@schemavaults/auth-common 0.22.5 → 0.22.8

package/dist/audience-schema.d.ts

@@ -17,4 +17,11 @@ export interface AudienceSchemaOverrides {
     auth_server_app_id?: string;
 }
 export declare function createAudienceSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment, overrides?: AudienceSchemaOverrides): zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>;
+/**
+ * A list of token audiences. The list may be empty: at the token endpoints
+ * an empty audience list means the grant mints no access tokens —
+ * authenticate (or rotate the refresh token) only, which is how clients
+ * configured with no default token audiences complete a login. Call sites
+ * that require at least one audience must enforce non-emptiness themselves.
+ */
 export declare function createAudienceListSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment, overrides?: AudienceSchemaOverrides): zod.ZodArray<zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, "many">;

package/dist/audience-schema.js

@@ -15,10 +15,16 @@ export function createAudienceSchema(z, environment = getAppEnvironment(), overr
     return z.union([authServerUrlSchema, apiServerIdWithoutAuthServerIdSchema]);
 }
 const MAX_APPS_IN_AUDIENCE_LIST = 10;
+/**
+ * A list of token audiences. The list may be empty: at the token endpoints
+ * an empty audience list means the grant mints no access tokens —
+ * authenticate (or rotate the refresh token) only, which is how clients
+ * configured with no default token audiences complete a login. Call sites
+ * that require at least one audience must enforce non-emptiness themselves.
+ */
 export function createAudienceListSchema(z, environment = getAppEnvironment(), overrides) {
     return createAudienceSchema(z, environment, overrides)
         .array()
-        .min(1, "Audience list may not be empty")
         .max(MAX_APPS_IN_AUDIENCE_LIST, `Audience list may not contain more than ${MAX_APPS_IN_AUDIENCE_LIST} audience references.`);
 }
 //# sourceMappingURL=audience-schema.js.map

package/dist/audience-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"audience-schema.js","sourceRoot":"","sources":["../src/audience-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,+BAA+B,CAAC;AA0BvC,MAAM,UAAU,oBAAoB,CAClC,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,MAAM,eAAe,GACnB,SAAS,EAAE,eAAe,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GACtB,SAAS,EAAE,kBAAkB,IAAI,kBAAkB,EAAE,CAAC;IAExD,MAAM,mBAAmB,GAAG,CAAC;SAC1B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,GAAG,EAAiC,EAAE,CAAC,GAAG,KAAK,eAAe,CAAC;SACvE,QAAQ,CAAC,8DAA8D,CAAC,CAAC;IAE5E,MAAM,oCAAoC,GAAG,iBAAiB;SAC3D,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QACb,OAAO,EAAE,KAAK,kBAAkB,CAAC;IACnC,CAAC,EAAE,iBAAiB,kBAAkB,qGAAqG,CAAC;SAC3I,QAAQ,CACP,4CAA4C,kBAAkB,iBAAiB,CAChF,CAAC;IAEJ,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,yBAAyB,GAAG,EAA4B,CAAC;AAE/D,MAAM,UAAU,wBAAwB,CACtC,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,oBAAoB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SACnD,KAAK,EAAE;SACP,GAAG,CAAC,CAAC,EAAE,gCAAgC,CAAC;SACxC,GAAG,CACF,yBAAyB,EACzB,2CAA2C,yBAAyB,uBAAuB,CAC5F,CAAC;AACN,CAAC"}
+{"version":3,"file":"audience-schema.js","sourceRoot":"","sources":["../src/audience-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,+BAA+B,CAAC;AA0BvC,MAAM,UAAU,oBAAoB,CAClC,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,MAAM,eAAe,GACnB,SAAS,EAAE,eAAe,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GACtB,SAAS,EAAE,kBAAkB,IAAI,kBAAkB,EAAE,CAAC;IAExD,MAAM,mBAAmB,GAAG,CAAC;SAC1B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,GAAG,EAAiC,EAAE,CAAC,GAAG,KAAK,eAAe,CAAC;SACvE,QAAQ,CAAC,8DAA8D,CAAC,CAAC;IAE5E,MAAM,oCAAoC,GAAG,iBAAiB;SAC3D,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QACb,OAAO,EAAE,KAAK,kBAAkB,CAAC;IACnC,CAAC,EAAE,iBAAiB,kBAAkB,qGAAqG,CAAC;SAC3I,QAAQ,CACP,4CAA4C,kBAAkB,iBAAiB,CAChF,CAAC;IAEJ,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,yBAAyB,GAAG,EAA4B,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,oBAAoB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SACnD,KAAK,EAAE;SACP,GAAG,CACF,yBAAyB,EACzB,2CAA2C,yBAAyB,uBAAuB,CAC5F,CAAC;AACN,CAAC"}

package/dist/auth_acquire_tokens_grant_types.js

@@ -7,6 +7,10 @@ export const grant_types = [
 ];
 function createTokenEndpointBaseSchema(z, environment = getAppEnvironment(), overrides) {
     return z.object({
+        // A single audience, or a (possibly empty) audience list. An empty list
+        // mints no access tokens — the grant authenticates (or rotates the
+        // refresh token) only, which is how clients configured with no default
+        // token audiences complete a login.
         audience: z.union([
             createAudienceSchema(z, environment, overrides),
             createAudienceListSchema(z, environment, overrides),
@@ -44,6 +48,10 @@ export function createRefreshTokenPOSTBodySchema(z, environment = getAppEnvironm
     return createTokenEndpointBaseSchema(z, environment, overrides)
         .extend({
         grant_type: z.literal("refresh_token"),
+        // Deprecated and ignored: the refresh grant now always rotates the
+        // refresh token. Still tolerated (the body schema is strict) so
+        // requests from older SDK versions — which unconditionally send the
+        // flag — keep parsing.
         replaceRefreshToo: z.boolean().optional(),
     })
         .required({

package/dist/auth_acquire_tokens_grant_types.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAEL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,SAAS,6BAA6B,CACpC,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC;YAChB,oBAAoB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;YAC/C,wBAAwB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SACpD,CAAC;QACF,aAAa,EAAE,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SAC5D,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE;QAC9C,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;QACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;QACxC,8DAA8D;QAC9D,mEAAmE;QACnE,iEAAiE;QACjE,6DAA6D;QAC7D,+DAA+D;QAC/D,kEAAkE;QAClE,qCAAqC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrD,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,IAAI,EAAE,IAAI;QACV,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,IAAI;KACrB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SAC5D,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;KACpB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC"}
+{"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAEL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,SAAS,6BAA6B,CACpC,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,oCAAoC;QACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC;YAChB,oBAAoB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;YAC/C,wBAAwB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SACpD,CAAC;QACF,aAAa,EAAE,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SAC5D,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE;QAC9C,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;QACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;QACxC,8DAA8D;QAC9D,mEAAmE;QACnE,iEAAiE;QACjE,6DAA6D;QAC7D,+DAA+D;QAC/D,kEAAkE;QAClE,qCAAqC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrD,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,IAAI,EAAE,IAAI;QACV,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,IAAI;KACrB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SAC5D,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACtC,mEAAmE;QACnE,gEAAgE;QAChE,oEAAoE;QACpE,uBAAuB;QACvB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;KACpB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.22.5",
+  "version": "0.22.8",
   "license": "UNLICENSED",
   "private": false,
   "repository": {