@schemavaults/auth-common 0.12.3 → 0.12.10

package/dist/auth-error-message-catalog.d.ts

@@ -1,4 +1,4 @@
-declare const ERROR_IDS: readonly ["unknown", "bad_request", "app_id_not_found", "api_server_id_not_found", "unauthenticated", "forbidden", "account_disabled", "load_user_data_failure", "internal_server_error", "load_server_config_failure", "server_misconfiguration", "account_not_in_organization", "pkce_challenge_expired"];
+declare const ERROR_IDS: readonly ["unknown", "bad_request", "app_id_not_found", "api_server_id_not_found", "unauthenticated", "forbidden", "account_disabled", "load_user_data_failure", "internal_server_error", "load_server_config_failure", "server_misconfiguration", "account_not_in_organization", "pkce_challenge_expired", "invalid_redirect_uri"];
 export type SchemaVaultsAuthErrorId = (typeof ERROR_IDS)[number];
 export declare const ERROR_MESSAGE_CATALOG: Record<SchemaVaultsAuthErrorId, string>;
 export declare function isValidErrorId(id: string): id is SchemaVaultsAuthErrorId;

package/dist/auth-error-message-catalog.js

@@ -12,6 +12,7 @@ const ERROR_IDS = [
     "server_misconfiguration",
     "account_not_in_organization",
     "pkce_challenge_expired",
+    "invalid_redirect_uri",
 ];
 export const ERROR_MESSAGE_CATALOG = {
     unknown: "An unknown error occurred",
@@ -27,6 +28,7 @@ export const ERROR_MESSAGE_CATALOG = {
     server_misconfiguration: "The server does not appear to be configured properly. If you are the site admin, please see the logs for more details.",
     account_not_in_organization: "Your account is not a member of the organization required for the attempted action.",
     pkce_challenge_expired: "Your authorization session has expired. Please return to the requesting application and try again.",
+    invalid_redirect_uri: "The redirect URI presented by the requesting application is not registered for it. For your safety, login has been blocked.",
 };
 export function isValidErrorId(id) {
     return ERROR_IDS.includes(id);

package/dist/auth-error-message-catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error-message-catalog.js","sourceRoot":"","sources":["../src/auth-error-message-catalog.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG;IAChB,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,yBAAyB;IACzB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,wBAAwB;IACxB,uBAAuB;IACvB,4BAA4B;IAC5B,yBAAyB;IACzB,6BAA6B;IAC7B,wBAAwB;CACY,CAAC;AAIvC,MAAM,CAAC,MAAM,qBAAqB,GAA4C;IAC5E,OAAO,EAAE,2BAA2B;IACpC,WAAW,EAAE,wCAAwC;IACrD,gBAAgB,EAAE,kCAAkC;IACpD,uBAAuB,EAAE,wCAAwC;IACjE,eAAe,EACb,iGAAiG;IACnG,SAAS,EACP,gHAAgH;IAClH,gBAAgB,EAAE,iCAAiC;IACnD,sBAAsB,EACpB,4EAA4E;IAC9E,qBAAqB,EACnB,qFAAqF;IACvF,0BAA0B,EACxB,4DAA4D;IAC9D,uBAAuB,EACrB,wHAAwH;IAC1H,2BAA2B,EACzB,qFAAqF;IACvF,sBAAsB,EACpB,oGAAoG;CACvG,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAA8C,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"auth-error-message-catalog.js","sourceRoot":"","sources":["../src/auth-error-message-catalog.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG;IAChB,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,yBAAyB;IACzB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,wBAAwB;IACxB,uBAAuB;IACvB,4BAA4B;IAC5B,yBAAyB;IACzB,6BAA6B;IAC7B,wBAAwB;IACxB,sBAAsB;CACc,CAAC;AAIvC,MAAM,CAAC,MAAM,qBAAqB,GAA4C;IAC5E,OAAO,EAAE,2BAA2B;IACpC,WAAW,EAAE,wCAAwC;IACrD,gBAAgB,EAAE,kCAAkC;IACpD,uBAAuB,EAAE,wCAAwC;IACjE,eAAe,EACb,iGAAiG;IACnG,SAAS,EACP,gHAAgH;IAClH,gBAAgB,EAAE,iCAAiC;IACnD,sBAAsB,EACpB,4EAA4E;IAC9E,qBAAqB,EACnB,qFAAqF;IACvF,0BAA0B,EACxB,4DAA4D;IAC9D,uBAAuB,EACrB,wHAAwH;IAC1H,2BAA2B,EACzB,qFAAqF;IACvF,sBAAsB,EACpB,oGAAoG;IACtG,oBAAoB,EAClB,6HAA6H;CAChI,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAA8C,CAAC,CAAC;AAC5E,CAAC"}

