@seamless-auth/types 0.1.3 → 0.3.0

package/dist/schemas/systemConfig/schema.d.ts

@@ -0,0 +1,368 @@
+import { z } from 'zod';
+export declare const LoginMethodSchema: z.ZodEnum<{
+    passkey: "passkey";
+    magic_link: "magic_link";
+    email_otp: "email_otp";
+    phone_otp: "phone_otp";
+    oauth: "oauth";
+}>;
+export type LoginMethod = z.infer<typeof LoginMethodSchema>;
+export declare const OAuthProviderIdSchema: z.ZodString;
+export declare const OAuthProviderConfigSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    clientId: z.ZodString;
+    clientSecretEnv: z.ZodString;
+    authorizationUrl: z.ZodURL;
+    tokenUrl: z.ZodURL;
+    userInfoUrl: z.ZodURL;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    redirectUri: z.ZodOptional<z.ZodURL>;
+    redirectUris: z.ZodDefault<z.ZodArray<z.ZodURL>>;
+    subjectJsonPath: z.ZodDefault<z.ZodString>;
+    emailJsonPath: z.ZodDefault<z.ZodString>;
+    emailVerifiedJsonPath: z.ZodDefault<z.ZodString>;
+    nameJsonPath: z.ZodOptional<z.ZodString>;
+    allowSignup: z.ZodDefault<z.ZodBoolean>;
+    accountLinking: z.ZodDefault<z.ZodEnum<{
+        email: "email";
+        disabled: "disabled";
+    }>>;
+    requireEmailVerified: z.ZodDefault<z.ZodBoolean>;
+    pkce: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type OAuthProviderConfig = z.infer<typeof OAuthProviderConfigSchema>;
+export declare const LockoutPolicySchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    maxFailures: z.ZodDefault<z.ZodNumber>;
+    windowSeconds: z.ZodDefault<z.ZodNumber>;
+    lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+export type LockoutPolicy = z.infer<typeof LockoutPolicySchema>;
+export declare const DefaultLockoutPolicy: {
+    readonly enabled: true;
+    readonly maxFailures: 10;
+    readonly windowSeconds: number;
+    readonly lockoutSeconds: number;
+};
+export declare const SystemConfigSchema: z.ZodObject<{
+    app_name: z.ZodString;
+    default_roles: z.ZodArray<z.ZodString>;
+    available_roles: z.ZodArray<z.ZodString>;
+    login_methods: z.ZodArray<z.ZodEnum<{
+        passkey: "passkey";
+        magic_link: "magic_link";
+        email_otp: "email_otp";
+        phone_otp: "phone_otp";
+        oauth: "oauth";
+    }>>;
+    passkey_login_fallback_enabled: z.ZodBoolean;
+    oauth_providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        clientId: z.ZodString;
+        clientSecretEnv: z.ZodString;
+        authorizationUrl: z.ZodURL;
+        tokenUrl: z.ZodURL;
+        userInfoUrl: z.ZodURL;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        redirectUri: z.ZodOptional<z.ZodURL>;
+        redirectUris: z.ZodDefault<z.ZodArray<z.ZodURL>>;
+        subjectJsonPath: z.ZodDefault<z.ZodString>;
+        emailJsonPath: z.ZodDefault<z.ZodString>;
+        emailVerifiedJsonPath: z.ZodDefault<z.ZodString>;
+        nameJsonPath: z.ZodOptional<z.ZodString>;
+        allowSignup: z.ZodDefault<z.ZodBoolean>;
+        accountLinking: z.ZodDefault<z.ZodEnum<{
+            email: "email";
+            disabled: "disabled";
+        }>>;
+        requireEmailVerified: z.ZodDefault<z.ZodBoolean>;
+        pkce: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+    lockout_policy: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxFailures: z.ZodDefault<z.ZodNumber>;
+        windowSeconds: z.ZodDefault<z.ZodNumber>;
+        lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    access_token_ttl: z.ZodString;
+    refresh_token_ttl: z.ZodString;
+    rate_limit: z.ZodNumber;
+    delay_after: z.ZodNumber;
+    rpid: z.ZodString;
+    origins: z.ZodArray<z.ZodURL>;
+    frontend_url: z.ZodOptional<z.ZodURL>;
