@go-mondo/identity-sdk 0.0.2-beta.7 → 0.0.2-beta.71

package/dist/cjs/oauth/authorize/schema/grants/authorization-code.test.js

@@ -0,0 +1,333 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const utils_js_1 = require("../../../../app/utils.js");
+const schema_js_1 = require("../../../common/schema.js");
+const authorization_code_js_1 = require("./authorization-code.js");
+(0, vitest_1.describe)('OAuth Authorization Code Schema', () => {
+    (0, vitest_1.describe)('AuthorizationCodeSchema validation', () => {
+        (0, vitest_1.test)('should validate minimal valid authorization code request', () => {
+            const minimalPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(minimalPayload);
+            (0, vitest_1.expect)(result).toEqual(minimalPayload);
+        });
+        (0, vitest_1.test)('should validate complete authorization code request', () => {
+            const completePayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://example.com/callback',
+                scope: 'openid profile email',
+                state: 'random-state-value',
+                code_challenge: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.S256,
+                nonce: 'random-nonce-value',
+                display: 'page',
+                prompt: 'consent',
+                max_age: 3600,
+                audience: 'https://api.example.com',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(completePayload);
+            (0, vitest_1.expect)(result).toEqual(completePayload);
+        });
+        (0, vitest_1.test)('should validate authorization code request with PKCE', () => {
+            const pkcePayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge: 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.S256,
+                redirect_uri: 'https://app.example.com/auth/callback',
+                scope: 'openid',
+                state: 'xyz',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(pkcePayload);
+            (0, vitest_1.expect)(result).toEqual(pkcePayload);
+        });
+        (0, vitest_1.test)('should validate authorization code request with plain PKCE', () => {
+            const plainPkcePayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.PLAIN,
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(plainPkcePayload);
+            (0, vitest_1.expect)(result).toEqual(plainPkcePayload);
+        });
+        (0, vitest_1.test)('should validate request without PKCE parameters', () => {
+            const noPkcePayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://legacy.example.com/callback',
+                scope: 'openid profile',
+                state: 'legacy-state',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(noPkcePayload);
+            (0, vitest_1.expect)(result).toEqual(noPkcePayload);
+        });
+        (0, vitest_1.test)('should validate OIDC specific parameters', () => {
+            const oidcPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                nonce: 'unique-nonce-12345',
+                display: 'popup',
+                prompt: 'login',
+                max_age: 7200,
+                scope: 'openid profile email address phone',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(oidcPayload);
+            (0, vitest_1.expect)(result).toEqual(oidcPayload);
+        });
+        (0, vitest_1.test)('should validate with optional audience parameter', () => {
+            const audiencePayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                audience: 'https://api.myservice.com',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(audiencePayload);
+            (0, vitest_1.expect)(result).toEqual(audiencePayload);
+        });
+    });
+    (0, vitest_1.describe)('AuthorizationCodeSchema validation errors', () => {
+        (0, vitest_1.test)('should reject missing response_type', () => {
+            const invalidPayload = {
+                client_id: (0, utils_js_1.generateAppId)(),
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.safeParse(invalidPayload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject invalid response_type', () => {
+            const invalidPayload = {
+                response_type: 'invalid_type',
+                client_id: (0, utils_js_1.generateAppId)(),
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.safeParse(invalidPayload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject missing client_id', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.safeParse(invalidPayload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject invalid client_id format', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: 'invalid-client-id',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.safeParse(invalidPayload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject invalid redirect_uri format', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'not-a-url',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.safeParse(invalidPayload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject invalid code_challenge_method', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge: 'valid-challenge',
+                code_challenge_method: 'invalid_method',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.safeParse(invalidPayload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject invalid display value', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                display: 'invalid_display',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.safeParse(invalidPayload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject invalid prompt value', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                prompt: 'invalid_prompt',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.safeParse(invalidPayload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject non-number max_age', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                max_age: 'not-a-number',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.safeParse(invalidPayload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+        (0, vitest_1.test)('should reject negative max_age', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                max_age: -100,
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.safeParse(invalidPayload);
+            (0, vitest_1.expect)(result.success).toBe(false);
+        });
