@schemavaults/auth-common 0.23.0 → 0.25.0

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { ERROR_MESSAGE_CATALOG, isValidErrorId, } from "./auth-error-message-catalog";
 export type { SchemaVaultsAuthErrorId } from "./auth-error-message-catalog";
 export { AppAlreadyConnectedToApiServerError, isAppAlreadyConnectedToApiServerError, } from "./app-to-api-connection-errors";
-export { userDataSchema, type UserData } from "./user_data";
+export { userDataSchema, type UserData, USERNAME_MIN_LENGTH, USERNAME_MAX_LENGTH, MAX_USER_NAME_PART_LENGTH, USERNAME_REGEX, usernameFormatSchema, userNamePartSchema, userDisplayNameSchema, userProfileNamesSchema, updateUserProfileRequestSchema, userProfileResponseSchema, type Username, type UserProfileNames, type UpdateUserProfileRequest, type UserProfileResponse, } from "./user_data";
 export * from "./credentials";
 export type * from "./credentials";
 export * from "./token-data";

package/dist/index.js

@@ -1,6 +1,6 @@
 export { ERROR_MESSAGE_CATALOG, isValidErrorId, } from "./auth-error-message-catalog";
 export { AppAlreadyConnectedToApiServerError, isAppAlreadyConnectedToApiServerError, } from "./app-to-api-connection-errors";
-export { userDataSchema } from "./user_data";
+export { userDataSchema, USERNAME_MIN_LENGTH, USERNAME_MAX_LENGTH, MAX_USER_NAME_PART_LENGTH, USERNAME_REGEX, usernameFormatSchema, userNamePartSchema, userDisplayNameSchema, userProfileNamesSchema, updateUserProfileRequestSchema, userProfileResponseSchema, } from "./user_data";
 export * from "./credentials";
 // Shapes of tokens
 export * from "./token-data";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,mCAAmC,EACnC,qCAAqC,GACtC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,cAAc,QAAQ,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,+BAA+B,EAE/B,6CAA6C,GAE9C,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,gBAAgB,EAChB,gCAAgC,EAChC,yCAAyC,EACzC,kCAAkC,EAClC,2CAA2C,EAC3C,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EAAE,gCAAgC,EAAE,MAAM,UAAU,CAAC;AAE5D,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,qCAAqC,EACrC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,mCAAmC,EACnC,qCAAqC,GACtC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,cAAc,EAEd,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,GAK1B,MAAM,aAAa,CAAC;AAErB,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,cAAc,QAAQ,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,+BAA+B,EAE/B,6CAA6C,GAE9C,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,gBAAgB,EAChB,gCAAgC,EAChC,yCAAyC,EACzC,kCAAkC,EAClC,2CAA2C,EAC3C,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EAAE,gCAAgC,EAAE,MAAM,UAAU,CAAC;AAE5D,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,qCAAqC,EACrC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC"}

package/dist/oidc/index.d.ts

@@ -2,3 +2,6 @@ export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOP
 export type { OidcSupportedScope, OidcScope, ParsedOidcScopes, } from "./scope";
 export { oidcNonceSchema, OIDC_NONCE_VSCHAR_REGEX, parseOidcNonce, OidcNonceValidationError, } from "./nonce";
 export type { OidcNonce } from "./nonce";
+export { OIDC_SUB_CLAIM_DELIMITER, formatOidcSubClaim, parseOidcSubClaim, } from "./sub-claim";
+export { buildOidcProfileClaims } from "./profile-claims";
+export type { OidcProfileClaims, OidcProfileClaimsSource, } from "./profile-claims";

package/dist/oidc/index.js

@@ -1,3 +1,5 @@
 export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOPE_REGEX, oidcScopeSchema, parseAndGrantScopes, serializeOidcScopes, } from "./scope";
 export { oidcNonceSchema, OIDC_NONCE_VSCHAR_REGEX, parseOidcNonce, OidcNonceValidationError, } from "./nonce";
+export { OIDC_SUB_CLAIM_DELIMITER, formatOidcSubClaim, parseOidcSubClaim, } from "./sub-claim";
+export { buildOidcProfileClaims } from "./profile-claims";
 //# sourceMappingURL=index.js.map

package/dist/oidc/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oidc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAOjB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,GACzB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oidc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAOjB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/oidc/profile-claims.d.ts

