@go-mondo/identity-sdk 0.0.2-beta.7 → 0.0.2-beta.71

package/dist/cjs/oauth/common/schema.d.ts

@@ -1,3 +1,4 @@
+import * as z from 'zod/v4';
 export declare const GrantType: {
     readonly CLIENT_CREDENTIALS: "client_credentials";
     readonly AUTHORIZATION_CODE: "authorization_code";
@@ -23,7 +24,10 @@ export declare const CodeChallengeMethod: {
     readonly PLAIN: "plain";
 };
 export type AnyCodeChallengeMethod = (typeof CodeChallengeMethod)[keyof typeof CodeChallengeMethod];
-export declare const CodeChallengeMethodSchema: import("arktype/out/methods/string").StringType<"S256" | "plain", {}>;
+export declare const CodeChallengeMethodSchema: z.ZodEnum<{
+    S256: "S256";
+    plain: "plain";
+}>;
 export declare const AuthorizationDisplay: {
     readonly PAGE: "page";
     readonly POPUP: "popup";
@@ -31,7 +35,12 @@ export declare const AuthorizationDisplay: {
     readonly WAP: "wap";
 };
 export type AnyAuthorizationDisplay = (typeof AuthorizationDisplay)[keyof typeof AuthorizationDisplay];
-export declare const AuthorizationDisplaySchema: import("arktype/out/methods/string").StringType<"page" | "popup" | "touch" | "wap", {}>;
+export declare const AuthorizationDisplaySchema: z.ZodEnum<{
+    page: "page";
+    popup: "popup";
+    touch: "touch";
+    wap: "wap";
+}>;
 export declare const AuthorizationPrompt: {
     readonly NONE: "none";
     readonly LOGIN: "login";
@@ -39,10 +48,15 @@ export declare const AuthorizationPrompt: {
     readonly SELECT_ACCOUNT: "select_account";
 };
 export type AnyAuthorizationPrompt = (typeof AuthorizationPrompt)[keyof typeof AuthorizationPrompt];
-export declare const AuthorizationPromptSchema: import("arktype/out/methods/string").StringType<"none" | "login" | "consent" | "select_account", {}>;
-export declare const OptionalSchema: import("arktype/out/methods/object").ObjectType<{
-    audience?: string | undefined;
-}, {}>;
+export declare const AuthorizationPromptSchema: z.ZodEnum<{
+    none: "none";
+    login: "login";
+    consent: "consent";
+    select_account: "select_account";
+}>;
+export declare const OptionalSchema: z.ZodObject<{
+    audience: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 export declare const OIDCScope: {
     readonly OPENID: "openid";
     readonly PROFILE: "profile";
@@ -64,5 +78,8 @@ export declare const Scope: {
     PHONE: "phone";
 };
 export type AnyScope = AnyOAuthScope | AnyOIDCScope | string;
-export declare const ScopeSchema: import("arktype/out/methods/string").StringType<string, {}>;
+export declare const ScopeStringSchema: z.ZodString;
+export type ScopeString = z.output<typeof ScopeStringSchema>;
+export declare const ScopeSetSchema: z.ZodPipe<z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>, z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>, z.ZodSet<z.ZodString>]>, z.ZodTransform<string[] | undefined, Set<string> | string[] | undefined>>, z.ZodSet<z.ZodString>]>, z.ZodTransform<Set<string> | undefined, Set<string> | string[] | undefined>>;
+export type ScopeSet = z.output<typeof ScopeSetSchema>;
 //# sourceMappingURL=schema.d.ts.map

