@schemavaults/auth-common 0.13.2 → 0.16.1

package/dist/audience-schema.d.ts

@@ -1,3 +1,4 @@
-import { z } from "zod";
-export declare const audienceRefSchema: z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>;
-export declare const audienceSchema: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
+import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
+import type { z as zod } from "zod";
+export declare function createAudienceSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>;
+export declare function createAudienceListSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodArray<zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, "many">;

package/dist/audience-schema.js

@@ -1,12 +1,29 @@
-import { apiServerIdSchema } from "@schemavaults/app-definitions";
-import { z } from "zod";
-export const audienceRefSchema = apiServerIdSchema;
+import { apiServerIdSchema, getAppEnvironment, getAuthServerAppId, getAuthServerUrl, } from "@schemavaults/app-definitions";
+// NOTE: Do not add module-scope `createAudienceSchema(...)` results here. The
+// factories below read SCHEMAVAULTS_APP_ENVIRONMENT (via getAppEnvironment()),
+// the auth-server URL, and the auth server's own app id, which are runtime
+// concerns; eager module-scope initialization breaks `next build` in Docker
+// where those env vars are unset.
+export function createAudienceSchema(z, environment = getAppEnvironment()) {
+    const auth_server_url = getAuthServerUrl(environment);
+    const auth_server_app_id = getAuthServerAppId();
+    const authServerUrlSchema = z
+        .string()
+        .url()
+        .refine((url) => url === auth_server_url)
+        .describe("Allow the auth-server URL configured for the current server!");
+    const apiServerIdWithoutAuthServerIdSchema = apiServerIdSchema
+        .refine((id) => {
+        return id !== auth_server_app_id;
+    }, `Auth app ID ('${auth_server_app_id}') is not allowed as an audience; use the auth-server URL for tokens with the auth-server audience!`)
+        .describe(`An API server ID, but the auth app's ID (${auth_server_app_id}) is forbidden.`);
+    return z.union([authServerUrlSchema, apiServerIdWithoutAuthServerIdSchema]);
+}
 const MAX_APPS_IN_AUDIENCE_LIST = 10;
-export const audienceSchema = z.union([
-    audienceRefSchema,
-    audienceRefSchema
+export function createAudienceListSchema(z, environment = getAppEnvironment()) {
+    return createAudienceSchema(z, environment)
         .array()
         .min(1, "Audience list may not be empty")
-        .max(MAX_APPS_IN_AUDIENCE_LIST, `Audience list may not contain more than ${MAX_APPS_IN_AUDIENCE_LIST} audience references.`),
-]);
+        .max(MAX_APPS_IN_AUDIENCE_LIST, `Audience list may not contain more than ${MAX_APPS_IN_AUDIENCE_LIST} audience references.`);
+}
 //# sourceMappingURL=audience-schema.js.map

package/dist/audience-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"audience-schema.js","sourceRoot":"","sources":["../src/audience-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAEnD,MAAM,yBAAyB,GAAG,EAA4B,CAAC;AAE/D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,iBAAiB;IACjB,iBAAiB;SACd,KAAK,EAAE;SACP,GAAG,CAAC,CAAC,EAAE,gCAAgC,CAAC;SACxC,GAAG,CACF,yBAAyB,EACzB,2CAA2C,yBAAyB,uBAAuB,CAC5F;CACJ,CAAC,CAAC"}
+{"version":3,"file":"audience-schema.js","sourceRoot":"","sources":["../src/audience-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,+BAA+B,CAAC;AAGvC,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,4EAA4E;AAC5E,kCAAkC;AAElC,MAAM,UAAU,oBAAoB,CAClC,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,MAAM,eAAe,GAAW,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAW,kBAAkB,EAAE,CAAC;IAExD,MAAM,mBAAmB,GAAG,CAAC;SAC1B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,GAAG,EAAiC,EAAE,CAAC,GAAG,KAAK,eAAe,CAAC;SACvE,QAAQ,CAAC,8DAA8D,CAAC,CAAC;IAE5E,MAAM,oCAAoC,GAAG,iBAAiB;SAC3D,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QACb,OAAO,EAAE,KAAK,kBAAkB,CAAC;IACnC,CAAC,EAAE,iBAAiB,kBAAkB,qGAAqG,CAAC;SAC3I,QAAQ,CACP,4CAA4C,kBAAkB,iBAAiB,CAChF,CAAC;IAEJ,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,yBAAyB,GAAG,EAA4B,CAAC;AAE/D,MAAM,UAAU,wBAAwB,CACtC,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC;SACxC,KAAK,EAAE;SACP,GAAG,CAAC,CAAC,EAAE,gCAAgC,CAAC;SACxC,GAAG,CACF,yBAAyB,EACzB,2CAA2C,yBAAyB,uBAAuB,CAC5F,CAAC;AACN,CAAC"}

package/dist/auth-error-message-catalog.js

@@ -22,8 +22,8 @@ export const ERROR_MESSAGE_CATALOG = {
     unauthenticated: "Failed to authenticate to figure out who you are! Try logging in again or contacting support...",
     forbidden: "Oops! You don't have permission to do that action! Get in touch with support if you believe this is a mistake!",
     account_disabled: "Your account has been disabled!",
-    load_user_data_failure: "There was an error loading data associated with your SchemaVaults account!",
-    internal_server_error: "There was a problem in the SchemaVaults backend logic and something caused a crash!",
+    load_user_data_failure: "There was an error loading data associated with your account!",
+    internal_server_error: "There was a problem in the backend logic and something caused a crash!",
     load_server_config_failure: "There was a problem loading server configuration settings.",
     server_misconfiguration: "The server does not appear to be configured properly. If you are the site admin, please see the logs for more details.",
     account_not_in_organization: "Your account is not a member of the organization required for the attempted action.",

package/dist/auth-error-message-catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error-message-catalog.js","sourceRoot":"","sources":["../src/auth-error-message-catalog.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG;IAChB,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,yBAAyB;IACzB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,wBAAwB;IACxB,uBAAuB;IACvB,4BAA4B;IAC5B,yBAAyB;IACzB,6BAA6B;IAC7B,wBAAwB;IACxB,sBAAsB;CACc,CAAC;AAIvC,MAAM,CAAC,MAAM,qBAAqB,GAA4C;IAC5E,OAAO,EAAE,2BAA2B;IACpC,WAAW,EAAE,wCAAwC;IACrD,gBAAgB,EAAE,kCAAkC;IACpD,uBAAuB,EAAE,wCAAwC;IACjE,eAAe,EACb,iGAAiG;IACnG,SAAS,EACP,gHAAgH;IAClH,gBAAgB,EAAE,iCAAiC;IACnD,sBAAsB,EACpB,4EAA4E;IAC9E,qBAAqB,EACnB,qFAAqF;IACvF,0BAA0B,EACxB,4DAA4D;IAC9D,uBAAuB,EACrB,wHAAwH;IAC1H,2BAA2B,EACzB,qFAAqF;IACvF,sBAAsB,EACpB,oGAAoG;IACtG,oBAAoB,EAClB,6HAA6H;CAChI,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAA8C,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"auth-error-message-catalog.js","sourceRoot":"","sources":["../src/auth-error-message-catalog.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG;IAChB,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,yBAAyB;IACzB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,wBAAwB;IACxB,uBAAuB;IACvB,4BAA4B;IAC5B,yBAAyB;IACzB,6BAA6B;IAC7B,wBAAwB;IACxB,sBAAsB;CACc,CAAC;AAIvC,MAAM,CAAC,MAAM,qBAAqB,GAA4C;IAC5E,OAAO,EAAE,2BAA2B;IACpC,WAAW,EAAE,wCAAwC;IACrD,gBAAgB,EAAE,kCAAkC;IACpD,uBAAuB,EAAE,wCAAwC;IACjE,eAAe,EACb,iGAAiG;IACnG,SAAS,EACP,gHAAgH;IAClH,gBAAgB,EAAE,iCAAiC;IACnD,sBAAsB,EACpB,+DAA+D;IACjE,qBAAqB,EACnB,wEAAwE;IAC1E,0BAA0B,EACxB,4DAA4D;IAC9D,uBAAuB,EACrB,wHAAwH;IAC1H,2BAA2B,EACzB,qFAAqF;IACvF,sBAAsB,EACpB,oGAAoG;IACtG,oBAAoB,EAClB,6HAA6H;CAChI,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAA8C,CAAC,CAAC;AAC5E,CAAC"}