+}, z.core.$strip>;
+export type SystemConfig = z.infer<typeof SystemConfigSchema>;
+export declare const SystemConfigPatchSchema: z.ZodObject<{
+    app_name: z.ZodOptional<z.ZodString>;
+    default_roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    available_roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    login_methods: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        passkey: "passkey";
+        magic_link: "magic_link";
+        email_otp: "email_otp";
+        phone_otp: "phone_otp";
+        oauth: "oauth";
+    }>>>;
+    passkey_login_fallback_enabled: z.ZodOptional<z.ZodBoolean>;
+    oauth_providers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        clientId: z.ZodString;
+        clientSecretEnv: z.ZodString;
+        authorizationUrl: z.ZodURL;
+        tokenUrl: z.ZodURL;
+        userInfoUrl: z.ZodURL;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        redirectUri: z.ZodOptional<z.ZodURL>;
+        redirectUris: z.ZodDefault<z.ZodArray<z.ZodURL>>;
+        subjectJsonPath: z.ZodDefault<z.ZodString>;
+        emailJsonPath: z.ZodDefault<z.ZodString>;
+        emailVerifiedJsonPath: z.ZodDefault<z.ZodString>;
+        nameJsonPath: z.ZodOptional<z.ZodString>;
+        allowSignup: z.ZodDefault<z.ZodBoolean>;
+        accountLinking: z.ZodDefault<z.ZodEnum<{
+            email: "email";
+            disabled: "disabled";
+        }>>;
+        requireEmailVerified: z.ZodDefault<z.ZodBoolean>;
+        pkce: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+    lockout_policy: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxFailures: z.ZodDefault<z.ZodNumber>;
+        windowSeconds: z.ZodDefault<z.ZodNumber>;
+        lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    access_token_ttl: z.ZodOptional<z.ZodString>;
+    refresh_token_ttl: z.ZodOptional<z.ZodString>;
+    rate_limit: z.ZodOptional<z.ZodNumber>;
+    delay_after: z.ZodOptional<z.ZodNumber>;
+    rpid: z.ZodOptional<z.ZodString>;
+    origins: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+}, z.core.$strict>;
+export type SystemConfigPatch = z.infer<typeof SystemConfigPatchSchema>;
+/**
+ * A patch schema bound to the config currently stored, so role edits can be
+ * checked against the merged result rather than the patch alone.
+ */
+export declare function createPatchSystemConfigSchema(existing: SystemConfig): z.ZodObject<{
+    app_name: z.ZodOptional<z.ZodString>;
+    default_roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    available_roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    login_methods: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        passkey: "passkey";
+        magic_link: "magic_link";
+        email_otp: "email_otp";
+        phone_otp: "phone_otp";
+        oauth: "oauth";
+    }>>>;
+    passkey_login_fallback_enabled: z.ZodOptional<z.ZodBoolean>;
+    oauth_providers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        clientId: z.ZodString;
+        clientSecretEnv: z.ZodString;
+        authorizationUrl: z.ZodURL;
+        tokenUrl: z.ZodURL;
+        userInfoUrl: z.ZodURL;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        redirectUri: z.ZodOptional<z.ZodURL>;
+        redirectUris: z.ZodDefault<z.ZodArray<z.ZodURL>>;
+        subjectJsonPath: z.ZodDefault<z.ZodString>;
+        emailJsonPath: z.ZodDefault<z.ZodString>;
+        emailVerifiedJsonPath: z.ZodDefault<z.ZodString>;
+        nameJsonPath: z.ZodOptional<z.ZodString>;
+        allowSignup: z.ZodDefault<z.ZodBoolean>;
+        accountLinking: z.ZodDefault<z.ZodEnum<{
+            email: "email";
