@go-mondo/identity-sdk 0.0.2-beta.8 → 0.0.2-beta.9

package/dist/cjs/app/authorization/schema.test.js

@@ -0,0 +1,353 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const arktype_1 = require("arktype");
+const vitest_1 = require("vitest");
+const schema_js_1 = require("./schema.js");
+(0, vitest_1.describe)('App Authorization - Schema', () => {
+    (0, vitest_1.describe)('AuthorizationSchema', () => {
+        (0, vitest_1.test)('should accept complete authorization object', () => {
+            const authorization = {
+                refreshTokenDuration: 3600,
+                accessTokenDuration: 900,
+                accessTokenSignatureAlgorithm: 'HS256',
+                loginUri: 'https://app.example.com/login',
+                callbackUrls: [
+                    'https://app.example.com/callback',
+                    'https://app.example.com/oauth/callback',
+                ],
+                availableAudiences: ['api.example.com', 'admin.example.com'],
+                availableGrants: new Set([
+                    'authorization_code',
+                    'refresh_token',
+                ]),
+                defaultAudience: 'api.example.com',
+                updatedAt: new Date(),
+                deletedAt: new Date(),
+                deactivatedAt: new Date(),
+                metadata: {
+                    oauth_version: '2.0',
+                    pkce_required: true,
+                    state_parameter_required: true,
+                },
+            };
+            const result = (0, schema_js_1.AuthorizationSchema)(authorization);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result.availableGrants).toBeInstanceOf(Set);
+        });
+        (0, vitest_1.test)('should accept minimal authorization object', () => {
+            const authorization = {
+                metadata: {},
+            };
+            const result = (0, schema_js_1.AuthorizationSchema)(authorization);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should accept authorization with grant array and convert to Set', () => {
+            const authorization = {
+                refreshTokenDuration: 7200,
+                accessTokenDuration: 1800,
+                availableGrants: ['authorization_code', 'client_credentials'],
+                metadata: {
+                    client_type: 'confidential',
+                },
+            };
+            const result = (0, schema_js_1.AuthorizationSchema)(authorization);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result.availableGrants).toBeInstanceOf(Set);
+            (0, vitest_1.expect)(result.availableGrants?.has('authorization_code')).toBe(true);
+            (0, vitest_1.expect)(result.availableGrants?.has('client_credentials')).toBe(true);
+        });
+        (0, vitest_1.test)('should accept authorization with Set of grants', () => {
+            const authorization = {
+                accessTokenDuration: 600,
+                availableGrants: new Set(['implicit', 'authorization_code']),
+                callbackUrls: ['https://spa.example.com/callback'],
+                metadata: {
+                    client_type: 'public',
+                    application_type: 'spa',
+                },
+            };
+            const result = (0, schema_js_1.AuthorizationSchema)(authorization);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result.availableGrants).toBeInstanceOf(Set);
+        });
+        (0, vitest_1.test)('should accept authorization with callback URLs as Set', () => {
+            const authorization = {
+                callbackUrls: new Set([
+                    'https://app.example.com/auth',
+                    'https://app.example.com/oauth',
+                ]),
+                availableAudiences: new Set(['api1.example.com', 'api2.example.com']),
+                metadata: {
+                    multi_tenant: true,
+                },
+            };
+            const result = (0, schema_js_1.AuthorizationSchema)(authorization);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result.callbackUrls).toBeInstanceOf(Set);
+            (0, vitest_1.expect)(result.availableAudiences).toBeInstanceOf(Set);
+        });
+        (0, vitest_1.test)('should accept authorization with optional fields', () => {
+            const authorization = {
+                refreshTokenDuration: 86400,
+                accessTokenDuration: 3600,
+                accessTokenSignatureAlgorithm: 'RS256',
+                loginUri: 'https://auth.example.com/login',
+                defaultAudience: 'https://api.example.com',
+                updatedAt: new Date(),
+                metadata: {
+                    jwt_configuration: {
+                        algorithm: 'RS256',
+                        public_key: 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...',
+                    },
+                    scopes: ['read:users', 'write:users', 'admin:all'],
+                },
+            };
+            const result = (0, schema_js_1.AuthorizationSchema)(authorization);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should filter empty strings from URLs and audiences', () => {