package/dist/auth_acquire_tokens_grant_types.d.ts

@@ -7,6 +7,7 @@ export declare const authorizationCodePOSTbody: z.ZodObject<{
     audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
     client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
     grant_type: z.ZodLiteral<"authorization_code">;
+    redirect_uri: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, "strict", z.ZodTypeAny, {
     code: string;
     challenge_time: number;
@@ -14,6 +15,7 @@ export declare const authorizationCodePOSTbody: z.ZodObject<{
     audience: string | string[];
     client_app_id: string;
     grant_type: "authorization_code";
+    redirect_uri?: string | null | undefined;
 }, {
     code: string;
     challenge_time: number;
@@ -21,6 +23,7 @@ export declare const authorizationCodePOSTbody: z.ZodObject<{
     audience: string | string[];
     client_app_id: string;
     grant_type: "authorization_code";
+    redirect_uri?: string | null | undefined;
 }>;
 export declare const refreshTokenPOSTbody: z.ZodObject<{
     audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
@@ -46,6 +49,7 @@ export declare const grantTypePOSTbodySchemaMap: {
         audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
         client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
         grant_type: z.ZodLiteral<"authorization_code">;
+        redirect_uri: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
         code: string;
         challenge_time: number;
@@ -53,6 +57,7 @@ export declare const grantTypePOSTbodySchemaMap: {
         audience: string | string[];
         client_app_id: string;
         grant_type: "authorization_code";
+        redirect_uri?: string | null | undefined;
     }, {
         code: string;
         challenge_time: number;
@@ -60,6 +65,7 @@ export declare const grantTypePOSTbodySchemaMap: {
         audience: string | string[];
         client_app_id: string;
         grant_type: "authorization_code";
+        redirect_uri?: string | null | undefined;
     }>;
     readonly refresh_token: z.ZodObject<{
         audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;

package/dist/auth_acquire_tokens_grant_types.js

@@ -20,6 +20,14 @@ export const authorizationCodePOSTbody = _createTokenEndpointBaseSchema
         .refine((value) => /^[A-Za-z0-9_-]+$/.test(value)),
     code_verifier: PKCE_ProofKeyManager.codeChallengeSchema,
     challenge_time: z.number().nonnegative(),
+    // OAuth2 `redirect_uri` (RFC 6749 §4.1.3) bound to the issued
+    // authorization code. The token endpoint verifies this matches the
+    // value persisted on the authorization_codes row by exact string
+    // equality, so a code minted for URI A cannot be redeemed by
+    // presenting URI B even when both share an allowlisted origin.
+    // Null/absent is reserved for the auth server's own account flow,
+    // which has no third-party callback.
+    redirect_uri: z.string().url().nullable().optional(),
 })
     .required({
     grant_type: true,