+    });
+    (0, vitest_1.describe)('PKCE validation edge cases', () => {
+        (0, vitest_1.test)('should require both code_challenge and code_challenge_method when one is provided', () => {
+            const onlyChallenge = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge: 'challenge-without-method',
+            };
+            const result1 = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.safeParse(onlyChallenge);
+            (0, vitest_1.expect)(result1.success).toBe(false);
+            const onlyMethod = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge_method: schema_js_1.CodeChallengeMethod.S256,
+            };
+            const result2 = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.safeParse(onlyMethod);
+            (0, vitest_1.expect)(result2.success).toBe(false);
+        });
+        (0, vitest_1.test)('should allow neither code_challenge nor code_challenge_method', () => {
+            const noPkce = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://example.com/callback',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(noPkce);
+            (0, vitest_1.expect)(result).toEqual(noPkce);
+        });
+        (0, vitest_1.test)('should validate PKCE with S256 method', () => {
+            const s256Pkce = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.S256,
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(s256Pkce);
+            (0, vitest_1.expect)(result).toEqual(s256Pkce);
+        });
+        (0, vitest_1.test)('should validate PKCE with plain method', () => {
+            const plainPkce = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge: 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.PLAIN,
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(plainPkce);
+            (0, vitest_1.expect)(result).toEqual(plainPkce);
+        });
+    });
+    (0, vitest_1.describe)('Real-world scenarios', () => {
+        (0, vitest_1.test)('should validate typical SPA authorization request', () => {
+            const spaRequest = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://myapp.com/auth/callback',
+                scope: 'openid profile email',
+                state: 'abc123def456',
+                code_challenge: 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.S256,
+                nonce: 'xyz789',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(spaRequest);
+            (0, vitest_1.expect)(result).toEqual(spaRequest);
+        });
+        (0, vitest_1.test)('should validate server-side web app authorization request', () => {
+            const webAppRequest = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://webapp.example.com/oauth/callback',
+                scope: 'openid profile email address phone',
+                state: 'secure-random-state-12345',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(webAppRequest);
+            (0, vitest_1.expect)(result).toEqual(webAppRequest);
+        });
+        (0, vitest_1.test)('should validate mobile app authorization request', () => {
+            const mobileRequest = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'com.example.myapp://oauth/callback',
+                scope: 'openid profile',
+                state: 'mobile-state-token',
+                code_challenge: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.S256,
+                display: 'touch',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(mobileRequest);
+            (0, vitest_1.expect)(result).toEqual(mobileRequest);
+        });
+        (0, vitest_1.test)('should validate enterprise SSO request', () => {
+            const enterpriseRequest = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://enterprise.example.com/sso/callback',
+                scope: 'openid profile email groups',
+                state: 'enterprise-session-12345',
+                prompt: 'select_account',
+                max_age: 28800, // 8 hours
+                audience: 'https://api.enterprise.example.com',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(enterpriseRequest);
+            (0, vitest_1.expect)(result).toEqual(enterpriseRequest);
+        });
+        (0, vitest_1.test)('should validate request with multiple scopes', () => {
+            const multiScopeRequest = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                scope: 'openid profile email address phone offline_access custom:read custom:write',
+                redirect_uri: 'https://example.com/callback',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(multiScopeRequest);
+            (0, vitest_1.expect)(result).toEqual(multiScopeRequest);
+        });
+    });
+    (0, vitest_1.describe)('Edge cases and boundary conditions', () => {
+        (0, vitest_1.test)('should handle empty strings for optional string fields', () => {
+            const emptyStringsPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                scope: 'test',
+                state: 'test',
+                nonce: 'test',
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(emptyStringsPayload);
+            (0, vitest_1.expect)(result).toEqual(emptyStringsPayload);
+        });
+        (0, vitest_1.test)('should handle very long valid values', () => {
+            const longValuesPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                state: 'a'.repeat(1000),
+                nonce: 'b'.repeat(500),
+                scope: `openid profile email ${'custom:scope'.repeat(100)}`,
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(longValuesPayload);
+            (0, vitest_1.expect)(result).toEqual(longValuesPayload);
+        });
+        (0, vitest_1.test)('should handle zero max_age', () => {
+            const zeroMaxAge = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                max_age: 0,
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(zeroMaxAge);
+            (0, vitest_1.expect)(result).toEqual(zeroMaxAge);
+        });
+        (0, vitest_1.test)('should handle large max_age values', () => {
+            const largeMaxAge = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                max_age: 31536000, // 1 year in seconds
+            };
+            const result = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.parse(largeMaxAge);
+            (0, vitest_1.expect)(result).toEqual(largeMaxAge);
+        });
+    });
+});

