@go-mondo/identity-sdk 0.0.2-beta.9 → 0.0.2-beta.92

package/dist/esm/app/authorization/schema.js

@@ -1,70 +1,62 @@
-import { type } from 'arktype';
-import { OptionalDatePayloadSchema, OptionalDateSchema, } from '../../common/schema/dates.js';
-import { MetadataMapPropertySchema, MetadataPayloadPropertySchema, UpsertMetadataPropertyPayloadSchema, } from '../../common/schema/metadata.js';
+import * as z from 'zod/v4';
+import { DeactivatedAtPropertyPayloadSchema, DeactivatedAtPropertySchema, DeletedAtPropertyPayloadSchema, DeletedAtPropertySchema, OptionalDatePayloadSchema, OptionalDateSchema, } from '../../common/schema/dates.js';
+import { AlgorithmSchema } from '../../common/schema/jwt.js';
+import { MetadataMapPropertySchema, MetadataRecordPropertySchema, UpsertMetadataPropertySchema, } from '../../common/schema/metadata.js';
+import { optionallyNullishToUndefined } from '../../common/schema/schema.js';
+import { UniqueStringArraySchema, UniqueStringSetSchema, } from '../../common/schema/sets.js';
+import { UniqueWebUrlObjectSetSchema, UniqueWebUrlStringArraySchema, WebUrlStringSchema, } from '../../common/schema/url.js';
 import { GrantType } from '../../oauth/common/schema.js';
-import { AuthorizationPayloadSchema as WorkspaceAuthorizationPayloadSchema } from '../../workspace/authorization/schema.js';
-const UrlSetSchema = type.instanceOf((Set));
-const UrlArrayScheama = type('string.url.parse').array();
-const StringSetSchema = type.instanceOf((Set));
-// const UrlStringSchema = type('string.url[]').pipe((v) => v?.filter((i) => !!i));
-const StringSchema = type('string[]').pipe((v) => v?.filter((i) => !!i));
-// const CallbackUrlsSchema = type('undefined')
-//   .or(UrlArrayScheama)
-//   .or(UrlSetSchema)
-//   .pipe((v) => (v instanceof Set ? Array.from(v.values()) : v));
-const CallbackUrlArraySchema = type('undefined')
-    .or(UrlArrayScheama)
-    .or(UrlSetSchema)
-    .pipe((v) => (v instanceof Set ? Array.from(v.values()) : v));
-const CallbackUrlSetSchema = type('undefined')
-    .or(UrlArrayScheama)
-    .or(UrlSetSchema)
-    .pipe((v) => (!v || v instanceof Set ? v : new Set(v)));
-const AvailableAudienceArraySchema = type('undefined')
-    .or(StringSchema)
-    .or(StringSetSchema)
-    .pipe((v) => (v instanceof Set ? Array.from(v.values()) : v));
-const AvailableAudienceSetSchema = type('undefined')
-    .or(StringSchema)
-    .or(StringSetSchema)
-    .pipe((v) => (!v || v instanceof Set ? v : new Set(v)));
-const GrantSetSchema = type.instanceOf((Set));
-const GrantArraySchema = type
-    .enumerated(GrantType.AUTHORIZATION_CODE, GrantType.CLIENT_CREDENTIALS, GrantType.IMPLICIT, GrantType.REFRESH_TOKEN)
-    .array();
-const AvailableGrantSetSchema = type('undefined')
-    .or(GrantArraySchema)
-    .or(GrantSetSchema)
-    .pipe((v) => (!v || v instanceof Set ? v : new Set(v)));
-const AvailableGrantArraySchema = type('undefined')
-    .or(GrantArraySchema)
-    .or(GrantSetSchema)
-    .pipe((v) => (v instanceof Set ? Array.from(v.values()) : v));
-const BaseAuthorization = WorkspaceAuthorizationPayloadSchema.pick('refreshTokenDuration', 'accessTokenDuration', 'accessTokenSignatureAlgorithm');
-export const AuthorizationSchema = BaseAuthorization.and({
-    loginUri: type('string.url | undefined').optional(),
-    callbackUrls: CallbackUrlSetSchema.optional(),
-    availableAudiences: AvailableAudienceSetSchema.optional(),
+const AudienceArraySchema = UniqueStringArraySchema;
+const AudienceSetSchema = UniqueStringSetSchema;
+const GrantSetSchema = z.instanceof((Set));
+const GrantArraySchema = z.array(z.enum([
+    GrantType.AUTHORIZATION_CODE,
+    GrantType.CLIENT_CREDENTIALS,
+    GrantType.IMPLICIT,
+    GrantType.REFRESH_TOKEN,
+]));
+const AvailableGrantSetSchema = z
+    .union([z.undefined(), GrantArraySchema, GrantSetSchema])
+    .pipe(z.transform((v) => (!v || v instanceof Set ? v : new Set(v))));
+const AvailableGrantArraySchema = z
+    .union([z.undefined(), GrantArraySchema, GrantSetSchema])
+    .pipe(z.transform((v) => (v instanceof Set ? Array.from(v.values()) : v)));
+const BaseAuthorization = z.object({
+    refreshTokenDuration: optionallyNullishToUndefined(z.number()),
+    accessTokenDuration: optionallyNullishToUndefined(z.number()),
+    accessTokenSignatureAlgorithm: optionallyNullishToUndefined(AlgorithmSchema),
+    loginUri: optionallyNullishToUndefined(WebUrlStringSchema),
+});
+export const AuthorizationSchema = z.object({
+    ...BaseAuthorization.shape,
+    callbackUrls: UniqueWebUrlObjectSetSchema.optional(),
+    availableAudiences: AudienceSetSchema.optional(),
     availableGrants: AvailableGrantSetSchema.optional(),
-    defaultAudience: type('string | undefined').optional(),
