@go-mondo/identity-sdk 0.0.2-beta.9 → 0.0.2-beta.91

package/dist/esm/oauth/token/schema/grants/client-credentials.js

@@ -1,22 +1,26 @@
-import { type } from 'arktype';
-import { AppIdSchema } from '../../../../app/schema.js';
-import { GrantType, OptionalSchema } from '../../../common/schema.js';
+import * as z from 'zod/v4';
+import { GrantType, OptionalSchema, ScopeStringSchema, } from '../../../common/schema.js';
+import { ClientRequestSchema } from './common.js';
 /**
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.2
  */
-const GrantTypeSchema = type.enumerated(GrantType.CLIENT_CREDENTIALS);
+const GrantTypeSchema = z.enum([GrantType.CLIENT_CREDENTIALS]);
 /**
- * What the incoming body may look like.
+ * Note: Prior to using this schema, the headers should be checked for
+ * HTTP Basic Authentication. If present, the client_id and client_secret
+ * should be included in with the payload before parsing.
  *
- * Note: the client_id and client_secrete may (likely) be in Authorization header
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.2
  */
-export const ClientCredentialsPayloadSchema = type({
-    grant_type: GrantTypeSchema,
-    scope: type('string').optional(),
-    client_id: AppIdSchema.optional(),
-    client_secret: type('string').optional(),
-}).and(OptionalSchema);
-export const ClientCredentialsSchema = ClientCredentialsPayloadSchema.omit('client_id', 'client_secret').and({
-    client_id: AppIdSchema,
-    client_secret: type('string'),
+export const ClientCredentialsGrantTokenSchema = z.object({
+    /**
+     * REQUIRED. Value MUST be set to "client_credentials".
+     */
+    grant_type: GrantTypeSchema.describe('The grant type.'),
+    /**
+     * OPTIONAL. The scope of the access request.
+     */
+    scope: ScopeStringSchema.optional(),
+    ...ClientRequestSchema.shape,
+    ...OptionalSchema.shape,
 });

package/dist/esm/oauth/token/schema/grants/common.d.ts

@@ -0,0 +1,6 @@
+import * as z from 'zod/v4';
+export declare const ClientRequestSchema: z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+}, z.core.$strip>;
+//# sourceMappingURL=common.d.ts.map

package/dist/esm/oauth/token/schema/grants/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/common.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,mBAAmB;;;iBAc9B,CAAC"}

package/dist/esm/oauth/token/schema/grants/common.js

@@ -0,0 +1,16 @@
+import * as z from 'zod/v4';
+import { AppIdSchema } from '../../../../app/schema.js';
+export const ClientRequestSchema = z.object({
+    /**
+     * REQUIRED. The client identifier.
+     * NOTE: This is only required in the body if the client is NOT authenticating
+     * via the HTTP "Authorization" header (Basic Auth).
+     */
+    client_id: AppIdSchema.describe('The Client ID.'),
+    /**
+     * REQUIRED. The client secret.
+     * NOTE: This is only required in the body if the client is NOT authenticating
+     * via the HTTP "Authorization" header (Basic Auth).
+     */
+    client_secret: z.string().min(1).describe('The Client Secret.'),
+});

package/dist/esm/oauth/token/schema/grants/refresh-token.d.ts

@@ -1,9 +1,16 @@
-export declare const RefreshTokenSchema: import("arktype/internal/methods/object.ts").ObjectType<{
-    grant_type: "refresh_token";
-    refresh_token: string;
-    client_id: string;
-    client_secret: string;
-    scope?: string | undefined;
-}, {}>;
-export type RefreshTokenPayload = typeof RefreshTokenSchema.inferOut;
+import * as z from 'zod/v4';
+/**
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+ */
+export declare const RefreshTokenGrantTokenSchema: z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    grant_type: z.ZodEnum<{
+        refresh_token: "refresh_token";
+    }>;
+    refresh_token: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type RefreshTokenGrantTokenInput = z.input<typeof RefreshTokenGrantTokenSchema>;
+export type RefreshTokenGrantToken = z.output<typeof RefreshTokenGrantTokenSchema>;
 //# sourceMappingURL=refresh-token.d.ts.map