+            const authorization = {
+                callbackUrls: new Set([
+                    'https://valid.example.com/callback',
+                    'https://another.example.com/auth',
+                ]),
+                availableAudiences: ['api.example.com', 'admin.example.com'],
+                metadata: {},
+            };
+            const result = (0, schema_js_1.AuthorizationSchema)(authorization);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result.callbackUrls).toEqual(new Set([
+                'https://valid.example.com/callback',
+                'https://another.example.com/auth',
+            ]));
+            (0, vitest_1.expect)(result.availableAudiences).toEqual(new Set(['api.example.com', 'admin.example.com']));
+        });
+        (0, vitest_1.test)('should reject invalid grant types', () => {
+            const authorization = {
+                availableGrants: ['invalid_grant_type'],
+                metadata: {},
+            };
+            const result = (0, schema_js_1.AuthorizationSchema)(authorization);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid URL formats', () => {
+            const authorization = {
+                loginUri: 'not-a-valid-url',
+                metadata: {},
+            };
+            const result = (0, schema_js_1.AuthorizationSchema)(authorization);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+    (0, vitest_1.describe)('AuthorizationPayloadSchema', () => {
+        (0, vitest_1.test)('should accept complete authorization payload', () => {
+            const payload = {
+                refreshTokenDuration: 3600,
+                accessTokenDuration: 900,
+                accessTokenSignatureAlgorithm: 'HS256',
+                loginUri: 'https://app.example.com/login',
+                callbackUrls: ['https://app.example.com/callback'],
+                availableAudiences: ['api.example.com'],
+                availableGrants: ['authorization_code', 'refresh_token'],
+                defaultAudience: 'api.example.com',
+                updatedAt: new Date().toISOString(),
+                deletedAt: new Date().toISOString(),
+                deactivatedAt: new Date().toISOString(),
+                metadata: {
+                    client_id: 'oauth_client_123',
+                    client_secret_set: true,
+                    token_endpoint_auth_method: 'client_secret_basic',
+                },
+            };
+            const result = (0, schema_js_1.AuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual(payload);
+        });
+        (0, vitest_1.test)('should accept minimal authorization payload', () => {
+            const payload = {
+                metadata: {},
+            };
+            const result = (0, schema_js_1.AuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toHaveProperty('accessTokenDuration');
+            (0, vitest_1.expect)(result).toHaveProperty('accessTokenSignatureAlgorithm');
+            (0, vitest_1.expect)(result).toHaveProperty('refreshTokenDuration');
+        });
+        (0, vitest_1.test)('should accept payload with grant arrays', () => {
+            const payload = {
+                refreshTokenDuration: 7200,
+                accessTokenDuration: 1800,
+                availableGrants: ['authorization_code', 'client_credentials'],
+                callbackUrls: ['https://server.example.com/oauth/callback'],
+                metadata: {
+                    client_type: 'confidential',
+                    requires_client_secret: true,
+                },
+            };
+            const result = (0, schema_js_1.AuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should accept payload with Set of grants', () => {
+            const payload = {
+                accessTokenDuration: 600,
+                availableGrants: new Set(['implicit']),
+                defaultAudience: 'https://spa-api.example.com',
+                metadata: {
+                    client_type: 'public',
+                    application_type: 'single_page_app',
+                },
+            };
+            const result = (0, schema_js_1.AuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should accept payload with comprehensive OAuth configuration', () => {
+            const payload = {
+                refreshTokenDuration: 2592000, // 30 days
+                accessTokenDuration: 3600, // 1 hour
+                accessTokenSignatureAlgorithm: 'RS256',
+                loginUri: 'https://auth.corporate.com/oauth/authorize',
+                callbackUrls: [
+                    'https://app.corporate.com/auth/callback',
+                    'https://mobile.corporate.com/oauth/callback',
+                    'https://admin.corporate.com/auth/return',
+                ],
+                availableAudiences: [
+                    'https://api.corporate.com',
+                    'https://admin-api.corporate.com',
+                    'https://analytics.corporate.com',
+                ],