-    'updatedAt?': OptionalDateSchema,
-    'deletedAt?': OptionalDateSchema,
-    'deactivatedAt?': OptionalDateSchema,
-}).and(MetadataMapPropertySchema);
-export const AuthorizationPayloadSchema = BaseAuthorization.and({
-    loginUri: type('string.url | undefined').optional(),
-    callbackUrls: CallbackUrlArraySchema.optional(),
-    availableAudiences: AvailableAudienceArraySchema.optional(),
+    defaultAudience: z.union([z.string(), z.undefined()]).optional(),
+    updatedAt: OptionalDateSchema,
+    ...DeletedAtPropertySchema.shape,
+    ...DeactivatedAtPropertySchema.shape,
+    ...MetadataMapPropertySchema.shape,
+});
+export const AuthorizationPayloadSchema = z.object({
+    ...BaseAuthorization.shape,
+    callbackUrls: UniqueWebUrlStringArraySchema.optional(),
+    availableAudiences: AudienceArraySchema.optional(),
     availableGrants: AvailableGrantArraySchema.optional(),
-    defaultAudience: type('string | undefined').optional(),
-    'updatedAt?': OptionalDatePayloadSchema,
-    'deletedAt?': OptionalDatePayloadSchema,
-    'deactivatedAt?': OptionalDatePayloadSchema,
-}).and(MetadataPayloadPropertySchema);
-export const UpsertAuthorizationPayloadSchema = BaseAuthorization.and({
-    loginUri: type('string.url | undefined').optional(),
-    callbackUrls: CallbackUrlArraySchema.optional(),
-    availableAudiences: AvailableAudienceArraySchema.optional(),
+    defaultAudience: z.union([z.string(), z.undefined()]).optional(),
+    updatedAt: OptionalDatePayloadSchema,
+    ...DeletedAtPropertyPayloadSchema.shape,
+    ...DeactivatedAtPropertyPayloadSchema.shape,
+    ...MetadataRecordPropertySchema.shape,
+});
+export const UpsertAuthorizationPayloadSchema = z.object({
+    loginUri: z.union([WebUrlStringSchema, z.null(), z.undefined()]).optional(),
+    refreshTokenDuration: z.number().nullish(),
+    accessTokenDuration: z.number().nullish(),
+    accessTokenSignatureAlgorithm: AlgorithmSchema.nullish(),
+    callbackUrls: UniqueWebUrlStringArraySchema.optional(),
+    availableAudiences: AudienceArraySchema.optional(),
     availableGrants: AvailableGrantArraySchema.optional(),
-    defaultAudience: type('string | undefined').optional(),
-}).and(UpsertMetadataPropertyPayloadSchema);
+    defaultAudience: z.union([z.string(), z.null(), z.undefined()]).optional(),
+    ...UpsertMetadataPropertySchema.shape,
+});

package/dist/esm/app/authorization/schema.test.js

@@ -1,4 +1,3 @@
-import { type } from 'arktype';
 import { describe, expect, test } from 'vitest';
 import { AuthorizationPayloadSchema, AuthorizationSchema, UpsertAuthorizationPayloadSchema, } from './schema.js';
 describe('App Authorization - Schema', () => {
@@ -7,7 +6,7 @@ describe('App Authorization - Schema', () => {
             const authorization = {
                 refreshTokenDuration: 3600,
                 accessTokenDuration: 900,
-                accessTokenSignatureAlgorithm: 'HS256',
+                accessTokenSignatureAlgorithm: 'RS256',
                 loginUri: 'https://app.example.com/login',
                 callbackUrls: [
                     'https://app.example.com/callback',
@@ -28,16 +27,18 @@ describe('App Authorization - Schema', () => {
                     state_parameter_required: true,
                 },
             };
-            const result = AuthorizationSchema(authorization);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result.availableGrants).toBeInstanceOf(Set);
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data.availableGrants).toBeInstanceOf(Set);
+            }
         });
         test('should accept minimal authorization object', () => {
             const authorization = {
                 metadata: {},
             };
-            const result = AuthorizationSchema(authorization);
-            expect(result).not.toBeInstanceOf(type.errors);
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
         });
         test('should accept authorization with grant array and convert to Set', () => {
             const authorization = {
@@ -48,11 +49,13 @@ describe('App Authorization - Schema', () => {
                     client_type: 'confidential',
                 },
             };
-            const result = AuthorizationSchema(authorization);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result.availableGrants).toBeInstanceOf(Set);
-            expect(result.availableGrants?.has('authorization_code')).toBe(true);
-            expect(result.availableGrants?.has('client_credentials')).toBe(true);
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data.availableGrants).toBeInstanceOf(Set);
+                expect(result.data.availableGrants?.has('authorization_code')).toBe(true);