package/dist/cjs/oauth/common/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/oauth/common/schema.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEtE,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX,eAAO,MAAM,YAAY;;;;CAIf,CAAC;AACX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAG/E,eAAO,MAAM,mBAAmB;;;;CAItB,CAAC;AACX,MAAM,MAAM,sBAAsB,GAChC,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AACjE,eAAO,MAAM,yBAAyB,uEAGrC,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AACX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAC;AACnE,eAAO,MAAM,0BAA0B,yFAKtC,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAC;AACX,MAAM,MAAM,sBAAsB,GAChC,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AACjE,eAAO,MAAM,yBAAyB,sGAKrC,CAAC;AAEF,eAAO,MAAM,cAAc;;MAEzB,CAAC;AAEH,eAAO,MAAM,SAAS;;;;;;CAMZ,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEtE,eAAO,MAAM,UAAU;;CAEb,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAEzE,eAAO,MAAM,KAAK;;;;;;;CAGjB,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,MAAM,CAAC;AAC7D,eAAO,MAAM,WAAW,6DAAiB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/oauth/common/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAO5B,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEtE,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX,eAAO,MAAM,YAAY;;;;CAIf,CAAC;AACX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAG/E,eAAO,MAAM,mBAAmB;;;;CAItB,CAAC;AACX,MAAM,MAAM,sBAAsB,GAChC,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AACjE,eAAO,MAAM,yBAAyB;;;EAED,CAAC;AAEtC,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AACX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAC;AACnE,eAAO,MAAM,0BAA0B;;;;;EAK5B,CAAC;AAEZ,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAC;AACX,MAAM,MAAM,sBAAsB,GAChC,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AACjE,eAAO,MAAM,yBAAyB;;;;;EAErC,CAAC;AAEF,eAAO,MAAM,cAAc;;iBAEzB,CAAC;AAEH,eAAO,MAAM,SAAS;;;;;;CAMZ,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEtE,eAAO,MAAM,UAAU;;CAEb,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAEzE,eAAO,MAAM,KAAK;;;;;;;CAGjB,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,MAAM,CAAC;AAE7D,eAAO,MAAM,iBAAiB,aAGmC,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE7D,eAAO,MAAM,cAAc,2ZAM2C,CAAC;AACvE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/cjs/oauth/common/schema.js

@@ -1,7 +1,41 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ScopeSchema = exports.Scope = exports.OAuthScope = exports.OIDCScope = exports.OptionalSchema = exports.AuthorizationPromptSchema = exports.AuthorizationPrompt = exports.AuthorizationDisplaySchema = exports.AuthorizationDisplay = exports.CodeChallengeMethodSchema = exports.CodeChallengeMethod = exports.ResponseType = exports.GrantTypeLabel = exports.GrantType = void 0;
-const arktype_1 = require("arktype");
+exports.ScopeSetSchema = exports.ScopeStringSchema = exports.Scope = exports.OAuthScope = exports.OIDCScope = exports.OptionalSchema = exports.AuthorizationPromptSchema = exports.AuthorizationPrompt = exports.AuthorizationDisplaySchema = exports.AuthorizationDisplay = exports.CodeChallengeMethodSchema = exports.CodeChallengeMethod = exports.ResponseType = exports.GrantTypeLabel = exports.GrantType = void 0;
+const z = __importStar(require("zod/v4"));
+const sets_js_1 = require("../../common/schema/sets.js");
 exports.GrantType = {
     CLIENT_CREDENTIALS: 'client_credentials',
     AUTHORIZATION_CODE: 'authorization_code',
@@ -25,23 +59,30 @@ exports.CodeChallengeMethod = {
     S256: 'S256',
     PLAIN: 'plain',
 };
-exports.CodeChallengeMethodSchema = arktype_1.type.enumerated(exports.CodeChallengeMethod.PLAIN, exports.CodeChallengeMethod.S256);
+exports.CodeChallengeMethodSchema = z
+    .enum([exports.CodeChallengeMethod.PLAIN, exports.CodeChallengeMethod.S256])
+    .describe('PKCE Challenge Method.');
 exports.AuthorizationDisplay = {
     PAGE: 'page',
     POPUP: 'popup',
     TOUCH: 'touch',
     WAP: 'wap',
 };
-exports.AuthorizationDisplaySchema = arktype_1.type.enumerated(exports.AuthorizationDisplay.PAGE, exports.AuthorizationDisplay.POPUP, exports.AuthorizationDisplay.TOUCH, exports.AuthorizationDisplay.WAP);
+exports.AuthorizationDisplaySchema = z.enum([
+    exports.AuthorizationDisplay.PAGE,
+    exports.AuthorizationDisplay.POPUP,
+    exports.AuthorizationDisplay.TOUCH,
+    exports.AuthorizationDisplay.WAP,
+]);
 exports.AuthorizationPrompt = {
     NONE: 'none',
     LOGIN: 'login',
     CONSENT: 'consent',
     SELECT_ACCOUNT: 'select_account',
 };
-exports.AuthorizationPromptSchema = arktype_1.type.enumerated(exports.AuthorizationPrompt.NONE, exports.AuthorizationPrompt.LOGIN, exports.AuthorizationPrompt.CONSENT, exports.AuthorizationPrompt.SELECT_ACCOUNT);
-exports.OptionalSchema = (0, arktype_1.type)({
-    audience: (0, arktype_1.type)('string').optional(),
+exports.AuthorizationPromptSchema = z.enum(Object.values(exports.AuthorizationPrompt));
+exports.OptionalSchema = z.object({
+    audience: z.string().optional(),
 });
 exports.OIDCScope = {
     OPENID: 'openid',
@@ -57,4 +98,14 @@ exports.Scope = {
     ...exports.OIDCScope,
     ...exports.OAuthScope,
 };
-exports.ScopeSchema = (0, arktype_1.type)('string');
+exports.ScopeStringSchema = z
+    .string()
+    .min(1)
+    .describe('A list of space-delimited, case-sensitive strings.');
+exports.ScopeSetSchema = z
+    .union([
+    sets_js_1.SpaceDelimitedStringToArraySchema,
+    sets_js_1.UniqueStringArraySchema,
+    sets_js_1.StringSetTypeSchema,
+])
+    .pipe(z.transform((v) => (!v || v instanceof Set ? v : new Set(v))));