package/dist/auth_acquire_tokens_grant_types.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAkB,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,WAAW;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B;KACpE,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC3C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,IAAI,CAAC;SACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;IACnB,IAAI,EAAE,IAAI;IACV,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B;KAC/D,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kBAAkB,EAAE,yBAAyB;IAC7C,aAAa,EAAE,oBAAoB;CAC+B,CAAC"}
+{"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAkB,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,WAAW;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B;KACpE,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC3C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,IAAI,CAAC;SACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IACxC,8DAA8D;IAC9D,mEAAmE;IACnE,iEAAiE;IACjE,6DAA6D;IAC7D,+DAA+D;IAC/D,kEAAkE;IAClE,qCAAqC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;IACnB,IAAI,EAAE,IAAI;IACV,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B;KAC/D,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kBAAkB,EAAE,yBAAyB;IAC7C,aAAa,EAAE,oBAAoB;CAC+B,CAAC"}

package/dist/index.d.ts

@@ -20,8 +20,8 @@ export { appIdSchema } from "@schemavaults/app-definitions";
 export { audienceSchema, audienceRefSchema } from "./audience-schema";
 export { inviteCodeFormatSchema, inviteCodeDefinitionSchema, } from "./invite-code";
 export type { InviteCode, InviteCodeDefinition } from "./invite-code";
-export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, organizationDefinitionSchema, hardcodedOrgs, SCHEMAVAULTS_ORGANIZATION_ID, MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, inviteMemberInputModes, inviteMemberFormSchema, organizationInvitationStatusTypes, organizationInvitationStatusSchema, organizationInvitationSchema, organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, isValidOrganizationMembershipRoleType, } from "./organizations";
-export type { OrganizationID, OrganizationDefinition, InviteMemberInputMode, InviteMemberFormValues, InviteMemberSubmitData, OrganizationInvitationStatus, OrganizationInvitation, UserPendingInvitation, OrganizationInvitationWithUserData, OrganizationMembershipRoleType, } from "./organizations";
+export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, organizationDefinitionSchema, hardcodedOrgs, SCHEMAVAULTS_ORGANIZATION_ID, MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, inviteMemberInputModes, inviteMemberFormSchema, organizationInvitationStatusTypes, organizationInvitationStatusSchema, organizationInvitationSchema, organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, isValidOrganizationMembershipRoleType, organizationMembershipRoleDetailsSchema, isValidOrganizationMembershipRoleDetails, } from "./organizations";
+export type { OrganizationID, OrganizationDefinition, InviteMemberInputMode, InviteMemberFormValues, InviteMemberSubmitData, OrganizationInvitationStatus, OrganizationInvitation, UserPendingInvitation, OrganizationInvitationWithUserData, OrganizationMembershipRoleType, OrganizationMembershipRoleDetails, } from "./organizations";
 export { MaximumBrowserCookieSize } from "./MaximumBrowserCookieSize";
 export { RefreshTokenCookieName, RefreshTokenExpiryCookieName, } from "./RefreshTokenCookieNames";
 export { AccessTokenCookieName, AccessTokenExpiryCookieName, } from "./AccessTokenCookieNames";

package/dist/index.js

@@ -13,7 +13,7 @@ export { PRODUCTION_AUTH_SERVER_URL } from "@schemavaults/app-definitions";
 export { appIdSchema } from "@schemavaults/app-definitions";
 export { audienceSchema, audienceRefSchema } from "./audience-schema";
 export { inviteCodeFormatSchema, inviteCodeDefinitionSchema, } from "./invite-code";
-export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, organizationDefinitionSchema, hardcodedOrgs, SCHEMAVAULTS_ORGANIZATION_ID, MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, inviteMemberInputModes, inviteMemberFormSchema, organizationInvitationStatusTypes, organizationInvitationStatusSchema, organizationInvitationSchema, organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, isValidOrganizationMembershipRoleType, } from "./organizations";
+export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, organizationDefinitionSchema, hardcodedOrgs, SCHEMAVAULTS_ORGANIZATION_ID, MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, inviteMemberInputModes, inviteMemberFormSchema, organizationInvitationStatusTypes, organizationInvitationStatusSchema, organizationInvitationSchema, organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, isValidOrganizationMembershipRoleType, organizationMembershipRoleDetailsSchema, isValidOrganizationMembershipRoleDetails, } from "./organizations";
 export { MaximumBrowserCookieSize } from "./MaximumBrowserCookieSize";
 export { RefreshTokenCookieName, RefreshTokenExpiryCookieName, } from "./RefreshTokenCookieNames";
 export { AccessTokenCookieName, AccessTokenExpiryCookieName, } from "./AccessTokenCookieNames";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,GAMzC,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,iBAAiB,CAAC;AAczB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,GAMzC,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}

