@vertesia/common 1.5.0-dev.20260725.083715Z → 1.5.0-dev.20260806.125520Z

package/lib/api-schemas/oauth-server.d.ts

@@ -0,0 +1,415 @@
+import { z } from 'zod';
+/**
+ * The contracts for Vertesia's OWN OAuth server: the clients registered against it and the grants
+ * their users have approved. Vertesia acting as a client of someone else's authorization server is
+ * `./oauth.js`.
+ *
+ * Only the three resources backed by the studio API have slots here. The token server's own surface
+ * — authorize, token, device code, consent — is still TypeScript-derived and has not been converted,
+ * so the types it uses stay declared in `../oauth-server.ts` rather than moving here.
+ */
+export declare const OAuthClientTypeSchema: z.ZodEnum<{
+    confidential: "confidential";
+    public: "public";
+}>;
+export declare const OAuthClientStatusSchema: z.ZodEnum<{
+    active: "active";
+    disabled: "disabled";
+}>;
+export declare const OAuthRegistrationSourceSchema: z.ZodEnum<{
+    admin: "admin";
+    dynamic: "dynamic";
+}>;
+export declare const OAuthProjectBindingModeSchema: z.ZodEnum<{
+    fixed: "fixed";
+    user_select: "user_select";
+}>;
+export declare const OAuthTokenEndpointAuthMethodSchema: z.ZodEnum<{
+    client_secret_basic: "client_secret_basic";
+    client_secret_post: "client_secret_post";
+    none: "none";
+}>;
+export declare const OAuthGrantTypeSchema: z.ZodEnum<{
+    authorization_code: "authorization_code";
+    refresh_token: "refresh_token";
+    "urn:ietf:params:oauth:grant-type:device_code": "urn:ietf:params:oauth:grant-type:device_code";
+}>;
+export declare const OAuthResponseTypeSchema: z.ZodLiteral<"code">;
+export declare const OAuthGrantStatusSchema: z.ZodEnum<{
+    active: "active";
+    expired: "expired";
+    revoked: "revoked";
+}>;
+export declare const OAuthGrantSortFieldSchema: z.ZodEnum<{
+    client_name: "client_name";
+    expires_at: "expires_at";
+    granted_at: "granted_at";
+    last_used_at: "last_used_at";
+    resource: "resource";
+    status: "status";
+    user_name: "user_name";
+}>;
+export declare const OAuthGrantSortOrderSchema: z.ZodEnum<{
+    asc: "asc";
+    desc: "desc";
+}>;
+/**
+ * A client's registration, without its issued id.
+ *
+ * Split from {@link OAuthClientSchema} because `OAuthClient extends OAuthClientData` in the published
+ * types and both names are exported. No `id` in its meta, so it is never a component: the document
+ * publishes these properties inline under `OAuthClient`, with `client_id` last.
+ */
+export declare const OAuthClientDataSchema: z.ZodObject<{
+    client_name: z.ZodString;
+    client_type: z.ZodEnum<{
+        confidential: "confidential";
+        public: "public";
+    }>;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    grant_types: z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+        "urn:ietf:params:oauth:grant-type:device_code": "urn:ietf:params:oauth:grant-type:device_code";
+    }>>;
+    response_types: z.ZodArray<z.ZodLiteral<"code">>;
+    token_endpoint_auth_method: z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        none: "none";
+    }>;
+    allowed_scopes: z.ZodArray<z.ZodString>;
+    default_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    registration_source: z.ZodEnum<{
+        admin: "admin";
+        dynamic: "dynamic";
+    }>;
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>;
+    project_binding_mode: z.ZodEnum<{
+        fixed: "fixed";
+        user_select: "user_select";
+    }>;
+    fixed_project_id: z.ZodOptional<z.ZodString>;
+    restrict_to_owner_account: z.ZodOptional<z.ZodBoolean>;
+    metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+    created_by: z.ZodOptional<z.ZodString>;
+    client_secret_configured: z.ZodOptional<z.ZodBoolean>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+}, z.core.$strict>;
+export declare const OAuthClientSchema: z.ZodObject<{
+    client_name: z.ZodString;
+    client_type: z.ZodEnum<{
+        confidential: "confidential";
+        public: "public";
+    }>;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    grant_types: z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+        "urn:ietf:params:oauth:grant-type:device_code": "urn:ietf:params:oauth:grant-type:device_code";
+    }>>;
+    response_types: z.ZodArray<z.ZodLiteral<"code">>;
+    token_endpoint_auth_method: z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        none: "none";
+    }>;
+    allowed_scopes: z.ZodArray<z.ZodString>;
+    default_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    registration_source: z.ZodEnum<{
+        admin: "admin";
+        dynamic: "dynamic";
+    }>;
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>;
+    project_binding_mode: z.ZodEnum<{
+        fixed: "fixed";
+        user_select: "user_select";
+    }>;
+    fixed_project_id: z.ZodOptional<z.ZodString>;