package/dist/auth_acquire_tokens_grant_types.d.ts

@@ -1,14 +1,15 @@
-import { z } from "zod";
+import type { z as zod } from "zod";
+import { SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
 export declare const grant_types: readonly ["authorization_code", "refresh_token"];
-export declare const authorizationCodePOSTbody: z.ZodObject<{
-    code: z.ZodEffects<z.ZodString, string, string>;
-    challenge_time: z.ZodNumber;
-    code_verifier: z.ZodEffects<z.ZodString, string, string>;
-    audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
-    client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
-    grant_type: z.ZodLiteral<"authorization_code">;
-    redirect_uri: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-}, "strict", z.ZodTypeAny, {
+export declare function createAuthorizationCodePOSTBodySchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodObject<{
+    code: zod.ZodString;
+    challenge_time: zod.ZodNumber;
+    code_verifier: zod.ZodEffects<zod.ZodString, string, string>;
+    audience: zod.ZodUnion<[zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, zod.ZodArray<zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, "many">]>;
+    client_app_id: zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>;
+    grant_type: zod.ZodLiteral<"authorization_code">;
+    redirect_uri: zod.ZodOptional<zod.ZodNullable<zod.ZodString>>;
+}, "strict", zod.ZodTypeAny, {
     code: string;
     challenge_time: number;
     code_verifier: string;
@@ -25,12 +26,12 @@ export declare const authorizationCodePOSTbody: z.ZodObject<{
     grant_type: "authorization_code";
     redirect_uri?: string | null | undefined;
 }>;
-export declare const refreshTokenPOSTbody: z.ZodObject<{
-    audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
-    client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
-    grant_type: z.ZodLiteral<"refresh_token">;
-    replaceRefreshToo: z.ZodOptional<z.ZodBoolean>;
-}, "strict", z.ZodTypeAny, {
+export declare function createRefreshTokenPOSTBodySchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodObject<{
+    audience: zod.ZodUnion<[zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, zod.ZodArray<zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, "many">]>;
+    client_app_id: zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>;
+    grant_type: zod.ZodLiteral<"refresh_token">;
+    replaceRefreshToo: zod.ZodOptional<zod.ZodBoolean>;
+}, "strict", zod.ZodTypeAny, {
     audience: string | string[];
     client_app_id: string;
     grant_type: "refresh_token";
@@ -41,46 +42,3 @@ export declare const refreshTokenPOSTbody: z.ZodObject<{
     grant_type: "refresh_token";
     replaceRefreshToo?: boolean | undefined;
 }>;
-export declare const grantTypePOSTbodySchemaMap: {
-    readonly authorization_code: z.ZodObject<{
-        code: z.ZodEffects<z.ZodString, string, string>;
-        challenge_time: z.ZodNumber;
-        code_verifier: z.ZodEffects<z.ZodString, string, string>;
-        audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
-        client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
-        grant_type: z.ZodLiteral<"authorization_code">;
-        redirect_uri: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    }, "strict", z.ZodTypeAny, {
-        code: string;
-        challenge_time: number;
-        code_verifier: string;
-        audience: string | string[];
-        client_app_id: string;
-        grant_type: "authorization_code";
-        redirect_uri?: string | null | undefined;
-    }, {
-        code: string;
-        challenge_time: number;
-        code_verifier: string;
-        audience: string | string[];
-        client_app_id: string;
-        grant_type: "authorization_code";
-        redirect_uri?: string | null | undefined;
-    }>;
-    readonly refresh_token: z.ZodObject<{
-        audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
-        client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
-        grant_type: z.ZodLiteral<"refresh_token">;
-        replaceRefreshToo: z.ZodOptional<z.ZodBoolean>;
-    }, "strict", z.ZodTypeAny, {
-        audience: string | string[];
-        client_app_id: string;
-        grant_type: "refresh_token";
-        replaceRefreshToo?: boolean | undefined;
-    }, {
-        audience: string | string[];
-        client_app_id: string;
-        grant_type: "refresh_token";
-        replaceRefreshToo?: boolean | undefined;
-    }>;
-};

package/dist/auth_acquire_tokens_grant_types.js

@@ -1,56 +1,56 @@
 import { PKCE_ProofKeyManager } from "./pkce";
-import { z } from "zod";
-import { audienceSchema } from "./audience-schema";
-import { appIdSchema } from "@schemavaults/app-definitions";
+import { createAudienceListSchema, createAudienceSchema, } from "./audience-schema";
+import { appIdSchema, getAppEnvironment, } from "@schemavaults/app-definitions";
 export const grant_types = [
     "authorization_code",
     "refresh_token",
 ];
-const _createTokenEndpointBaseSchema = z.object({
-    audience: audienceSchema,
-    client_app_id: appIdSchema,
-});
-export const authorizationCodePOSTbody = _createTokenEndpointBaseSchema
-    .extend({
-    grant_type: z.literal("authorization_code"),
-    code: z
-        .string()
-        .min(64)
-        .max(1024)
-        .refine((value) => /^[A-Za-z0-9_-]+$/.test(value)),
-    code_verifier: PKCE_ProofKeyManager.codeChallengeSchema,
-    challenge_time: z.number().nonnegative(),
-    // OAuth2 `redirect_uri` (RFC 6749 §4.1.3) bound to the issued
-    // authorization code. The token endpoint verifies this matches the
-    // value persisted on the authorization_codes row by exact string
-    // equality, so a code minted for URI A cannot be redeemed by
-    // presenting URI B even when both share an allowlisted origin.
-    // Null/absent is reserved for the auth server's own account flow,
-    // which has no third-party callback.
-    redirect_uri: z.string().url().nullable().optional(),
-})
-    .required({
-    grant_type: true,
-    audience: true,
-    client_app_id: true,
-    code: true,
-    code_verifier: true,
-    challenge_time: true,
-})
-    .strict();
-export const refreshTokenPOSTbody = _createTokenEndpointBaseSchema
-    .extend({
-    grant_type: z.literal("refresh_token"),
-    replaceRefreshToo: z.boolean().optional(),
-})
-    .required({
-    grant_type: true,
-    audience: true,
-    client_app_id: true,
-})
-    .strict();
-export const grantTypePOSTbodySchemaMap = {
-    authorization_code: authorizationCodePOSTbody,
-    refresh_token: refreshTokenPOSTbody,
-};
+function createTokenEndpointBaseSchema(z, environment = getAppEnvironment()) {
+    return z.object({
+        audience: z.union([
+            createAudienceSchema(z, environment),
+            createAudienceListSchema(z, environment),
+        ]),
+        client_app_id: appIdSchema,
+    });
+}
+export function createAuthorizationCodePOSTBodySchema(z, environment = getAppEnvironment()) {
+    return createTokenEndpointBaseSchema(z, environment)
+        .extend({
+        grant_type: z.literal("authorization_code"),
+        code: z.string().min(64).max(1024).base64url(),
+        code_verifier: PKCE_ProofKeyManager.codeChallengeSchema,
+        challenge_time: z.number().nonnegative(),
+        // OAuth2 `redirect_uri` (RFC 6749 §4.1.3) bound to the issued
+        // authorization code. The token endpoint verifies this matches the
+        // value persisted on the authorization_codes row by exact string
+        // equality, so a code minted for URI A cannot be redeemed by
+        // presenting URI B even when both share an allowlisted origin.
+        // Null/absent is reserved for the auth server's own account flow,
+        // which has no third-party callback.
+        redirect_uri: z.string().url().nullable().optional(),
+    })
+        .required({
+        grant_type: true,
+        audience: true,
+        client_app_id: true,
+        code: true,
+        code_verifier: true,
+        challenge_time: true,
+    })
+        .strict();
+}
+export function createRefreshTokenPOSTBodySchema(z, environment = getAppEnvironment()) {
+    return createTokenEndpointBaseSchema(z, environment)
+        .extend({
+        grant_type: z.literal("refresh_token"),
+        replaceRefreshToo: z.boolean().optional(),
+    })
+        .required({
+        grant_type: true,
+        audience: true,
+        client_app_id: true,
+    })
+        .strict();
+}
 //# sourceMappingURL=auth_acquire_tokens_grant_types.js.map

