@go-mondo/identity-sdk 0.0.2-beta.7 → 0.0.2-beta.71

package/dist/esm/oauth/common/schema.js

@@ -1,4 +1,5 @@
-import { type } from 'arktype';
+import * as z from 'zod/v4';
+import { SpaceDelimitedStringToArraySchema, StringSetTypeSchema, UniqueStringArraySchema, } from '../../common/schema/sets.js';
 export const GrantType = {
     CLIENT_CREDENTIALS: 'client_credentials',
     AUTHORIZATION_CODE: 'authorization_code',
@@ -22,23 +23,30 @@ export const CodeChallengeMethod = {
     S256: 'S256',
     PLAIN: 'plain',
 };
-export const CodeChallengeMethodSchema = type.enumerated(CodeChallengeMethod.PLAIN, CodeChallengeMethod.S256);
+export const CodeChallengeMethodSchema = z
+    .enum([CodeChallengeMethod.PLAIN, CodeChallengeMethod.S256])
+    .describe('PKCE Challenge Method.');
 export const AuthorizationDisplay = {
     PAGE: 'page',
     POPUP: 'popup',
     TOUCH: 'touch',
     WAP: 'wap',
 };
-export const AuthorizationDisplaySchema = type.enumerated(AuthorizationDisplay.PAGE, AuthorizationDisplay.POPUP, AuthorizationDisplay.TOUCH, AuthorizationDisplay.WAP);
+export const AuthorizationDisplaySchema = z.enum([
+    AuthorizationDisplay.PAGE,
+    AuthorizationDisplay.POPUP,
+    AuthorizationDisplay.TOUCH,
+    AuthorizationDisplay.WAP,
+]);
 export const AuthorizationPrompt = {
     NONE: 'none',
     LOGIN: 'login',
     CONSENT: 'consent',
     SELECT_ACCOUNT: 'select_account',
 };
-export const AuthorizationPromptSchema = type.enumerated(AuthorizationPrompt.NONE, AuthorizationPrompt.LOGIN, AuthorizationPrompt.CONSENT, AuthorizationPrompt.SELECT_ACCOUNT);
-export const OptionalSchema = type({
-    audience: type('string').optional(),
+export const AuthorizationPromptSchema = z.enum(Object.values(AuthorizationPrompt));
+export const OptionalSchema = z.object({
+    audience: z.string().optional(),
 });
 export const OIDCScope = {
     OPENID: 'openid',
@@ -54,4 +62,14 @@ export const Scope = {
     ...OIDCScope,
     ...OAuthScope,
 };
-export const ScopeSchema = type('string');
+export const ScopeStringSchema = z
+    .string()
+    .min(1)
+    .describe('A list of space-delimited, case-sensitive strings.');
+export const ScopeSetSchema = z
+    .union([
+    SpaceDelimitedStringToArraySchema,
+    UniqueStringArraySchema,
+    StringSetTypeSchema,
+])
+    .pipe(z.transform((v) => (!v || v instanceof Set ? v : new Set(v))));

package/dist/esm/oauth/common/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/esm/oauth/common/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../src/oauth/common/schema.test.ts"],"names":[],"mappings":""}