+    restrict_to_owner_account: z.ZodOptional<z.ZodBoolean>;
+    metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+    created_by: z.ZodOptional<z.ZodString>;
+    client_secret_configured: z.ZodOptional<z.ZodBoolean>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+    client_id: z.ZodString;
+}, z.core.$strict>;
+export declare const OAuthClientArraySchema: z.ZodArray<z.ZodObject<{
+    client_name: z.ZodString;
+    client_type: z.ZodEnum<{
+        confidential: "confidential";
+        public: "public";
+    }>;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    grant_types: z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+        "urn:ietf:params:oauth:grant-type:device_code": "urn:ietf:params:oauth:grant-type:device_code";
+    }>>;
+    response_types: z.ZodArray<z.ZodLiteral<"code">>;
+    token_endpoint_auth_method: z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        none: "none";
+    }>;
+    allowed_scopes: z.ZodArray<z.ZodString>;
+    default_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    registration_source: z.ZodEnum<{
+        admin: "admin";
+        dynamic: "dynamic";
+    }>;
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>;
+    project_binding_mode: z.ZodEnum<{
+        fixed: "fixed";
+        user_select: "user_select";
+    }>;
+    fixed_project_id: z.ZodOptional<z.ZodString>;
+    restrict_to_owner_account: z.ZodOptional<z.ZodBoolean>;
+    metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+    created_by: z.ZodOptional<z.ZodString>;
+    client_secret_configured: z.ZodOptional<z.ZodBoolean>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+    client_id: z.ZodString;
+}, z.core.$strict>>;
+/**
+ * The create response, which is the read shape plus the one field that is never readable again.
+ *
+ * `client_secret` is returned exactly once, by the call that generates it; every later read of the
+ * same client publishes `client_secret_configured` instead. Two components rather than one optional
+ * field on `OAuthClient` is what keeps that one-time disclosure visible in the document.
+ */
+export declare const OAuthClientCreateResponseSchema: z.ZodObject<{
+    client_name: z.ZodString;
+    client_type: z.ZodEnum<{
+        confidential: "confidential";
+        public: "public";
+    }>;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    grant_types: z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+        "urn:ietf:params:oauth:grant-type:device_code": "urn:ietf:params:oauth:grant-type:device_code";
+    }>>;
+    response_types: z.ZodArray<z.ZodLiteral<"code">>;
+    token_endpoint_auth_method: z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        none: "none";
+    }>;
+    allowed_scopes: z.ZodArray<z.ZodString>;
+    default_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    registration_source: z.ZodEnum<{
+        admin: "admin";
+        dynamic: "dynamic";
+    }>;
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>;
+    project_binding_mode: z.ZodEnum<{
+        fixed: "fixed";
+        user_select: "user_select";
+    }>;
+    fixed_project_id: z.ZodOptional<z.ZodString>;
+    restrict_to_owner_account: z.ZodOptional<z.ZodBoolean>;
+    metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+    created_by: z.ZodOptional<z.ZodString>;
+    client_secret_configured: z.ZodOptional<z.ZodBoolean>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const OAuthClientScopeMetadataSchema: z.ZodObject<{
+    supported_scopes: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare const CreateOAuthClientPayloadSchema: z.ZodObject<{
+    client_name: z.ZodString;
+    client_type: z.ZodOptional<z.ZodEnum<{
+        confidential: "confidential";
+        public: "public";
+    }>>;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+        "urn:ietf:params:oauth:grant-type:device_code": "urn:ietf:params:oauth:grant-type:device_code";
+    }>>>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodLiteral<"code">>>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        none: "none";
+    }>>;
+    allowed_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    default_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    project_binding_mode: z.ZodOptional<z.ZodEnum<{
+        fixed: "fixed";
+        user_select: "user_select";
+    }>>;
+    fixed_project_id: z.ZodOptional<z.ZodString>;
+    restrict_to_owner_account: z.ZodOptional<z.ZodBoolean>;
+    client_secret: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+}, z.core.$strict>;
+/**
+ * Not `.partial()` of the create payload, and the difference is deliberate rather than an oversight
+ * to tidy up: an update accepts `status`, which a create does not (a new client is always `active`),
+ * and cannot accept `client_type`, which is fixed at registration because the auth method and secret
+ * are decided from it. Deriving one from the other would publish both of those wrong.
