@go-mondo/identity-sdk 0.0.2-beta.8 → 0.0.2-beta.9

package/dist/cjs/authentication/utils.test.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const utils_js_1 = require("./utils.js");
+(0, vitest_1.describe)('Authentication Utils', () => {
+    (0, vitest_1.describe)('Model constants', () => {
+        (0, vitest_1.test)('should have correct Strategy model properties', () => {
+            (0, vitest_1.expect)(utils_js_1.Model.Strategy.UIDPrefix).toBe('stg');
+            (0, vitest_1.expect)(utils_js_1.Model.Strategy.TYPE).toBe('Strategy');
+        });
+        (0, vitest_1.test)('should have correct Session model properties', () => {
+            (0, vitest_1.expect)(utils_js_1.Model.Session.UIDPrefix).toBe('ssn');
+            (0, vitest_1.expect)(utils_js_1.Model.Session.TYPE).toBe('Session');
+        });
+        (0, vitest_1.test)('should be readonly (const assertion)', () => {
+            // Test that the Model object is properly typed as const
+            (0, vitest_1.expect)(typeof utils_js_1.Model).toBe('object');
+            (0, vitest_1.expect)(Object.isFrozen(utils_js_1.Model)).toBe(false); // const assertion doesn't freeze at runtime
+        });
+    });
+    (0, vitest_1.describe)('generateStrategyId', () => {
+        (0, vitest_1.test)('should generate ID with correct prefix', () => {
+            const id = (0, utils_js_1.generateStrategyId)();
+            (0, vitest_1.expect)(id).toMatch(/^stg_/);
+        });
+        (0, vitest_1.test)('should generate ID with correct format', () => {
+            const id = (0, utils_js_1.generateStrategyId)();
+            // Should match: prefix + underscore + KSUID (27 characters)
+            (0, vitest_1.expect)(id).toMatch(/^stg_[A-Za-z0-9]{27}$/);
+        });
+        (0, vitest_1.test)('should generate unique IDs on multiple calls', () => {
+            const id1 = (0, utils_js_1.generateStrategyId)();
+            const id2 = (0, utils_js_1.generateStrategyId)();
+            const id3 = (0, utils_js_1.generateStrategyId)();
+            (0, vitest_1.expect)(id1).not.toBe(id2);
+            (0, vitest_1.expect)(id2).not.toBe(id3);
+            (0, vitest_1.expect)(id1).not.toBe(id3);
+        });
+        (0, vitest_1.test)('should generate IDs with correct total length', () => {
+            const id = (0, utils_js_1.generateStrategyId)();
+            // prefix (3) + underscore (1) + KSUID (27) = 31 characters
+            (0, vitest_1.expect)(id.length).toBe(31);
+        });
+        (0, vitest_1.test)('should generate IDs that start with strategy prefix', () => {
+            const ids = Array.from({ length: 10 }, () => (0, utils_js_1.generateStrategyId)());
+            for (const id of ids) {
+                (0, vitest_1.expect)(id.startsWith('stg_')).toBe(true);
+            }
+        });
+        (0, vitest_1.test)('should generate KSUID-compatible format', () => {
+            const id = (0, utils_js_1.generateStrategyId)();
+            const ksuidPart = id.substring(4); // Remove 'stg_'
+            // KSUID should be 27 characters of base62
+            (0, vitest_1.expect)(ksuidPart.length).toBe(27);
+            (0, vitest_1.expect)(ksuidPart).toMatch(/^[A-Za-z0-9]{27}$/);
+        });
+        (0, vitest_1.test)('should be deterministic in format but random in content', () => {
+            const ids = Array.from({ length: 100 }, () => (0, utils_js_1.generateStrategyId)());
+            // All should have same format
+            for (const id of ids) {
+                (0, vitest_1.expect)(id).toMatch(/^stg_[A-Za-z0-9]{27}$/);
+            }
+            // All should be unique
+            const uniqueIds = new Set(ids);
+            (0, vitest_1.expect)(uniqueIds.size).toBe(100);
+        });
+    });
+    (0, vitest_1.describe)('generateSessionId', () => {
+        (0, vitest_1.test)('should generate ID with correct prefix', () => {
+            const id = (0, utils_js_1.generateSessionId)();