package/dist/esm/oauth/common/schema.test.js

@@ -0,0 +1,280 @@
+import { describe, expect, test } from 'vitest';
+import { AuthorizationDisplay, AuthorizationDisplaySchema, AuthorizationPrompt, AuthorizationPromptSchema, CodeChallengeMethod, CodeChallengeMethodSchema, GrantType, GrantTypeLabel, OAuthScope, OIDCScope, OptionalSchema, ResponseType, Scope, ScopeStringSchema, } from './schema.js';
+describe('OAuth Common Schema', () => {
+    describe('GrantType constants', () => {
+        test('should define correct grant type values', () => {
+            expect(GrantType.CLIENT_CREDENTIALS).toBe('client_credentials');
+            expect(GrantType.AUTHORIZATION_CODE).toBe('authorization_code');
+            expect(GrantType.IMPLICIT).toBe('implicit');
+            expect(GrantType.REFRESH_TOKEN).toBe('refresh_token');
+        });
+        test('should have corresponding labels for each grant type', () => {
+            expect(GrantTypeLabel[GrantType.CLIENT_CREDENTIALS]).toBe('Client Credentials');
+            expect(GrantTypeLabel[GrantType.AUTHORIZATION_CODE]).toBe('Authorization Code');
+            expect(GrantTypeLabel[GrantType.IMPLICIT]).toBe('Implicit');
+            expect(GrantTypeLabel[GrantType.REFRESH_TOKEN]).toBe('Refresh Token');
+        });
+        test('should have all grant types covered in labels', () => {
+            const grantTypeKeys = Object.keys(GrantType);
+            const labelKeys = Object.keys(GrantTypeLabel);
+            expect(labelKeys).toHaveLength(grantTypeKeys.length);
+            for (const key of grantTypeKeys) {
+                const grantType = GrantType[key];
+                expect(GrantTypeLabel).toHaveProperty(grantType);
+            }
+        });
+        test('AnyGrantType type should work with valid values', () => {
+            const validGrantTypes = [
+                'client_credentials',
+                'authorization_code',
+                'implicit',
+                'refresh_token',
+            ];
+            for (const grantType of validGrantTypes) {
+                expect(Object.values(GrantType)).toContain(grantType);
+            }
+        });
+    });
+    describe('ResponseType constants', () => {
+        test('should define correct response type values', () => {
+            expect(ResponseType.ID_TOKEN).toBe('id_token');
+            expect(ResponseType.TOKEN).toBe('token');
+            expect(ResponseType.CODE).toBe('code');
+        });
+        test('AnyResponseType type should work with valid values', () => {
+            const validResponseTypes = [
+                'id_token',
+                'token',
+                'code',
+            ];
+            for (const responseType of validResponseTypes) {
+                expect(Object.values(ResponseType)).toContain(responseType);
+            }
+        });
+    });
+    describe('CodeChallengeMethod constants and schema', () => {
+        test('should define correct code challenge method values', () => {
+            expect(CodeChallengeMethod.DEFAULT).toBe('S256');
+            expect(CodeChallengeMethod.S256).toBe('S256');
+            expect(CodeChallengeMethod.PLAIN).toBe('plain');
+        });
+        test('CodeChallengeMethodSchema should validate valid methods', () => {
+            const validResult1 = CodeChallengeMethodSchema.parse('S256');
+            expect(validResult1).toBe('S256');
+            const validResult2 = CodeChallengeMethodSchema.parse('plain');
+            expect(validResult2).toBe('plain');
+        });
+        test('CodeChallengeMethodSchema should reject invalid methods', () => {
+            const invalidResult = CodeChallengeMethodSchema.safeParse('invalid_method');
+            expect(invalidResult.success).toBe(false);
+        });
+        test('AnyCodeChallengeMethod type should work with valid values', () => {
+            const validMethods = ['S256', 'plain'];
+            for (const method of validMethods) {
+                expect(Object.values(CodeChallengeMethod)).toContain(method);
+            }
+        });
+    });
+    describe('AuthorizationDisplay constants and schema', () => {
+        test('should define correct authorization display values', () => {
+            expect(AuthorizationDisplay.PAGE).toBe('page');
+            expect(AuthorizationDisplay.POPUP).toBe('popup');
+            expect(AuthorizationDisplay.TOUCH).toBe('touch');
+            expect(AuthorizationDisplay.WAP).toBe('wap');
+        });
+        test('AuthorizationDisplaySchema should validate valid display values', () => {
+            const validDisplays = ['page', 'popup', 'touch', 'wap'];
+            for (const display of validDisplays) {
+                const result = AuthorizationDisplaySchema.parse(display);
+                expect(result).toBe(display);
+            }
+        });
+        test('AuthorizationDisplaySchema should reject invalid display values', () => {
+            const invalidResult = AuthorizationDisplaySchema.safeParse('invalid_display');
+            expect(invalidResult.success).toBe(false);
+        });
+        test('AnyAuthorizationDisplay type should work with valid values', () => {
+            const validDisplays = [
+                'page',
+                'popup',
+                'touch',
+                'wap',
+            ];
+            for (const display of validDisplays) {
+                expect(Object.values(AuthorizationDisplay)).toContain(display);
+            }
+        });
+    });
+    describe('AuthorizationPrompt constants and schema', () => {
+        test('should define correct authorization prompt values', () => {
+            expect(AuthorizationPrompt.NONE).toBe('none');
+            expect(AuthorizationPrompt.LOGIN).toBe('login');
+            expect(AuthorizationPrompt.CONSENT).toBe('consent');
+            expect(AuthorizationPrompt.SELECT_ACCOUNT).toBe('select_account');
+        });
+        test('AuthorizationPromptSchema should validate valid prompt values', () => {
+            const validPrompts = ['none', 'login', 'consent', 'select_account'];
+            for (const prompt of validPrompts) {
+                const result = AuthorizationPromptSchema.parse(prompt);
+                expect(result).toBe(prompt);
+            }
+        });
+        test('AuthorizationPromptSchema should reject invalid prompt values', () => {
+            const invalidResult = AuthorizationPromptSchema.safeParse('invalid_prompt');
+            expect(invalidResult.success).toBe(false);
+        });
+        test('AnyAuthorizationPrompt type should work with valid values', () => {
+            const validPrompts = [
+                'none',
+                'login',