package/dist/auth_acquire_tokens_grant_types.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAkB,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,WAAW;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B;KACpE,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC3C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,IAAI,CAAC;SACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IACxC,8DAA8D;IAC9D,mEAAmE;IACnE,iEAAiE;IACjE,6DAA6D;IAC7D,+DAA+D;IAC/D,kEAAkE;IAClE,qCAAqC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;IACnB,IAAI,EAAE,IAAI;IACV,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B;KAC/D,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kBAAkB,EAAE,yBAAyB;IAC7C,aAAa,EAAE,oBAAoB;CAC+B,CAAC"}
+{"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,SAAS,6BAA6B,CACpC,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC;YAChB,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC;YACpC,wBAAwB,CAAC,CAAC,EAAE,WAAW,CAAC;SACzC,CAAC;QACF,aAAa,EAAE,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,CAAC;SACjD,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE;QAC9C,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;QACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;QACxC,8DAA8D;QAC9D,mEAAmE;QACnE,iEAAiE;QACjE,6DAA6D;QAC7D,+DAA+D;QAC/D,kEAAkE;QAClE,qCAAqC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrD,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,IAAI,EAAE,IAAI;QACV,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,IAAI;KACrB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,CAAC;SACjD,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;KACpB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC"}

package/dist/authorize-client-application-form-type.d.ts

@@ -1,13 +1,9 @@
 import { z } from "zod";
-export declare const authorizeClientApplicationFormType: z.ZodEffects<z.ZodObject<{
-    app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
+export declare const authorizeClientApplicationFormType: z.ZodObject<{
+    app_id: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
 }, "strict", z.ZodTypeAny, {
     app_id: string;
 }, {
     app_id: string;
-}>, {
-    app_id: string;
-}, {
-    app_id: string;
 }>;
 export default authorizeClientApplicationFormType;

package/dist/authorize-client-application-form-type.js

@@ -1,4 +1,4 @@
-import { appIdSchema, isHardcodedAppId } from "@schemavaults/app-definitions";
+import { appIdSchema } from "@schemavaults/app-definitions";
 import { z } from "zod";
 export const authorizeClientApplicationFormType = z
     .object({
@@ -7,14 +7,6 @@ export const authorizeClientApplicationFormType = z
     .required({
     app_id: true,
 })
-    .strict()
-    .refine((values) => {
-    if (isHardcodedAppId(values.app_id)) {
-        return false;
-    }
-    else {
-        return true;
-    }
-}, "Hardcoded client applications are automatically pre-authorized!");
+    .strict();
 export default authorizeClientApplicationFormType;
 //# sourceMappingURL=authorize-client-application-form-type.js.map

package/dist/authorize-client-application-form-type.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize-client-application-form-type.js","sourceRoot":"","sources":["../src/authorize-client-application-form-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,MAAM,CAAC;IACN,MAAM,EAAE,WAAW;CACpB,CAAC;KACD,QAAQ,CAAC;IACR,MAAM,EAAE,IAAI;CACb,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;IAC1B,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,EAAE,iEAAiE,CAAC,CAAC;AAExE,eAAe,kCAAkC,CAAC"}
+{"version":3,"file":"authorize-client-application-form-type.js","sourceRoot":"","sources":["../src/authorize-client-application-form-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,MAAM,CAAC;IACN,MAAM,EAAE,WAAW;CACpB,CAAC;KACD,QAAQ,CAAC;IACR,MAAM,EAAE,IAAI;CACb,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,eAAe,kCAAkC,CAAC"}

package/dist/cors/index.d.ts

@@ -0,0 +1 @@
+export { isOriginInAllowedList } from "./is-origin-in-allowed-list";

package/dist/cors/index.js

@@ -0,0 +1,2 @@
+export { isOriginInAllowedList } from "./is-origin-in-allowed-list";
+//# sourceMappingURL=index.js.map

package/dist/cors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/cors/is-origin-in-allowed-list.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Check if an origin is in a list of allowed origins.
+ *
+ * Matching is exact, but tolerant of a single trailing slash on either the
+ * request origin or the allowed origin (e.g. "https://app.example.com" and
+ * "https://app.example.com/" match each other).
+ */
+export declare function isOriginInAllowedList(origin: string, allowedOrigins: readonly string[]): boolean;
+export default isOriginInAllowedList;

package/dist/cors/is-origin-in-allowed-list.js

@@ -0,0 +1,22 @@
+/**
+ * Check if an origin is in a list of allowed origins.
+ *
+ * Matching is exact, but tolerant of a single trailing slash on either the
+ * request origin or the allowed origin (e.g. "https://app.example.com" and
+ * "https://app.example.com/" match each other).
+ */
+export function isOriginInAllowedList(origin, allowedOrigins) {
+    return allowedOrigins.some((allowed) => {
+        // Direct match
+        if (origin === allowed)
+            return true;
+        // Origin may or may not have trailing slash
+        if (origin === allowed.replace(/\/$/, ""))
+            return true;
+        if (origin.replace(/\/$/, "") === allowed)
+            return true;
+        return false;
+    });
+}
+export default isOriginInAllowedList;
+//# sourceMappingURL=is-origin-in-allowed-list.js.map

package/dist/cors/is-origin-in-allowed-list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-origin-in-allowed-list.js","sourceRoot":"","sources":["../../src/cors/is-origin-in-allowed-list.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,cAAiC;IAEjC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACrC,eAAe;QACf,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpC,4CAA4C;QAC5C,IAAI,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,eAAe,qBAAqB,CAAC"}

package/dist/determineRefreshTokenCookieSameSiteValue.js

@@ -1,9 +1,9 @@
-import { SCHEMAVAULTS_AUTH_APP_ID, } from "@schemavaults/app-definitions";
+import { getAuthServerAppId, } from "@schemavaults/app-definitions";
 // SameSite=none | send cookie in all contexts
 // SameSite=strict | send cookie in same-site contexts (navigations and other requests)
 // SameSite=lax | send cookie in same-site requests and when navigating
 export function determineRefreshTokenCookieSameSiteValue(client_app_id, secure) {
-    const isAuthServer = SCHEMAVAULTS_AUTH_APP_ID === client_app_id;
+    const isAuthServer = getAuthServerAppId() === client_app_id;
     if (isAuthServer) {
         return secure ? "strict" : "lax";
     }

package/dist/determineRefreshTokenCookieSameSiteValue.js.map

@@ -1 +1 @@
-{"version":3,"file":"determineRefreshTokenCookieSameSiteValue.js","sourceRoot":"","sources":["../src/determineRefreshTokenCookieSameSiteValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AAEvC,8CAA8C;AAC9C,uFAAuF;AACvF,uEAAuE;AACvE,MAAM,UAAU,wCAAwC,CACtD,aAAoB,EACpB,MAAe;IAEf,MAAM,YAAY,GAAY,wBAAwB,KAAK,aAAa,CAAC;IACzE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,eAAe,wCAAwC,CAAC"}
+{"version":3,"file":"determineRefreshTokenCookieSameSiteValue.js","sourceRoot":"","sources":["../src/determineRefreshTokenCookieSameSiteValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AAEvC,8CAA8C;AAC9C,uFAAuF;AACvF,uEAAuE;AACvE,MAAM,UAAU,wCAAwC,CACtD,aAAoB,EACpB,MAAe;IAEf,MAAM,YAAY,GAAY,kBAAkB,EAAE,KAAK,aAAa,CAAC;IACrE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,eAAe,wCAAwC,CAAC"}