@@ -0,0 +1,34 @@
+/**
+ * OIDC Core §5.1 standard claims gated by the `profile` scope, built
+ * from the user's stored profile name fields. Shared by every surface
+ * that emits profile claims — the id_token (`generateIdToken` in
+ * @schemavaults/jwt) and GET/POST /api/oidc/userinfo — so the two
+ * always agree for the same user.
+ */
+/** The profile name fields the claims are derived from (all optional). */
+export interface OidcProfileClaimsSource {
+    username?: string;
+    first_name?: string;
+    middle_name?: string;
+    last_name?: string;
+    display_name?: string;
+}
+/** The OIDC Core §5.1 claims emitted under the `profile` scope. */
+export interface OidcProfileClaims {
+    /**
+     * The user's full name in displayable form: the public display name
+     * when set, otherwise the joined first/middle/last name parts.
+     */
+    name?: string;
+    given_name?: string;
+    middle_name?: string;
+    family_name?: string;
+    preferred_username?: string;
+}
+/**
+ * Builds the `profile`-scoped claim set from a user's stored name
+ * fields. Claims without a stored value are omitted entirely (OIDC Core
+ * §5.3.2 — absent, not null/empty). Callers are responsible for only
+ * emitting the result when the `profile` scope was actually granted.
+ */
+export declare function buildOidcProfileClaims(user: OidcProfileClaimsSource): OidcProfileClaims;

package/dist/oidc/profile-claims.js

@@ -0,0 +1,45 @@
+/**
+ * OIDC Core §5.1 standard claims gated by the `profile` scope, built
+ * from the user's stored profile name fields. Shared by every surface
+ * that emits profile claims — the id_token (`generateIdToken` in
+ * @schemavaults/jwt) and GET/POST /api/oidc/userinfo — so the two
+ * always agree for the same user.
+ */
+/**
+ * Builds the `profile`-scoped claim set from a user's stored name
+ * fields. Claims without a stored value are omitted entirely (OIDC Core
+ * §5.3.2 — absent, not null/empty). Callers are responsible for only
+ * emitting the result when the `profile` scope was actually granted.
+ */
+export function buildOidcProfileClaims(user) {
+    const claims = {};
+    const joined_name_parts = [
+        user.first_name,
+        user.middle_name,
+        user.last_name,
+    ]
+        .filter((part) => typeof part === "string" && part.length > 0)
+        .join(" ");
+    const full_name = user.display_name && user.display_name.length > 0
+        ? user.display_name
+        : joined_name_parts.length > 0
+            ? joined_name_parts
+            : undefined;
+    if (full_name) {
+        claims.name = full_name;
+    }
+    if (user.first_name) {
+        claims.given_name = user.first_name;
+    }
+    if (user.middle_name) {
+        claims.middle_name = user.middle_name;
+    }
+    if (user.last_name) {
+        claims.family_name = user.last_name;
+    }
+    if (user.username) {
+        claims.preferred_username = user.username;
+    }
+    return claims;
+}
+//# sourceMappingURL=profile-claims.js.map

package/dist/oidc/profile-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-claims.js","sourceRoot":"","sources":["../../src/oidc/profile-claims.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAwBH;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAA6B;IAE7B,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,MAAM,iBAAiB,GAAW;QAChC,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,SAAS;KACf;SACE,MAAM,CACL,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CACtE;SACA,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,SAAS,GACb,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC,YAAY;QACnB,CAAC,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;YAC5B,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,SAAS,CAAC;IAElB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACtC,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;IACtC,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC5C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/oidc/sub-claim.d.ts