+                'consent',
+                'select_account',
+            ];
+            for (const prompt of validPrompts) {
+                expect(Object.values(AuthorizationPrompt)).toContain(prompt);
+            }
+        });
+    });
+    describe('OptionalSchema', () => {
+        test('should validate object with optional audience', () => {
+            const validWithAudience = OptionalSchema.parse({
+                audience: 'https://api.example.com',
+            });
+            expect(validWithAudience).toEqual({
+                audience: 'https://api.example.com',
+            });
+            const validWithoutAudience = OptionalSchema.parse({});
+            expect(validWithoutAudience).toEqual({});
+        });
+        test('should reject non-string audience values', () => {
+            const invalidResult = OptionalSchema.safeParse({ audience: 123 });
+            expect(invalidResult.success).toBe(false);
+        });
+        test('should allow additional properties to be filtered', () => {
+            // Depending on schema configuration, extra properties might be filtered
+            const input = {
+                audience: 'https://api.example.com',
+                extraProperty: 'should be handled based on schema config',
+            };
+            const result = OptionalSchema.parse(input);
+            // The result depends on schema configuration (onUndeclaredKey behavior)
+            expect(result).toHaveProperty('audience', 'https://api.example.com');
+        });
+    });
+    describe('OIDC and OAuth Scopes', () => {
+        test('should define correct OIDC scope values', () => {
+            expect(OIDCScope.OPENID).toBe('openid');
+            expect(OIDCScope.PROFILE).toBe('profile');
+            expect(OIDCScope.EMAIL).toBe('email');
+            expect(OIDCScope.ADDRESS).toBe('address');
+            expect(OIDCScope.PHONE).toBe('phone');
+        });
+        test('should define correct OAuth scope values', () => {
+            expect(OAuthScope.OFFLINE_ACCESS).toBe('offline_access');
+        });
+        test('Scope should combine OIDC and OAuth scopes', () => {
+            expect(Scope.OPENID).toBe('openid');
+            expect(Scope.PROFILE).toBe('profile');
+            expect(Scope.EMAIL).toBe('email');
+            expect(Scope.ADDRESS).toBe('address');
+            expect(Scope.PHONE).toBe('phone');
+            expect(Scope.OFFLINE_ACCESS).toBe('offline_access');
+        });
+        test('AnyOIDCScope type should work with valid OIDC values', () => {
+            const validOIDCScopes = [
+                'openid',
+                'profile',
+                'email',
+                'address',
+                'phone',
+            ];
+            for (const scope of validOIDCScopes) {
+                expect(Object.values(OIDCScope)).toContain(scope);
+            }
+        });
+        test('AnyOAuthScope type should work with valid OAuth values', () => {
+            const validOAuthScopes = ['offline_access'];
+            for (const scope of validOAuthScopes) {
+                expect(Object.values(OAuthScope)).toContain(scope);
+            }
+        });
+        test('AnyScope type should work with any string', () => {
+            const validScopes = [
+                'openid',
+                'profile',
+                'offline_access',
+                'custom:read',
+                'api:write',
+                'admin:all',
+            ];
+            // All should be valid as AnyScope includes string
+            for (const scope of validScopes) {
+                expect(typeof scope).toBe('string');
+            }
+        });
+        test('ScopeSchema should validate string values', () => {
+            const validScopes = [
+                'openid',
+                'profile email',
+                'custom:scope',
+                'api:read api:write',
+                'offline_access',
+            ];
+            for (const scope of validScopes) {
+                const result = ScopeStringSchema.parse(scope);
+                expect(result).toBe(scope);
+            }
+        });
+        test('ScopeSchema should reject non-string values', () => {
+            const invalidValues = [123, true, null, undefined, {}, []];
+            for (const value of invalidValues) {
+                const result = ScopeStringSchema.safeParse(value);
+                expect(result.success).toBe(false);
+            }
+        });
+    });
+    describe('Type consistency', () => {
+        test('should ensure all constants are properly typed', () => {
+            // Test that constants match their type definitions
+            const grantType = GrantType.AUTHORIZATION_CODE;
+            expect(grantType).toBe('authorization_code');
+            const responseType = ResponseType.CODE;
+            expect(responseType).toBe('code');
+            const challengeMethod = CodeChallengeMethod.S256;
+            expect(challengeMethod).toBe('S256');
+            const display = AuthorizationDisplay.PAGE;
+            expect(display).toBe('page');
+            const prompt = AuthorizationPrompt.LOGIN;
+            expect(prompt).toBe('login');
+        });
+        test('should handle scope combinations correctly', () => {
+            const oidcScope = 'openid';
+            const oauthScope = 'offline_access';
+            const customScope = 'custom:permission';
+            expect(typeof oidcScope).toBe('string');
+            expect(typeof oauthScope).toBe('string');
+            expect(typeof customScope).toBe('string');
+            // Test that combined scope includes both OIDC and OAuth
+            expect(Scope).toHaveProperty('OPENID');
+            expect(Scope).toHaveProperty('OFFLINE_ACCESS');
+        });
+    });
+    describe('Schema edge cases', () => {
+        test('should handle whitespace and special characters', () => {
+            const spacedScope = '  openid profile  ';
+            const result = ScopeStringSchema.parse(spacedScope);
+            expect(result).toBe(spacedScope); // Preserves whitespace
+            const specialScope = 'custom:read+write';
+            const specialResult = ScopeStringSchema.parse(specialScope);
+            expect(specialResult).toBe(specialScope);
+        });
+        test('should validate complex optional schema scenarios', () => {
+            const complexValid = OptionalSchema.parse({
+                audience: 'urn:example:audience',
+            });
+            expect(complexValid.audience).toBe('urn:example:audience');
+            const emptyValid = OptionalSchema.parse({});
+            expect(emptyValid).toEqual({});
+        });
+    });
+});