+ */
+export declare const UpdateOAuthClientPayloadSchema: z.ZodObject<{
+    client_name: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+        "urn:ietf:params:oauth:grant-type:device_code": "urn:ietf:params:oauth:grant-type:device_code";
+    }>>>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodLiteral<"code">>>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        none: "none";
+    }>>;
+    allowed_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    default_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>>;
+    project_binding_mode: z.ZodOptional<z.ZodEnum<{
+        fixed: "fixed";
+        user_select: "user_select";
+    }>>;
+    fixed_project_id: z.ZodOptional<z.ZodString>;
+    restrict_to_owner_account: z.ZodOptional<z.ZodBoolean>;
+    client_secret: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+}, z.core.$strict>;
+export declare const OAuthGrantSchema: z.ZodObject<{
+    grant_id: z.ZodString;
+    client_id: z.ZodString;
+    client_name: z.ZodString;
+    user_id: z.ZodString;
+    user_name: z.ZodOptional<z.ZodString>;
+    user_email: z.ZodOptional<z.ZodString>;
+    account_id: z.ZodString;
+    project_id: z.ZodString;
+    resource: z.ZodString;
+    scope: z.ZodArray<z.ZodString>;
+    status: z.ZodEnum<{
+        active: "active";
+        expired: "expired";
+        revoked: "revoked";
+    }>;
+    token_count: z.ZodNumber;
+    granted_at: z.ZodString;
+    created_at: z.ZodString;
+    last_used_at: z.ZodOptional<z.ZodString>;
+    expires_at: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const ListOAuthGrantsQuerySchema: z.ZodObject<{
+    account_id: z.ZodOptional<z.ZodString>;
+    project_id: z.ZodOptional<z.ZodString>;
+    user_id: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        all: "all";
+        expired: "expired";
+        revoked: "revoked";
+    }>>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    offset: z.ZodOptional<z.ZodNumber>;
+    sort_by: z.ZodOptional<z.ZodEnum<{
+        client_name: "client_name";
+        expires_at: "expires_at";
+        granted_at: "granted_at";
+        last_used_at: "last_used_at";
+        resource: "resource";
+        status: "status";
+        user_name: "user_name";
+    }>>;
+    sort_order: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+}, z.core.$strict>;
+export declare const RevokeOAuthGrantQuerySchema: z.ZodObject<{
+    include_consent: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const BulkRevokeOAuthGrantsPayloadSchema: z.ZodObject<{
+    account_id: z.ZodOptional<z.ZodString>;
+    project_id: z.ZodOptional<z.ZodString>;
+    user_id: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        all: "all";
+        expired: "expired";
+        revoked: "revoked";
+    }>>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    offset: z.ZodOptional<z.ZodNumber>;
+    sort_by: z.ZodOptional<z.ZodEnum<{
+        client_name: "client_name";
+        expires_at: "expires_at";
+        granted_at: "granted_at";
+        last_used_at: "last_used_at";
+        resource: "resource";
+        status: "status";
+        user_name: "user_name";
+    }>>;
+    sort_order: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+    grant_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    include_consent: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const OAuthGrantListResponseSchema: z.ZodObject<{
+    grants: z.ZodArray<z.ZodObject<{
+        grant_id: z.ZodString;
+        client_id: z.ZodString;
+        client_name: z.ZodString;
+        user_id: z.ZodString;
+        user_name: z.ZodOptional<z.ZodString>;
+        user_email: z.ZodOptional<z.ZodString>;
+        account_id: z.ZodString;
+        project_id: z.ZodString;