package/dist/index.d.ts

@@ -12,15 +12,15 @@ export * from "./pkce";
 export type * from "./pkce";
 export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, collapseWebauthnFactors, type AuthenticateResult, type AuthenticatedAuthenticateResult, type MfaRequiredAuthenticateResult, type AuthenticateFailureResult, type ChallengeExpiredAuthenticateResult, type AvailableMfaFactor, } from "./authenticate_result";
 export * from "./mfa";
-export { requestTokensResultSchema, type RequestTokensResult, successfullyGeneratedTokensRecordSchema, type SuccessfullyGeneratedTokensRecord, } from "./request_tokens_result";
+export { createRequestTokensResultSchema, type RequestTokensResult, createSuccessfullyGeneratedTokensRecordSchema, type SuccessfullyGeneratedTokensRecord, } from "./request_tokens_result";
 export * from "./auth_acquire_tokens_grant_types";
 export type * from "./auth_acquire_tokens_grant_types";
-export { PRODUCTION_AUTH_SERVER_URL } from "@schemavaults/app-definitions";
+export { getAuthServerUrl } from "@schemavaults/app-definitions";
 export { appIdSchema } from "@schemavaults/app-definitions";
-export { audienceSchema, audienceRefSchema } from "./audience-schema";
+export { createAudienceSchema, createAudienceListSchema, } from "./audience-schema";
 export { inviteCodeFormatSchema, inviteCodeDefinitionSchema, } from "./invite-code";
 export type { InviteCode, InviteCodeDefinition } from "./invite-code";
-export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, organizationDefinitionSchema, hardcodedOrgs, SCHEMAVAULTS_ORGANIZATION_ID, MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, inviteMemberInputModes, inviteMemberFormSchema, organizationInvitationStatusTypes, organizationInvitationStatusSchema, organizationInvitationSchema, organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, isValidOrganizationMembershipRoleType, organizationMembershipRoleDetailsSchema, isValidOrganizationMembershipRoleDetails, } from "./organizations";
+export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, organizationDefinitionSchema, getHardcodedOrgs, getAuthServerOwnerOrganizationId, DEFAULT_AUTH_SERVER_OWNER_ORGANIZATION_ID, getAuthServerOwnerOrganizationName, DEFAULT_AUTH_SERVER_OWNER_ORGANIZATION_NAME, MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, inviteMemberInputModes, inviteMemberFormSchema, organizationInvitationStatusTypes, organizationInvitationStatusSchema, organizationInvitationSchema, organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, isValidOrganizationMembershipRoleType, organizationMembershipRoleDetailsSchema, isValidOrganizationMembershipRoleDetails, } from "./organizations";
 export type { OrganizationID, OrganizationDefinition, InviteMemberInputMode, InviteMemberFormValues, InviteMemberSubmitData, OrganizationInvitationStatus, OrganizationInvitation, UserPendingInvitation, OrganizationInvitationWithUserData, OrganizationMembershipRoleType, OrganizationMembershipRoleDetails, } from "./organizations";
 export { MaximumBrowserCookieSize } from "./MaximumBrowserCookieSize";
 export { RefreshTokenCookieName, RefreshTokenExpiryCookieName, } from "./RefreshTokenCookieNames";
@@ -30,5 +30,7 @@ export { authorizeClientApplicationFormType } from "./authorize-client-applicati
 export { paginationOptionsSchema, DEFAULT_PAGINATION_PAGE_INDEX, DEFAULT_PAGINATION_PAGE_SIZE, isValidPaginationOptions, } from "./pagination";
 export type { PaginationOptions } from "./pagination";
 export { timingSafeStringEqual } from "./timing-safe-string-equal";
+export { isOriginInAllowedList } from "./cors";
 export { oauth2StateSchema, OAUTH2_STATE_VSCHAR_REGEX, parseOAuth2State, OAuth2StateValidationError, } from "./oauth2-state-schema";
 export type { OAuth2State } from "./oauth2-state-schema";
+export { createAuthorizationCodePOSTBodySchema, createRefreshTokenPOSTBodySchema, } from "./auth_acquire_tokens_grant_types";

package/dist/index.js

@@ -7,13 +7,13 @@ export * from "./middleware";
 export * from "./pkce";
 export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, collapseWebauthnFactors, } from "./authenticate_result";
 export * from "./mfa";
-export { requestTokensResultSchema, successfullyGeneratedTokensRecordSchema, } from "./request_tokens_result";
+export { createRequestTokensResultSchema, createSuccessfullyGeneratedTokensRecordSchema, } from "./request_tokens_result";
 export * from "./auth_acquire_tokens_grant_types";
-export { PRODUCTION_AUTH_SERVER_URL } from "@schemavaults/app-definitions";
+export { getAuthServerUrl } from "@schemavaults/app-definitions";
 export { appIdSchema } from "@schemavaults/app-definitions";
-export { audienceSchema, audienceRefSchema } from "./audience-schema";
+export { createAudienceSchema, createAudienceListSchema, } from "./audience-schema";
 export { inviteCodeFormatSchema, inviteCodeDefinitionSchema, } from "./invite-code";
-export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, organizationDefinitionSchema, hardcodedOrgs, SCHEMAVAULTS_ORGANIZATION_ID, MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, inviteMemberInputModes, inviteMemberFormSchema, organizationInvitationStatusTypes, organizationInvitationStatusSchema, organizationInvitationSchema, organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, isValidOrganizationMembershipRoleType, organizationMembershipRoleDetailsSchema, isValidOrganizationMembershipRoleDetails, } from "./organizations";
+export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, organizationDefinitionSchema, getHardcodedOrgs, getAuthServerOwnerOrganizationId, DEFAULT_AUTH_SERVER_OWNER_ORGANIZATION_ID, getAuthServerOwnerOrganizationName, DEFAULT_AUTH_SERVER_OWNER_ORGANIZATION_NAME, MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, inviteMemberInputModes, inviteMemberFormSchema, organizationInvitationStatusTypes, organizationInvitationStatusSchema, organizationInvitationSchema, organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, isValidOrganizationMembershipRoleType, organizationMembershipRoleDetailsSchema, isValidOrganizationMembershipRoleDetails, } from "./organizations";
 export { MaximumBrowserCookieSize } from "./MaximumBrowserCookieSize";
 export { RefreshTokenCookieName, RefreshTokenExpiryCookieName, } from "./RefreshTokenCookieNames";
 export { AccessTokenCookieName, AccessTokenExpiryCookieName, } from "./AccessTokenCookieNames";
@@ -21,5 +21,7 @@ export { determineRefreshTokenCookieSameSiteValue } from "./determineRefreshToke
 export { authorizeClientApplicationFormType } from "./authorize-client-application-form-type";
 export { paginationOptionsSchema, DEFAULT_PAGINATION_PAGE_INDEX, DEFAULT_PAGINATION_PAGE_SIZE, isValidPaginationOptions, } from "./pagination";
 export { timingSafeStringEqual } from "./timing-safe-string-equal";
+export { isOriginInAllowedList } from "./cors";
 export { oauth2StateSchema, OAUTH2_STATE_VSCHAR_REGEX, parseOAuth2State, OAuth2StateValidationError, } from "./oauth2-state-schema";
+export { createAuthorizationCodePOSTBodySchema, createRefreshTokenPOSTBodySchema, } from "./auth_acquire_tokens_grant_types";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,yBAAyB,EAEzB,uCAAuC,GAExC,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,aAAa,EACb,4BAA4B,EAC5B,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,+BAA+B,EAE/B,6CAA6C,GAE9C,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,gBAAgB,EAChB,gCAAgC,EAChC,yCAAyC,EACzC,kCAAkC,EAClC,2CAA2C,EAC3C,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,qCAAqC,EACrC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC"}