package/dist/esm/oauth/token/schema/grants/refresh-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/refresh-token.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,kBAAkB;;;;;;MAM7B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,kBAAkB,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../../../../src/oauth/token/schema/grants/refresh-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAS5B;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;iBAmBvC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,4BAA4B,CACpC,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAC3C,OAAO,4BAA4B,CACpC,CAAC"}

package/dist/esm/oauth/token/schema/grants/refresh-token.js

@@ -1,14 +1,27 @@
-import { type } from 'arktype';
-import { AppIdSchema } from '../../../../app/schema.js';
-import { GrantType } from '../../../common/schema.js';
+import * as z from 'zod/v4';
+import { GrantType, ScopeStringSchema } from '../../../common/schema.js';
+import { ClientRequestSchema } from './common.js';
 /**
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
  */
-const GrantTypeSchema = type.enumerated(GrantType.REFRESH_TOKEN);
-export const RefreshTokenSchema = type({
-    grant_type: GrantTypeSchema,
-    refresh_token: type('string'),
-    scope: type('string').optional(),
-    client_id: AppIdSchema,
-    client_secret: type('string'),
+const GrantTypeSchema = z.enum([GrantType.REFRESH_TOKEN]);
+/**
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+ */
+export const RefreshTokenGrantTokenSchema = z.object({
+    /**
+     * REQUIRED. Value MUST be set to "refresh_token".
+     */
+    grant_type: GrantTypeSchema.describe('The grant type.'),
+    /**
+     * REQUIRED. The refresh token issued to the client.
+     */
+    refresh_token: z.string().min(1).describe('The refresh token.'),
+    /**
+     * OPTIONAL. The scope of the access request. If omitted, the scope is
+     * unchanged from the original grant. If specified, it must be equal to or
+     * a subset of the original scope.
+     */
+    scope: ScopeStringSchema.optional(),
+    ...ClientRequestSchema.shape,
 });

package/dist/esm/oauth/token/schema/schema.d.ts

@@ -1,28 +1,55 @@
+import * as z from 'zod/v4';
 export * from './grants/authorization-code.js';
 export * from './grants/client-credentials.js';
 export * from './grants/refresh-token.js';
 /**
  * Union(s)
  */
-export declare const Schema: import("arktype/internal/methods/object.ts").ObjectType<{
-    grant_type: "authorization_code";
-    code: string;
-    client_id: string;
-    redirect_uri: string;
-    client_secret?: string | undefined;
-    code_verifier?: string | undefined;
-} | {
-    grant_type: "client_credentials";
-    scope?: string | undefined;
-    audience?: string | undefined;
-    client_id: string;
-    client_secret: string;
-} | {
-    grant_type: "refresh_token";
-    refresh_token: string;
-    client_id: string;
-    client_secret: string;
-    scope?: string | undefined;
-}, {}>;
-export type Payload = typeof Schema.inferOut;
+export declare const TokenGrantSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    code_verifier: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    grant_type: z.ZodEnum<{
+        authorization_code: "authorization_code";
+    }>;
+    code: z.ZodString;
+    redirect_uri: z.ZodOptional<z.ZodURL>;
+}, z.core.$strip>, z.ZodObject<{
+    audience: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    grant_type: z.ZodEnum<{
+        client_credentials: "client_credentials";
+    }>;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    grant_type: z.ZodEnum<{
+        refresh_token: "refresh_token";
+    }>;
+    refresh_token: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "grant_type">;
+export type TokenGrantInput = z.input<typeof TokenGrantSchema>;
+export type TokenGrant = z.output<typeof TokenGrantSchema>;
+export declare const TokenSchema: z.ZodObject<{
+    access_token: z.ZodString;
+    token_type: z.ZodDefault<z.ZodLiteral<"Bearer">>;
+    expires_in: z.ZodOptional<z.ZodNumber>;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    id_token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type TokenInput = z.input<typeof TokenSchema>;
+export type Token = z.output<typeof TokenSchema>;
+export declare const ImplicitTokenSchema: z.ZodObject<{
+    access_token: z.ZodOptional<z.ZodString>;
+    id_token: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    token_type: z.ZodDefault<z.ZodLiteral<"Bearer">>;
+    expires_in: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type ImplicitTokenInput = z.input<typeof ImplicitTokenSchema>;
+export type ImplicitToken = z.output<typeof ImplicitTokenSchema>;
 //# sourceMappingURL=schema.d.ts.map