+            disabled: "disabled";
+        }>>;
+        requireEmailVerified: z.ZodDefault<z.ZodBoolean>;
+        pkce: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+    lockout_policy: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxFailures: z.ZodDefault<z.ZodNumber>;
+        windowSeconds: z.ZodDefault<z.ZodNumber>;
+        lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    access_token_ttl: z.ZodOptional<z.ZodString>;
+    refresh_token_ttl: z.ZodOptional<z.ZodString>;
+    rate_limit: z.ZodOptional<z.ZodNumber>;
+    delay_after: z.ZodOptional<z.ZodNumber>;
+    rpid: z.ZodOptional<z.ZodString>;
+    origins: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+}, z.core.$strict>;
+export declare const OAuthProviderCreateSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    clientId: z.ZodString;
+    clientSecretEnv: z.ZodString;
+    authorizationUrl: z.ZodURL;
+    tokenUrl: z.ZodURL;
+    userInfoUrl: z.ZodURL;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    redirectUri: z.ZodOptional<z.ZodURL>;
+    redirectUris: z.ZodDefault<z.ZodArray<z.ZodURL>>;
+    subjectJsonPath: z.ZodDefault<z.ZodString>;
+    emailJsonPath: z.ZodDefault<z.ZodString>;
+    emailVerifiedJsonPath: z.ZodDefault<z.ZodString>;
+    nameJsonPath: z.ZodOptional<z.ZodString>;
+    allowSignup: z.ZodDefault<z.ZodBoolean>;
+    accountLinking: z.ZodDefault<z.ZodEnum<{
+        email: "email";
+        disabled: "disabled";
+    }>>;
+    requireEmailVerified: z.ZodDefault<z.ZodBoolean>;
+    pkce: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const OAuthProviderIdParamSchema: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const OAuthProviderUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecretEnv: z.ZodOptional<z.ZodString>;
+    authorizationUrl: z.ZodOptional<z.ZodURL>;
+    tokenUrl: z.ZodOptional<z.ZodURL>;
+    userInfoUrl: z.ZodOptional<z.ZodURL>;
+    scopes: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    redirectUri: z.ZodOptional<z.ZodOptional<z.ZodURL>>;
+    redirectUris: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodURL>>>;
+    subjectJsonPath: z.ZodOptional<z.ZodDefault<z.ZodString>>;
+    emailJsonPath: z.ZodOptional<z.ZodDefault<z.ZodString>>;
+    emailVerifiedJsonPath: z.ZodOptional<z.ZodDefault<z.ZodString>>;
+    nameJsonPath: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    allowSignup: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    accountLinking: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
+        email: "email";
+        disabled: "disabled";
+    }>>>;
+    requireEmailVerified: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    pkce: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$strict>;
+export type OAuthProviderUpdate = z.infer<typeof OAuthProviderUpdateSchema>;
+export declare const OAuthProvidersListResponseSchema: z.ZodObject<{
+    providers: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        clientId: z.ZodString;
+        clientSecretEnv: z.ZodString;
+        authorizationUrl: z.ZodURL;
+        tokenUrl: z.ZodURL;
+        userInfoUrl: z.ZodURL;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        redirectUri: z.ZodOptional<z.ZodURL>;
+        redirectUris: z.ZodDefault<z.ZodArray<z.ZodURL>>;
+        subjectJsonPath: z.ZodDefault<z.ZodString>;
+        emailJsonPath: z.ZodDefault<z.ZodString>;
+        emailVerifiedJsonPath: z.ZodDefault<z.ZodString>;
+        nameJsonPath: z.ZodOptional<z.ZodString>;
+        allowSignup: z.ZodDefault<z.ZodBoolean>;
+        accountLinking: z.ZodDefault<z.ZodEnum<{
+            email: "email";
+            disabled: "disabled";