+                availableGrants: [
+                    'authorization_code',
+                    'refresh_token',
+                    'client_credentials',
+                ],
+                defaultAudience: 'https://api.corporate.com',
+                updatedAt: new Date().toISOString(),
+                metadata: {
+                    client_name: 'Corporate Application',
+                    client_uri: 'https://corporate.com',
+                    logo_uri: 'https://corporate.com/logo.png',
+                    tos_uri: 'https://corporate.com/terms',
+                    policy_uri: 'https://corporate.com/privacy',
+                },
+            };
+            const result = (0, schema_js_1.AuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid date format', () => {
+            const payload = {
+                updatedAt: 'invalid-date',
+                metadata: {},
+            };
+            const result = (0, schema_js_1.AuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid signature algorithm', () => {
+            const payload = {
+                accessTokenSignatureAlgorithm: 'INVALID_ALG',
+                metadata: {},
+            };
+            const result = (0, schema_js_1.AuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+    (0, vitest_1.describe)('UpsertAuthorizationPayloadSchema', () => {
+        (0, vitest_1.test)('should accept upsert with all fields', () => {
+            const payload = {
+                refreshTokenDuration: 3600,
+                accessTokenDuration: 900,
+                accessTokenSignatureAlgorithm: 'HS256',
+                loginUri: 'https://updated.example.com/login',
+                callbackUrls: ['https://updated.example.com/callback'],
+                availableAudiences: ['updated-api.example.com'],
+                availableGrants: ['authorization_code'],
+                defaultAudience: 'updated-api.example.com',
+                metadata: {
+                    update_reason: 'security_enhancement',
+                    updated_by: 'admin@example.com',
+                },
+            };
+            const result = (0, schema_js_1.UpsertAuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual(payload);
+        });
+        (0, vitest_1.test)('should accept partial upsert payload', () => {
+            const payload = {
+                accessTokenDuration: 1800,
+                callbackUrls: ['https://new-callback.example.com'],
+                metadata: {
+                    fields_updated: 'accessTokenDuration',
+                },
+            };
+            const result = (0, schema_js_1.UpsertAuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should accept upsert with undefined values', () => {
+            const payload = {
+                loginUri: undefined,
+                defaultAudience: undefined,
+                metadata: {
+                    reset_fields: 'loginUri',
+                },
+            };
+            const result = (0, schema_js_1.UpsertAuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should accept empty metadata upsert', () => {
+            const payload = {
+                refreshTokenDuration: 7200,
+                metadata: {},
+            };
+            const result = (0, schema_js_1.UpsertAuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should accept upsert with grant types modification', () => {
+            const payload = {
+                availableGrants: [
+                    'authorization_code',
+                    'refresh_token',
+                    'client_credentials',
+                ],
+                metadata: {
+                    added_grants: 'client_credentials',
+                },
+            };
+            const result = (0, schema_js_1.UpsertAuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should accept upsert with complex callback URL updates', () => {
+            const payload = {
+                callbackUrls: [
+                    'https://prod.example.com/oauth/callback',
+                    'https://staging.example.com/oauth/callback',
+                    'https://dev.example.com/oauth/callback',
+                ],
+                availableAudiences: [
+                    'https://api.example.com',
+                    'https://staging-api.example.com',
+                ],
+                metadata: {
+                    environment: 'production',
+                },
+            };
+            const result = (0, schema_js_1.UpsertAuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid grant types in upsert', () => {
+            const payload = {
+                availableGrants: ['invalid_grant'],
+                metadata: {},
+            };
+            const result = (0, schema_js_1.UpsertAuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid URL in upsert', () => {
+            const payload = {
+                loginUri: 'not-a-valid-url',
+                metadata: {},
+            };
+            const result = (0, schema_js_1.UpsertAuthorizationPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+});