package/dist/cjs/oauth/common/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/cjs/oauth/common/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../src/oauth/common/schema.test.ts"],"names":[],"mappings":""}

package/dist/cjs/oauth/common/schema.test.js

@@ -0,0 +1,282 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const schema_js_1 = require("./schema.js");
+(0, vitest_1.describe)('OAuth Common Schema', () => {
+    (0, vitest_1.describe)('GrantType constants', () => {
+        (0, vitest_1.test)('should define correct grant type values', () => {
+            (0, vitest_1.expect)(schema_js_1.GrantType.CLIENT_CREDENTIALS).toBe('client_credentials');
+            (0, vitest_1.expect)(schema_js_1.GrantType.AUTHORIZATION_CODE).toBe('authorization_code');
+            (0, vitest_1.expect)(schema_js_1.GrantType.IMPLICIT).toBe('implicit');
+            (0, vitest_1.expect)(schema_js_1.GrantType.REFRESH_TOKEN).toBe('refresh_token');
+        });
+        (0, vitest_1.test)('should have corresponding labels for each grant type', () => {
+            (0, vitest_1.expect)(schema_js_1.GrantTypeLabel[schema_js_1.GrantType.CLIENT_CREDENTIALS]).toBe('Client Credentials');
+            (0, vitest_1.expect)(schema_js_1.GrantTypeLabel[schema_js_1.GrantType.AUTHORIZATION_CODE]).toBe('Authorization Code');
+            (0, vitest_1.expect)(schema_js_1.GrantTypeLabel[schema_js_1.GrantType.IMPLICIT]).toBe('Implicit');
+            (0, vitest_1.expect)(schema_js_1.GrantTypeLabel[schema_js_1.GrantType.REFRESH_TOKEN]).toBe('Refresh Token');
+        });
+        (0, vitest_1.test)('should have all grant types covered in labels', () => {
+            const grantTypeKeys = Object.keys(schema_js_1.GrantType);
+            const labelKeys = Object.keys(schema_js_1.GrantTypeLabel);
+            (0, vitest_1.expect)(labelKeys).toHaveLength(grantTypeKeys.length);
+            for (const key of grantTypeKeys) {
+                const grantType = schema_js_1.GrantType[key];
+                (0, vitest_1.expect)(schema_js_1.GrantTypeLabel).toHaveProperty(grantType);
+            }
+        });
+        (0, vitest_1.test)('AnyGrantType type should work with valid values', () => {
+            const validGrantTypes = [
+                'client_credentials',
+                'authorization_code',
+                'implicit',
+                'refresh_token',
+            ];
+            for (const grantType of validGrantTypes) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.GrantType)).toContain(grantType);
+            }
+        });
+    });
+    (0, vitest_1.describe)('ResponseType constants', () => {
+        (0, vitest_1.test)('should define correct response type values', () => {
+            (0, vitest_1.expect)(schema_js_1.ResponseType.ID_TOKEN).toBe('id_token');
+            (0, vitest_1.expect)(schema_js_1.ResponseType.TOKEN).toBe('token');
+            (0, vitest_1.expect)(schema_js_1.ResponseType.CODE).toBe('code');
+        });
+        (0, vitest_1.test)('AnyResponseType type should work with valid values', () => {
+            const validResponseTypes = [
+                'id_token',
+                'token',
+                'code',
+            ];
+            for (const responseType of validResponseTypes) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.ResponseType)).toContain(responseType);
+            }
+        });
+    });
+    (0, vitest_1.describe)('CodeChallengeMethod constants and schema', () => {
+        (0, vitest_1.test)('should define correct code challenge method values', () => {
+            (0, vitest_1.expect)(schema_js_1.CodeChallengeMethod.DEFAULT).toBe('S256');
+            (0, vitest_1.expect)(schema_js_1.CodeChallengeMethod.S256).toBe('S256');
+            (0, vitest_1.expect)(schema_js_1.CodeChallengeMethod.PLAIN).toBe('plain');
+        });
+        (0, vitest_1.test)('CodeChallengeMethodSchema should validate valid methods', () => {