+            (0, vitest_1.expect)(id).toMatch(/^ssn_/);
+        });
+        (0, vitest_1.test)('should generate ID with correct format', () => {
+            const id = (0, utils_js_1.generateSessionId)();
+            // Should match: prefix + underscore + KSUID (27 characters)
+            (0, vitest_1.expect)(id).toMatch(/^ssn_[A-Za-z0-9]{27}$/);
+        });
+        (0, vitest_1.test)('should generate unique IDs on multiple calls', () => {
+            const id1 = (0, utils_js_1.generateSessionId)();
+            const id2 = (0, utils_js_1.generateSessionId)();
+            const id3 = (0, utils_js_1.generateSessionId)();
+            (0, vitest_1.expect)(id1).not.toBe(id2);
+            (0, vitest_1.expect)(id2).not.toBe(id3);
+            (0, vitest_1.expect)(id1).not.toBe(id3);
+        });
+        (0, vitest_1.test)('should generate IDs with correct total length', () => {
+            const id = (0, utils_js_1.generateSessionId)();
+            // prefix (3) + underscore (1) + KSUID (27) = 31 characters
+            (0, vitest_1.expect)(id.length).toBe(31);
+        });
+        (0, vitest_1.test)('should generate IDs that start with session prefix', () => {
+            const ids = Array.from({ length: 10 }, () => (0, utils_js_1.generateSessionId)());
+            for (const id of ids) {
+                (0, vitest_1.expect)(id.startsWith('ssn_')).toBe(true);
+            }
+        });
+        (0, vitest_1.test)('should generate KSUID-compatible format', () => {
+            const id = (0, utils_js_1.generateSessionId)();
+            const ksuidPart = id.substring(4); // Remove 'ssn_'
+            // KSUID should be 27 characters of base62
+            (0, vitest_1.expect)(ksuidPart.length).toBe(27);
+            (0, vitest_1.expect)(ksuidPart).toMatch(/^[A-Za-z0-9]{27}$/);
+        });
+        (0, vitest_1.test)('should be deterministic in format but random in content', () => {
+            const ids = Array.from({ length: 100 }, () => (0, utils_js_1.generateSessionId)());
+            // All should have same format
+            for (const id of ids) {
+                (0, vitest_1.expect)(id).toMatch(/^ssn_[A-Za-z0-9]{27}$/);
+            }
+            // All should be unique
+            const uniqueIds = new Set(ids);
+            (0, vitest_1.expect)(uniqueIds.size).toBe(100);
+        });
+    });
+    (0, vitest_1.describe)('ID generation comparison', () => {
+        (0, vitest_1.test)('should generate different formats for strategy vs session', () => {
+            const strategyId = (0, utils_js_1.generateStrategyId)();
+            const sessionId = (0, utils_js_1.generateSessionId)();
+            (0, vitest_1.expect)(strategyId.startsWith('stg_')).toBe(true);
+            (0, vitest_1.expect)(sessionId.startsWith('ssn_')).toBe(true);
+            (0, vitest_1.expect)(strategyId).not.toBe(sessionId);
+        });
+        (0, vitest_1.test)('should maintain format consistency across generators', () => {
+            const strategyIds = Array.from({ length: 10 }, () => (0, utils_js_1.generateStrategyId)());
+            const sessionIds = Array.from({ length: 10 }, () => (0, utils_js_1.generateSessionId)());
+            // All strategy IDs should have same prefix
+            for (const id of strategyIds) {
+                (0, vitest_1.expect)(id.startsWith('stg_')).toBe(true);
+                (0, vitest_1.expect)(id.length).toBe(31);
+            }
+            // All session IDs should have same prefix
+            for (const id of sessionIds) {
+                (0, vitest_1.expect)(id.startsWith('ssn_')).toBe(true);
+                (0, vitest_1.expect)(id.length).toBe(31);
+            }
+            // No overlap between the two sets
+            const allIds = [...strategyIds, ...sessionIds];
+            const uniqueIds = new Set(allIds);
+            (0, vitest_1.expect)(uniqueIds.size).toBe(20);
+        });
+    });
+});