+                expect(result.data.availableGrants?.has('client_credentials')).toBe(true);
+            }
         });
         test('should accept authorization with Set of grants', () => {
             const authorization = {
@@ -64,9 +67,11 @@ describe('App Authorization - Schema', () => {
                     application_type: 'spa',
                 },
             };
-            const result = AuthorizationSchema(authorization);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result.availableGrants).toBeInstanceOf(Set);
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data.availableGrants).toBeInstanceOf(Set);
+            }
         });
         test('should accept authorization with callback URLs as Set', () => {
             const authorization = {
@@ -79,10 +84,12 @@ describe('App Authorization - Schema', () => {
                     multi_tenant: true,
                 },
             };
-            const result = AuthorizationSchema(authorization);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result.callbackUrls).toBeInstanceOf(Set);
-            expect(result.availableAudiences).toBeInstanceOf(Set);
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data.callbackUrls).toBeInstanceOf(Set);
+                expect(result.data.availableAudiences).toBeInstanceOf(Set);
+            }
         });
         test('should accept authorization with optional fields', () => {
             const authorization = {
@@ -93,15 +100,13 @@ describe('App Authorization - Schema', () => {
                 defaultAudience: 'https://api.example.com',
                 updatedAt: new Date(),
                 metadata: {
-                    jwt_configuration: {
-                        algorithm: 'RS256',
-                        public_key: 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...',
-                    },
-                    scopes: ['read:users', 'write:users', 'admin:all'],
+                    algorithm: 'RS256',
+                    client_name: 'Test App',
+                    description: 'Test authorization with optional fields',
                 },
             };
-            const result = AuthorizationSchema(authorization);
-            expect(result).not.toBeInstanceOf(type.errors);
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
         });
         test('should filter empty strings from URLs and audiences', () => {
             const authorization = {
@@ -112,29 +117,56 @@ describe('App Authorization - Schema', () => {
                 availableAudiences: ['api.example.com', 'admin.example.com'],
                 metadata: {},
             };
-            const result = AuthorizationSchema(authorization);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result.callbackUrls).toEqual(new Set([
-                'https://valid.example.com/callback',
-                'https://another.example.com/auth',
-            ]));
-            expect(result.availableAudiences).toEqual(new Set(['api.example.com', 'admin.example.com']));
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data.callbackUrls).toEqual(new Set([
+                    'https://valid.example.com/callback',
+                    'https://another.example.com/auth',
+                ]));
+                expect(result.data.availableAudiences).toEqual(new Set(['api.example.com', 'admin.example.com']));
+            }
         });
         test('should reject invalid grant types', () => {
             const authorization = {
                 availableGrants: ['invalid_grant_type'],
                 metadata: {},
             };
-            const result = AuthorizationSchema(authorization);
-            expect(result).toBeInstanceOf(type.errors);
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(false);
         });
         test('should reject invalid URL formats', () => {
             const authorization = {
                 loginUri: 'not-a-valid-url',
                 metadata: {},
             };
-            const result = AuthorizationSchema(authorization);
-            expect(result).toBeInstanceOf(type.errors);
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(false);
+        });
+        test('should transform null removable fields to undefined', () => {
+            const authorization = {
+                loginUri: null,
+                refreshTokenDuration: null,
+                accessTokenDuration: null,
+                accessTokenSignatureAlgorithm: null,
+                metadata: {},
+            };
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data.loginUri).toBeUndefined();
+                expect(result.data.refreshTokenDuration).toBeUndefined();
+                expect(result.data.accessTokenDuration).toBeUndefined();