package/dist/cjs/oauth/authorize/schema/grants/common.d.ts

@@ -0,0 +1,6 @@
+import * as z from 'zod/v4';
+export declare const ExtraGrantSchema: z.ZodObject<{
+    audience: z.ZodOptional<z.ZodString>;
+    device: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+//# sourceMappingURL=common.d.ts.map

package/dist/cjs/oauth/authorize/schema/grants/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/authorize/schema/grants/common.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,gBAAgB;;;iBAU3B,CAAC"}

package/dist/cjs/oauth/authorize/schema/grants/common.js

@@ -0,0 +1,47 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExtraGrantSchema = void 0;
+const z = __importStar(require("zod/v4"));
+exports.ExtraGrantSchema = z.object({
+    /**
+     * OPTIONAL. An audience identifier.
+     */
+    audience: z.string().optional(),
+    /**
+     * OPTIONAL. A device identifier.
+     */
+    device: z.string().optional(),
+});

package/dist/cjs/oauth/authorize/schema/grants/implicit.d.ts

@@ -1,11 +1,19 @@
-export declare const ImplicitSchema: import("arktype/out/methods/object.js").ObjectType<{
-    response_type: "token" | "id_token" | "string string" | "string number" | "string bigint" | "string boolean" | "string symbol" | "string undefined" | "string object" | "string function" | "number string" | "number number" | "number bigint" | "number boolean" | "number symbol" | "number undefined" | "number object" | "number function" | "bigint string" | "bigint number" | "bigint bigint" | "bigint boolean" | "bigint symbol" | "bigint undefined" | "bigint object" | "bigint function" | "boolean string" | "boolean number" | "boolean bigint" | "boolean boolean" | "boolean symbol" | "boolean undefined" | "boolean object" | "boolean function" | "symbol string" | "symbol number" | "symbol bigint" | "symbol boolean" | "symbol symbol" | "symbol undefined" | "symbol object" | "symbol function" | "undefined string" | "undefined number" | "undefined bigint" | "undefined boolean" | "undefined symbol" | "undefined undefined" | "undefined object" | "undefined function" | "object string" | "object number" | "object bigint" | "object boolean" | "object symbol" | "object undefined" | "object object" | "object function" | "function string" | "function number" | "function bigint" | "function boolean" | "function symbol" | "function undefined" | "function object" | "function function";
-    client_id: string;
-    redirect_uri?: string | undefined;
-    scope?: string | undefined;
-    state?: string | undefined;
-    nonce?: string | undefined;
-    audience?: string | undefined;
-}, {}>;
-export type ImplicitPayload = typeof ImplicitSchema.inferOut;
+import * as z from 'zod/v4';
+export declare const ImplicitGrantAuthorizationSchema: z.ZodObject<{
+    audience: z.ZodOptional<z.ZodString>;
+    device: z.ZodOptional<z.ZodString>;
+    nonce: z.ZodOptional<z.ZodString>;
+    response_type: z.ZodEnum<{
+        id_token: "id_token";
+        token: "token";
+        "id_token token": "id_token token";
+        "token id_token": "token id_token";
+    }>;
+    client_id: z.ZodString;
+    redirect_uri: z.ZodOptional<z.ZodURL>;
+    scope: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ImplicitGrantAuthorizationInput = z.input<typeof ImplicitGrantAuthorizationSchema>;
+export type ImplicitGrantAuthorization = z.output<typeof ImplicitGrantAuthorizationSchema>;
 //# sourceMappingURL=implicit.d.ts.map

package/dist/cjs/oauth/authorize/schema/grants/implicit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"implicit.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/authorize/schema/grants/implicit.ts"],"names":[],"mappings":"AA2BA,eAAO,MAAM,cAAc;;;;;;;;MAAkD,CAAC;AAC9E,MAAM,MAAM,eAAe,GAAG,OAAO,cAAc,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"implicit.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/authorize/schema/grants/implicit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AA4B5B,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAM3C,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CACnD,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAC/C,OAAO,gCAAgC,CACxC,CAAC"}