package/dist/esm/oauth/index.d.ts

@@ -1,4 +1,4 @@
-export { AuthorizationDisplay, AuthorizationDisplaySchema, AuthorizationPrompt, AuthorizationPromptSchema, CodeChallengeMethod, CodeChallengeMethodSchema, GrantType, GrantTypeLabel, OAuthScope, OIDCScope, ResponseType, type AnyAuthorizationDisplay, type AnyAuthorizationPrompt, type AnyCodeChallengeMethod, type AnyGrantType, type AnyOAuthScope, type AnyOIDCScope, type AnyResponseType, type AnyScope, } from './common/schema.js';
-export * as Authorize from './authorize/index.js';
-export * as Token from './token/index.js';
+export { AuthorizationDisplay, AuthorizationDisplaySchema, AuthorizationPrompt, AuthorizationPromptSchema, CodeChallengeMethod, CodeChallengeMethodSchema, GrantType, GrantTypeLabel, OAuthScope, OIDCScope, ResponseType, ScopeSetSchema, ScopeStringSchema, type AnyAuthorizationDisplay, type AnyAuthorizationPrompt, type AnyCodeChallengeMethod, type AnyGrantType, type AnyOAuthScope, type AnyOIDCScope, type AnyResponseType, type AnyScope, type ScopeSet, type ScopeString, } from './common/schema.js';
+export * from './authorize/index.js';
+export * from './token/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,SAAS,EACT,cAAc,EACd,UAAU,EACV,SAAS,EACT,YAAY,EACZ,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,QAAQ,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAC;AAClD,OAAO,KAAK,KAAK,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,SAAS,EACT,cAAc,EACd,UAAU,EACV,SAAS,EACT,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAC;AAE5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC"}