package/dist/cjs/authorization/index.d.ts

@@ -2,5 +2,5 @@ export * from './permissions/resources.js';
 export * from './permissions/schema.js';
 export * from './roles/resources.js';
 export * from './roles/schema.js';
-export * from './utils.js';
+export * from './schema.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/index.ts"],"names":[],"mappings":"AACA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AAGxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAElC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/index.ts"],"names":[],"mappings":"AACA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AAGxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAElC,cAAc,aAAa,CAAC"}

package/dist/cjs/authorization/index.js

@@ -20,4 +20,4 @@ __exportStar(require("./permissions/schema.js"), exports);
 // Roles
 __exportStar(require("./roles/resources.js"), exports);
 __exportStar(require("./roles/schema.js"), exports);
-__exportStar(require("./utils.js"), exports);
+__exportStar(require("./schema.js"), exports);

package/dist/cjs/authorization/permissions/schema.d.ts

@@ -3,7 +3,6 @@ export declare const PermissionStatus: {
     readonly DISABLED: "disabled";
 };
 export type AnyPermissionStatus = (typeof PermissionStatus)[keyof typeof PermissionStatus];
-export declare const PermissionIdSchema: import("arktype/out/methods/string.js").StringType<string, {}>;
 export declare const PermissionIdPropertySchema: import("arktype/out/methods/object.js").ObjectType<{
     id: string;
 }, {}>;
@@ -30,7 +29,7 @@ export declare const PermissionSchema: import("arktype/out/methods/object.js").O
     } | undefined;
     deletedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
     deactivatedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
-    metadata: (In: import("arktype/out/attributes.js").Default<unknown, Map<string, string | number | boolean>>) => import("arktype").Out<Map<string, string | number | boolean> | Map<string, any>>;
+    metadata: (In: import("arktype/out/attributes.js").Default<unknown, Map<string, string | number | boolean>>) => import("arktype").Out<Map<string, string | number | boolean>>;
 }, {}>;
 export type PermissionProperties = typeof PermissionSchema.inferIn;
 export type Permission = typeof PermissionSchema.inferOut;

package/dist/cjs/authorization/permissions/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/authorization/permissions/schema.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,gBAAgB;;;CAGnB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAC7B,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE3D,eAAO,MAAM,kBAAkB,gEAAc,CAAC;AAE9C,eAAO,MAAM,0BAA0B;;MAErC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,0BAA0B,CAAC,QAAQ,CAAC;AAS9E,eAAO,MAAM,4BAA4B;;;MAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAChC,OAAO,4BAA4B,CAAC,QAAQ,CAAC;AAQ/C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;MAOI,CAAC;AAClC,MAAM,MAAM,oBAAoB,GAAG,OAAO,gBAAgB,CAAC,OAAO,CAAC;AACnE,MAAM,MAAM,UAAU,GAAG,OAAO,gBAAgB,CAAC,QAAQ,CAAC;AAE1D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;MAOC,CAAC;AACtC,MAAM,MAAM,iBAAiB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;MAOC,CAAC;AAC5C,MAAM,MAAM,qBAAqB,GAC/B,OAAO,6BAA6B,CAAC,OAAO,CAAC;AAC/C,MAAM,MAAM,uBAAuB,GACjC,OAAO,6BAA6B,CAAC,QAAQ,CAAC;AAEhD;;GAEG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;MAIC,CAAC;AAC5C,MAAM,MAAM,qBAAqB,GAC/B,OAAO,6BAA6B,CAAC,OAAO,CAAC;AAC/C,MAAM,MAAM,uBAAuB,GACjC,OAAO,6BAA6B,CAAC,QAAQ,CAAC;AAEhD;;GAEG;AACH,eAAO,MAAM,oCAAoC;;;;;MAK7C,CAAC;AACL,MAAM,MAAM,8BAA8B,GACxC,OAAO,oCAAoC,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/authorization/permissions/schema.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,gBAAgB;;;CAGnB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAC7B,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE3D,eAAO,MAAM,0BAA0B;;MAErC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,0BAA0B,CAAC,QAAQ,CAAC;AAO9E,eAAO,MAAM,4BAA4B;;;MAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAChC,OAAO,4BAA4B,CAAC,QAAQ,CAAC;AAQ/C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;MAOI,CAAC;AAClC,MAAM,MAAM,oBAAoB,GAAG,OAAO,gBAAgB,CAAC,OAAO,CAAC;AACnE,MAAM,MAAM,UAAU,GAAG,OAAO,gBAAgB,CAAC,QAAQ,CAAC;AAE1D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;MAOC,CAAC;AACtC,MAAM,MAAM,iBAAiB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;MAOC,CAAC;AAC5C,MAAM,MAAM,qBAAqB,GAC/B,OAAO,6BAA6B,CAAC,OAAO,CAAC;AAC/C,MAAM,MAAM,uBAAuB,GACjC,OAAO,6BAA6B,CAAC,QAAQ,CAAC;AAEhD;;GAEG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;MAIC,CAAC;AAC5C,MAAM,MAAM,qBAAqB,GAC/B,OAAO,6BAA6B,CAAC,OAAO,CAAC;AAC/C,MAAM,MAAM,uBAAuB,GACjC,OAAO,6BAA6B,CAAC,QAAQ,CAAC;AAEhD;;GAEG;AAEH,eAAO,MAAM,oCAAoC;;;;;MAK7C,CAAC;AACL,MAAM,MAAM,8BAA8B,GACxC,OAAO,oCAAoC,CAAC,QAAQ,CAAC"}