package/dist/cjs/app/oauth/schema.d.ts

@@ -11,7 +11,7 @@ export declare const OAuthSchema: import("arktype/out/methods/object.js").Object
     updatedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
     deletedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
     deactivatedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
-    metadata: (In: import("arktype/out/attributes.js").Default<unknown, Map<string, string | number | boolean>>) => import("arktype").Out<Map<string, string | number | boolean> | Map<string, any>>;
+    metadata: (In: import("arktype/out/attributes.js").Default<unknown, Map<string, string | number | boolean>>) => import("arktype").Out<Map<string, string | number | boolean>>;
 }, {}>;
 export type OAuthProperties = typeof OAuthSchema.inferIn;
 export type OAuth = typeof OAuthSchema.inferOut;

package/dist/cjs/app/oauth/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/app/oauth/schema.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,aAAa,gEAAc,CAAC;AACzC,MAAM,MAAM,OAAO,GAAG,OAAO,aAAa,CAAC,QAAQ,CAAC;AAEpD,eAAO,MAAM,qBAAqB;;MAEhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,qBAAqB,CAAC,QAAQ,CAAC;AAOpE,eAAO,MAAM,WAAW;;;;;;;;MAIS,CAAC;AAClC,MAAM,MAAM,eAAe,GAAG,OAAO,WAAW,CAAC,OAAO,CAAC;AACzD,MAAM,MAAM,KAAK,GAAG,OAAO,WAAW,CAAC,QAAQ,CAAC;AAEhD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;MAIM,CAAC;AACtC,MAAM,MAAM,YAAY,GAAG,OAAO,kBAAkB,CAAC,QAAQ,CAAC;AAE9D,eAAO,MAAM,wBAAwB;;;;;;;MAEA,CAAC;AACtC,MAAM,MAAM,gBAAgB,GAAG,OAAO,wBAAwB,CAAC,OAAO,CAAC;AACvE,MAAM,MAAM,kBAAkB,GAAG,OAAO,wBAAwB,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/app/oauth/schema.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,aAAa,gEAAqC,CAAC;AAChE,MAAM,MAAM,OAAO,GAAG,OAAO,aAAa,CAAC,QAAQ,CAAC;AAEpD,eAAO,MAAM,qBAAqB;;MAEhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,qBAAqB,CAAC,QAAQ,CAAC;AAOpE,eAAO,MAAM,WAAW;;;;;;;;MAIS,CAAC;AAClC,MAAM,MAAM,eAAe,GAAG,OAAO,WAAW,CAAC,OAAO,CAAC;AACzD,MAAM,MAAM,KAAK,GAAG,OAAO,WAAW,CAAC,QAAQ,CAAC;AAEhD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;MAIM,CAAC;AACtC,MAAM,MAAM,YAAY,GAAG,OAAO,kBAAkB,CAAC,QAAQ,CAAC;AAE9D,eAAO,MAAM,wBAAwB;;;;;;;MAEA,CAAC;AACtC,MAAM,MAAM,gBAAgB,GAAG,OAAO,wBAAwB,CAAC,OAAO,CAAC;AACvE,MAAM,MAAM,kBAAkB,GAAG,OAAO,wBAAwB,CAAC,QAAQ,CAAC"}

package/dist/cjs/app/oauth/schema.js

@@ -3,9 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.InsertOAuthPayloadSchema = exports.OAuthPayloadSchema = exports.OAuthSchema = exports.OAuthIdPropertySchema = exports.OAuthIdSchema = void 0;
 const arktype_1 = require("arktype");
 const dates_js_1 = require("../../common/schema/dates.js");
+const id_js_1 = require("../../common/schema/id.js");
 const metadata_js_1 = require("../../common/schema/metadata.js");
 const utils_js_1 = require("../utils.js");
-exports.OAuthIdSchema = arktype_1.type.string;
+exports.OAuthIdSchema = (0, id_js_1.KSUIDSchema)(utils_js_1.Model.OAuth.UIDPrefix);
 exports.OAuthIdPropertySchema = (0, arktype_1.type)({
     id: exports.OAuthIdSchema,
 });

package/dist/cjs/app/oauth/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/cjs/app/oauth/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../src/app/oauth/schema.test.ts"],"names":[],"mappings":""}