package/dist/esm/oauth/token/schema/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../src/oauth/token/schema/schema.ts"],"names":[],"mappings":"AAIA,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;MAElB,CAAC;AACF,MAAM,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../src/oauth/token/schema/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAO5B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;iCAI3B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC/D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAK3D,eAAO,MAAM,WAAW;;;;;;;iBA8CtB,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACrD,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAEjD,eAAO,MAAM,mBAAmB;;;;;;iBAG9B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACrE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/esm/oauth/token/schema/schema.js

@@ -1,10 +1,65 @@
-import { AuthorizationCodeSchema } from './grants/authorization-code.js';
-import { ClientCredentialsSchema } from './grants/client-credentials.js';
-import { RefreshTokenSchema } from './grants/refresh-token.js';
+import * as z from 'zod/v4';
+import { ScopeStringSchema } from '../../common/schema.js';
+import { AuthorizationCodeGrantTokenSchema } from './grants/authorization-code.js';
+import { ClientCredentialsGrantTokenSchema } from './grants/client-credentials.js';
+import { RefreshTokenGrantTokenSchema } from './grants/refresh-token.js';
 export * from './grants/authorization-code.js';
 export * from './grants/client-credentials.js';
 export * from './grants/refresh-token.js';
 /**
  * Union(s)
  */
-export const Schema = AuthorizationCodeSchema.or(ClientCredentialsSchema).or(RefreshTokenSchema);
+export const TokenGrantSchema = z.discriminatedUnion('grant_type', [
+    AuthorizationCodeGrantTokenSchema,
+    ClientCredentialsGrantTokenSchema,
+    RefreshTokenGrantTokenSchema,
+]);
+/*
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
+ */
+export const TokenSchema = z.object({
+    /**
+     * REQUIRED. The access token issued by the authorization server.
+     * Typically a JWT or an opaque string.
+     */
+    access_token: z
+        .string()
+        .min(1)
+        .describe('The access token issued by the authorization server.'),
+    /**
+     * REQUIRED. The type of the token issued. Value is typically 'Bearer'.
+     */
+    token_type: z
+        .literal('Bearer')
+        .default('Bearer')
+        .describe('The type of the token issued. Must be "Bearer".'),
+    /**
+     * RECOMMENDED. The lifetime in seconds of the access token.
+     * For example, the value 3600 represents an expiration time of one hour.
+     */
+    expires_in: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe('The lifetime in seconds of the access token.'),
+    /**
+     * OPTIONAL. The refresh token, which can be used to obtain a new access token
+     * when the current one expires.
+     */
+    refresh_token: z.string().min(1).optional().describe('The refresh token.'),
+    /**
+     * OPTIONAL. The scope of the access token as issued by the authorization server.
+     * If omitted, the scope is the same as the scope originally requested by the client.
+     */
+    scope: ScopeStringSchema.optional(),
+    /**
+     * OPTIONAL, for OpenID Connect (OIDC). The ID token, a JWT that contains claims
+     * about the authentication of the end-user.
+     */
+    id_token: z.string().min(1).optional().describe('The ID Token (OIDC only).'),
+});
+export const ImplicitTokenSchema = z.object({
+    ...TokenSchema.omit({ refresh_token: true, access_token: true }).shape,
+    ...TokenSchema.pick({ access_token: true }).partial().shape,
+});