package/dist/cjs/authorization/permissions/schema.js

@@ -1,24 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PermissionAssociationReferenceSchema = exports.UpdatePermissionPayloadSchema = exports.InsertPermissionPayloadSchema = exports.PermissionPayloadSchema = exports.PermissionSchema = exports.PermissionAssociationsSchema = exports.PermissionIdPropertySchema = exports.PermissionIdSchema = exports.PermissionStatus = void 0;
+exports.PermissionAssociationReferenceSchema = exports.UpdatePermissionPayloadSchema = exports.InsertPermissionPayloadSchema = exports.PermissionPayloadSchema = exports.PermissionSchema = exports.PermissionAssociationsSchema = exports.PermissionIdPropertySchema = exports.PermissionStatus = void 0;
 const arktype_1 = require("arktype");
+const schema_js_1 = require("../../app/schema.js");
 const index_js_1 = require("../../common/index.js");
 const aggregate_js_1 = require("../../common/schema/aggregate.js");
 const metadata_js_1 = require("../../common/schema/metadata.js");
-const utils_js_1 = require("../utils.js");
+const schema_js_2 = require("../schema.js");
 exports.PermissionStatus = {
     ENABLED: 'enabled',
     DISABLED: 'disabled',
 };
-exports.PermissionIdSchema = arktype_1.type.string;
 exports.PermissionIdPropertySchema = (0, arktype_1.type)({
-    id: exports.PermissionIdSchema,
+    id: schema_js_2.PermissionIdSchema,
 });
 const PermissionStatusSchema = arktype_1.type.enumerated(exports.PermissionStatus.ENABLED, exports.PermissionStatus.DISABLED);
-const AssociationSchema = (0, arktype_1.type)('string[] | undefined');
 exports.PermissionAssociationsSchema = (0, arktype_1.type)({
-    apps: AssociationSchema.optional(),
-    roles: AssociationSchema.optional(),
+    apps: schema_js_1.AppIdAssociationsSchema.optional(),
+    roles: schema_js_2.RoleIdAssociationsSchema.optional(),
 });
 const BaseSchema = exports.PermissionIdPropertySchema.and({
     name: (0, arktype_1.type)('string'),
@@ -45,13 +44,13 @@ exports.PermissionPayloadSchema = BaseSchema.and({
  * Insert
  */
 exports.InsertPermissionPayloadSchema = (0, arktype_1.type)({
-    id: exports.PermissionIdSchema.default(() => (0, utils_js_1.generatePermissionId)()),
+    id: schema_js_2.PermissionIdSchema.default(() => (0, schema_js_2.generatePermissionId)()),
     name: (0, arktype_1.type)('string'),
     status: PermissionStatusSchema.default(exports.PermissionStatus.ENABLED),
     description: (0, arktype_1.type)('string').optional(),
 })
     .and(exports.PermissionAssociationsSchema)
-    .and(metadata_js_1.UpsertMetadataPayloadPropertySchema);
+    .and(metadata_js_1.UpsertMetadataPropertyPayloadSchema);
 /**
  * Update
  */
@@ -59,7 +58,7 @@ exports.UpdatePermissionPayloadSchema = (0, arktype_1.type)({
     name: (0, arktype_1.type)('string').optional(),
     status: PermissionStatusSchema.optional(),
     description: (0, arktype_1.type)('string').optional(),
-}).and(metadata_js_1.UpsertMetadataPayloadPropertySchema);
+}).and(metadata_js_1.UpsertMetadataPropertyPayloadSchema);
 /**
  * Association
  */