@@ -0,0 +1,21 @@
+import { type AppId } from "@schemavaults/app-definitions";
+export declare const OIDC_SUB_CLAIM_DELIMITER: "|";
+/**
+ * Builds the OIDC-facing `sub` claim for a platform user:
+ * `<auth_server_app_id>|<uid>`. The auth server app id is stable per
+ * deployment, so the resulting subject is stable for the lifetime of
+ * the user (OIDC Core §2: `sub` must be locally unique and never
+ * reassigned within the issuer).
+ */
+export declare function formatOidcSubClaim(auth_server_app_id: AppId | string, uid: string): string;
+/**
+ * Splits an OIDC-facing `sub` claim back into the issuing deployment's
+ * app id and the platform user id. Returns `null` for values not in the
+ * `<app_id>|<uid>` shape (e.g. subjects issued by other providers).
+ * Only the FIRST delimiter splits — the uid keeps any later characters
+ * verbatim.
+ */
+export declare function parseOidcSubClaim(sub: string): {
+    auth_server_app_id: AppId;
+    uid: string;
+} | null;

package/dist/oidc/sub-claim.js

@@ -0,0 +1,57 @@
+import { appIdSchema } from "@schemavaults/app-definitions";
+// The OIDC-facing `sub` claim namespaces the platform user id with the
+// deployment's own app id (SCHEMAVAULTS_AUTH_SERVER_APP_ID), Auth0-style:
+// `<auth_server_app_id>|<uid>` (e.g. "schemavaults-auth|4f7c…"). The
+// prefix marks which auth deployment a subject came from, so RPs that
+// aggregate identities from several issuers / white-label deployments
+// can't collide or confuse them. It applies ONLY at the OIDC boundary —
+// the id_token, /api/oidc/userinfo, and RFC 7662 introspection, which
+// OIDC Core §5.3.2 requires to agree exactly — never inside the
+// platform's own encrypted access/refresh token payloads, whose
+// `sub === uid` invariant (payload_data.ts) resource servers rely on.
+// The app id charset ([a-z0-9_-]) can never contain the delimiter, so
+// the encoding is unambiguous.
+export const OIDC_SUB_CLAIM_DELIMITER = "|";
+/**
+ * Builds the OIDC-facing `sub` claim for a platform user:
+ * `<auth_server_app_id>|<uid>`. The auth server app id is stable per
+ * deployment, so the resulting subject is stable for the lifetime of
+ * the user (OIDC Core §2: `sub` must be locally unique and never
+ * reassigned within the issuer).
+ */
+export function formatOidcSubClaim(auth_server_app_id, uid) {
+    const app_id = appIdSchema.safeParse(auth_server_app_id);
+    if (!app_id.success) {
+        throw new TypeError("Invalid auth server app id for OIDC 'sub' claim prefix!", { cause: app_id.error });
+    }
+    if (typeof uid !== "string" || uid.length === 0) {
+        throw new TypeError("A user id is required to build an OIDC 'sub' claim!");
+    }
+    return `${app_id.data}${OIDC_SUB_CLAIM_DELIMITER}${uid}`;
+}
+/**
+ * Splits an OIDC-facing `sub` claim back into the issuing deployment's
+ * app id and the platform user id. Returns `null` for values not in the
+ * `<app_id>|<uid>` shape (e.g. subjects issued by other providers).
+ * Only the FIRST delimiter splits — the uid keeps any later characters
+ * verbatim.
+ */
+export function parseOidcSubClaim(sub) {
+    if (typeof sub !== "string") {
+        return null;
+    }
+    const delimiter_index = sub.indexOf(OIDC_SUB_CLAIM_DELIMITER);
+    if (delimiter_index <= 0) {
+        return null;
+    }
+    const app_id = appIdSchema.safeParse(sub.slice(0, delimiter_index));
+    if (!app_id.success) {
+        return null;
+    }
+    const uid = sub.slice(delimiter_index + OIDC_SUB_CLAIM_DELIMITER.length);
+    if (uid.length === 0) {
+        return null;
+    }
+    return { auth_server_app_id: app_id.data, uid };
+}
+//# sourceMappingURL=sub-claim.js.map