package/dist/esm/oauth/token/schema/schema.test.js

@@ -1,7 +1,6 @@
-import { type } from 'arktype';
 import { describe, expect, test } from 'vitest';
 import { generateAppId } from '../../../app/utils.js';
-import { Schema } from './schema.js';
+import { TokenGrantSchema } from './schema.js';
 describe('OAuth Token - Schema', () => {
     describe('Schema union', () => {
         test('should accept authorization code grant', () => {
@@ -9,23 +8,31 @@ describe('OAuth Token - Schema', () => {
                 grant_type: 'authorization_code',
                 code: 'auth_code_123',
                 client_id: generateAppId(),
+                client_secret: 'secret_123',
                 redirect_uri: 'https://example.com/callback',
             };
-            const result = Schema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result).toEqual(payload);
+            const result = TokenGrantSchema.safeParse(payload);
+            // Parse succeeds for valid data
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data).toEqual(payload);
+            }
         });
         test('should accept authorization code with PKCE', () => {
             const payload = {
                 grant_type: 'authorization_code',
                 code: 'auth_code_123',
                 client_id: generateAppId(),
+                client_secret: 'secret_123',
                 redirect_uri: 'https://example.com/callback',
                 code_verifier: 'pkce_verifier_123',
             };
-            const result = Schema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result).toEqual(payload);
+            const result = TokenGrantSchema.safeParse(payload);
+            // Parse succeeds for valid data
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data).toEqual(payload);
+            }
         });
         test('should accept authorization code with client secret', () => {
             const payload = {
@@ -35,9 +42,12 @@ describe('OAuth Token - Schema', () => {
                 client_secret: 'secret_123',
                 redirect_uri: 'https://example.com/callback',
             };
-            const result = Schema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result).toEqual(payload);
+            const result = TokenGrantSchema.safeParse(payload);
+            // Parse succeeds for valid data
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data).toEqual(payload);
+            }
         });
         test('should accept client credentials grant', () => {
             const payload = {
@@ -46,9 +56,12 @@ describe('OAuth Token - Schema', () => {
                 client_secret: 'secret_123',
                 scope: 'read write',
             };
-            const result = Schema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result).toEqual(payload);
+            const result = TokenGrantSchema.safeParse(payload);
+            // Parse succeeds for valid data
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data).toEqual(payload);
+            }
         });
         test('should accept refresh token grant', () => {
             const payload = {
@@ -58,9 +71,12 @@ describe('OAuth Token - Schema', () => {
                 client_secret: 'secret_123',
                 scope: 'read',
             };
-            const result = Schema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result).toEqual(payload);
+            const result = TokenGrantSchema.safeParse(payload);
+            // Parse succeeds for valid data
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data).toEqual(payload);
+            }
         });
         test('should reject invalid grant type', () => {
             const payload = {
@@ -69,8 +85,8 @@ describe('OAuth Token - Schema', () => {
                 client_id: generateAppId(),
                 redirect_uri: 'https://example.com/callback',
             };
-            const result = Schema(payload);
-            expect(result).toBeInstanceOf(type.errors);
+            const result = TokenGrantSchema.safeParse(payload);
+            expect(result.success).toBe(false);
         });
         test('should reject authorization code without required fields', () => {
             const payload = {
@@ -78,8 +94,8 @@ describe('OAuth Token - Schema', () => {
                 client_id: generateAppId(),
                 // missing code and redirect_uri
             };
-            const result = Schema(payload);
-            expect(result).toBeInstanceOf(type.errors);
+            const result = TokenGrantSchema.safeParse(payload);
+            expect(result.success).toBe(false);
         });
         test('should reject invalid redirect URI', () => {
             const payload = {
@@ -88,8 +104,8 @@ describe('OAuth Token - Schema', () => {
                 client_id: generateAppId(),
                 redirect_uri: 'not-a-valid-url',
             };
-            const result = Schema(payload);
-            expect(result).toBeInstanceOf(type.errors);
+            const result = TokenGrantSchema.safeParse(payload);
+            expect(result.success).toBe(false);
         });
         test('should reject client credentials without required fields', () => {
             const payload = {
@@ -97,8 +113,8 @@ describe('OAuth Token - Schema', () => {
                 client_id: generateAppId(),
                 // missing client_secret
             };
-            const result = Schema(payload);
-            expect(result).toBeInstanceOf(type.errors);
+            const result = TokenGrantSchema.safeParse(payload);
+            expect(result.success).toBe(false);
         });
         test('should reject refresh token without required fields', () => {
             const payload = {
@@ -106,15 +122,15 @@ describe('OAuth Token - Schema', () => {
                 client_id: 'app_123',
                 // missing refresh_token and client_secret
             };
-            const result = Schema(payload);
-            expect(result).toBeInstanceOf(type.errors);
+            const result = TokenGrantSchema.safeParse(payload);
+            expect(result.success).toBe(false);
         });
         test('should reject completely invalid payload', () => {
             const payload = {
                 invalid: 'data',
             };
-            const result = Schema(payload);
-            expect(result).toBeInstanceOf(type.errors);
+            const result = TokenGrantSchema.safeParse(payload);
+            expect(result.success).toBe(false);
         });
     });
 });