package/dist/cjs/app/oauth/schema.test.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const arktype_1 = require("arktype");
+const vitest_1 = require("vitest");
+const utils_js_1 = require("../utils.js");
+const schema_js_1 = require("./schema.js");
+(0, vitest_1.describe)('App OAuth - Schema', () => {
+    (0, vitest_1.describe)('OAuthIdSchema', () => {
+        (0, vitest_1.test)('should accept valid OAuth ID', () => {
+            const id = (0, utils_js_1.generateOAuthId)();
+            const result = (0, schema_js_1.OAuthIdSchema)(id);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toBe(id);
+        });
+        (0, vitest_1.test)('should reject invalid OAuth ID format', () => {
+            (0, vitest_1.expect)((0, schema_js_1.OAuthIdSchema)('invalid_id')).toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)((0, schema_js_1.OAuthIdSchema)('wrong_prefix_123')).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject non-string values', () => {
+            (0, vitest_1.expect)((0, schema_js_1.OAuthIdSchema)(123)).toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)((0, schema_js_1.OAuthIdSchema)(null)).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+    (0, vitest_1.describe)('OAuthIdPropertySchema', () => {
+        (0, vitest_1.test)('should accept valid id property', () => {
+            const payload = { id: (0, utils_js_1.generateOAuthId)() };
+            const result = (0, schema_js_1.OAuthIdPropertySchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual(payload);
+        });
+        (0, vitest_1.test)('should reject missing id', () => {
+            const result = (0, schema_js_1.OAuthIdPropertySchema)({});
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid id format', () => {
+            const result = (0, schema_js_1.OAuthIdPropertySchema)({ id: 'invalid_id' });
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+    (0, vitest_1.describe)('OAuthSchema', () => {
+        (0, vitest_1.test)('should accept complete OAuth object', () => {
+            const oauth = {
+                id: (0, utils_js_1.generateOAuthId)(),
+                clientId: 'client_12345',
+                clientSecret: 'secret_abcdef',
+                updatedAt: new Date(),
+                metadata: { key: 'value' },
+            };
+            const result = (0, schema_js_1.OAuthSchema)(oauth);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should accept minimal OAuth object', () => {
+            const oauth = {
+                id: (0, utils_js_1.generateOAuthId)(),
+                clientId: 'simple_client',
+                clientSecret: 'simple_secret',
+                metadata: {},
+            };
+            const result = (0, schema_js_1.OAuthSchema)(oauth);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should accept OAuth with optional dates', () => {
+            const oauth = {
+                id: (0, utils_js_1.generateOAuthId)(),
+                clientId: 'test_client',
+                clientSecret: 'test_secret',
+                updatedAt: new Date(),
+                deletedAt: new Date(),
+                deactivatedAt: new Date(),
+                metadata: {},
+            };
+            const result = (0, schema_js_1.OAuthSchema)(oauth);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject missing required fields', () => {
+            const oauth = {
+                id: (0, utils_js_1.generateOAuthId)(),
+                // missing clientId, clientSecret, metadata
+            };
+            const result = (0, schema_js_1.OAuthSchema)(oauth);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject empty client credentials', () => {
+            const oauth = {
+                id: (0, utils_js_1.generateOAuthId)(),
+                clientId: '',
+                clientSecret: '',
+                metadata: {},
+            };
+            const result = (0, schema_js_1.OAuthSchema)(oauth);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors); // Empty strings are valid strings
+        });
+    });
+    (0, vitest_1.describe)('OAuthPayloadSchema', () => {
+        (0, vitest_1.test)('should accept complete payload', () => {
+            const payload = {
+                id: (0, utils_js_1.generateOAuthId)(),
+                clientId: 'payload_client',
+                clientSecret: 'payload_secret',
+                updatedAt: new Date().toISOString(),
+                deletedAt: new Date().toISOString(),
+                deactivatedAt: new Date().toISOString(),
+                metadata: { version: '1.0' },
+            };
+            const result = (0, schema_js_1.OAuthPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual(payload);
+        });
+        (0, vitest_1.test)('should accept minimal payload', () => {
+            const payload = {
+                id: (0, utils_js_1.generateOAuthId)(),
+                clientId: 'min_client',
+                clientSecret: 'min_secret',
+                metadata: {},
+            };
+            const result = (0, schema_js_1.OAuthPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual(payload);
+        });
+        (0, vitest_1.test)('should accept payload with optional dates', () => {
+            const payload = {
+                id: (0, utils_js_1.generateOAuthId)(),
+                clientId: 'client_with_dates',
+                clientSecret: 'secret_with_dates',
+                updatedAt: new Date().toISOString(),
+                metadata: {},
+            };
+            const result = (0, schema_js_1.OAuthPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject missing required fields', () => {
+            const payload = {
+                id: (0, utils_js_1.generateOAuthId)(),
+                // missing clientId, clientSecret, metadata
+            };
+            const result = (0, schema_js_1.OAuthPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+    (0, vitest_1.describe)('InsertOAuthPayloadSchema', () => {
+        (0, vitest_1.test)('should accept complete insert payload', () => {
+            const payload = {
+                id: (0, utils_js_1.generateOAuthId)(),
+                metadata: { source: 'manual' },
+            };
+            const result = (0, schema_js_1.InsertOAuthPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual(payload);
+        });
+        (0, vitest_1.test)('should accept minimal insert payload', () => {
+            const payload = {};
+            const result = (0, schema_js_1.InsertOAuthPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            // Should generate default ID
+            (0, vitest_1.expect)(result.id).toMatch(/^aoa_/);
+        });
+        (0, vitest_1.test)('should generate default ID when not provided', () => {
+            const payload = {
+                metadata: { auto: true },
+            };
+            const result = (0, schema_js_1.InsertOAuthPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result.id).toMatch(/^aoa_/);
+        });
+        (0, vitest_1.test)('should accept payload with only metadata', () => {
+            const payload = {
+                metadata: { test: 'value' },
+            };
+            const result = (0, schema_js_1.InsertOAuthPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+});