package/dist/organizations/index.d.ts

@@ -2,6 +2,8 @@ export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS,
 export type { OrganizationID } from "./organization_id";
 export { organizationDefinitionSchema } from "./organization_definition";
 export type { OrganizationDefinition } from "./organization_definition";
+export { organizationNameSchema, isValidOrganizationName, } from "./organization_name";
+export type { OrganizationName } from "./organization_name";
 export { SCHEMAVAULTS_ORGANIZATION_ID } from "./schemavaults_org_id";
 export { hardcodedOrgs } from "./hardcoded_orgs";
 export { MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, } from "./organization_constants";
@@ -11,3 +13,5 @@ export { organizationInvitationStatusTypes, organizationInvitationStatusSchema,
 export type { OrganizationInvitationStatus, OrganizationInvitation, UserPendingInvitation, OrganizationInvitationWithUserData, } from "./organization_invitation";
 export { organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, isValidOrganizationMembershipRoleType, } from "./organization-membership-role-type";
 export type { OrganizationMembershipRoleType } from "./organization-membership-role-type";
+export { organizationMembershipRoleDetailsSchema, isValidOrganizationMembershipRoleDetails, } from "./organization_membership_role_details";
+export type { OrganizationMembershipRoleDetails } from "./organization_membership_role_details";

package/dist/organizations/index.js

@@ -1,9 +1,11 @@
 export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, } from "./organization_id";
 export { organizationDefinitionSchema } from "./organization_definition";
+export { organizationNameSchema, isValidOrganizationName, } from "./organization_name";
 export { SCHEMAVAULTS_ORGANIZATION_ID } from "./schemavaults_org_id";
 export { hardcodedOrgs } from "./hardcoded_orgs";
 export { MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, } from "./organization_constants";
 export { inviteMemberInputModes, inviteMemberFormSchema, } from "./invite_member_form";
 export { organizationInvitationStatusTypes, organizationInvitationStatusSchema, organizationInvitationSchema, } from "./organization_invitation";
 export { organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, isValidOrganizationMembershipRoleType, } from "./organization-membership-role-type";
+export { organizationMembershipRoleDetailsSchema, isValidOrganizationMembershipRoleDetails, } from "./organization_membership_role_details";
 //# sourceMappingURL=index.js.map

package/dist/organizations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAGzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EACL,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAQnC,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAGzE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EACL,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAQnC,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EACL,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,wCAAwC,CAAC"}

package/dist/organizations/organization_definition.js

@@ -1,10 +1,6 @@
 import { z } from "zod";
 import { organizationIdSchema } from "./organization_id";
-import { MAXIMUM_ORGANIZATION_NAME_LENGTH, MINIMUM_ORGANIZATION_NAME_LENGTH, } from "./organization_constants";
-const organizationNameSchema = z
-    .string()
-    .min(MINIMUM_ORGANIZATION_NAME_LENGTH, `Organization name must be at least ${MINIMUM_ORGANIZATION_NAME_LENGTH} character${MINIMUM_ORGANIZATION_NAME_LENGTH >= 2 ? "s" : ""} long.`)
-    .max(MAXIMUM_ORGANIZATION_NAME_LENGTH, `Organization name may not be longer than ${MAXIMUM_ORGANIZATION_NAME_LENGTH} characters long.`);
+import { organizationNameSchema } from "./organization_name";
 export const organizationDefinitionSchema = z
     .object({
     organization_id: organizationIdSchema,