package/dist/esm/workspace/authorization/schema.d.ts

@@ -1,31 +1,66 @@
+import * as z from 'zod/v4';
 export declare const DEFAULT_SESSION_DURATION: number;
 export declare const DEFAULT_REFRESH_TOKEN_DURATION: number;
 export declare const DEFAULT_ACCESS_TOKEN_DURATION: number;
-export declare const AuthorizationPayloadSchema: import("arktype/internal/methods/object.ts").ObjectType<{
-    sessionDuration: import("arktype/internal/attributes.ts").Default<number, number>;
-    refreshTokenDuration: import("arktype/internal/attributes.ts").Default<number, number>;
-    accessTokenDuration: import("arktype/internal/attributes.ts").Default<number, number>;
-    accessTokenSignatureAlgorithm: import("arktype/internal/attributes.ts").Default<string, string>;
-    updatedAt?: ((In: string | Date | undefined) => import("arktype").Out<string | undefined>) | undefined;
-    deletedAt?: ((In: string | Date | undefined) => import("arktype").Out<string | undefined>) | undefined;
-    deactivatedAt?: ((In: string | Date | undefined) => import("arktype").Out<string | undefined>) | undefined;
-    metadata?: ((In: {
-        [x: string]: string | number | boolean;
-    } | Map<string, string | number | boolean> | null | undefined) => import("arktype").Out<{
-        [x: string]: string | number | boolean;
-    } | undefined>) | undefined;
-}, {}>;
-export type AuthorizationPayload = typeof AuthorizationPayloadSchema.inferOut;
-export declare const UpsertAuthorizationPayloadSchema: import("arktype/internal/methods/object.ts").ObjectType<{
-    sessionDuration: import("arktype/internal/attributes.ts").Default<number, number>;
-    refreshTokenDuration: import("arktype/internal/attributes.ts").Default<number, number>;
-    accessTokenDuration: import("arktype/internal/attributes.ts").Default<number, number>;
-    accessTokenSignatureAlgorithm: import("arktype/internal/attributes.ts").Default<string, string>;
-    metadata?: ((In: {
-        [x: string]: string | number | boolean;
-    } | Map<string, string | number | boolean> | null | undefined) => import("arktype").Out<{
-        [x: string]: string | number | boolean;
-    } | undefined>) | undefined;
-}, {}>;
-export type UpsertAuthorizationPayload = typeof UpsertAuthorizationPayloadSchema.inferOut;
+export declare const AuthorizationSchema: z.ZodObject<{
+    metadata: z.ZodPipe<z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodNull, z.ZodMap<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>, z.ZodTransform<import("../../common/schema/metadata.js").MetadataMap, Record<string, string | number | boolean> | Map<string, string | number | boolean> | null | undefined>>>, z.ZodTransform<import("../../common/schema/metadata.js").MetadataMap, import("../../common/schema/metadata.js").MetadataMap | undefined>>;
+    deactivatedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>;
+    deletedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>;
+    updatedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>;
+    sessionDuration: z.ZodDefault<z.ZodNumber>;
+    refreshTokenDuration: z.ZodDefault<z.ZodNumber>;
+    accessTokenDuration: z.ZodDefault<z.ZodNumber>;