package/dist/cjs/oauth/authorize/schema/grants/implicit.js

@@ -1,21 +1,66 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ImplicitSchema = void 0;
-const arktype_1 = require("arktype");
+exports.ImplicitGrantAuthorizationSchema = void 0;
+const z = __importStar(require("zod/v4"));
 const schema_js_1 = require("../../../common/schema.js");
+const common_js_1 = require("./common.js");
 /**
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.1
  * @see https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.2.2.1
  */
-const ResponseTypeSchema = arktype_1.type.enumerated(schema_js_1.ResponseType.TOKEN, schema_js_1.ResponseType.ID_TOKEN, `${typeof schema_js_1.ResponseType.ID_TOKEN} ${typeof schema_js_1.ResponseType.TOKEN}`, `${typeof schema_js_1.ResponseType.TOKEN} ${typeof schema_js_1.ResponseType.ID_TOKEN}`);
-const OAuthSchema = (0, arktype_1.type)({
+const ResponseTypeSchema = z.enum([
+    schema_js_1.ResponseType.TOKEN,
+    schema_js_1.ResponseType.ID_TOKEN,
+    `${schema_js_1.ResponseType.ID_TOKEN} ${schema_js_1.ResponseType.TOKEN}`,
+    `${schema_js_1.ResponseType.TOKEN} ${schema_js_1.ResponseType.ID_TOKEN}`,
+]);
+const OAuthSchema = z.object({
     response_type: ResponseTypeSchema,
-    client_id: (0, arktype_1.type)('string'),
-    redirect_uri: (0, arktype_1.type)('string.url').optional(),
-    scope: (0, arktype_1.type)('string').optional(),
-    state: (0, arktype_1.type)('string').optional(),
+    client_id: z.string(),
+    redirect_uri: z.url().optional(),
+    scope: z.string().optional(),
+    state: z.string().optional(),
+});
+const OIDCSchema = z.object({
+    nonce: z.string().optional(), // OIDC (this is required if resposne_type includes ID TOKEN)
 });
-const OIDCSchema = (0, arktype_1.type)({
-    nonce: (0, arktype_1.type)('string').optional(), // OIDC (this is required if resposne_type includes ID TOKEN)
+exports.ImplicitGrantAuthorizationSchema = z.object({
+    ...OAuthSchema.shape,
+    ...OIDCSchema.shape,
+    ...schema_js_1.OptionalSchema.shape,
+    // Custom
+    ...common_js_1.ExtraGrantSchema.shape,
 });
-exports.ImplicitSchema = OAuthSchema.and(OIDCSchema).and(schema_js_1.OptionalSchema);