package/dist/cjs/authorization/permissions/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/cjs/authorization/permissions/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../src/authorization/permissions/schema.test.ts"],"names":[],"mappings":""}

package/dist/cjs/authorization/permissions/schema.test.js

@@ -0,0 +1,217 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const arktype_1 = require("arktype");
+const vitest_1 = require("vitest");
+const utils_js_1 = require("../../app/utils.js");
+const schema_js_1 = require("../schema.js");
+const schema_js_2 = require("./schema.js");
+(0, vitest_1.describe)('Authorization Permissions - Schema', () => {
+    (0, vitest_1.describe)('PermissionStatus constants', () => {
+        (0, vitest_1.test)('should have correct status values', () => {
+            (0, vitest_1.expect)(schema_js_2.PermissionStatus.ENABLED).toBe('enabled');
+            (0, vitest_1.expect)(schema_js_2.PermissionStatus.DISABLED).toBe('disabled');
+        });
+    });
+    (0, vitest_1.describe)('PermissionIdSchema', () => {
+        (0, vitest_1.test)('should accept valid string ID', () => {
+            const result = (0, schema_js_1.PermissionIdSchema)((0, schema_js_1.generatePermissionId)());
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject non-string values', () => {
+            (0, vitest_1.expect)((0, schema_js_1.PermissionIdSchema)(123)).toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)((0, schema_js_1.PermissionIdSchema)(null)).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+    (0, vitest_1.describe)('PermissionIdPropertySchema', () => {
+        (0, vitest_1.test)('should accept valid id property', () => {
+            const payload = { id: (0, schema_js_1.generatePermissionId)() };
+            const result = (0, schema_js_2.PermissionIdPropertySchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual({ id: payload.id });
+        });
+        (0, vitest_1.test)('should reject missing id', () => {
+            const result = (0, schema_js_2.PermissionIdPropertySchema)({});
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+    (0, vitest_1.describe)('PermissionAssociationsSchema', () => {
+        const payload = {
+            apps: [(0, utils_js_1.generateAppId)(), (0, utils_js_1.generateAppId)()],
+            roles: [(0, schema_js_1.generateRoleId)(), (0, schema_js_1.generateRoleId)()],
+        };
+        (0, vitest_1.test)('should accept valid associations', () => {
+            const result = (0, schema_js_2.PermissionAssociationsSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual({
+                apps: payload.apps,
+                roles: payload.roles,
+            });
+        });
+        (0, vitest_1.test)('should accept optional associations', () => {
+            const result = (0, schema_js_2.PermissionAssociationsSchema)({});
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual({});
+        });
+        (0, vitest_1.test)('should accept undefined associations', () => {
+            const result = (0, schema_js_2.PermissionAssociationsSchema)({
+                apps: undefined,
+                roles: [(0, schema_js_1.generateRoleId)()],
+            });
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject non-array associations', () => {
+            const result = (0, schema_js_2.PermissionAssociationsSchema)({
+                apps: 'not-an-array',
+            });
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+    (0, vitest_1.describe)('PermissionSchema', () => {
+        (0, vitest_1.test)('should accept complete permission object', () => {
+            const permission = {
+                id: (0, schema_js_1.generatePermissionId)(),
+                name: 'read:users',
+                status: 'enabled',
+                description: 'Read user data',
+                apps: { ids: [(0, utils_js_1.generateAppId)()], count: 1 },
+                roles: { ids: [(0, schema_js_1.generateRoleId)()], count: 1 },
+                createdAt: new Date(),
+                updatedAt: new Date(),
+                metadata: { key: 'value' },
+            };
+            const result = (0, schema_js_2.PermissionSchema)(permission);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should accept minimal permission object', () => {
+            const permission = {
+                id: (0, schema_js_1.generatePermissionId)(),
+                name: 'read:users',
+                status: 'enabled',
+                createdAt: new Date(),
+                updatedAt: new Date(),
+                metadata: {},
+            };
+            const result = (0, schema_js_2.PermissionSchema)(permission);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid status', () => {
+            const permission = {
+                id: (0, schema_js_1.generatePermissionId)(),
+                name: 'read:users',
+                status: 'invalid',
+                createdAt: new Date(),
+                updatedAt: new Date(),