package/dist/mfa/mfa-verify-body.d.ts

@@ -81,7 +81,7 @@ export declare const mfaProofSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObjec
 export type MfaProof = z.infer<typeof mfaProofSchema>;
 export declare const mfaVerifyBodySchema: z.ZodObject<{
     challenge_id: z.ZodString;
-    client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
+    client_app_id: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
     proof: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
         type: z.ZodLiteral<"totp">;
         factor_id: z.ZodString;

package/dist/organizations/hardcoded_orgs.d.ts

@@ -1,3 +1,10 @@
 import { OrganizationDefinition } from "./organization_definition";
-export declare const hardcodedOrgs: readonly OrganizationDefinition[];
-export default hardcodedOrgs;
+/**
+ * @description Builds the virtual "hardcoded" organizations fresh on each call
+ * so the owner organization's ID and display name are resolved from the
+ * SCHEMAVAULTS_AUTH_SERVER_OWNER_ORGANIZATION / _NAME environment variables at
+ * call time rather than module load. Server-side only — client code should
+ * receive the value via context/props (see useAuthUiOwnerOrganizationId).
+ */
+export declare function getHardcodedOrgs(): readonly OrganizationDefinition[];
+export default getHardcodedOrgs;

package/dist/organizations/hardcoded_orgs.js

@@ -1,11 +1,20 @@
-import SCHEMAVAULTS_ORGANIZATION_ID from "./schemavaults_org_id";
+import { getAuthServerOwnerOrganizationId, getAuthServerOwnerOrganizationName, } from "@schemavaults/app-definitions";
 const DefaultHardcodedOrgCreationTime = new Date("2024-01-01T00:00:00Z");
-export const hardcodedOrgs = [
-    {
-        name: "SchemaVaults",
-        organization_id: SCHEMAVAULTS_ORGANIZATION_ID,
-        created_at: DefaultHardcodedOrgCreationTime.getTime(),
-    },
-];
-export default hardcodedOrgs;
+/**
+ * @description Builds the virtual "hardcoded" organizations fresh on each call
+ * so the owner organization's ID and display name are resolved from the
+ * SCHEMAVAULTS_AUTH_SERVER_OWNER_ORGANIZATION / _NAME environment variables at
+ * call time rather than module load. Server-side only — client code should
+ * receive the value via context/props (see useAuthUiOwnerOrganizationId).
+ */
+export function getHardcodedOrgs() {
+    return [
+        {
+            name: getAuthServerOwnerOrganizationName(),
+            organization_id: getAuthServerOwnerOrganizationId(),
+            created_at: DefaultHardcodedOrgCreationTime.getTime(),
+        },
+    ];
+}
+export default getHardcodedOrgs;
 //# sourceMappingURL=hardcoded_orgs.js.map

package/dist/organizations/hardcoded_orgs.js.map

@@ -1 +1 @@
-{"version":3,"file":"hardcoded_orgs.js","sourceRoot":"","sources":["../../src/organizations/hardcoded_orgs.ts"],"names":[],"mappings":"AACA,OAAO,4BAA4B,MAAM,uBAAuB,CAAC;AAEjE,MAAM,+BAA+B,GAAG,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,aAAa,GAAsC;IAC9D;QACE,IAAI,EAAE,cAAc;QACpB,eAAe,EAAE,4BAA4B;QAC7C,UAAU,EAAE,+BAA+B,CAAC,OAAO,EAAE;KACtD;CACF,CAAC;AAEF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"hardcoded_orgs.js","sourceRoot":"","sources":["../../src/organizations/hardcoded_orgs.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,kCAAkC,GACnC,MAAM,+BAA+B,CAAC;AAGvC,MAAM,+BAA+B,GAAG,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL;YACE,IAAI,EAAE,kCAAkC,EAAE;YAC1C,eAAe,EAAE,gCAAgC,EAAE;YACnD,UAAU,EAAE,+BAA+B,CAAC,OAAO,EAAE;SACtD;KACF,CAAC;AACJ,CAAC;AAED,eAAe,gBAAgB,CAAC"}

package/dist/organizations/index.d.ts

@@ -4,8 +4,8 @@ export { organizationDefinitionSchema } from "./organization_definition";
 export type { OrganizationDefinition } from "./organization_definition";
 export { organizationNameSchema, isValidOrganizationName, } from "./organization_name";
 export type { OrganizationName } from "./organization_name";
-export { SCHEMAVAULTS_ORGANIZATION_ID } from "./schemavaults_org_id";
-export { hardcodedOrgs } from "./hardcoded_orgs";
+export { getAuthServerOwnerOrganizationId, DEFAULT_AUTH_SERVER_OWNER_ORGANIZATION_ID, getAuthServerOwnerOrganizationName, DEFAULT_AUTH_SERVER_OWNER_ORGANIZATION_NAME, } from "@schemavaults/app-definitions";
+export { getHardcodedOrgs } from "./hardcoded_orgs";
 export { MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, } from "./organization_constants";
 export { inviteMemberInputModes, inviteMemberFormSchema, } from "./invite_member_form";
 export type { InviteMemberInputMode, InviteMemberFormValues, InviteMemberSubmitData, } from "./invite_member_form";

package/dist/organizations/index.js

@@ -1,8 +1,8 @@
 export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, } from "./organization_id";
 export { organizationDefinitionSchema } from "./organization_definition";
 export { organizationNameSchema, isValidOrganizationName, } from "./organization_name";
-export { SCHEMAVAULTS_ORGANIZATION_ID } from "./schemavaults_org_id";
-export { hardcodedOrgs } from "./hardcoded_orgs";
+export { getAuthServerOwnerOrganizationId, DEFAULT_AUTH_SERVER_OWNER_ORGANIZATION_ID, getAuthServerOwnerOrganizationName, DEFAULT_AUTH_SERVER_OWNER_ORGANIZATION_NAME, } from "@schemavaults/app-definitions";
+export { getHardcodedOrgs } from "./hardcoded_orgs";
 export { MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, } from "./organization_constants";
 export { inviteMemberInputModes, inviteMemberFormSchema, } from "./invite_member_form";
 export { organizationInvitationStatusTypes, organizationInvitationStatusSchema, organizationInvitationSchema, } from "./organization_invitation";

package/dist/organizations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAGzE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EACL,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAQnC,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EACL,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,wCAAwC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAGzE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,gCAAgC,EAChC,yCAAyC,EACzC,kCAAkC,EAClC,2CAA2C,GAC5C,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EACL,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAQnC,OAAO,EACL,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EACL,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,wCAAwC,CAAC"}

package/dist/organizations/organization_constants.d.ts

@@ -1,5 +1,4 @@
-export declare const MINIMUM_ORGANIZATION_ID_LENGTH: 4;
-export declare const MAXIMUM_ORGANIZATION_ID_LENGTH: 32;
+export { MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, } from "@schemavaults/app-definitions";
 export declare const MINIMUM_ORGANIZATION_NAME_LENGTH: 1;
 export declare const MAXIMUM_ORGANIZATION_NAME_LENGTH: 64;
 export declare const MAXIMUM_USER_ORGANIZATIONS: 10;

package/dist/organizations/organization_constants.js

@@ -1,5 +1,6 @@
-export const MINIMUM_ORGANIZATION_ID_LENGTH = 4;
-export const MAXIMUM_ORGANIZATION_ID_LENGTH = 32;
+// The ID length limits moved to @schemavaults/app-definitions alongside
+// organizationIdSchema; re-exported here to keep this package's public API unchanged.
+export { MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, } from "@schemavaults/app-definitions";
 export const MINIMUM_ORGANIZATION_NAME_LENGTH = 1;
 export const MAXIMUM_ORGANIZATION_NAME_LENGTH = 64;
 export const MAXIMUM_USER_ORGANIZATIONS = 10;