package/dist/oidc/sub-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sub-claim.js","sourceRoot":"","sources":["../../src/oidc/sub-claim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,+BAA+B,CAAC;AAExE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,sEAAsE;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,gEAAgE;AAChE,gEAAgE;AAChE,sEAAsE;AACtE,sEAAsE;AACtE,+BAA+B;AAE/B,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAY,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,kBAAkC,EAClC,GAAW;IAEX,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CACjB,yDAAyD,EACzD,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,IAAI,GAAG,wBAAwB,GAAG,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW;IAEX,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9D,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,kBAAkB,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC"}

package/dist/request_tokens_result.d.ts

@@ -371,6 +371,11 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
     }>>;
     userData: zod.ZodOptional<zod.ZodEffects<zod.ZodObject<{
         uid: zod.ZodString;
+        username: zod.ZodOptional<zod.ZodString>;
+        first_name: zod.ZodOptional<zod.ZodString>;
+        middle_name: zod.ZodOptional<zod.ZodString>;
+        last_name: zod.ZodOptional<zod.ZodString>;
+        display_name: zod.ZodOptional<zod.ZodString>;
         sub: zod.ZodString;
         email: zod.ZodString;
         email_verified: zod.ZodOptional<zod.ZodBoolean>;
@@ -385,6 +390,11 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
         sub: string;
         email: string;
         created_at: number;
+        username?: string | undefined;
+        first_name?: string | undefined;
+        middle_name?: string | undefined;
+        last_name?: string | undefined;
+        display_name?: string | undefined;
         email_verified?: boolean | undefined;
         admin?: boolean | undefined;
         phone_number?: string | undefined;
@@ -396,6 +406,11 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
         sub: string;
         email: string;
         created_at: number;
+        username?: string | undefined;
+        first_name?: string | undefined;
+        middle_name?: string | undefined;
+        last_name?: string | undefined;
+        display_name?: string | undefined;
         email_verified?: boolean | undefined;
         admin?: boolean | undefined;
         phone_number?: string | undefined;
@@ -407,6 +422,11 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
         sub: string;
         email: string;
         created_at: number;
+        username?: string | undefined;
+        first_name?: string | undefined;
+        middle_name?: string | undefined;
+        last_name?: string | undefined;
+        display_name?: string | undefined;
         email_verified?: boolean | undefined;
         admin?: boolean | undefined;
         phone_number?: string | undefined;
@@ -418,6 +438,11 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
         sub: string;
         email: string;
         created_at: number;
+        username?: string | undefined;
+        first_name?: string | undefined;
+        middle_name?: string | undefined;
+        last_name?: string | undefined;
+        display_name?: string | undefined;
         email_verified?: boolean | undefined;
         admin?: boolean | undefined;
         phone_number?: string | undefined;
@@ -458,6 +483,11 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
         sub: string;
         email: string;
         created_at: number;
+        username?: string | undefined;
+        first_name?: string | undefined;
+        middle_name?: string | undefined;
+        last_name?: string | undefined;
+        display_name?: string | undefined;
         email_verified?: boolean | undefined;
         admin?: boolean | undefined;
         phone_number?: string | undefined;
@@ -498,6 +528,11 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
         sub: string;
         email: string;
         created_at: number;
+        username?: string | undefined;
+        first_name?: string | undefined;
+        middle_name?: string | undefined;
+        last_name?: string | undefined;
+        display_name?: string | undefined;
         email_verified?: boolean | undefined;
         admin?: boolean | undefined;
         phone_number?: string | undefined;