+    accessTokenSignatureAlgorithm: z.ZodDefault<z.ZodEnum<{
+        RS256: "RS256";
+        RS384: "RS384";
+        RS512: "RS512";
+        ES256: "ES256";
+        ES384: "ES384";
+        ES512: "ES512";
+        PS256: "PS256";
+        PS384: "PS384";
+        PS512: "PS512";
+    }>>;
+}, z.core.$strip>;
+export type AuthorizationProperties = z.input<typeof AuthorizationSchema>;
+export type Authorization = z.output<typeof AuthorizationSchema>;
+export declare const AuthorizationPayloadSchema: z.ZodObject<{
+    metadata: z.ZodPipe<z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodNull, z.ZodMap<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>, z.ZodTransform<import("../../common/schema/metadata.js").MetadataRecord, Record<string, string | number | boolean> | Map<string, string | number | boolean> | null | undefined>>>, z.ZodTransform<import("../../common/schema/metadata.js").MetadataRecord | undefined, import("../../common/schema/metadata.js").MetadataRecord | undefined>>;
+    deactivatedAt: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>, z.ZodTransform<string | undefined, Date | undefined>>>;
+    deletedAt: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>, z.ZodTransform<string | undefined, Date | undefined>>>;
+    updatedAt: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodDate, z.ZodPipe<z.ZodString, z.ZodTransform<Date, string>>]>>, z.ZodTransform<string | undefined, Date | undefined>>>;
+    sessionDuration: z.ZodDefault<z.ZodNumber>;
+    refreshTokenDuration: z.ZodDefault<z.ZodNumber>;
+    accessTokenDuration: z.ZodDefault<z.ZodNumber>;
+    accessTokenSignatureAlgorithm: z.ZodDefault<z.ZodEnum<{
+        RS256: "RS256";
+        RS384: "RS384";
+        RS512: "RS512";
+        ES256: "ES256";
+        ES384: "ES384";
+        ES512: "ES512";
+        PS256: "PS256";
+        PS384: "PS384";
+        PS512: "PS512";
+    }>>;
+}, z.core.$strip>;
+export type AuthorizationPayload = z.output<typeof AuthorizationPayloadSchema>;
+export declare const UpsertAuthorizationPayloadSchema: z.ZodObject<{
+    metadata: z.ZodPipe<z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodUndefined, z.ZodNull, z.ZodMap<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>, z.ZodTransform<import("../../common/schema/metadata.js").MetadataRecord, Record<string, string | number | boolean> | Map<string, string | number | boolean> | null | undefined>>>, z.ZodTransform<import("../../common/schema/metadata.js").MetadataRecord | null | undefined, import("../../common/schema/metadata.js").MetadataRecord | undefined>>;
+    sessionDuration: z.ZodDefault<z.ZodNumber>;
+    refreshTokenDuration: z.ZodDefault<z.ZodNumber>;
+    accessTokenDuration: z.ZodDefault<z.ZodNumber>;
+    accessTokenSignatureAlgorithm: z.ZodDefault<z.ZodEnum<{
+        RS256: "RS256";
+        RS384: "RS384";
+        RS512: "RS512";
+        ES256: "ES256";
+        ES384: "ES384";
+        ES512: "ES512";
+        PS256: "PS256";
+        PS384: "PS384";
+        PS512: "PS512";
+    }>>;
+}, z.core.$strip>;
+export type UpsertAuthorizationPayload = z.output<typeof UpsertAuthorizationPayloadSchema>;
 //# sourceMappingURL=schema.d.ts.map