package/dist/esm/oauth/index.js

@@ -1,3 +1,3 @@
-export { AuthorizationDisplay, AuthorizationDisplaySchema, AuthorizationPrompt, AuthorizationPromptSchema, CodeChallengeMethod, CodeChallengeMethodSchema, GrantType, GrantTypeLabel, OAuthScope, OIDCScope, ResponseType, } from './common/schema.js';
-export * as Authorize from './authorize/index.js';
-export * as Token from './token/index.js';
+export { AuthorizationDisplay, AuthorizationDisplaySchema, AuthorizationPrompt, AuthorizationPromptSchema, CodeChallengeMethod, CodeChallengeMethodSchema, GrantType, GrantTypeLabel, OAuthScope, OIDCScope, ResponseType, ScopeSetSchema, ScopeStringSchema, } from './common/schema.js';
+export * from './authorize/index.js';
+export * from './token/index.js';

package/dist/esm/oauth/token/schema/grants/authorization-code.d.ts

@@ -1,10 +1,17 @@
-export declare const AuthorizationCodeSchema: import("arktype/internal/methods/object.ts").ObjectType<{
-    grant_type: "authorization_code";
-    code: string;
-    client_id: string;
-    redirect_uri: string;
-    client_secret?: string | undefined;
-    code_verifier?: string | undefined;
-}, {}>;
-export type AuthorizationCodePayload = typeof AuthorizationCodeSchema.inferOut;
+import * as z from 'zod/v4';
+/**
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
+ */
+export declare const AuthorizationCodeGrantTokenSchema: z.ZodObject<{
+    code_verifier: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    grant_type: z.ZodEnum<{
+        authorization_code: "authorization_code";
+    }>;
+    code: z.ZodString;
+    redirect_uri: z.ZodOptional<z.ZodURL>;
+}, z.core.$strip>;
+export type AuthorizationCodeGrantTokenInput = z.input<typeof AuthorizationCodeGrantTokenSchema>;
+export type AuthorizationCodeGrantToken = z.output<typeof AuthorizationCodeGrantTokenSchema>;
 //# sourceMappingURL=authorization-code.d.ts.map

package/dist/esm/oauth/token/schema/grants/authorization-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-code.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/authorization-code.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,uBAAuB;;;;;;;MAMlB,CAAC;AACnB,MAAM,MAAM,wBAAwB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"authorization-code.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/authorization-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAW5B;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;iBA8B5C,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,iCAAiC,CACzC,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAChD,OAAO,iCAAiC,CACzC,CAAC"}

package/dist/esm/oauth/token/schema/grants/authorization-code.js

@@ -1,17 +1,38 @@
-import { type } from 'arktype';
+import * as z from 'zod/v4';
 import { GrantType } from '../../../common/schema.js';
+import { ClientRequestSchema } from './common.js';
 /**
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
  * @see https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.3.1
  */
-const GrantTypeSchema = type.enumerated(GrantType.AUTHORIZATION_CODE);
-const PKCESchema = type({
-    code_verifier: type('string').optional(),
+const GrantTypeSchema = z.enum([GrantType.AUTHORIZATION_CODE]);
+/**
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
+ */
+export const AuthorizationCodeGrantTokenSchema = z.object({
+    /**
+     * REQUIRED. Must be set to "authorization_code".
+     */
+    grant_type: GrantTypeSchema.describe('The grant type.'),
+    /**
+     * REQUIRED. The authorization code received from the authorization server.
+     */
+    code: z
+        .string()
+        .min(1)
+        .describe('The authorization code received in the redirect.'),
+    /**
+     * REQUIRED. If the "redirect_uri" parameter was included in the
+     * authorization request, it must be identical here.
+     */
+    redirect_uri: z
+        .url()
+        .optional()
+        .describe('The callback URL used in the initial request.'),
+    ...ClientRequestSchema.shape,
+    /**
+     * PKCE EXTENSION. REQUIRED if "code_challenge" was present in the authorization request.
+     * The unhashed, original random string created by the client.
+     */
+    code_verifier: z.string().min(1).optional().describe('PKCE Code Verifier.'),
 });
-export const AuthorizationCodeSchema = type({
-    grant_type: GrantTypeSchema,
-    code: type('string'),
-    client_id: type('string'),
-    client_secret: type('string').optional(),
-    redirect_uri: type('string.url'),
-}).and(PKCESchema);