+        }>>;
+        requireEmailVerified: z.ZodDefault<z.ZodBoolean>;
+        pkce: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const OAuthProviderResponseSchema: z.ZodObject<{
+    provider: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        clientId: z.ZodString;
+        clientSecretEnv: z.ZodString;
+        authorizationUrl: z.ZodURL;
+        tokenUrl: z.ZodURL;
+        userInfoUrl: z.ZodURL;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        redirectUri: z.ZodOptional<z.ZodURL>;
+        redirectUris: z.ZodDefault<z.ZodArray<z.ZodURL>>;
+        subjectJsonPath: z.ZodDefault<z.ZodString>;
+        emailJsonPath: z.ZodDefault<z.ZodString>;
+        emailVerifiedJsonPath: z.ZodDefault<z.ZodString>;
+        nameJsonPath: z.ZodOptional<z.ZodString>;
+        allowSignup: z.ZodDefault<z.ZodBoolean>;
+        accountLinking: z.ZodDefault<z.ZodEnum<{
+            email: "email";
+            disabled: "disabled";
+        }>>;
+        requireEmailVerified: z.ZodDefault<z.ZodBoolean>;
+        pkce: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const OAuthProviderDeletedResponseSchema: z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const GetSystemConfigResponseSchema: z.ZodObject<{
+    app_name: z.ZodString;
+    default_roles: z.ZodArray<z.ZodString>;
+    available_roles: z.ZodArray<z.ZodString>;
+    login_methods: z.ZodArray<z.ZodEnum<{
+        passkey: "passkey";
+        magic_link: "magic_link";
+        email_otp: "email_otp";
+        phone_otp: "phone_otp";
+        oauth: "oauth";
+    }>>;
+    passkey_login_fallback_enabled: z.ZodBoolean;
+    oauth_providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        clientId: z.ZodString;
+        clientSecretEnv: z.ZodString;
+        authorizationUrl: z.ZodURL;
+        tokenUrl: z.ZodURL;
+        userInfoUrl: z.ZodURL;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        redirectUri: z.ZodOptional<z.ZodURL>;
+        redirectUris: z.ZodDefault<z.ZodArray<z.ZodURL>>;
+        subjectJsonPath: z.ZodDefault<z.ZodString>;
+        emailJsonPath: z.ZodDefault<z.ZodString>;
+        emailVerifiedJsonPath: z.ZodDefault<z.ZodString>;
+        nameJsonPath: z.ZodOptional<z.ZodString>;
+        allowSignup: z.ZodDefault<z.ZodBoolean>;
+        accountLinking: z.ZodDefault<z.ZodEnum<{
+            email: "email";
+            disabled: "disabled";
+        }>>;
+        requireEmailVerified: z.ZodDefault<z.ZodBoolean>;
+        pkce: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+    lockout_policy: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxFailures: z.ZodDefault<z.ZodNumber>;
+        windowSeconds: z.ZodDefault<z.ZodNumber>;
+        lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    access_token_ttl: z.ZodString;
+    refresh_token_ttl: z.ZodString;
+    rate_limit: z.ZodNumber;
+    delay_after: z.ZodNumber;
+    rpid: z.ZodString;
+    origins: z.ZodArray<z.ZodURL>;
+    frontend_url: z.ZodOptional<z.ZodURL>;
+}, z.core.$strip>;
+export declare const UpdateSystemConfigResponseSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    updatedKeys: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type UpdateSystemConfigResponse = z.infer<typeof UpdateSystemConfigResponseSchema>;
+export declare const AvailableRolesResponseSchema: z.ZodObject<{
+    roles: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schemas/systemConfig/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmB7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAKH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAE3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC"}