package/dist/organizations/organization_constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization_constants.js","sourceRoot":"","sources":["../../src/organizations/organization_constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAA2B,CAAC;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAA4B,CAAC;AAE3E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAA2B,CAAC;AAC5E,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAA4B,CAAC;AAE7E,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAA4B,CAAC"}
+{"version":3,"file":"organization_constants.js","sourceRoot":"","sources":["../../src/organizations/organization_constants.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,sFAAsF;AACtF,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAA2B,CAAC;AAC5E,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAA4B,CAAC;AAE7E,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAA4B,CAAC"}

package/dist/organizations/organization_id.d.ts

@@ -1,5 +1,2 @@
-import { z } from "zod";
-export declare const RESERVED_ORGANIZATION_IDS: readonly ["new", "create", "delete", "update"];
-export declare const organizationIdSchema: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
-export type OrganizationID = z.infer<typeof organizationIdSchema>;
-export declare function isValidOrganizationID(organization_id: string): organization_id is OrganizationID;
+export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, } from "@schemavaults/app-definitions";
+export type { OrganizationID } from "@schemavaults/app-definitions";

package/dist/organizations/organization_id.js

@@ -1,24 +1,5 @@
-import { z } from "zod";
-import { MAXIMUM_ORGANIZATION_ID_LENGTH, MINIMUM_ORGANIZATION_ID_LENGTH, } from "./organization_constants";
-export const RESERVED_ORGANIZATION_IDS = [
-    "new",
-    "create",
-    "delete",
-    "update",
-];
-export const organizationIdSchema = z
-    .string()
-    .min(MINIMUM_ORGANIZATION_ID_LENGTH, `Organization ID must be at least ${MINIMUM_ORGANIZATION_ID_LENGTH} characters long.`)
-    .max(MAXIMUM_ORGANIZATION_ID_LENGTH, `Organization ID may not be longer than ${MAXIMUM_ORGANIZATION_ID_LENGTH} characters long.`)
-    .regex(/^[a-z][a-z0-9_-]+$/, "Organization ID must start with a letter, and may only contain lowercase alphanumeric characters, numbers, hyphens and underscores.")
-    .refine((orgId) => {
-    if (orgId.endsWith("_") || orgId.endsWith("-")) {
-        return false;
-    }
-    return true;
-}, "Organization ID may not end with a hyphen or dash.")
-    .refine((orgId) => !RESERVED_ORGANIZATION_IDS.includes(orgId), "This organization ID is reserved and cannot be used.");
-export function isValidOrganizationID(organization_id) {
-    return organizationIdSchema.safeParse(organization_id).success;
-}
+// Organization ID validation moved to @schemavaults/app-definitions so the
+// env-driven owner-organization getter can validate without a circular
+// dependency; re-exported here to keep this package's public API unchanged.
+export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, } from "@schemavaults/app-definitions";
 //# sourceMappingURL=organization_id.js.map

package/dist/organizations/organization_id.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization_id.js","sourceRoot":"","sources":["../../src/organizations/organization_id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAElC,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,QAAQ;CAC4B,CAAC;AAEvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,GAAG,CACF,8BAA8B,EAC9B,oCAAoC,8BAA8B,mBAAmB,CACtF;KACA,GAAG,CACF,8BAA8B,EAC9B,0CAA0C,8BAA8B,mBAAmB,CAC5F;KACA,KAAK,CACJ,oBAAoB,EACpB,qIAAqI,CACtI;KACA,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE;IACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,EAAE,oDAAoD,CAAC;KACvD,MAAM,CACL,CAAC,KAAa,EAAW,EAAE,CACzB,CAAC,yBAAyB,CAAC,QAAQ,CAAC,KAAmD,CAAC,EAC1F,sDAAsD,CACvD,CAAC;AAIJ,MAAM,UAAU,qBAAqB,CACnC,eAAuB;IAEvB,OAAO,oBAAoB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC;AACjE,CAAC"}
+{"version":3,"file":"organization_id.js","sourceRoot":"","sources":["../../src/organizations/organization_id.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,uEAAuE;AACvE,4EAA4E;AAC5E,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC"}