package/dist/esm/oauth/token/schema/grants/client-credentials.d.ts

@@ -1,21 +1,20 @@
+import * as z from 'zod/v4';
 /**
- * What the incoming body may look like.
+ * Note: Prior to using this schema, the headers should be checked for
+ * HTTP Basic Authentication. If present, the client_id and client_secret
+ * should be included in with the payload before parsing.
  *
- * Note: the client_id and client_secrete may (likely) be in Authorization header
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.2
  */
-export declare const ClientCredentialsPayloadSchema: import("arktype/internal/methods/object.ts").ObjectType<{
-    grant_type: "client_credentials";
-    scope?: string | undefined;
-    client_id?: string | undefined;
-    client_secret?: string | undefined;
-    audience?: string | undefined;
-}, {}>;
-export declare const ClientCredentialsSchema: import("arktype/internal/methods/object.ts").ObjectType<{
-    grant_type: "client_credentials";
-    scope?: string | undefined;
-    audience?: string | undefined;
-    client_id: string;
-    client_secret: string;
-}, {}>;
-export type ClientCredentialsPayload = typeof ClientCredentialsSchema.inferOut;
+export declare const ClientCredentialsGrantTokenSchema: z.ZodObject<{
+    audience: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    grant_type: z.ZodEnum<{
+        client_credentials: "client_credentials";
+    }>;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ClientCredentialsGrantTokenInput = z.input<typeof ClientCredentialsGrantTokenSchema>;
+export type ClientCredentialsGrantToken = z.output<typeof ClientCredentialsGrantTokenSchema>;
 //# sourceMappingURL=client-credentials.d.ts.map

package/dist/esm/oauth/token/schema/grants/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/client-credentials.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;MAKrB,CAAC;AAEvB,eAAO,MAAM,uBAAuB;;;;;;MAMlC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/client-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAc5B;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;iBAa5C,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,iCAAiC,CACzC,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAChD,OAAO,iCAAiC,CACzC,CAAC"}

package/dist/esm/oauth/token/schema/grants/client-credentials.js

@@ -1,22 +1,26 @@
-import { type } from 'arktype';
-import { AppIdSchema } from '../../../../app/schema.js';
-import { GrantType, OptionalSchema } from '../../../common/schema.js';
+import * as z from 'zod/v4';
+import { GrantType, OptionalSchema, ScopeStringSchema, } from '../../../common/schema.js';
+import { ClientRequestSchema } from './common.js';
 /**
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.2
  */
-const GrantTypeSchema = type.enumerated(GrantType.CLIENT_CREDENTIALS);
+const GrantTypeSchema = z.enum([GrantType.CLIENT_CREDENTIALS]);
 /**
- * What the incoming body may look like.
+ * Note: Prior to using this schema, the headers should be checked for
+ * HTTP Basic Authentication. If present, the client_id and client_secret
+ * should be included in with the payload before parsing.
  *
- * Note: the client_id and client_secrete may (likely) be in Authorization header
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.2
  */
-export const ClientCredentialsPayloadSchema = type({
-    grant_type: GrantTypeSchema,
-    scope: type('string').optional(),
-    client_id: AppIdSchema.optional(),
-    client_secret: type('string').optional(),
-}).and(OptionalSchema);
-export const ClientCredentialsSchema = ClientCredentialsPayloadSchema.omit('client_id', 'client_secret').and({
-    client_id: AppIdSchema,
-    client_secret: type('string'),
+export const ClientCredentialsGrantTokenSchema = z.object({
+    /**
+     * REQUIRED. Value MUST be set to "client_credentials".
+     */
+    grant_type: GrantTypeSchema.describe('The grant type.'),
+    /**
+     * OPTIONAL. The scope of the access request.
+     */
+    scope: ScopeStringSchema.optional(),
+    ...ClientRequestSchema.shape,
+    ...OptionalSchema.shape,
 });