package/dist/esm/workspace/authorization/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/workspace/authorization/schema.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,wBAAwB,QAAc,CAAC;AACpD,eAAO,MAAM,8BAA8B,QAAoB,CAAC;AAChE,eAAO,MAAM,6BAA6B,QAAc,CAAC;AASzD,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;MAIF,CAAC;AACtC,MAAM,MAAM,oBAAoB,GAAG,OAAO,0BAA0B,CAAC,QAAQ,CAAC;AAE9E,eAAO,MAAM,gCAAgC;;;;;;;;;;MAE5C,CAAC;AACF,MAAM,MAAM,0BAA0B,GACpC,OAAO,gCAAgC,CAAC,QAAQ,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/workspace/authorization/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAgB5B,eAAO,MAAM,wBAAwB,QAAc,CAAC;AACpD,eAAO,MAAM,8BAA8B,QAAoB,CAAC;AAChE,eAAO,MAAM,6BAA6B,QAAc,CAAC;AASzD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;iBAM9B,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAC1E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEjE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;iBAMrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE/E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;iBAG3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAC/C,OAAO,gCAAgC,CACxC,CAAC"}

package/dist/esm/workspace/authorization/schema.js

@@ -1,19 +1,31 @@
-import { type } from 'arktype';
-import { OptionalDatePayloadSchema } from '../../common/schema/dates.js';
-import { Algorithm, AlgorithmSchema } from '../../common/schema/jwt.js';
-import { MetadataPayloadPropertySchema } from '../../common/schema/metadata.js';
+import * as z from 'zod/v4';
+import { DeactivatedAtPropertyPayloadSchema, DeactivatedAtPropertySchema, DeletedAtPropertyPayloadSchema, DeletedAtPropertySchema, OptionalDatePayloadSchema, OptionalDateSchema, } from '../../common/schema/dates.js';
+import { AlgorithmSchema, DEFAULT_ALGORITHM } from '../../common/schema/jwt.js';
+import { MetadataMapPropertySchema, MetadataRecordPropertySchema, UpsertMetadataPropertySchema, } from '../../common/schema/metadata.js';
 export const DEFAULT_SESSION_DURATION = 60 * 60 * 4; // 4 hour
 export const DEFAULT_REFRESH_TOKEN_DURATION = 60 * 60 * 24 * 14; // 14 days
 export const DEFAULT_ACCESS_TOKEN_DURATION = 60 * 60 * 2; // 2 hours
-const BaseAttributes = type({
-    sessionDuration: type('number').default(DEFAULT_SESSION_DURATION),
-    refreshTokenDuration: type('number').default(DEFAULT_REFRESH_TOKEN_DURATION),
-    accessTokenDuration: type('number').default(DEFAULT_ACCESS_TOKEN_DURATION),
-    accessTokenSignatureAlgorithm: AlgorithmSchema.default(Algorithm.DEFAULT),
+const BaseAttributes = z.object({
+    sessionDuration: z.number().default(DEFAULT_SESSION_DURATION),
+    refreshTokenDuration: z.number().default(DEFAULT_REFRESH_TOKEN_DURATION),
+    accessTokenDuration: z.number().default(DEFAULT_ACCESS_TOKEN_DURATION),
+    accessTokenSignatureAlgorithm: AlgorithmSchema.default(DEFAULT_ALGORITHM),
+});
+export const AuthorizationSchema = z.object({
+    ...BaseAttributes.shape,
+    updatedAt: OptionalDateSchema,
+    ...DeletedAtPropertySchema.shape,
+    ...DeactivatedAtPropertySchema.shape,
+    ...MetadataMapPropertySchema.shape,
+});
+export const AuthorizationPayloadSchema = z.object({
+    ...BaseAttributes.shape,
+    updatedAt: OptionalDatePayloadSchema,
+    ...DeletedAtPropertyPayloadSchema.shape,
+    ...DeactivatedAtPropertyPayloadSchema.shape,
+    ...MetadataRecordPropertySchema.shape,
+});
+export const UpsertAuthorizationPayloadSchema = z.object({
+    ...BaseAttributes.shape,
+    ...UpsertMetadataPropertySchema.shape,
 });
-export const AuthorizationPayloadSchema = BaseAttributes.and({
-    'updatedAt?': OptionalDatePayloadSchema,
-    'deletedAt?': OptionalDatePayloadSchema,
-    'deactivatedAt?': OptionalDatePayloadSchema,
-}).and(MetadataPayloadPropertySchema);
-export const UpsertAuthorizationPayloadSchema = BaseAttributes.and(MetadataPayloadPropertySchema);