+                expect(result.data.accessTokenSignatureAlgorithm).toBeUndefined();
+            }
+        });
+        test('should reject null values for non-removable fields', () => {
+            const authorization = {
+                defaultAudience: null,
+                metadata: {},
+            };
+            const result = AuthorizationSchema.safeParse(authorization);
+            expect(result.success).toBe(false);
         });
     });
     describe('AuthorizationPayloadSchema', () => {
@@ -142,7 +174,7 @@ describe('App Authorization - Schema', () => {
             const payload = {
                 refreshTokenDuration: 3600,
                 accessTokenDuration: 900,
-                accessTokenSignatureAlgorithm: 'HS256',
+                accessTokenSignatureAlgorithm: 'RS256',
                 loginUri: 'https://app.example.com/login',
                 callbackUrls: ['https://app.example.com/callback'],
                 availableAudiences: ['api.example.com'],
@@ -157,19 +189,28 @@ describe('App Authorization - Schema', () => {
                     token_endpoint_auth_method: 'client_secret_basic',
                 },
             };
-            const result = AuthorizationPayloadSchema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result).toEqual(payload);
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                // The schema transforms string URLs to URL objects, so we check individual properties
+                expect(result.data).toHaveProperty('refreshTokenDuration', payload.refreshTokenDuration);
+                expect(result.data).toHaveProperty('accessTokenDuration', payload.accessTokenDuration);
+                expect(result.data).toHaveProperty('accessTokenSignatureAlgorithm', payload.accessTokenSignatureAlgorithm);
+                expect(result.data).toHaveProperty('loginUri', payload.loginUri);
+                expect(result.data).toHaveProperty('metadata', payload.metadata);
+                // callbackUrls will be transformed to URL objects
+                expect(result.data.callbackUrls).toBeDefined();
+            }
         });
         test('should accept minimal authorization payload', () => {
             const payload = {
                 metadata: {},
             };
-            const result = AuthorizationPayloadSchema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result).toHaveProperty('accessTokenDuration');
-            expect(result).toHaveProperty('accessTokenSignatureAlgorithm');
-            expect(result).toHaveProperty('refreshTokenDuration');
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data).toHaveProperty('metadata');
+            }
         });
         test('should accept payload with grant arrays', () => {
             const payload = {
@@ -182,8 +223,8 @@ describe('App Authorization - Schema', () => {
                     requires_client_secret: true,
                 },
             };
-            const result = AuthorizationPayloadSchema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
         });
         test('should accept payload with Set of grants', () => {
             const payload = {
@@ -195,8 +236,8 @@ describe('App Authorization - Schema', () => {
                     application_type: 'single_page_app',
                 },
             };
-            const result = AuthorizationPayloadSchema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
         });
         test('should accept payload with comprehensive OAuth configuration', () => {
             const payload = {
@@ -229,24 +270,41 @@ describe('App Authorization - Schema', () => {
                     policy_uri: 'https://corporate.com/privacy',
                 },
             };
-            const result = AuthorizationPayloadSchema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
         });
         test('should reject invalid date format', () => {
             const payload = {
                 updatedAt: 'invalid-date',
                 metadata: {},
             };
-            const result = AuthorizationPayloadSchema(payload);
-            expect(result).toBeInstanceOf(type.errors);
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(false);
         });
         test('should reject invalid signature algorithm', () => {
             const payload = {
                 accessTokenSignatureAlgorithm: 'INVALID_ALG',
                 metadata: {},
             };
-            const result = AuthorizationPayloadSchema(payload);
-            expect(result).toBeInstanceOf(type.errors);
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(false);
+        });
+        test('should transform null removable fields to undefined', () => {