+            const validResult1 = schema_js_1.CodeChallengeMethodSchema.parse('S256');
+            (0, vitest_1.expect)(validResult1).toBe('S256');
+            const validResult2 = schema_js_1.CodeChallengeMethodSchema.parse('plain');
+            (0, vitest_1.expect)(validResult2).toBe('plain');
+        });
+        (0, vitest_1.test)('CodeChallengeMethodSchema should reject invalid methods', () => {
+            const invalidResult = schema_js_1.CodeChallengeMethodSchema.safeParse('invalid_method');
+            (0, vitest_1.expect)(invalidResult.success).toBe(false);
+        });
+        (0, vitest_1.test)('AnyCodeChallengeMethod type should work with valid values', () => {
+            const validMethods = ['S256', 'plain'];
+            for (const method of validMethods) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.CodeChallengeMethod)).toContain(method);
+            }
+        });
+    });
+    (0, vitest_1.describe)('AuthorizationDisplay constants and schema', () => {
+        (0, vitest_1.test)('should define correct authorization display values', () => {
+            (0, vitest_1.expect)(schema_js_1.AuthorizationDisplay.PAGE).toBe('page');
+            (0, vitest_1.expect)(schema_js_1.AuthorizationDisplay.POPUP).toBe('popup');
+            (0, vitest_1.expect)(schema_js_1.AuthorizationDisplay.TOUCH).toBe('touch');
+            (0, vitest_1.expect)(schema_js_1.AuthorizationDisplay.WAP).toBe('wap');
+        });
+        (0, vitest_1.test)('AuthorizationDisplaySchema should validate valid display values', () => {
+            const validDisplays = ['page', 'popup', 'touch', 'wap'];
+            for (const display of validDisplays) {
+                const result = schema_js_1.AuthorizationDisplaySchema.parse(display);
+                (0, vitest_1.expect)(result).toBe(display);
+            }
+        });
+        (0, vitest_1.test)('AuthorizationDisplaySchema should reject invalid display values', () => {
+            const invalidResult = schema_js_1.AuthorizationDisplaySchema.safeParse('invalid_display');
+            (0, vitest_1.expect)(invalidResult.success).toBe(false);
+        });
+        (0, vitest_1.test)('AnyAuthorizationDisplay type should work with valid values', () => {
+            const validDisplays = [
+                'page',
+                'popup',
+                'touch',
+                'wap',
+            ];
+            for (const display of validDisplays) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.AuthorizationDisplay)).toContain(display);
+            }
+        });
+    });
+    (0, vitest_1.describe)('AuthorizationPrompt constants and schema', () => {
+        (0, vitest_1.test)('should define correct authorization prompt values', () => {
+            (0, vitest_1.expect)(schema_js_1.AuthorizationPrompt.NONE).toBe('none');
+            (0, vitest_1.expect)(schema_js_1.AuthorizationPrompt.LOGIN).toBe('login');
+            (0, vitest_1.expect)(schema_js_1.AuthorizationPrompt.CONSENT).toBe('consent');
+            (0, vitest_1.expect)(schema_js_1.AuthorizationPrompt.SELECT_ACCOUNT).toBe('select_account');
+        });
+        (0, vitest_1.test)('AuthorizationPromptSchema should validate valid prompt values', () => {
+            const validPrompts = ['none', 'login', 'consent', 'select_account'];
+            for (const prompt of validPrompts) {
+                const result = schema_js_1.AuthorizationPromptSchema.parse(prompt);
+                (0, vitest_1.expect)(result).toBe(prompt);
+            }
+        });
+        (0, vitest_1.test)('AuthorizationPromptSchema should reject invalid prompt values', () => {
+            const invalidResult = schema_js_1.AuthorizationPromptSchema.safeParse('invalid_prompt');
+            (0, vitest_1.expect)(invalidResult.success).toBe(false);
+        });
+        (0, vitest_1.test)('AnyAuthorizationPrompt type should work with valid values', () => {
+            const validPrompts = [