package/dist/cjs/app/oidc/schema.d.ts

@@ -2,7 +2,7 @@ export declare const OIDCSchema: import("arktype/out/methods/object.js").ObjectT
     updatedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
     deletedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
     deactivatedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
-    metadata: (In: import("arktype/out/attributes.js").Default<unknown, Map<string, string | number | boolean>>) => import("arktype").Out<Map<string, string | number | boolean> | Map<string, any>>;
+    metadata: (In: import("arktype/out/attributes.js").Default<unknown, Map<string, string | number | boolean>>) => import("arktype").Out<Map<string, string | number | boolean>>;
 }, {}>;
 export type OIDCProperties = typeof OIDCSchema.inferIn;
 export type OIDC = typeof OIDCSchema.inferOut;
@@ -22,7 +22,7 @@ export declare const InsertOIDCPayloadSchema: import("arktype").BaseType<{
         [x: string]: string | number | boolean;
     } | Map<string, string | number | boolean> | null | undefined) => import("arktype").Out<{
         [x: string]: string | number | boolean;
-    } | undefined>) | undefined;
+    } | null>) | undefined;
 } | undefined, {}>;
 export type InsertOIDCInput = typeof InsertOIDCPayloadSchema.inferIn;
 export type InsertOIDCPayload = typeof InsertOIDCPayloadSchema.inferOut;

package/dist/cjs/app/oidc/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/app/oidc/schema.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,UAAU;;;;;MAIU,CAAC;AAClC,MAAM,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,OAAO,CAAC;AACvD,MAAM,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,QAAQ,CAAC;AAE9C,eAAO,MAAM,iBAAiB;;;;;;;;;MAIO,CAAC;AACtC,MAAM,MAAM,WAAW,GAAG,OAAO,iBAAiB,CAAC,QAAQ,CAAC;AAE5D,eAAO,MAAM,uBAAuB;;;;;;kBACW,CAAC;AAChD,MAAM,MAAM,eAAe,GAAG,OAAO,uBAAuB,CAAC,OAAO,CAAC;AACrE,MAAM,MAAM,iBAAiB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC;AAExE,eAAO,MAAM,uBAAuB;;;;;;MAAgC,CAAC;AACrE,MAAM,MAAM,eAAe,GAAG,OAAO,uBAAuB,CAAC,OAAO,CAAC;AACrE,MAAM,MAAM,iBAAiB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/app/oidc/schema.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,UAAU;;;;;MAIU,CAAC;AAClC,MAAM,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,OAAO,CAAC;AACvD,MAAM,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,QAAQ,CAAC;AAE9C,eAAO,MAAM,iBAAiB;;;;;;;;;MAIO,CAAC;AACtC,MAAM,MAAM,WAAW,GAAG,OAAO,iBAAiB,CAAC,QAAQ,CAAC;AAE5D,eAAO,MAAM,uBAAuB;;;;;;kBACiB,CAAC;AACtD,MAAM,MAAM,eAAe,GAAG,OAAO,uBAAuB,CAAC,OAAO,CAAC;AACrE,MAAM,MAAM,iBAAiB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC;AAExE,eAAO,MAAM,uBAAuB;;;;;;MAAgC,CAAC;AACrE,MAAM,MAAM,eAAe,GAAG,OAAO,uBAAuB,CAAC,OAAO,CAAC;AACrE,MAAM,MAAM,iBAAiB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC"}

package/dist/cjs/app/oidc/schema.js

@@ -14,5 +14,5 @@ exports.OIDCPayloadSchema = (0, arktype_1.type)({
     'deletedAt?': dates_js_1.OptionalDatePayloadSchema,
     'deactivatedAt?': dates_js_1.OptionalDatePayloadSchema,
 }).and(metadata_js_1.MetadataPayloadPropertySchema);
-exports.InsertOIDCPayloadSchema = metadata_js_1.MetadataPayloadPropertySchema.or('undefined');
+exports.InsertOIDCPayloadSchema = metadata_js_1.UpsertMetadataPropertyPayloadSchema.or('undefined');
 exports.UpdateOIDCPayloadSchema = metadata_js_1.MetadataPayloadPropertySchema;

package/dist/cjs/app/oidc/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/cjs/app/oidc/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../src/app/oidc/schema.test.ts"],"names":[],"mappings":""}