+            const payload = {
+                loginUri: null,
+                refreshTokenDuration: null,
+                accessTokenDuration: null,
+                accessTokenSignatureAlgorithm: null,
+                metadata: {},
+            };
+            const result = AuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.data.loginUri).toBeUndefined();
+                expect(result.data.refreshTokenDuration).toBeUndefined();
+                expect(result.data.accessTokenDuration).toBeUndefined();
+                expect(result.data.accessTokenSignatureAlgorithm).toBeUndefined();
+            }
         });
     });
     describe('UpsertAuthorizationPayloadSchema', () => {
@@ -254,7 +312,7 @@ describe('App Authorization - Schema', () => {
             const payload = {
                 refreshTokenDuration: 3600,
                 accessTokenDuration: 900,
-                accessTokenSignatureAlgorithm: 'HS256',
+                accessTokenSignatureAlgorithm: 'RS256',
                 loginUri: 'https://updated.example.com/login',
                 callbackUrls: ['https://updated.example.com/callback'],
                 availableAudiences: ['updated-api.example.com'],
@@ -265,9 +323,18 @@ describe('App Authorization - Schema', () => {
                     updated_by: 'admin@example.com',
                 },
             };
-            const result = UpsertAuthorizationPayloadSchema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
-            expect(result).toEqual(payload);
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+            if (result.success) {
+                // The schema transforms string URLs to URL objects, so we check individual properties
+                expect(result.data).toHaveProperty('refreshTokenDuration', payload.refreshTokenDuration);
+                expect(result.data).toHaveProperty('accessTokenDuration', payload.accessTokenDuration);
+                expect(result.data).toHaveProperty('accessTokenSignatureAlgorithm', payload.accessTokenSignatureAlgorithm);
+                expect(result.data).toHaveProperty('loginUri', payload.loginUri);
+                expect(result.data).toHaveProperty('metadata', payload.metadata);
+                // callbackUrls will be transformed to URL objects
+                expect(result.data.callbackUrls).toBeDefined();
+            }
         });
         test('should accept partial upsert payload', () => {
             const payload = {
@@ -277,8 +344,8 @@ describe('App Authorization - Schema', () => {
                     fields_updated: 'accessTokenDuration',
                 },
             };
-            const result = UpsertAuthorizationPayloadSchema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
         });
         test('should accept upsert with undefined values', () => {
             const payload = {
@@ -288,16 +355,30 @@ describe('App Authorization - Schema', () => {
                     reset_fields: 'loginUri',
                 },
             };
-            const result = UpsertAuthorizationPayloadSchema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
+        });
+        test('should accept upsert with null values for removable fields', () => {
+            const payload = {
+                loginUri: null,
+                refreshTokenDuration: null,
+                accessTokenDuration: null,
+                accessTokenSignatureAlgorithm: null,
+                defaultAudience: null,
+                metadata: {
+                    reset_fields: 'loginUri,refreshTokenDuration,accessTokenDuration,accessTokenSignatureAlgorithm,defaultAudience',
+                },
+            };
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
         });
         test('should accept empty metadata upsert', () => {
             const payload = {
                 refreshTokenDuration: 7200,
                 metadata: {},
             };
-            const result = UpsertAuthorizationPayloadSchema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
         });
         test('should accept upsert with grant types modification', () => {
             const payload = {
@@ -310,8 +391,8 @@ describe('App Authorization - Schema', () => {
                     added_grants: 'client_credentials',
                 },
             };
-            const result = UpsertAuthorizationPayloadSchema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
         });
         test('should accept upsert with complex callback URL updates', () => {
             const payload = {
@@ -328,24 +409,24 @@ describe('App Authorization - Schema', () => {
                     environment: 'production',
                 },
             };