package/dist/organizations/organization_definition.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization_definition.js","sourceRoot":"","sources":["../../src/organizations/organization_definition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EACL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAElC,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CACF,gCAAgC,EAChC,sCAAsC,gCAAgC,aAAa,gCAAgC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAC5I;KACA,GAAG,CACF,gCAAgC,EAChC,4CAA4C,gCAAgC,mBAAmB,CAChG,CAAC;AAEJ,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,eAAe,EAAE,oBAAoB;IACrC,IAAI,EAAE,sBAAsB;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,QAAQ,CAAC;IACR,eAAe,EAAE,IAAI;IACrB,IAAI,EAAE,IAAI;IACV,UAAU,EAAE,IAAI;CACjB,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"organization_definition.js","sourceRoot":"","sources":["../../src/organizations/organization_definition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,eAAe,EAAE,oBAAoB;IACrC,IAAI,EAAE,sBAAsB;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,QAAQ,CAAC;IACR,eAAe,EAAE,IAAI;IACrB,IAAI,EAAE,IAAI;IACV,UAAU,EAAE,IAAI;CACjB,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/organizations/organization_membership_role_details.d.ts

@@ -0,0 +1,44 @@
+import { z } from "zod";
+import type { OrganizationMembershipRoleType } from "./organization-membership-role-type";
+/**
+ * A single organization-membership row, as returned by
+ * `GET /api/me/organizations`. Carries enough info to display a button
+ * linking to the org plus the user's role badge.
+ *
+ * `created_at` is the **organization's** creation timestamp (mirrors
+ * `OrganizationDefinition.created_at`).
+ * `joined_at` is the timestamp at which **this user** acquired their
+ * current role in the organization (the underlying membership row's
+ * `created_at` in the database).
+ *
+ * Distinct from `OrganizationMembershipRoleType` (the role enum) and from
+ * the auth-server's internal `OrganizationMembershipRoleDefinition` (DB
+ * row shape with `uid` + `membership_declaration_id`).
+ */
+export interface OrganizationMembershipRoleDetails {
+    organization_id: string;
+    organization_name: string;
+    role: OrganizationMembershipRoleType;
+    created_at: number;
+    joined_at: number;
+}
+export declare const organizationMembershipRoleDetailsSchema: z.ZodObject<{
+    created_at: z.ZodNumber;
+    organization_id: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+    organization_name: z.ZodString;
+    joined_at: z.ZodNumber;
+    role: z.ZodType<"admin" | "owner" | "member", z.ZodTypeDef, "admin" | "owner" | "member">;
+}, "strict", z.ZodTypeAny, {
+    created_at: number;
+    organization_id: string;
+    organization_name: string;
+    joined_at: number;
+    role: "admin" | "owner" | "member";
+}, {
+    created_at: number;
+    organization_id: string;
+    organization_name: string;
+    joined_at: number;
+    role: "admin" | "owner" | "member";
+}>;
+export declare function isValidOrganizationMembershipRoleDetails(value: unknown): value is OrganizationMembershipRoleDetails;

package/dist/organizations/organization_membership_role_details.js

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import { organizationIdSchema } from "./organization_id";
+import { organizationNameSchema } from "./organization_name";
+import { organizationMembershipRoleTypeSchema } from "./organization-membership-role-type";
+export const organizationMembershipRoleDetailsSchema = z
+    .object({
+    organization_id: organizationIdSchema,
+    organization_name: organizationNameSchema,
+    role: organizationMembershipRoleTypeSchema,
+    created_at: z.number().int().nonnegative(),
+    joined_at: z.number().int().nonnegative(),
+})
+    .required({
+    organization_id: true,
+    organization_name: true,
+    role: true,
+    created_at: true,
+    joined_at: true,
+})
+    .strict();
+export function isValidOrganizationMembershipRoleDetails(value) {
+    return organizationMembershipRoleDetailsSchema.safeParse(value).success;
+}
+//# sourceMappingURL=organization_membership_role_details.js.map