package/dist/request_tokens_result.d.ts

@@ -1,15 +1,16 @@
-import { z } from "zod";
-export declare const successfullyGeneratedTokensRecordSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
-    access: z.ZodOptional<z.ZodRecord<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodUnion<[z.ZodObject<{
-        uid: z.ZodString;
-        iat: z.ZodNumber;
-        exp: z.ZodNumber;
-        token: z.ZodString;
-        aud: z.ZodString;
-        jti: z.ZodOptional<z.ZodString>;
+import type { z as zod } from "zod";
+import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
+export declare function createSuccessfullyGeneratedTokensRecordSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodEffects<zod.ZodEffects<zod.ZodObject<{
+    access: zod.ZodOptional<zod.ZodRecord<zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, zod.ZodUnion<[zod.ZodObject<{
+        uid: zod.ZodString;
+        iat: zod.ZodNumber;
+        exp: zod.ZodNumber;
+        token: zod.ZodString;
+        aud: zod.ZodString;
+        jti: zod.ZodOptional<zod.ZodString>;
     } & {
-        type: z.ZodLiteral<"access">;
-    }, "strict", z.ZodTypeAny, {
+        type: zod.ZodLiteral<"access">;
+    }, "strict", zod.ZodTypeAny, {
         type: "access";
         uid: string;
         iat: number;
@@ -25,17 +26,17 @@ export declare const successfullyGeneratedTokensRecordSchema: z.ZodEffects<z.Zod
         token: string;
         aud: string;
         jti?: string | undefined;
-    }>, z.ZodLiteral<"AS_HTTP_ONLY_COOKIE">]>>>;
-    refresh: z.ZodOptional<z.ZodUnion<[z.ZodObject<{
-        uid: z.ZodString;
-        iat: z.ZodNumber;
-        exp: z.ZodNumber;
-        token: z.ZodString;
-        aud: z.ZodString;
-        jti: z.ZodOptional<z.ZodString>;
+    }>, zod.ZodLiteral<"AS_HTTP_ONLY_COOKIE">]>>>;
+    refresh: zod.ZodOptional<zod.ZodUnion<[zod.ZodObject<{
+        uid: zod.ZodString;
+        iat: zod.ZodNumber;
+        exp: zod.ZodNumber;
+        token: zod.ZodString;
+        aud: zod.ZodString;
+        jti: zod.ZodOptional<zod.ZodString>;
     } & {
-        type: z.ZodLiteral<"refresh">;
-    }, "strict", z.ZodTypeAny, {
+        type: zod.ZodLiteral<"refresh">;
+    }, "strict", zod.ZodTypeAny, {
         type: "refresh";
         uid: string;
         iat: number;
@@ -51,9 +52,9 @@ export declare const successfullyGeneratedTokensRecordSchema: z.ZodEffects<z.Zod
         token: string;
         aud: string;
         jti?: string | undefined;
-    }>, z.ZodLiteral<"AS_HTTP_ONLY_COOKIE">]>>;
-    refresh_token_expiry: z.ZodOptional<z.ZodNumber>;
-}, "strict", z.ZodTypeAny, {
+    }>, zod.ZodLiteral<"AS_HTTP_ONLY_COOKIE">]>>;
+    refresh_token_expiry: zod.ZodOptional<zod.ZodNumber>;
+}, "strict", zod.ZodTypeAny, {
     refresh?: {
         type: "refresh";
         uid: string;
@@ -174,12 +175,12 @@ export declare const successfullyGeneratedTokensRecordSchema: z.ZodEffects<z.Zod
     } | "AS_HTTP_ONLY_COOKIE"> | undefined;
     refresh_token_expiry?: number | undefined;
 }>;
-export type SuccessfullyGeneratedTokensRecord = z.infer<typeof successfullyGeneratedTokensRecordSchema>;
-export declare const requestTokensResultSchema: z.ZodUnion<[z.ZodObject<{
-    message: z.ZodString;
-    success: z.ZodLiteral<false>;
-    error: z.ZodLiteral<true>;
-}, "strict", z.ZodTypeAny, {
+export type SuccessfullyGeneratedTokensRecord = zod.infer<ReturnType<typeof createSuccessfullyGeneratedTokensRecordSchema>>;
+export declare function createRequestTokensResultSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodUnion<[zod.ZodObject<{
+    message: zod.ZodString;
+    success: zod.ZodLiteral<false>;
+    error: zod.ZodLiteral<true>;
+}, "strict", zod.ZodTypeAny, {
     message: string;
     success: false;
     error: true;
@@ -187,22 +188,22 @@ export declare const requestTokensResultSchema: z.ZodUnion<[z.ZodObject<{
     message: string;
     success: false;
     error: true;
-}>, z.ZodObject<{
-    message: z.ZodString;
-    client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
-    success: z.ZodLiteral<true>;
-    error: z.ZodLiteral<false>;
-    tokens: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodObject<{
-        access: z.ZodOptional<z.ZodRecord<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodUnion<[z.ZodObject<{
-            uid: z.ZodString;
-            iat: z.ZodNumber;
-            exp: z.ZodNumber;
-            token: z.ZodString;
-            aud: z.ZodString;
-            jti: z.ZodOptional<z.ZodString>;
+}>, zod.ZodObject<{
+    message: zod.ZodString;
+    client_app_id: zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>;
+    success: zod.ZodLiteral<true>;
+    error: zod.ZodLiteral<false>;
+    tokens: zod.ZodOptional<zod.ZodEffects<zod.ZodEffects<zod.ZodObject<{
+        access: zod.ZodOptional<zod.ZodRecord<zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, zod.ZodUnion<[zod.ZodObject<{
+            uid: zod.ZodString;
+            iat: zod.ZodNumber;
+            exp: zod.ZodNumber;
+            token: zod.ZodString;
+            aud: zod.ZodString;
+            jti: zod.ZodOptional<zod.ZodString>;
         } & {
-            type: z.ZodLiteral<"access">;
-        }, "strict", z.ZodTypeAny, {
+            type: zod.ZodLiteral<"access">;
+        }, "strict", zod.ZodTypeAny, {
             type: "access";
             uid: string;
             iat: number;
@@ -218,17 +219,17 @@ export declare const requestTokensResultSchema: z.ZodUnion<[z.ZodObject<{
             token: string;
             aud: string;
             jti?: string | undefined;
-        }>, z.ZodLiteral<"AS_HTTP_ONLY_COOKIE">]>>>;
-        refresh: z.ZodOptional<z.ZodUnion<[z.ZodObject<{
-            uid: z.ZodString;
-            iat: z.ZodNumber;
-            exp: z.ZodNumber;
-            token: z.ZodString;
-            aud: z.ZodString;
-            jti: z.ZodOptional<z.ZodString>;
+        }>, zod.ZodLiteral<"AS_HTTP_ONLY_COOKIE">]>>>;
+        refresh: zod.ZodOptional<zod.ZodUnion<[zod.ZodObject<{
+            uid: zod.ZodString;
+            iat: zod.ZodNumber;
+            exp: zod.ZodNumber;
+            token: zod.ZodString;
+            aud: zod.ZodString;
+            jti: zod.ZodOptional<zod.ZodString>;
         } & {
-            type: z.ZodLiteral<"refresh">;
-        }, "strict", z.ZodTypeAny, {
+            type: zod.ZodLiteral<"refresh">;
+        }, "strict", zod.ZodTypeAny, {
             type: "refresh";
             uid: string;
             iat: number;
@@ -244,9 +245,9 @@ export declare const requestTokensResultSchema: z.ZodUnion<[z.ZodObject<{
             token: string;
             aud: string;
             jti?: string | undefined;
-        }>, z.ZodLiteral<"AS_HTTP_ONLY_COOKIE">]>>;
-        refresh_token_expiry: z.ZodOptional<z.ZodNumber>;
-    }, "strict", z.ZodTypeAny, {
+        }>, zod.ZodLiteral<"AS_HTTP_ONLY_COOKIE">]>>;
+        refresh_token_expiry: zod.ZodOptional<zod.ZodNumber>;
+    }, "strict", zod.ZodTypeAny, {
         refresh?: {
             type: "refresh";
             uid: string;
@@ -367,18 +368,18 @@ export declare const requestTokensResultSchema: z.ZodUnion<[z.ZodObject<{
         } | "AS_HTTP_ONLY_COOKIE"> | undefined;
         refresh_token_expiry?: number | undefined;
     }>>;
-    userData: z.ZodOptional<z.ZodEffects<z.ZodObject<{
-        uid: z.ZodString;
-        sub: z.ZodString;
-        email: z.ZodString;
-        email_verified: z.ZodOptional<z.ZodBoolean>;
-        admin: z.ZodOptional<z.ZodBoolean>;
-        phone_number: z.ZodOptional<z.ZodString>;
-        phone_verified: z.ZodOptional<z.ZodBoolean>;
-        disabled: z.ZodOptional<z.ZodBoolean>;
-        created_at: z.ZodNumber;
-        invite_code: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
+    userData: zod.ZodOptional<zod.ZodEffects<zod.ZodObject<{
+        uid: zod.ZodString;
+        sub: zod.ZodString;
+        email: zod.ZodString;
+        email_verified: zod.ZodOptional<zod.ZodBoolean>;
+        admin: zod.ZodOptional<zod.ZodBoolean>;
+        phone_number: zod.ZodOptional<zod.ZodString>;
+        phone_verified: zod.ZodOptional<zod.ZodBoolean>;
+        disabled: zod.ZodOptional<zod.ZodBoolean>;
+        created_at: zod.ZodNumber;
+        invite_code: zod.ZodOptional<zod.ZodString>;
+    }, "strict", zod.ZodTypeAny, {
         uid: string;
         sub: string;
         email: string;
@@ -423,8 +424,8 @@ export declare const requestTokensResultSchema: z.ZodUnion<[z.ZodObject<{
         disabled?: boolean | undefined;
         invite_code?: string | undefined;
     }>>;
-    userOrgs: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, "many">>;
-}, "strict", z.ZodTypeAny, {
+    userOrgs: zod.ZodOptional<zod.ZodArray<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, "many">>;
+}, "strict", zod.ZodTypeAny, {
     message: string;
     client_app_id: string;
     success: true;
@@ -503,4 +504,4 @@ export declare const requestTokensResultSchema: z.ZodUnion<[z.ZodObject<{
     } | undefined;
     userOrgs?: string[] | undefined;
 }>]>;
-export type RequestTokensResult = z.infer<typeof requestTokensResultSchema>;
+export type RequestTokensResult = zod.infer<ReturnType<typeof createRequestTokensResultSchema>>;