+                metadata: {},
+            };
+            const result = (0, schema_js_2.PermissionSchema)(permission);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject missing required fields', () => {
+            const permission = {
+                id: (0, schema_js_1.generatePermissionId)(),
+                name: 'read:users',
+            };
+            const result = (0, schema_js_2.PermissionSchema)(permission);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+    (0, vitest_1.describe)('InsertPermissionPayloadSchema', () => {
+        (0, vitest_1.test)('should accept complete insert payload', () => {
+            const payload = {
+                id: (0, schema_js_1.generatePermissionId)(),
+                name: 'read:users',
+                status: 'enabled',
+                description: 'Read user data',
+                apps: [(0, utils_js_1.generateAppId)()],
+                roles: [(0, schema_js_1.generateRoleId)()],
+                metadata: { key: 'value' },
+            };
+            const result = (0, schema_js_2.InsertPermissionPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should accept minimal insert payload', () => {
+            const payload = {
+                name: 'read:users',
+            };
+            const result = (0, schema_js_2.InsertPermissionPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result.status).toBe('enabled'); // default value
+        });
+        (0, vitest_1.test)('should generate default ID when not provided', () => {
+            const payload = { name: 'read:users' };
+            const result = (0, schema_js_2.InsertPermissionPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result.id).toMatch(/^per_/);
+        });
+        (0, vitest_1.test)('should reject missing name', () => {
+            const result = (0, schema_js_2.InsertPermissionPayloadSchema)({});
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+    (0, vitest_1.describe)('UpdatePermissionPayloadSchema', () => {
+        (0, vitest_1.test)('should accept all optional fields', () => {
+            const payload = {
+                name: 'updated:permission',
+                status: 'disabled',
+                description: 'Updated description',
+                metadata: { updated: true },
+            };
+            const result = (0, schema_js_2.UpdatePermissionPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual(payload);
+        });
+        (0, vitest_1.test)('should accept empty update payload', () => {
+            const result = (0, schema_js_2.UpdatePermissionPayloadSchema)({});
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual({});
+        });
+        (0, vitest_1.test)('should accept partial updates', () => {
+            const payload = { name: 'new:name' };
+            const result = (0, schema_js_2.UpdatePermissionPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual(payload);
+        });
+        (0, vitest_1.test)('should reject invalid status', () => {
+            const payload = { status: 'invalid-status' };
+            const result = (0, schema_js_2.UpdatePermissionPayloadSchema)(payload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+    (0, vitest_1.describe)('PermissionAssociationReferenceSchema', () => {
+        (0, vitest_1.test)('should accept complete association reference', () => {
+            const reference = {
+                id: (0, schema_js_1.generatePermissionId)(),
+                name: 'read:users',
+                status: 'enabled',
+                model: 'Permission',
+            };
+            const result = (0, schema_js_2.PermissionAssociationReferenceSchema)(reference);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result).toEqual(reference);
+        });
+        (0, vitest_1.test)('should use default status when not provided', () => {
+            const reference = {
+                id: (0, schema_js_1.generatePermissionId)(),
+                name: 'read:users',
+                model: 'Permission',
+            };
+            const result = (0, schema_js_2.PermissionAssociationReferenceSchema)(reference);
+            (0, vitest_1.expect)(result).not.toBeInstanceOf(arktype_1.type.errors);
+            (0, vitest_1.expect)(result.status).toBe('disabled'); // default value
+        });
+        (0, vitest_1.test)('should reject missing required fields', () => {
+            const reference = { id: (0, schema_js_1.generatePermissionId)() };
+            const result = (0, schema_js_2.PermissionAssociationReferenceSchema)(reference);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid model value', () => {
+            const reference = {
+                id: (0, schema_js_1.generatePermissionId)(),
+                name: 'read:users',
+                model: 'InvalidModel',
+            };
+            const result = (0, schema_js_2.PermissionAssociationReferenceSchema)(reference);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+});