package/dist/schemas/systemConfig/schema.js

@@ -0,0 +1,141 @@
+import { z } from 'zod';
+import { RoleNameSchema } from '../role/schema.js';
+export const LoginMethodSchema = z.enum([
+    'passkey',
+    'magic_link',
+    'email_otp',
+    'phone_otp',
+    'oauth',
+]);
+export const OAuthProviderIdSchema = z.string().regex(/^[a-z0-9-]{2,40}$/);
+export const OAuthProviderConfigSchema = z.object({
+    id: OAuthProviderIdSchema,
+    name: z.string().trim().min(1).max(80),
+    enabled: z.boolean().default(true),
+    clientId: z.string().trim().min(1),
+    // The secret itself never lives in config; this names the environment
+    // variable the server reads it from.
+    clientSecretEnv: z.string().trim().min(1),
+    authorizationUrl: z.url(),
+    tokenUrl: z.url(),
+    userInfoUrl: z.url(),
+    scopes: z.array(z.string().trim().min(1)).default([]),
+    redirectUri: z.url().optional(),
+    redirectUris: z.array(z.url()).default([]),
+    subjectJsonPath: z.string().trim().min(1).default('sub'),
+    emailJsonPath: z.string().trim().min(1).default('email'),
+    emailVerifiedJsonPath: z.string().trim().min(1).default('email_verified'),
+    nameJsonPath: z.string().trim().min(1).optional(),
+    allowSignup: z.boolean().default(true),
+    accountLinking: z.enum(['email', 'disabled']).default('email'),
+    requireEmailVerified: z.boolean().default(false),
+    pkce: z.boolean().optional(),
+});
+export const LockoutPolicySchema = z.object({
+    enabled: z.boolean().default(true),
+    maxFailures: z.number().int().positive().default(10),
+    windowSeconds: z
+        .number()
+        .int()
+        .positive()
+        .default(15 * 60),
+    lockoutSeconds: z
+        .number()
+        .int()
+        .positive()
+        .default(15 * 60),
+});
+export const DefaultLockoutPolicy = {
+    enabled: true,
+    maxFailures: 10,
+    windowSeconds: 15 * 60,
+    lockoutSeconds: 15 * 60,
+};
+export const SystemConfigSchema = z.object({
+    app_name: z.string().min(3),
+    default_roles: z.array(RoleNameSchema).min(1),
+    available_roles: z.array(RoleNameSchema).min(1),
+    login_methods: z.array(LoginMethodSchema).min(1),
+    passkey_login_fallback_enabled: z.boolean(),
+    oauth_providers: z.array(OAuthProviderConfigSchema).default([]),
+    lockout_policy: LockoutPolicySchema.default(DefaultLockoutPolicy),
+    access_token_ttl: z.string().regex(/^\d+[smhd]$/),
+    refresh_token_ttl: z.string().regex(/^\d+[smhd]$/),
+    rate_limit: z.number().int().positive(),
+    delay_after: z.number().int().nonnegative(),
+    rpid: z.string().min(1),
+    origins: z.array(z.url()).min(1),
+    frontend_url: z.url().optional(),
+});
+export const SystemConfigPatchSchema = z
+    .object({
+    app_name: SystemConfigSchema.shape.app_name.optional(),
+    default_roles: SystemConfigSchema.shape.default_roles.optional(),
+    available_roles: SystemConfigSchema.shape.available_roles.optional(),
+    login_methods: SystemConfigSchema.shape.login_methods.optional(),
+    passkey_login_fallback_enabled: SystemConfigSchema.shape.passkey_login_fallback_enabled.optional(),
+    oauth_providers: z.array(OAuthProviderConfigSchema).optional(),
+    lockout_policy: LockoutPolicySchema.optional(),
+    access_token_ttl: SystemConfigSchema.shape.access_token_ttl.optional(),
+    refresh_token_ttl: SystemConfigSchema.shape.refresh_token_ttl.optional(),
+    rate_limit: SystemConfigSchema.shape.rate_limit.optional(),
+    delay_after: SystemConfigSchema.shape.delay_after.optional(),
+    rpid: SystemConfigSchema.shape.rpid.optional(),
+    origins: SystemConfigSchema.shape.origins.optional(),
+})
+    .strict();
+/**
+ * A patch schema bound to the config currently stored, so role edits can be
+ * checked against the merged result rather than the patch alone.
+ */
+export function createPatchSystemConfigSchema(existing) {
+    return SystemConfigPatchSchema.superRefine((data, ctx) => {
+        const nextAvailable = data.available_roles ?? existing.available_roles;
+        const nextDefault = data.default_roles ?? existing.default_roles;
+        const removedDefaults = data.available_roles !== undefined &&
+            existing.default_roles.some((role) => !data.available_roles?.includes(role));
+        if (removedDefaults) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['available_roles'],
+                message: 'Cannot remove roles currently set as default',
+            });
+        }
+        if (!nextDefault.every((role) => nextAvailable.includes(role))) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['default_roles'],
+                message: 'All default roles must exist in available_roles',
+            });
+        }
+    });
+}
+export const OAuthProviderCreateSchema = OAuthProviderConfigSchema;
+export const OAuthProviderIdParamSchema = z.object({
+    id: OAuthProviderIdSchema,
+});
+// The id is immutable and taken from the path, so it is omitted here. Every other
+// field is optional so callers can patch a single attribute without resending the
+// whole provider; the merged result is re-validated against the full schema.
+export const OAuthProviderUpdateSchema = OAuthProviderConfigSchema.omit({ id: true })
+    .partial()
+    .strict();
+export const OAuthProvidersListResponseSchema = z.object({
+    providers: z.array(OAuthProviderConfigSchema),
+});
+export const OAuthProviderResponseSchema = z.object({
+    provider: OAuthProviderConfigSchema,
+});
+export const OAuthProviderDeletedResponseSchema = z.object({
+    success: z.literal(true),
+    id: z.string(),
+});
+export const GetSystemConfigResponseSchema = SystemConfigSchema;
+export const UpdateSystemConfigResponseSchema = z.object({
+    success: z.boolean(),
+    updatedKeys: z.array(z.string()),
+});
+export const AvailableRolesResponseSchema = z.object({
+    roles: z.array(z.string()),
+});
+//# sourceMappingURL=schema.js.map