package/dist/esm/oauth/token/schema/grants/common.d.ts

@@ -0,0 +1,6 @@
+import * as z from 'zod/v4';
+export declare const ClientRequestSchema: z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+}, z.core.$strip>;
+//# sourceMappingURL=common.d.ts.map

package/dist/esm/oauth/token/schema/grants/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/common.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,mBAAmB;;;iBAc9B,CAAC"}

package/dist/esm/oauth/token/schema/grants/common.js

@@ -0,0 +1,16 @@
+import * as z from 'zod/v4';
+import { AppIdSchema } from '../../../../app/schema.js';
+export const ClientRequestSchema = z.object({
+    /**
+     * REQUIRED. The client identifier.
+     * NOTE: This is only required in the body if the client is NOT authenticating
+     * via the HTTP "Authorization" header (Basic Auth).
+     */
+    client_id: AppIdSchema.describe('The Client ID.'),
+    /**
+     * REQUIRED. The client secret.
+     * NOTE: This is only required in the body if the client is NOT authenticating
+     * via the HTTP "Authorization" header (Basic Auth).
+     */
+    client_secret: z.string().min(1).describe('The Client Secret.'),
+});

package/dist/esm/oauth/token/schema/grants/refresh-token.d.ts

@@ -1,9 +1,16 @@
-export declare const RefreshTokenSchema: import("arktype/internal/methods/object.ts").ObjectType<{
-    grant_type: "refresh_token";
-    refresh_token: string;
-    client_id: string;
-    client_secret: string;
-    scope?: string | undefined;
-}, {}>;
-export type RefreshTokenPayload = typeof RefreshTokenSchema.inferOut;
+import * as z from 'zod/v4';
+/**
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+ */
+export declare const RefreshTokenGrantTokenSchema: z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    grant_type: z.ZodEnum<{
+        refresh_token: "refresh_token";
+    }>;
+    refresh_token: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type RefreshTokenGrantTokenInput = z.input<typeof RefreshTokenGrantTokenSchema>;
+export type RefreshTokenGrantToken = z.output<typeof RefreshTokenGrantTokenSchema>;
 //# sourceMappingURL=refresh-token.d.ts.map

package/dist/esm/oauth/token/schema/grants/refresh-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/refresh-token.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,kBAAkB;;;;;;MAM7B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,kBAAkB,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/refresh-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAS5B;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;iBAmBvC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,4BAA4B,CACpC,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAC3C,OAAO,4BAA4B,CACpC,CAAC"}

package/dist/esm/oauth/token/schema/grants/refresh-token.js

@@ -1,14 +1,27 @@
-import { type } from 'arktype';
-import { AppIdSchema } from '../../../../app/schema.js';
-import { GrantType } from '../../../common/schema.js';
+import * as z from 'zod/v4';
+import { GrantType, ScopeStringSchema } from '../../../common/schema.js';
+import { ClientRequestSchema } from './common.js';
 /**
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
  */
-const GrantTypeSchema = type.enumerated(GrantType.REFRESH_TOKEN);
-export const RefreshTokenSchema = type({
-    grant_type: GrantTypeSchema,
-    refresh_token: type('string'),
-    scope: type('string').optional(),
-    client_id: AppIdSchema,
-    client_secret: type('string'),
+const GrantTypeSchema = z.enum([GrantType.REFRESH_TOKEN]);
+/**
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+ */
+export const RefreshTokenGrantTokenSchema = z.object({
+    /**
+     * REQUIRED. Value MUST be set to "refresh_token".
+     */
+    grant_type: GrantTypeSchema.describe('The grant type.'),
+    /**
+     * REQUIRED. The refresh token issued to the client.
+     */
+    refresh_token: z.string().min(1).describe('The refresh token.'),
+    /**
+     * OPTIONAL. The scope of the access request. If omitted, the scope is
+     * unchanged from the original grant. If specified, it must be equal to or
+     * a subset of the original scope.
+     */
+    scope: ScopeStringSchema.optional(),
+    ...ClientRequestSchema.shape,
 });