package/dist/user_data/index.d.ts

@@ -1 +1,2 @@
 export { userDataSchema, type UserData } from './user_data';
+export { USERNAME_MIN_LENGTH, USERNAME_MAX_LENGTH, MAX_USER_NAME_PART_LENGTH, USERNAME_REGEX, usernameFormatSchema, userNamePartSchema, userDisplayNameSchema, userProfileNamesSchema, updateUserProfileRequestSchema, userProfileResponseSchema, type Username, type UserProfileNames, type UpdateUserProfileRequest, type UserProfileResponse, } from './user_profile';

package/dist/user_data/index.js

@@ -1,2 +1,3 @@
 export { userDataSchema } from './user_data';
+export { USERNAME_MIN_LENGTH, USERNAME_MAX_LENGTH, MAX_USER_NAME_PART_LENGTH, USERNAME_REGEX, usernameFormatSchema, userNamePartSchema, userDisplayNameSchema, userProfileNamesSchema, updateUserProfileRequestSchema, userProfileResponseSchema, } from './user_profile';
 //# sourceMappingURL=index.js.map

package/dist/user_data/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/user_data/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EAEf,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/user_data/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EAEf,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,GAK1B,MAAM,gBAAgB,CAAC"}

package/dist/user_data/user_data.d.ts

@@ -1,6 +1,11 @@
 import { z } from "zod";
 export declare const userDataSchema: z.ZodEffects<z.ZodObject<{
     uid: z.ZodString;
+    username: z.ZodOptional<z.ZodString>;
+    first_name: z.ZodOptional<z.ZodString>;
+    middle_name: z.ZodOptional<z.ZodString>;
+    last_name: z.ZodOptional<z.ZodString>;
+    display_name: z.ZodOptional<z.ZodString>;
     sub: z.ZodString;
     email: z.ZodString;
     email_verified: z.ZodOptional<z.ZodBoolean>;
@@ -15,6 +20,11 @@ export declare const userDataSchema: z.ZodEffects<z.ZodObject<{
     sub: string;
     email: string;
     created_at: number;
+    username?: string | undefined;
+    first_name?: string | undefined;
+    middle_name?: string | undefined;
+    last_name?: string | undefined;
+    display_name?: string | undefined;
     email_verified?: boolean | undefined;
     admin?: boolean | undefined;
     phone_number?: string | undefined;
@@ -26,6 +36,11 @@ export declare const userDataSchema: z.ZodEffects<z.ZodObject<{
     sub: string;
     email: string;
     created_at: number;
+    username?: string | undefined;
+    first_name?: string | undefined;
+    middle_name?: string | undefined;
+    last_name?: string | undefined;
+    display_name?: string | undefined;
     email_verified?: boolean | undefined;
     admin?: boolean | undefined;
     phone_number?: string | undefined;
@@ -37,6 +52,11 @@ export declare const userDataSchema: z.ZodEffects<z.ZodObject<{
     sub: string;
     email: string;
     created_at: number;
+    username?: string | undefined;
+    first_name?: string | undefined;
+    middle_name?: string | undefined;
+    last_name?: string | undefined;
+    display_name?: string | undefined;
     email_verified?: boolean | undefined;
     admin?: boolean | undefined;
     phone_number?: string | undefined;
@@ -48,6 +68,11 @@ export declare const userDataSchema: z.ZodEffects<z.ZodObject<{
     sub: string;
     email: string;
     created_at: number;
+    username?: string | undefined;
+    first_name?: string | undefined;
+    middle_name?: string | undefined;
+    last_name?: string | undefined;
+    display_name?: string | undefined;
     email_verified?: boolean | undefined;
     admin?: boolean | undefined;
     phone_number?: string | undefined;