+                'none',
+                'login',
+                'consent',
+                'select_account',
+            ];
+            for (const prompt of validPrompts) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.AuthorizationPrompt)).toContain(prompt);
+            }
+        });
+    });
+    (0, vitest_1.describe)('OptionalSchema', () => {
+        (0, vitest_1.test)('should validate object with optional audience', () => {
+            const validWithAudience = schema_js_1.OptionalSchema.parse({
+                audience: 'https://api.example.com',
+            });
+            (0, vitest_1.expect)(validWithAudience).toEqual({
+                audience: 'https://api.example.com',
+            });
+            const validWithoutAudience = schema_js_1.OptionalSchema.parse({});
+            (0, vitest_1.expect)(validWithoutAudience).toEqual({});
+        });
+        (0, vitest_1.test)('should reject non-string audience values', () => {
+            const invalidResult = schema_js_1.OptionalSchema.safeParse({ audience: 123 });
+            (0, vitest_1.expect)(invalidResult.success).toBe(false);
+        });
+        (0, vitest_1.test)('should allow additional properties to be filtered', () => {
+            // Depending on schema configuration, extra properties might be filtered
+            const input = {
+                audience: 'https://api.example.com',
+                extraProperty: 'should be handled based on schema config',
+            };
+            const result = schema_js_1.OptionalSchema.parse(input);
+            // The result depends on schema configuration (onUndeclaredKey behavior)
+            (0, vitest_1.expect)(result).toHaveProperty('audience', 'https://api.example.com');
+        });
+    });
+    (0, vitest_1.describe)('OIDC and OAuth Scopes', () => {
+        (0, vitest_1.test)('should define correct OIDC scope values', () => {
+            (0, vitest_1.expect)(schema_js_1.OIDCScope.OPENID).toBe('openid');
+            (0, vitest_1.expect)(schema_js_1.OIDCScope.PROFILE).toBe('profile');
+            (0, vitest_1.expect)(schema_js_1.OIDCScope.EMAIL).toBe('email');
+            (0, vitest_1.expect)(schema_js_1.OIDCScope.ADDRESS).toBe('address');
+            (0, vitest_1.expect)(schema_js_1.OIDCScope.PHONE).toBe('phone');
+        });
+        (0, vitest_1.test)('should define correct OAuth scope values', () => {
+            (0, vitest_1.expect)(schema_js_1.OAuthScope.OFFLINE_ACCESS).toBe('offline_access');
+        });
+        (0, vitest_1.test)('Scope should combine OIDC and OAuth scopes', () => {
+            (0, vitest_1.expect)(schema_js_1.Scope.OPENID).toBe('openid');
+            (0, vitest_1.expect)(schema_js_1.Scope.PROFILE).toBe('profile');
+            (0, vitest_1.expect)(schema_js_1.Scope.EMAIL).toBe('email');
+            (0, vitest_1.expect)(schema_js_1.Scope.ADDRESS).toBe('address');
+            (0, vitest_1.expect)(schema_js_1.Scope.PHONE).toBe('phone');
+            (0, vitest_1.expect)(schema_js_1.Scope.OFFLINE_ACCESS).toBe('offline_access');
+        });
+        (0, vitest_1.test)('AnyOIDCScope type should work with valid OIDC values', () => {
+            const validOIDCScopes = [
+                'openid',
+                'profile',
+                'email',
+                'address',
+                'phone',
+            ];
+            for (const scope of validOIDCScopes) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.OIDCScope)).toContain(scope);
+            }
+        });
+        (0, vitest_1.test)('AnyOAuthScope type should work with valid OAuth values', () => {
+            const validOAuthScopes = ['offline_access'];
+            for (const scope of validOAuthScopes) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.OAuthScope)).toContain(scope);
+            }
+        });
+        (0, vitest_1.test)('AnyScope type should work with any string', () => {
+            const validScopes = [
