWithAuthorization)(new URL(OAuthResources.buildPath(appId), instance.config.host), instance.authorizer, (0, utils_js_1.parseEgressSchema)(schema_js_1.InsertOAuthPayloadSchema.onUndeclaredKey('delete')(item)))));
+    return schema_js_1.OAuthSchema.parse(await (0, operations_js_1.postItemWithAuthorization)(new URL(OAuthResources.buildPath(appId), instance.config.host), instance.authorizer, schema_js_1.InsertOAuthPayloadSchema.parse(item)));
 }

package/dist/cjs/app/oauth/schema.d.ts

@@ -1,42 +1,35 @@
-export declare const OAuthIdSchema: import("arktype/out/methods/string.js").StringType<string, {}>;
-export type OAuthId = typeof OAuthIdSchema.inferOut;
-export declare const OAuthIdPropertySchema: import("arktype/out/methods/object.js").ObjectType<{
-    id: string;
-}, {}>;
-export type OAuthIdProperty = typeof OAuthIdPropertySchema.inferOut;
-export declare const OAuthSchema: import("arktype/out/methods/object.js").ObjectType<{
-    id: string;
-    clientId: string;
-    clientSecret: string;
-    updatedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
-    deletedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
-    deactivatedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
-    metadata: (In: import("arktype/out/attributes.js").Default<unknown, Map<string, string | number | boolean>>) => import("arktype").Out<Map<string, string | number | boolean> | Map<string, any>>;
-}, {}>;
-export type OAuthProperties = typeof OAuthSchema.inferIn;
-export type OAuth = typeof OAuthSchema.inferOut;
-export declare const OAuthPayloadSchema: import("arktype/out/methods/object.js").ObjectType<{
-    id: string;
-    clientId: string;
-    clientSecret: string;
-    updatedAt?: ((In: string | Date | undefined) => import("arktype").Out<string | undefined>) | undefined;
-    deletedAt?: ((In: string | Date | undefined) => import("arktype").Out<string | undefined>) | undefined;
-    deactivatedAt?: ((In: string | Date | undefined) => import("arktype").Out<string | undefined>) | undefined;
-    metadata?: ((In: {
-        [x: string]: string | number | boolean;
-    } | Map<string, string | number | boolean> | null | undefined) => import("arktype").Out<{
-        [x: string]: string | number | boolean;
-    } | undefined>) | undefined;
-}, {}>;
-export type OAuthPayload = typeof OAuthPayloadSchema.inferOut;
-export declare const InsertOAuthPayloadSchema: import("arktype/out/methods/object.js").ObjectType<{
-    id: import("arktype/out/attributes.js").Default<string, string>;
-    metadata?: ((In: {
-        [x: string]: string | number | boolean;
-    } | Map<string, string | number | boolean> | null | undefined) => import("arktype").Out<{
-        [x: string]: string | number | boolean;
-    } | undefined>) | undefined;
-}, {}>;
-export type InsertOAuthInput = typeof InsertOAuthPayloadSchema.inferIn;
-export type InsertOAuthPayload = typeof InsertOAuthPayloadSchema.inferOut;
+import * as z from 'zod/v4';
+export declare const OAuthIdSchema: z.ZodString;
+export type OAuthId = z.output<typeof OAuthIdSchema>;
+export declare const OAuthIdPropertySchema: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export type OAuthIdProperty = z.output<typeof OAuthIdPropertySchema>;
+export declare const OAuthSchema: z.ZodObject<{
+    metadata: z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodNull, z.ZodCustom<Map<string, string | number | boolean>, Map<string, string | number | boolean>>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>, z.ZodTransform<Map<string, string | number | boolean>, Record<string, string | number | boolean> | Map<string, string | number | boolean> | null | undefined>>;
+    deactivatedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>;
+    deletedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>;
+    updatedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    id: z.ZodString;
+}, z.core.$strip>;
+export type OAuthProperties = z.input<typeof OAuthSchema>;
+export type OAuth = z.output<typeof OAuthSchema>;
+export declare const OAuthPayloadSchema: z.ZodObject<{
+    metadata: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodNull, z.ZodCustom<Map<string, string | number | boolean>, Map<string, string | number | boolean>>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>, z.ZodTransform<Record<string, string | number | boolean> | undefined, Record<string, string | number | boolean> | Map<string, string | number | boolean> | null | undefined>>>;
+    deactivatedAt: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>, z.ZodTransform<string | undefined, Date | undefined>>>;
+    deletedAt: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>, z.ZodTransform<string | undefined, Date | undefined>>>;
+    updatedAt: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>, z.ZodTransform<string | undefined, Date | undefined>>>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    id: z.ZodString;
+}, z.core.$strip>;
+export type OAuthPayload = z.output<typeof OAuthPayloadSchema>;
+export declare const InsertOAuthPayloadSchema: z.ZodObject<{
+    metadata: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodNull, z.ZodCustom<Map<string, string | number | boolean>, Map<string, string | number | boolean>>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>, z.ZodTransform<Record<string, string | number | boolean> | undefined, Record<string, string | number | boolean> | Map<string, string | number | boolean> | null | undefined>>>;
+    id: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type InsertOAuthInput = z.input<typeof InsertOAuthPayloadSchema>;
+export type InsertOAuthPayload = z.output<typeof InsertOAuthPayloadSchema>;
 //# sourceMappingURL=schema.d.ts.map