package/dist/organizations/organization_membership_role_details.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization_membership_role_details.js","sourceRoot":"","sources":["../../src/organizations/organization_membership_role_details.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AA0B3F,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,MAAM,CAAC;IACN,eAAe,EAAE,oBAAoB;IACrC,iBAAiB,EAAE,sBAAsB;IACzC,IAAI,EAAE,oCAAiF;IACvF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC;KACD,QAAQ,CAAC;IACR,eAAe,EAAE,IAAI;IACrB,iBAAiB,EAAE,IAAI;IACvB,IAAI,EAAE,IAAI;IACV,UAAU,EAAE,IAAI;IAChB,SAAS,EAAE,IAAI;CAChB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,UAAU,wCAAwC,CACtD,KAAc;IAEd,OAAO,uCAAuC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC"}

package/dist/organizations/organization_name.d.ts

@@ -0,0 +1,4 @@
+import { z } from "zod";
+export declare const organizationNameSchema: z.ZodString;
+export type OrganizationName = z.infer<typeof organizationNameSchema>;
+export declare function isValidOrganizationName(organization_name: string): organization_name is OrganizationName;

package/dist/organizations/organization_name.js

@@ -0,0 +1,11 @@
+import { z } from "zod";
+import { MAXIMUM_ORGANIZATION_NAME_LENGTH, MINIMUM_ORGANIZATION_NAME_LENGTH, } from "./organization_constants";
+export const organizationNameSchema = z
+    .string()
+    .min(MINIMUM_ORGANIZATION_NAME_LENGTH, `Organization name must be at least ${MINIMUM_ORGANIZATION_NAME_LENGTH} character${MINIMUM_ORGANIZATION_NAME_LENGTH >= 2 ? "s" : ""} long.`)
+    .max(MAXIMUM_ORGANIZATION_NAME_LENGTH, `Organization name may not be longer than ${MAXIMUM_ORGANIZATION_NAME_LENGTH} characters long.`)
+    .regex(/^[a-zA-Z0-9]([a-zA-Z0-9 _-]*[a-zA-Z0-9])?$/, "Organization name may only contain alphanumeric characters, spaces, hyphens, and underscores, and must start and end with an alphanumeric character.");
+export function isValidOrganizationName(organization_name) {
+    return organizationNameSchema.safeParse(organization_name).success;
+}
+//# sourceMappingURL=organization_name.js.map

package/dist/organizations/organization_name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization_name.js","sourceRoot":"","sources":["../../src/organizations/organization_name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAElC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,GAAG,CACF,gCAAgC,EAChC,sCAAsC,gCAAgC,aAAa,gCAAgC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAC5I;KACA,GAAG,CACF,gCAAgC,EAChC,4CAA4C,gCAAgC,mBAAmB,CAChG;KACA,KAAK,CACJ,4CAA4C,EAC5C,sJAAsJ,CACvJ,CAAC;AAIJ,MAAM,UAAU,uBAAuB,CACrC,iBAAyB;IAEzB,OAAO,sBAAsB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;AACrE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.12.3",
+  "version": "0.12.10",
   "license": "UNLICENSED",
   "private": false,
   "repository": {
@@ -14,7 +14,7 @@
   "types": "dist/index.d.ts",
   "dependencies": {
     "zod": "3.25.8",
-    "@schemavaults/app-definitions": "0.7.0",
+    "@schemavaults/app-definitions": "0.7.1",
     "crypto-js": "4.2.0"
   },
   "scripts": {
@@ -30,7 +30,7 @@
     "typescript": "5.8.3",
     "tsc-alias": "1.8.16",
     "@types/crypto-js": "4.2.0",
-    "bun-types": "1.3.11",
+    "bun-types": "1.3.14",
     "eslint": "9.39.1",
     "@eslint/js": "9.39.1",
     "globals": "16.5.0",
@@ -40,7 +40,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "packageManager": "bun@1.3.11",
+  "packageManager": "bun@1.3.14",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",