package/dist/cjs/authorization/roles/schema.d.ts

@@ -34,7 +34,7 @@ export declare const RoleSchema: import("arktype/out/methods/object.js").ObjectT
     updatedAt: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>);
     deletedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
     deactivatedAt?: Date | ((In: string) => import("arktype/out/attributes.js").To<Date>) | undefined;
-    metadata: (In: import("arktype/out/attributes.js").Default<unknown, Map<string, string | number | boolean>>) => import("arktype").Out<Map<string, string | number | boolean> | Map<string, any>>;
+    metadata: (In: import("arktype/out/attributes.js").Default<unknown, Map<string, string | number | boolean>>) => import("arktype").Out<Map<string, string | number | boolean>>;
 }, {}>;
 export type RoleProperties = typeof RoleSchema.inferIn;
 export type Role = typeof RoleSchema.inferOut;
@@ -81,7 +81,7 @@ export declare const InsertRolePayloadSchema: import("arktype/out/methods/object
         [x: string]: string | number | boolean;
     } | Map<string, string | number | boolean> | null | undefined) => import("arktype").Out<{
         [x: string]: string | number | boolean;
-    } | undefined>) | undefined;
+    } | null>) | undefined;
 }, {}>;
 export type InsertRoleInput = typeof InsertRolePayloadSchema.inferIn;
 export type InsertRolePayload = typeof InsertRolePayloadSchema.inferOut;
@@ -96,7 +96,7 @@ export declare const UpdateRolePayloadSchema: import("arktype/out/methods/object
         [x: string]: string | number | boolean;
     } | Map<string, string | number | boolean> | null | undefined) => import("arktype").Out<{
         [x: string]: string | number | boolean;
-    } | undefined>) | undefined;
+    } | null>) | undefined;
 }, {}>;
 export type UpdateRoleInput = typeof UpdateRolePayloadSchema.inferIn;
 export type UpdateRolePayload = typeof UpdateRolePayloadSchema.inferOut;

package/dist/cjs/authorization/roles/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/authorization/roles/schema.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,UAAU;;;CAGb,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAIzE,eAAO,MAAM,oBAAoB;;MAE/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,oBAAoB,CAAC,QAAQ,CAAC;AAMlE,eAAO,MAAM,sBAAsB;;;;MAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,sBAAsB,CAAC,QAAQ,CAAC;AAWtE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;MAOU,CAAC;AAClC,MAAM,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,OAAO,CAAC;AACvD,MAAM,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,QAAQ,CAAC;AAE9C,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;MAOO,CAAC;AACtC,MAAM,MAAM,WAAW,GAAG,OAAO,iBAAiB,CAAC,QAAQ,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;MAOC,CAAC;AACtC,MAAM,MAAM,eAAe,GAAG,OAAO,uBAAuB,CAAC,OAAO,CAAC;AACrE,MAAM,MAAM,iBAAiB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;MAIC,CAAC;AACtC,MAAM,MAAM,eAAe,GAAG,OAAO,uBAAuB,CAAC,OAAO,CAAC;AACrE,MAAM,MAAM,iBAAiB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,8BAA8B;;;;;MAIzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAClC,OAAO,8BAA8B,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/authorization/roles/schema.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,UAAU;;;CAGb,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAEzE,eAAO,MAAM,oBAAoB;;MAE/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,oBAAoB,CAAC,QAAQ,CAAC;AAIlE,eAAO,MAAM,sBAAsB;;;;MAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,sBAAsB,CAAC,QAAQ,CAAC;AAWtE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;MAOU,CAAC;AAClC,MAAM,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,OAAO,CAAC;AACvD,MAAM,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,QAAQ,CAAC;AAE9C,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;MAOO,CAAC;AACtC,MAAM,MAAM,WAAW,GAAG,OAAO,iBAAiB,CAAC,QAAQ,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;MAOO,CAAC;AAC5C,MAAM,MAAM,eAAe,GAAG,OAAO,uBAAuB,CAAC,OAAO,CAAC;AACrE,MAAM,MAAM,iBAAiB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;MAIO,CAAC;AAC5C,MAAM,MAAM,eAAe,GAAG,OAAO,uBAAuB,CAAC,OAAO,CAAC;AACrE,MAAM,MAAM,iBAAiB,GAAG,OAAO,uBAAuB,CAAC,QAAQ,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,8BAA8B;;;;;MAIzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAClC,OAAO,8BAA8B,CAAC,QAAQ,CAAC"}