package/dist/user_data/user_data.js

@@ -1,4 +1,5 @@
 import { inviteCodeFormatSchema } from "../invite-code/invite-code-format";
+import { usernameFormatSchema, userNamePartSchema, userDisplayNameSchema, } from "../user_data/user_profile";
 import { z } from "zod";
 const _baseUserDataSchema = z
     .object({
@@ -8,6 +9,15 @@ const _baseUserDataSchema = z
     // Email
     email: z.string().email(),
     email_verified: z.boolean().optional(),
+    // Profile names (user-editable; absent for accounts that never set
+    // them). Only present when the UserData was built from the database
+    // row (loadUserData) — UserData derived from a decoded token payload
+    // does not carry them.
+    username: usernameFormatSchema.optional(),
+    first_name: userNamePartSchema.optional(),
+    middle_name: userNamePartSchema.optional(),
+    last_name: userNamePartSchema.optional(),
+    display_name: userDisplayNameSchema.optional(),
     // Admin
     admin: z.boolean().optional(),
     // Phone

package/dist/user_data/user_data.js.map

@@ -1 +1 @@
-{"version":3,"file":"user_data.js","sourceRoot":"","sources":["../../src/user_data/user_data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,UAAU;IACV,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,mBAAmB;IAE3C,QAAQ;IACR,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,QAAQ;IACR,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7B,QAAQ;IACR,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,4BAA4B;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEvC,cAAc;IACd,WAAW,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,QAAQ,CAAC;IACR,GAAG,EAAE,IAAI;IACT,KAAK,EAAE,IAAI;IACX,GAAG,EAAE,IAAI;IACT,UAAU,EAAE,IAAI;CACjB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IAChE,OAAO,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;AAC/B,CAAC,EAAE,6BAA6B,CAAC,CAAC"}
+{"version":3,"file":"user_data.js","sourceRoot":"","sources":["../../src/user_data/user_data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,UAAU;IACV,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,mBAAmB;IAE3C,QAAQ;IACR,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,uBAAuB;IACvB,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE9C,QAAQ;IACR,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7B,QAAQ;IACR,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,4BAA4B;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEvC,cAAc;IACd,WAAW,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,QAAQ,CAAC;IACR,GAAG,EAAE,IAAI;IACT,KAAK,EAAE,IAAI;IACX,GAAG,EAAE,IAAI;IACT,UAAU,EAAE,IAAI;CACjB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IAChE,OAAO,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;AAC/B,CAAC,EAAE,6BAA6B,CAAC,CAAC"}