package/dist/request_tokens_result.js

@@ -1,73 +1,80 @@
-import { z } from "zod";
 import { userDataSchema } from "./user_data";
 import { accessTokenDataSchema, refreshTokenDataSchema } from "./token-data";
-import { audienceRefSchema } from "./audience-schema";
+import { createAudienceSchema } from "./audience-schema";
 import { organizationIdSchema } from "./organizations";
-import { appIdSchema } from "@schemavaults/app-definitions";
-export const successfullyGeneratedTokensRecordSchema = z
-    .object({
-    access: z
-        .record(
-    // map of audience (app id, fs region, or auth server url) to token for that audience
-    audienceRefSchema, z.union([accessTokenDataSchema, z.literal("AS_HTTP_ONLY_COOKIE")]))
-        .optional(),
-    refresh: z
-        .union([refreshTokenDataSchema, z.literal("AS_HTTP_ONLY_COOKIE")])
-        .optional(),
-    refresh_token_expiry: z.number().optional(),
-})
-    .strict()
-    .refine((values) => {
-    if (values.refresh === "AS_HTTP_ONLY_COOKIE") {
-        if (typeof values.refresh_token_expiry === "number" &&
-            !isNaN(values.refresh_token_expiry)) {
-            return true;
+import { appIdSchema, getAppEnvironment, } from "@schemavaults/app-definitions";
+// NOTE: These schemas are exposed as factories (rather than module-scope
+// constants) because the audience schema depends on the app environment and
+// auth-server URL, which must be resolved at call time. Eager module-scope
+// initialization breaks `next build` in Docker where those env vars are unset.
+export function createSuccessfullyGeneratedTokensRecordSchema(z, environment = getAppEnvironment()) {
+    return z
+        .object({
+        access: z
+            .record(
+        // map of audience (app id, fs region, or auth server url) to token for that audience
+        createAudienceSchema(z, environment), z.union([accessTokenDataSchema, z.literal("AS_HTTP_ONLY_COOKIE")]))
+            .optional(),
+        refresh: z
+            .union([refreshTokenDataSchema, z.literal("AS_HTTP_ONLY_COOKIE")])
+            .optional(),
+        refresh_token_expiry: z.number().optional(),
+    })
+        .strict()
+        .refine((values) => {
+        if (values.refresh === "AS_HTTP_ONLY_COOKIE") {
+            if (typeof values.refresh_token_expiry === "number" &&
+                !isNaN(values.refresh_token_expiry)) {
+                return true;
+            }
+            else {
+                return false;
+            }
         }
-        else {
-            return false;
+        return true;
+    }, `A value must be supplied for 'refresh_token_expiry' if refresh token is passed 'AS_HTTP_ONLY_COOKIE'!`)
+        .refine((values) => {
+        if (values.refresh && typeof values.refresh === "object") {
+            if (typeof values.refresh_token_expiry === "number") {
+                return false;
+            }
         }
-    }
-    return true;
-}, `A value must be supplied for 'refresh_token_expiry' if refresh token is passed 'AS_HTTP_ONLY_COOKIE'!`)
-    .refine((values) => {
-    if (values.refresh && typeof values.refresh === "object") {
-        if (typeof values.refresh_token_expiry === "number") {
-            return false;
-        }
-    }
-    return true;
-}, "Passing 'refresh_token_expiry' is redundant when refresh token is passed as an object!");
-const requestTokensSuccessfulResultSchema = z
-    .object({
-    success: z.literal(true),
-    error: z.literal(false),
-    message: z.string(),
-    client_app_id: appIdSchema,
-    tokens: successfullyGeneratedTokensRecordSchema.optional(),
-    userData: userDataSchema.optional(),
-    userOrgs: organizationIdSchema.array().optional(),
-})
-    .required({
-    success: true,
-    message: true,
-    error: true,
-    client_app_id: true,
-})
-    .strict();
-const requestTokensFailureResultSchema = z
-    .object({
-    success: z.literal(false),
-    error: z.literal(true),
-    message: z.string(),
-})
-    .required({
-    success: true,
-    message: true,
-    error: true,
-})
-    .strict();
-export const requestTokensResultSchema = z.union([
-    requestTokensFailureResultSchema,
-    requestTokensSuccessfulResultSchema,
-]);
+        return true;
+    }, "Passing 'refresh_token_expiry' is redundant when refresh token is passed as an object!");
+}
+export function createRequestTokensResultSchema(z, environment = getAppEnvironment()) {
+    const requestTokensSuccessfulResultSchema = z
+        .object({
+        success: z.literal(true),
+        error: z.literal(false),
+        message: z.string(),
+        client_app_id: appIdSchema,
+        tokens: createSuccessfullyGeneratedTokensRecordSchema(z, environment).optional(),
+        userData: userDataSchema.optional(),
+        userOrgs: organizationIdSchema.array().optional(),
+    })
+        .required({
+        success: true,
+        message: true,
+        error: true,
+        client_app_id: true,
+    })
+        .strict();
+    const requestTokensFailureResultSchema = z
+        .object({
+        success: z.literal(false),
+        error: z.literal(true),
+        message: z.string(),
+    })
+        .required({
+        success: true,
+        message: true,
+        error: true,
+    })
+        .strict();
+    return z.union([
+        requestTokensFailureResultSchema,
+        requestTokensSuccessfulResultSchema,
+    ]);
+}
 //# sourceMappingURL=request_tokens_result.js.map

package/dist/request_tokens_result.js.map

@@ -1 +1 @@
-{"version":3,"file":"request_tokens_result.js","sourceRoot":"","sources":["../src/request_tokens_result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,MAAM,CAAC;IACN,MAAM,EAAE,CAAC;SACN,MAAM;IACL,qFAAqF;IACrF,iBAAiB,EACjB,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CACnE;SACA,QAAQ,EAAE;IACb,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;SACjE,QAAQ,EAAE;IACb,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;IAC1B,IAAI,MAAM,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;QAC7C,IACE,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ;YAC/C,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,EACnC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,EAAE,uGAAuG,CAAC;KAC1G,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;IAC1B,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzD,IAAI,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,EAAE,wFAAwF,CAAC,CAAC;AAM/F,MAAM,mCAAmC,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,aAAa,EAAE,WAAW;IAC1B,MAAM,EAAE,uCAAuC,CAAC,QAAQ,EAAE;IAC1D,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,QAAQ,CAAC;IACR,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,IAAI;IACX,aAAa,EAAE,IAAI;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,gCAAgC,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,QAAQ,CAAC;IACR,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,IAAI;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/C,gCAAgC;IAChC,mCAAmC;CACpC,CAAC,CAAC"}
+{"version":3,"file":"request_tokens_result.js","sourceRoot":"","sources":["../src/request_tokens_result.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,WAAW,EACX,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAE/E,MAAM,UAAU,6CAA6C,CAC3D,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,CAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,MAAM;QACL,qFAAqF;QACrF,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,EACpC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CACnE;aACA,QAAQ,EAAE;QACb,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACjE,QAAQ,EAAE;QACb,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5C,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;QAC1B,IAAI,MAAM,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;YAC7C,IACE,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ;gBAC/C,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,EACnC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,uGAAuG,CAAC;SAC1G,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;QAC1B,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzD,IAAI,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;gBACpD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,wFAAwF,CAAC,CAAC;AACjG,CAAC;AAMD,MAAM,UAAU,+BAA+B,CAC7C,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,MAAM,mCAAmC,GAAG,CAAC;SAC1C,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,aAAa,EAAE,WAAW;QAC1B,MAAM,EAAE,6CAA6C,CACnD,CAAC,EACD,WAAW,CACZ,CAAC,QAAQ,EAAE;QACZ,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;QACnC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;KAClD,CAAC;SACD,QAAQ,CAAC;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,IAAI;KACpB,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,MAAM,gCAAgC,GAAG,CAAC;SACvC,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;SACD,QAAQ,CAAC;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;KACZ,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,OAAO,CAAC,CAAC,KAAK,CAAC;QACb,gCAAgC;QAChC,mCAAmC;KACpC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.13.2",
+  "version": "0.16.1",
   "license": "UNLICENSED",
   "private": false,
   "repository": {
@@ -14,7 +14,7 @@
   "types": "dist/index.d.ts",
   "dependencies": {
     "zod": "3.25.8",
-    "@schemavaults/app-definitions": "0.7.1",
+    "@schemavaults/app-definitions": "0.10.0",
     "crypto-js": "4.2.0"
   },
   "scripts": {

package/dist/organizations/schemavaults_org_id.d.ts

@@ -1,2 +0,0 @@
-export declare const SCHEMAVAULTS_ORGANIZATION_ID: "schemavaults";
-export default SCHEMAVAULTS_ORGANIZATION_ID;

package/dist/organizations/schemavaults_org_id.js

@@ -1,3 +0,0 @@
-export const SCHEMAVAULTS_ORGANIZATION_ID = "schemavaults";
-export default SCHEMAVAULTS_ORGANIZATION_ID;
-//# sourceMappingURL=schemavaults_org_id.js.map

package/dist/organizations/schemavaults_org_id.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schemavaults_org_id.js","sourceRoot":"","sources":["../../src/organizations/schemavaults_org_id.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,4BAA4B,GACvC,cAAgD,CAAC;AAEnD,eAAe,4BAA4B,CAAC"}