+                'openid',
+                'profile',
+                'offline_access',
+                'custom:read',
+                'api:write',
+                'admin:all',
+            ];
+            // All should be valid as AnyScope includes string
+            for (const scope of validScopes) {
+                (0, vitest_1.expect)(typeof scope).toBe('string');
+            }
+        });
+        (0, vitest_1.test)('ScopeSchema should validate string values', () => {
+            const validScopes = [
+                'openid',
+                'profile email',
+                'custom:scope',
+                'api:read api:write',
+                'offline_access',
+            ];
+            for (const scope of validScopes) {
+                const result = schema_js_1.ScopeStringSchema.parse(scope);
+                (0, vitest_1.expect)(result).toBe(scope);
+            }
+        });
+        (0, vitest_1.test)('ScopeSchema should reject non-string values', () => {
+            const invalidValues = [123, true, null, undefined, {}, []];
+            for (const value of invalidValues) {
+                const result = schema_js_1.ScopeStringSchema.safeParse(value);
+                (0, vitest_1.expect)(result.success).toBe(false);
+            }
+        });
+    });
+    (0, vitest_1.describe)('Type consistency', () => {
+        (0, vitest_1.test)('should ensure all constants are properly typed', () => {
+            // Test that constants match their type definitions
+            const grantType = schema_js_1.GrantType.AUTHORIZATION_CODE;
+            (0, vitest_1.expect)(grantType).toBe('authorization_code');
+            const responseType = schema_js_1.ResponseType.CODE;
+            (0, vitest_1.expect)(responseType).toBe('code');
+            const challengeMethod = schema_js_1.CodeChallengeMethod.S256;
+            (0, vitest_1.expect)(challengeMethod).toBe('S256');
+            const display = schema_js_1.AuthorizationDisplay.PAGE;
+            (0, vitest_1.expect)(display).toBe('page');
+            const prompt = schema_js_1.AuthorizationPrompt.LOGIN;
+            (0, vitest_1.expect)(prompt).toBe('login');
+        });
+        (0, vitest_1.test)('should handle scope combinations correctly', () => {
+            const oidcScope = 'openid';
+            const oauthScope = 'offline_access';
+            const customScope = 'custom:permission';
+            (0, vitest_1.expect)(typeof oidcScope).toBe('string');
+            (0, vitest_1.expect)(typeof oauthScope).toBe('string');
+            (0, vitest_1.expect)(typeof customScope).toBe('string');
+            // Test that combined scope includes both OIDC and OAuth
+            (0, vitest_1.expect)(schema_js_1.Scope).toHaveProperty('OPENID');
+            (0, vitest_1.expect)(schema_js_1.Scope).toHaveProperty('OFFLINE_ACCESS');
+        });
+    });
+    (0, vitest_1.describe)('Schema edge cases', () => {
+        (0, vitest_1.test)('should handle whitespace and special characters', () => {
+            const spacedScope = '  openid profile  ';
+            const result = schema_js_1.ScopeStringSchema.parse(spacedScope);
+            (0, vitest_1.expect)(result).toBe(spacedScope); // Preserves whitespace
+            const specialScope = 'custom:read+write';
+            const specialResult = schema_js_1.ScopeStringSchema.parse(specialScope);
+            (0, vitest_1.expect)(specialResult).toBe(specialScope);
+        });
+        (0, vitest_1.test)('should validate complex optional schema scenarios', () => {
+            const complexValid = schema_js_1.OptionalSchema.parse({
+                audience: 'urn:example:audience',
+            });
+            (0, vitest_1.expect)(complexValid.audience).toBe('urn:example:audience');
+            const emptyValid = schema_js_1.OptionalSchema.parse({});
+            (0, vitest_1.expect)(emptyValid).toEqual({});
+        });
+    });
+});