package/dist/user_data/user_profile.d.ts

@@ -0,0 +1,119 @@
+import { z } from "zod";
+export declare const USERNAME_MIN_LENGTH: number;
+export declare const USERNAME_MAX_LENGTH: number;
+/**
+ * Maximum length for each individual person-name part (first / middle /
+ * last) and for the public display name.
+ */
+export declare const MAX_USER_NAME_PART_LENGTH: number;
+/**
+ * Usernames are unique per deployment (case-insensitively — the database
+ * enforces uniqueness on LOWER(username), while the stored casing is
+ * preserved for display). Format: alphanumeric start and end with `.`,
+ * `_`, and `-` permitted in between. `@` is deliberately excluded so a
+ * username can never be confused with an email address, and `|` can
+ * never appear (the OIDC sub-claim delimiter).
+ */
+export declare const USERNAME_REGEX: RegExp;
+export declare const usernameFormatSchema: z.ZodString;
+export type Username = z.infer<typeof usernameFormatSchema>;
+/** A single part of a user's personal name (first / middle / last). */
+export declare const userNamePartSchema: z.ZodString;
+/**
+ * The user's public display name. Shown to other users and exposed to
+ * OIDC relying parties as the `name` claim when the `profile` scope is
+ * granted.
+ */
+export declare const userDisplayNameSchema: z.ZodString;
+/**
+ * The user-editable profile name fields stored on the USERS row. All
+ * fields are optional — accounts predating this feature (and accounts
+ * that never fill them in) simply have none set.
+ */
+export declare const userProfileNamesSchema: z.ZodObject<{
+    username: z.ZodOptional<z.ZodString>;
+    first_name: z.ZodOptional<z.ZodString>;
+    middle_name: z.ZodOptional<z.ZodString>;
+    last_name: z.ZodOptional<z.ZodString>;
+    display_name: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    username?: string | undefined;
+    first_name?: string | undefined;
+    middle_name?: string | undefined;
+    last_name?: string | undefined;
+    display_name?: string | undefined;
+}, {
+    username?: string | undefined;
+    first_name?: string | undefined;
+    middle_name?: string | undefined;
+    last_name?: string | undefined;
+    display_name?: string | undefined;
+}>;
+export type UserProfileNames = z.infer<typeof userProfileNamesSchema>;
+/**
+ * PUT /api/user/profile request body. Full-replacement semantics: every
+ * field the user wants to keep must be present; `null` (or an omitted
+ * field) clears the stored value.
+ */
+export declare const updateUserProfileRequestSchema: z.ZodObject<{
+    username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    first_name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    middle_name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    last_name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    display_name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strict", z.ZodTypeAny, {
+    username?: string | null | undefined;
+    first_name?: string | null | undefined;
+    middle_name?: string | null | undefined;
+    last_name?: string | null | undefined;
+    display_name?: string | null | undefined;
+}, {
+    username?: string | null | undefined;
+    first_name?: string | null | undefined;
+    middle_name?: string | null | undefined;
+    last_name?: string | null | undefined;
+    display_name?: string | null | undefined;
+}>;
+export type UpdateUserProfileRequest = z.infer<typeof updateUserProfileRequestSchema>;
+/** GET/PUT /api/user/profile success response body. */
+export declare const userProfileResponseSchema: z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    profile: z.ZodObject<{
+        username: z.ZodOptional<z.ZodString>;
+        first_name: z.ZodOptional<z.ZodString>;
+        middle_name: z.ZodOptional<z.ZodString>;
+        last_name: z.ZodOptional<z.ZodString>;
+        display_name: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        username?: string | undefined;
+        first_name?: string | undefined;
+        middle_name?: string | undefined;
+        last_name?: string | undefined;
+        display_name?: string | undefined;
+    }, {
+        username?: string | undefined;
+        first_name?: string | undefined;
+        middle_name?: string | undefined;
+        last_name?: string | undefined;
+        display_name?: string | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    success: true;
+    profile: {
+        username?: string | undefined;
+        first_name?: string | undefined;
+        middle_name?: string | undefined;
+        last_name?: string | undefined;
+        display_name?: string | undefined;
+    };
+}, {
+    success: true;
+    profile: {
+        username?: string | undefined;
+        first_name?: string | undefined;
+        middle_name?: string | undefined;
+        last_name?: string | undefined;
+        display_name?: string | undefined;
+    };
+}>;
+export type UserProfileResponse = z.infer<typeof userProfileResponseSchema>;