package/dist/cjs/authorization/roles/schema.js

@@ -2,24 +2,24 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RoleAssociationReferenceSchema = exports.UpdateRolePayloadSchema = exports.InsertRolePayloadSchema = exports.RolePayloadSchema = exports.RoleSchema = exports.RoleAssociationsSchema = exports.RoleIdPropertySchema = exports.RoleStatus = void 0;
 const arktype_1 = require("arktype");
+const schema_js_1 = require("../../app/schema.js");
 const index_js_1 = require("../../common/index.js");
 const aggregate_js_1 = require("../../common/schema/aggregate.js");
 const metadata_js_1 = require("../../common/schema/metadata.js");
-const utils_js_1 = require("../utils.js");
+const schema_js_2 = require("../../customer/schema.js");
+const schema_js_3 = require("../schema.js");
 exports.RoleStatus = {
     ENABLED: 'enabled',
     DISABLED: 'disabled',
 };
-const RoleIdSchema = arktype_1.type.string;
 exports.RoleIdPropertySchema = (0, arktype_1.type)({
-    id: RoleIdSchema,
+    id: schema_js_3.RoleIdSchema,
 });
 const StatusSchema = arktype_1.type.enumerated(exports.RoleStatus.ENABLED, exports.RoleStatus.DISABLED);
-const AssociationSchema = (0, arktype_1.type)('string[] | undefined');
 exports.RoleAssociationsSchema = (0, arktype_1.type)({
-    apps: AssociationSchema.optional(),
-    permissions: AssociationSchema.optional(),
-    users: AssociationSchema.optional(),
+    apps: schema_js_1.AppIdAssociationsSchema.optional(),
+    permissions: schema_js_3.PermissionIdAssociationsSchema.optional(),
+    users: schema_js_2.UserIdAssociationsSchema.optional(),
 });
 const BaseSchema = exports.RoleIdPropertySchema.and({
     name: (0, arktype_1.type)('string'),
@@ -49,13 +49,13 @@ exports.RolePayloadSchema = BaseSchema.and({
  * Insert
  */
 exports.InsertRolePayloadSchema = (0, arktype_1.type)({
-    id: RoleIdSchema.default(() => (0, utils_js_1.generateRoleId)()),
+    id: schema_js_3.RoleIdSchema.default(() => (0, schema_js_3.generateRoleId)()),
     name: (0, arktype_1.type)('string'),
     status: StatusSchema.default(exports.RoleStatus.ENABLED),
     description: (0, arktype_1.type)('string').optional(),
 })
     .and(exports.RoleAssociationsSchema)
-    .and(metadata_js_1.MetadataPayloadPropertySchema);
+    .and(metadata_js_1.UpsertMetadataPropertyPayloadSchema);
 /**
  * Update
  */
@@ -63,7 +63,7 @@ exports.UpdateRolePayloadSchema = (0, arktype_1.type)({
     name: (0, arktype_1.type)('string').optional(),
     status: StatusSchema.optional(),
     description: (0, arktype_1.type)('string').optional(),
-}).and(metadata_js_1.MetadataPayloadPropertySchema);
+}).and(metadata_js_1.UpsertMetadataPropertyPayloadSchema);
 /**
  * Association
  */

package/dist/cjs/authorization/roles/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/cjs/authorization/roles/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../src/authorization/roles/schema.test.ts"],"names":[],"mappings":""}