-            const result = UpsertAuthorizationPayloadSchema(payload);
-            expect(result).not.toBeInstanceOf(type.errors);
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(true);
         });
         test('should reject invalid grant types in upsert', () => {
             const payload = {
                 availableGrants: ['invalid_grant'],
                 metadata: {},
             };
-            const result = UpsertAuthorizationPayloadSchema(payload);
-            expect(result).toBeInstanceOf(type.errors);
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(false);
         });
         test('should reject invalid URL in upsert', () => {
             const payload = {
                 loginUri: 'not-a-valid-url',
                 metadata: {},
             };
-            const result = UpsertAuthorizationPayloadSchema(payload);
-            expect(result).toBeInstanceOf(type.errors);
+            const result = UpsertAuthorizationPayloadSchema.safeParse(payload);
+            expect(result.success).toBe(false);
         });
     });
 });

package/dist/esm/app/oauth/resources.d.ts

@@ -1,12 +1,12 @@
-import type { MondoIdentity } from '../../common/resources/init.js';
+import type { MondoInstance } from '../../common/resources/init.js';
 import { type InsertOAuthInput, type OAuth } from './schema.js';
 export declare class OAuthResources {
     private readonly instance;
-    constructor(instance: MondoIdentity);
+    constructor(instance: MondoInstance);
     static buildPath(appId: string): string;
     getItem(id: string): Promise<OAuth>;
     rotateItemSecret(id: string): Promise<OAuth>;
 }
-export declare function getOAuth(instance: MondoIdentity, appId: string): Promise<OAuth>;
-export declare function rotateOAuthSecret(instance: MondoIdentity, appId: string, item?: InsertOAuthInput): Promise<OAuth>;
+export declare function getOAuth(instance: MondoInstance, appId: string): Promise<OAuth>;
+export declare function rotateOAuthSecret(instance: MondoInstance, appId: string, item?: InsertOAuthInput): Promise<OAuth>;
 //# sourceMappingURL=resources.d.ts.map

package/dist/esm/app/oauth/resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../../../src/app/oauth/resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAOpE,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,KAAK,EAEX,MAAM,aAAa,CAAC;AAIrB,qBAAa,cAAc;IACN,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAE3D,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAQhC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAInC,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;CAGpD;AAED,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC,CAShB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,KAAK,CAAC,CAYhB"}
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../../../src/app/oauth/resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAMpE,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,KAAK,EAEX,MAAM,aAAa,CAAC;AAIrB,qBAAa,cAAc;IACN,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAE3D,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAQhC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAInC,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;CAGpD;AAED,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC,CAOhB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,KAAK,CAAC,CAQhB"}

package/dist/esm/app/oauth/resources.js

@@ -1,5 +1,4 @@
-import { getItemWithAuthorization, insertItemWithAuthorization, } from '../../common/resources/operations.js';
-import { parseEgressSchema } from '../../common/resources/utils.js';
+import { getItemWithAuthorization, postItemWithAuthorization, } from '../../common/resources/operations.js';
 import { PATH } from '../resources.js';
 import { InsertOAuthPayloadSchema, OAuthSchema, } from './schema.js';
 const RESOURCE = 'oauth';
@@ -22,8 +21,8 @@ export class OAuthResources {
     }
 }
 export async function getOAuth(instance, appId) {
-    return parseEgressSchema(OAuthSchema(await getItemWithAuthorization(new URL(OAuthResources.buildPath(appId), instance.config.host), instance.authorizer)));
+    return OAuthSchema.parse(await getItemWithAuthorization(new URL(OAuthResources.buildPath(appId), instance.baseUrl), instance.authorize));
 }
 export async function rotateOAuthSecret(instance, appId, item) {
-    return parseEgressSchema(OAuthSchema(await insertItemWithAuthorization(new URL(OAuthResources.buildPath(appId), instance.config.host), instance.authorizer, parseEgressSchema(InsertOAuthPayloadSchema.onUndeclaredKey('delete')(item)))));
+    return OAuthSchema.parse(await postItemWithAuthorization(new URL(OAuthResources.buildPath(appId), instance.baseUrl), instance.authorize, InsertOAuthPayloadSchema.parse(item)));
 }