package/dist/cjs/oauth/authorize/schema/schema.d.ts

@@ -1,42 +1,54 @@
+import type { z } from 'zod';
 export * from './grants/authorization-code.js';
 export * from './grants/implicit.js';
 /**
  * Union(s)
  */
-export declare const Schema: import("arktype/out/methods/object.js").ObjectType<{
-    response_type: "code";
-    client_id: string;
-    redirect_uri?: string | undefined;
-    scope?: string | undefined;
-    state?: string | undefined;
-    nonce?: string | undefined;
-    display?: "page" | "popup" | "touch" | "wap" | undefined;
-    prompt?: "none" | "login" | "consent" | "select_account" | undefined;
-    max_age?: number | undefined;
-    code_challenge_method?: "S256" | "plain" | undefined;
-    code_challenge?: string | undefined;
-    audience?: string | undefined;
-} | {
-    response_type: "code";
-    client_id: string;
-    redirect_uri?: string | undefined;
-    scope?: string | undefined;
-    state?: string | undefined;
-    nonce?: string | undefined;
-    display?: "page" | "popup" | "touch" | "wap" | undefined;
-    prompt?: "none" | "login" | "consent" | "select_account" | undefined;
-    max_age?: number | undefined;
-    code_challenge_method: "S256" | "plain";
-    code_challenge: string;
-    audience?: string | undefined;
-} | {
-    response_type: "token" | "id_token" | "string string" | "string number" | "string bigint" | "string boolean" | "string symbol" | "string undefined" | "string object" | "string function" | "number string" | "number number" | "number bigint" | "number boolean" | "number symbol" | "number undefined" | "number object" | "number function" | "bigint string" | "bigint number" | "bigint bigint" | "bigint boolean" | "bigint symbol" | "bigint undefined" | "bigint object" | "bigint function" | "boolean string" | "boolean number" | "boolean bigint" | "boolean boolean" | "boolean symbol" | "boolean undefined" | "boolean object" | "boolean function" | "symbol string" | "symbol number" | "symbol bigint" | "symbol boolean" | "symbol symbol" | "symbol undefined" | "symbol object" | "symbol function" | "undefined string" | "undefined number" | "undefined bigint" | "undefined boolean" | "undefined symbol" | "undefined undefined" | "undefined object" | "undefined function" | "object string" | "object number" | "object bigint" | "object boolean" | "object symbol" | "object undefined" | "object object" | "object function" | "function string" | "function number" | "function bigint" | "function boolean" | "function symbol" | "function undefined" | "function object" | "function function";
-    client_id: string;
-    redirect_uri?: string | undefined;
-    scope?: string | undefined;
-    state?: string | undefined;
-    nonce?: string | undefined;
-    audience?: string | undefined;
-}, {}>;
-export type Payload = typeof Schema.inferOut;
+export declare const AuthorizationGrantSchema: import("zod/v4/index.js").ZodUnion<[import("zod/v4/index.js").ZodObject<{
+    audience: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodString>;
+    device: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodString>;
+    code_challenge_method: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodEnum<{
+        S256: "S256";
+        plain: "plain";
+    }>>;
+    code_challenge: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodString>;
+    nonce: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodString>;
+    display: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodEnum<{
+        page: "page";
+        popup: "popup";
+        touch: "touch";
+        wap: "wap";
+    }>>;
+    prompt: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodEnum<{
+        none: "none";
+        login: "login";
+        consent: "consent";
+        select_account: "select_account";
+    }>>;
+    max_age: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodNumber>;
+    response_type: import("zod/v4/index.js").ZodEnum<{
+        code: "code";
+    }>;
+    client_id: import("zod/v4/index.js").ZodString;
+    redirect_uri: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodURL>;
+    scope: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodString>;
+    state: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodString>;
+}, import("zod/v4/core/schemas.js").$strip>, import("zod/v4/index.js").ZodObject<{
+    audience: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodString>;
+    device: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodString>;
+    nonce: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodString>;
+    response_type: import("zod/v4/index.js").ZodEnum<{
+        id_token: "id_token";
+        token: "token";
+        "id_token token": "id_token token";
+        "token id_token": "token id_token";
+    }>;
+    client_id: import("zod/v4/index.js").ZodString;
+    redirect_uri: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodURL>;
+    scope: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodString>;
+    state: import("zod/v4/index.js").ZodOptional<import("zod/v4/index.js").ZodString>;
+}, import("zod/v4/core/schemas.js").$strip>]>;
+export type AuthorizationGrantInput = z.input<typeof AuthorizationGrantSchema>;
+export type AuthorizationGrant = z.output<typeof AuthorizationGrantSchema>;
+export { CodeChallengeSchema } from './grants/authorization-code.js';
 //# sourceMappingURL=schema.d.ts.map

package/dist/cjs/oauth/authorize/schema/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../src/oauth/authorize/schema/schema.ts"],"names":[],"mappings":"AAGA,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sBAAsB,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAA6C,CAAC;AACjE,MAAM,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../src/oauth/authorize/schema/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAK7B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sBAAsB,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAGlC,CAAC;AACJ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC/E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/cjs/oauth/authorize/schema/schema.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Schema = void 0;
+exports.CodeChallengeSchema = exports.AuthorizationGrantSchema = void 0;
 const authorization_code_js_1 = require("./grants/authorization-code.js");
 const implicit_js_1 = require("./grants/implicit.js");
 __exportStar(require("./grants/authorization-code.js"), exports);
@@ -22,4 +22,6 @@ __exportStar(require("./grants/implicit.js"), exports);
 /**
  * Union(s)
  */
-exports.Schema = authorization_code_js_1.AuthorizationCodeSchema.or(implicit_js_1.ImplicitSchema);
+exports.AuthorizationGrantSchema = authorization_code_js_1.AuthorizationCodeGrantAuthorizationSchema.or(implicit_js_1.ImplicitGrantAuthorizationSchema);
+var authorization_code_js_2 = require("./grants/authorization-code.js");
+Object.defineProperty(exports, "CodeChallengeSchema", { enumerable: true, get: function () { return authorization_code_js_2.CodeChallengeSchema; } });