package/dist/user_data/user_profile.js

@@ -0,0 +1,79 @@
+import { z } from "zod";
+export const USERNAME_MIN_LENGTH = 3;
+export const USERNAME_MAX_LENGTH = 32;
+/**
+ * Maximum length for each individual person-name part (first / middle /
+ * last) and for the public display name.
+ */
+export const MAX_USER_NAME_PART_LENGTH = 64;
+/**
+ * Usernames are unique per deployment (case-insensitively — the database
+ * enforces uniqueness on LOWER(username), while the stored casing is
+ * preserved for display). Format: alphanumeric start and end with `.`,
+ * `_`, and `-` permitted in between. `@` is deliberately excluded so a
+ * username can never be confused with an email address, and `|` can
+ * never appear (the OIDC sub-claim delimiter).
+ */
+export const USERNAME_REGEX = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+export const usernameFormatSchema = z
+    .string()
+    .min(USERNAME_MIN_LENGTH, `Username must be at least ${USERNAME_MIN_LENGTH} characters long!`)
+    .max(USERNAME_MAX_LENGTH, `Username may not be longer than ${USERNAME_MAX_LENGTH} characters!`)
+    .regex(USERNAME_REGEX, "Username may only contain letters, numbers, '.', '_', and '-', and must start and end with a letter or number.");
+/**
+ * Rejects ASCII control characters (including CR/LF) that could pollute
+ * logs, headers, or rendered UI. All other unicode is permitted — names
+ * are human text.
+ */
+// eslint-disable-next-line no-control-regex -- rejecting control chars is the point
+const NO_CONTROL_CHARS_REGEX = /^[^\u0000-\u001F\u007F]*$/;
+const namePartSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(MAX_USER_NAME_PART_LENGTH, `Name may not be longer than ${MAX_USER_NAME_PART_LENGTH} characters!`)
+    .regex(NO_CONTROL_CHARS_REGEX, "Name may not contain control characters!");
+/** A single part of a user's personal name (first / middle / last). */
+export const userNamePartSchema = namePartSchema;
+/**
+ * The user's public display name. Shown to other users and exposed to
+ * OIDC relying parties as the `name` claim when the `profile` scope is
+ * granted.
+ */
+export const userDisplayNameSchema = namePartSchema;
+/**
+ * The user-editable profile name fields stored on the USERS row. All
+ * fields are optional — accounts predating this feature (and accounts
+ * that never fill them in) simply have none set.
+ */
+export const userProfileNamesSchema = z
+    .object({
+    username: usernameFormatSchema.optional(),
+    first_name: userNamePartSchema.optional(),
+    middle_name: userNamePartSchema.optional(),
+    last_name: userNamePartSchema.optional(),
+    display_name: userDisplayNameSchema.optional(),
+})
+    .strict();
+/**
+ * PUT /api/user/profile request body. Full-replacement semantics: every
+ * field the user wants to keep must be present; `null` (or an omitted
+ * field) clears the stored value.
+ */
+export const updateUserProfileRequestSchema = z
+    .object({
+    username: usernameFormatSchema.nullable().optional(),
+    first_name: userNamePartSchema.nullable().optional(),
+    middle_name: userNamePartSchema.nullable().optional(),
+    last_name: userNamePartSchema.nullable().optional(),
+    display_name: userDisplayNameSchema.nullable().optional(),
+})
+    .strict();
+/** GET/PUT /api/user/profile success response body. */
+export const userProfileResponseSchema = z
+    .object({
+    success: z.literal(true),
+    profile: userProfileNamesSchema,
+})
+    .strict();
+//# sourceMappingURL=user_profile.js.map

package/dist/user_data/user_profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user_profile.js","sourceRoot":"","sources":["../../src/user_data/user_profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,mBAAmB,GAAW,CAAC,CAAC;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAW,EAAE,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW,EAAE,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GACzB,8CAA8C,CAAC;AAEjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,GAAG,CACF,mBAAmB,EACnB,6BAA6B,mBAAmB,mBAAmB,CACpE;KACA,GAAG,CACF,mBAAmB,EACnB,mCAAmC,mBAAmB,cAAc,CACrE;KACA,KAAK,CACJ,cAAc,EACd,gHAAgH,CACjH,CAAC;AAIJ;;;;GAIG;AACH,oFAAoF;AACpF,MAAM,sBAAsB,GAAW,2BAA2B,CAAC;AAEnE,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CACF,yBAAyB,EACzB,+BAA+B,yBAAyB,cAAc,CACvE;KACA,KAAK,CAAC,sBAAsB,EAAE,0CAA0C,CAAC,CAAC;AAE7E,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,UAAU,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,WAAW,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,SAAS,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,YAAY,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,uDAAuD;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,OAAO,EAAE,sBAAsB;CAChC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "license": "UNLICENSED",
   "private": false,
   "repository": {