package/dist/schemas/systemConfig/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAEjE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAE3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAEH,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAClF,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAEhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC"}

package/dist/schemas/totp/schema.d.ts

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+export declare const TotpVerifyRequestSchema: z.ZodObject<{
+    code: z.ZodString;
+}, z.core.$strip>;
+export type TotpVerifyRequest = z.infer<typeof TotpVerifyRequestSchema>;
+export declare const TotpStatusSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    verifiedAt: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type TotpStatus = z.infer<typeof TotpStatusSchema>;
+export declare const TotpEnrollmentStartSchema: z.ZodObject<{
+    message: z.ZodString;
+    secret: z.ZodString;
+    otpauthUrl: z.ZodString;
+    issuer: z.ZodString;
+    accountName: z.ZodString;
+    algorithm: z.ZodLiteral<"SHA1">;
+    digits: z.ZodNumber;
+    period: z.ZodNumber;
+}, z.core.$strip>;
+export type TotpEnrollmentStartResponse = z.infer<typeof TotpEnrollmentStartSchema>;
+export declare const TotpVerifySuccessSchema: z.ZodObject<{
+    message: z.ZodString;
+}, z.core.$strip>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schemas/totp/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/totp/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,yBAAyB;;;;;;;;;iBASpC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEpF,eAAO,MAAM,uBAAuB;;iBAElC,CAAC"}

package/dist/schemas/totp/schema.js

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+export const TotpVerifyRequestSchema = z.object({
+    code: z.string().regex(/^\d{6}$/),
+});
+export const TotpStatusSchema = z.object({
+    enabled: z.boolean(),
+    verifiedAt: z.string().nullable(),
+    lastUsedAt: z.string().nullable(),
+});
+export const TotpEnrollmentStartSchema = z.object({
+    message: z.string(),
+    secret: z.string(),
+    otpauthUrl: z.string(),
+    issuer: z.string(),
+    accountName: z.string(),
+    algorithm: z.literal('SHA1'),
+    digits: z.number(),
+    period: z.number(),
+});
+export const TotpVerifySuccessSchema = z.object({
+    message: z.string(),
+});
+//# sourceMappingURL=schema.js.map

package/dist/schemas/totp/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/totp/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAClC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC"}