package/dist/cjs/oauth/index.d.ts

@@ -1,4 +1,4 @@
-export { AuthorizationDisplay, AuthorizationDisplaySchema, AuthorizationPrompt, AuthorizationPromptSchema, CodeChallengeMethod, CodeChallengeMethodSchema, GrantType, GrantTypeLabel, OAuthScope, OIDCScope, ResponseType, type AnyAuthorizationDisplay, type AnyAuthorizationPrompt, type AnyCodeChallengeMethod, type AnyGrantType, type AnyOAuthScope, type AnyOIDCScope, type AnyResponseType, type AnyScope, } from './common/schema.js';
-export * as Authorize from './authorize/index.js';
-export * as Token from './token/index.js';
+export { AuthorizationDisplay, AuthorizationDisplaySchema, AuthorizationPrompt, AuthorizationPromptSchema, CodeChallengeMethod, CodeChallengeMethodSchema, GrantType, GrantTypeLabel, OAuthScope, OIDCScope, ResponseType, ScopeSetSchema, ScopeStringSchema, type AnyAuthorizationDisplay, type AnyAuthorizationPrompt, type AnyCodeChallengeMethod, type AnyGrantType, type AnyOAuthScope, type AnyOIDCScope, type AnyResponseType, type AnyScope, type ScopeSet, type ScopeString, } from './common/schema.js';
+export * from './authorize/index.js';
+export * from './token/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,SAAS,EACT,cAAc,EACd,UAAU,EACV,SAAS,EACT,YAAY,EACZ,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,QAAQ,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAC;AAClD,OAAO,KAAK,KAAK,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,SAAS,EACT,cAAc,EACd,UAAU,EACV,SAAS,EACT,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAC;AAE5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC"}

package/dist/cjs/oauth/index.js

@@ -10,30 +10,11 @@ var __createBinding = (this && this.__createBinding) || (Object.create ? (functi
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];
 }));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Token = exports.Authorize = exports.ResponseType = exports.OIDCScope = exports.OAuthScope = exports.GrantTypeLabel = exports.GrantType = exports.CodeChallengeMethodSchema = exports.CodeChallengeMethod = exports.AuthorizationPromptSchema = exports.AuthorizationPrompt = exports.AuthorizationDisplaySchema = exports.AuthorizationDisplay = void 0;
+exports.ScopeStringSchema = exports.ScopeSetSchema = exports.ResponseType = exports.OIDCScope = exports.OAuthScope = exports.GrantTypeLabel = exports.GrantType = exports.CodeChallengeMethodSchema = exports.CodeChallengeMethod = exports.AuthorizationPromptSchema = exports.AuthorizationPrompt = exports.AuthorizationDisplaySchema = exports.AuthorizationDisplay = void 0;
 var schema_js_1 = require("./common/schema.js");
 Object.defineProperty(exports, "AuthorizationDisplay", { enumerable: true, get: function () { return schema_js_1.AuthorizationDisplay; } });
 Object.defineProperty(exports, "AuthorizationDisplaySchema", { enumerable: true, get: function () { return schema_js_1.AuthorizationDisplaySchema; } });
@@ -46,5 +27,7 @@ Object.defineProperty(exports, "GrantTypeLabel", { enumerable: true, get: functi
 Object.defineProperty(exports, "OAuthScope", { enumerable: true, get: function () { return schema_js_1.OAuthScope; } });
 Object.defineProperty(exports, "OIDCScope", { enumerable: true, get: function () { return schema_js_1.OIDCScope; } });
 Object.defineProperty(exports, "ResponseType", { enumerable: true, get: function () { return schema_js_1.ResponseType; } });
-exports.Authorize = __importStar(require("./authorize/index.js"));
-exports.Token = __importStar(require("./token/index.js"));
+Object.defineProperty(exports, "ScopeSetSchema", { enumerable: true, get: function () { return schema_js_1.ScopeSetSchema; } });
+Object.defineProperty(exports, "ScopeStringSchema", { enumerable: true, get: function () { return schema_js_1.ScopeStringSchema; } });
+__exportStar(require("./authorize/index.js"), exports);
+__exportStar(require("./token/index.js"), exports);