package/dist/schemas/user/schema.d.ts

@@ -1,5 +1,4 @@
 import { z } from 'zod';
-export declare const RoleSchema: z.ZodString;
 export declare const UserSchema: z.ZodObject<{
     id: z.ZodUUID;
     email: z.ZodEmail;
@@ -14,16 +13,68 @@ export declare const UserSchema: z.ZodObject<{
     updatedAt: z.ZodOptional<z.ZodNullable<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>>;
 }, z.core.$strip>;
 export type User = z.infer<typeof UserSchema>;
+/**
+ * The user as it crosses the wire. Looser than {@link UserSchema}: the id is an
+ * opaque string rather than a UUID, phone is nullable for email-only accounts,
+ * and the verification flags are absent on endpoints that do not expose them.
+ */
+export declare const ApiUserSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodEmail;
+    phone: z.ZodNullable<z.ZodString>;
+    roles: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    revoked: z.ZodOptional<z.ZodBoolean>;
+    emailVerified: z.ZodOptional<z.ZodBoolean>;
+    phoneVerified: z.ZodOptional<z.ZodBoolean>;
+    verified: z.ZodOptional<z.ZodBoolean>;
+    lastLogin: z.ZodOptional<z.ZodNullable<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>>;
+    createdAt: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
+    updatedAt: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
+}, z.core.$strict>;
+export type ApiUser = z.infer<typeof ApiUserSchema>;
 export declare const CreateUserSchema: z.ZodObject<{
     email: z.ZodEmail;
-    phone: z.ZodString;
+    phone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     roles: z.ZodArray<z.ZodString>;
 }, z.core.$strip>;
+export type CreateUserRequest = z.infer<typeof CreateUserSchema>;
 export declare const UpdateUserSchema: z.ZodObject<{
     email: z.ZodOptional<z.ZodEmail>;
-    phone: z.ZodOptional<z.ZodString>;
+    phone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     emailVerified: z.ZodOptional<z.ZodBoolean>;
     phoneVerified: z.ZodOptional<z.ZodBoolean>;
     roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
+export type UpdateUserRequest = z.infer<typeof UpdateUserSchema>;
+export declare const UserResponseSchema: z.ZodObject<{
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodEmail;
+        phone: z.ZodNullable<z.ZodString>;
+        roles: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        revoked: z.ZodOptional<z.ZodBoolean>;
+        emailVerified: z.ZodOptional<z.ZodBoolean>;
+        phoneVerified: z.ZodOptional<z.ZodBoolean>;
+        verified: z.ZodOptional<z.ZodBoolean>;
+        lastLogin: z.ZodOptional<z.ZodNullable<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>>;
+        createdAt: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
+        updatedAt: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
+    }, z.core.$strict>;
+}, z.core.$strip>;
+export declare const UsersListResponseSchema: z.ZodObject<{
+    users: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodEmail;
+        phone: z.ZodNullable<z.ZodString>;
+        roles: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        revoked: z.ZodOptional<z.ZodBoolean>;
+        emailVerified: z.ZodOptional<z.ZodBoolean>;
+        phoneVerified: z.ZodOptional<z.ZodBoolean>;
+        verified: z.ZodOptional<z.ZodBoolean>;
+        lastLogin: z.ZodOptional<z.ZodNullable<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>>;
+        createdAt: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
+        updatedAt: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
+    }, z.core.$strict>>;
+    total: z.ZodNumber;
+}, z.core.$strip>;
 //# sourceMappingURL=schema.d.ts.map

package/dist/schemas/user/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/user/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,UAAU,aAAyD,CAAC;AAEjF,eAAO,MAAM,UAAU;;;;;;;;;;;;iBAYrB,CAAC;AAEH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;kBAQlB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/user/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,UAAU;;;;;;;;;;;;iBAYrB,CAAC;AAEH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;kBAcf,CAAC;AAEZ,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE,eAAO,MAAM,gBAAgB;;;;;;kBAQlB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;iBAE7B,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;iBAGlC,CAAC"}