package/dist/cjs/oauth/token/schema/grants/authorization-code.d.ts

@@ -1,10 +1,17 @@
-export declare const AuthorizationCodeSchema: import("arktype/out/methods/object.js").ObjectType<{
-    grant_type: "authorization_code";
-    code: string;
-    client_id: string;
-    redirect_uri: string;
-    client_secret?: string | undefined;
-    code_verifier?: string | undefined;
-}, {}>;
-export type AuthorizationCodePayload = typeof AuthorizationCodeSchema.inferOut;
+import * as z from 'zod/v4';
+/**
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
+ */
+export declare const AuthorizationCodeGrantTokenSchema: z.ZodObject<{
+    code_verifier: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    grant_type: z.ZodEnum<{
+        authorization_code: "authorization_code";
+    }>;
+    code: z.ZodString;
+    redirect_uri: z.ZodOptional<z.ZodURL>;
+}, z.core.$strip>;
+export type AuthorizationCodeGrantTokenInput = z.input<typeof AuthorizationCodeGrantTokenSchema>;
+export type AuthorizationCodeGrantToken = z.output<typeof AuthorizationCodeGrantTokenSchema>;
 //# sourceMappingURL=authorization-code.d.ts.map

package/dist/cjs/oauth/token/schema/grants/authorization-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-code.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/authorization-code.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,uBAAuB;;;;;;;MAMlB,CAAC;AACnB,MAAM,MAAM,wBAAwB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"authorization-code.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/authorization-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAW5B;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;iBA8B5C,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,iCAAiC,CACzC,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAChD,OAAO,iCAAiC,CACzC,CAAC"}

package/dist/cjs/oauth/token/schema/grants/authorization-code.js

@@ -1,20 +1,74 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationCodeSchema = void 0;
-const arktype_1 = require("arktype");
+exports.AuthorizationCodeGrantTokenSchema = void 0;
+const z = __importStar(require("zod/v4"));
 const schema_js_1 = require("../../../common/schema.js");
+const common_js_1 = require("./common.js");
 /**
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
  * @see https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.3.1
  */
-const GrantTypeSchema = arktype_1.type.enumerated(schema_js_1.GrantType.AUTHORIZATION_CODE);
-const PKCESchema = (0, arktype_1.type)({
-    code_verifier: (0, arktype_1.type)('string').optional(),
+const GrantTypeSchema = z.enum([schema_js_1.GrantType.AUTHORIZATION_CODE]);
+/**
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
+ */
+exports.AuthorizationCodeGrantTokenSchema = z.object({
+    /**
+     * REQUIRED. Must be set to "authorization_code".
+     */
+    grant_type: GrantTypeSchema.describe('The grant type.'),
+    /**
+     * REQUIRED. The authorization code received from the authorization server.
+     */
+    code: z
+        .string()
+        .min(1)
+        .describe('The authorization code received in the redirect.'),
+    /**
+     * REQUIRED. If the "redirect_uri" parameter was included in the
+     * authorization request, it must be identical here.
+     */
+    redirect_uri: z
+        .url()
+        .optional()
+        .describe('The callback URL used in the initial request.'),
+    ...common_js_1.ClientRequestSchema.shape,
+    /**
+     * PKCE EXTENSION. REQUIRED if "code_challenge" was present in the authorization request.
+     * The unhashed, original random string created by the client.
+     */
+    code_verifier: z.string().min(1).optional().describe('PKCE Code Verifier.'),
 });
-exports.AuthorizationCodeSchema = (0, arktype_1.type)({
-    grant_type: GrantTypeSchema,
-    code: (0, arktype_1.type)('string'),
-    client_id: (0, arktype_1.type)('string'),
-    client_secret: (0, arktype_1.type)('string').optional(),
-    redirect_uri: (0, arktype_1.type)('string.url'),
-}).and(PKCESchema);