+        resource: z.ZodString;
+        scope: z.ZodArray<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            expired: "expired";
+            revoked: "revoked";
+        }>;
+        token_count: z.ZodNumber;
+        granted_at: z.ZodString;
+        created_at: z.ZodString;
+        last_used_at: z.ZodOptional<z.ZodString>;
+        expires_at: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    total_count: z.ZodNumber;
+    limit: z.ZodNumber;
+    offset: z.ZodNumber;
+}, z.core.$strict>;
+export declare const OAuthGrantRevokeResponseSchema: z.ZodObject<{
+    revoked_tokens: z.ZodNumber;
+    revoked_consents: z.ZodNumber;
+}, z.core.$strict>;
+//# sourceMappingURL=oauth-server.d.ts.map

package/lib/api-schemas/oauth-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.d.ts","sourceRoot":"","sources":["../../src/api-schemas/oauth-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AAEH,eAAO,MAAM,qBAAqB;;;EAAqE,CAAC;AAExG,eAAO,MAAM,uBAAuB;;;EAAmE,CAAC;AAExG,eAAO,MAAM,6BAA6B;;;EAAuE,CAAC;AAElH,eAAO,MAAM,6BAA6B;;;EAA2E,CAAC;AAEtH,eAAO,MAAM,kCAAkC;;;;EAEE,CAAC;AAElD,eAAO,MAAM,oBAAoB;;;;EAEE,CAAC;AAEpC,eAAO,MAAM,uBAAuB,sBAAsD,CAAC;AAE3F,eAAO,MAAM,sBAAsB;;;;EAA4E,CAAC;AAEhH,eAAO,MAAM,yBAAyB;;;;;;;;EAEE,CAAC;AAEzC,eAAO,MAAM,yBAAyB;;;EAA8D,CAAC;AAErG;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAyBhC,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAEA,CAAC;AAE/B,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAA8D,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAEA,CAAC;AAE7C,eAAO,MAAM,8BAA8B;;kBAIE,CAAC;AAE9C,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgBE,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgBE,CAAC;AAE9C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;kBAmBE,CAAC;AAgChC,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAA8E,CAAC;AAEtH,eAAO,MAAM,2BAA2B;;kBAIE,CAAC;AAE3C,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAME,CAAC;AAElD,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOE,CAAC;AAE5C,eAAO,MAAM,8BAA8B;;;kBAKE,CAAC"}

package/lib/api-schemas/oauth-server.js

@@ -0,0 +1,193 @@
+import { z } from 'zod';
+/**
+ * The contracts for Vertesia's OWN OAuth server: the clients registered against it and the grants
+ * their users have approved. Vertesia acting as a client of someone else's authorization server is
+ * `./oauth.js`.
+ *
+ * Only the three resources backed by the studio API have slots here. The token server's own surface
+ * — authorize, token, device code, consent — is still TypeScript-derived and has not been converted,
+ * so the types it uses stay declared in `../oauth-server.ts` rather than moving here.
+ */
+export const OAuthClientTypeSchema = z.enum(['public', 'confidential']).meta({ id: 'OAuthClientType' });
+export const OAuthClientStatusSchema = z.enum(['active', 'disabled']).meta({ id: 'OAuthClientStatus' });
+export const OAuthRegistrationSourceSchema = z.enum(['admin', 'dynamic']).meta({ id: 'OAuthRegistrationSource' });
+export const OAuthProjectBindingModeSchema = z.enum(['user_select', 'fixed']).meta({ id: 'OAuthProjectBindingMode' });
+export const OAuthTokenEndpointAuthMethodSchema = z
+    .enum(['none', 'client_secret_post', 'client_secret_basic'])
+    .meta({ id: 'OAuthTokenEndpointAuthMethod' });
+export const OAuthGrantTypeSchema = z
+    .enum(['authorization_code', 'refresh_token', 'urn:ietf:params:oauth:grant-type:device_code'])
+    .meta({ id: 'OAuthGrantType' });
+export const OAuthResponseTypeSchema = z.literal('code').meta({ id: 'OAuthResponseType' });
+export const OAuthGrantStatusSchema = z.enum(['active', 'revoked', 'expired']).meta({ id: 'OAuthGrantStatus' });
+export const OAuthGrantSortFieldSchema = z
+    .enum(['granted_at', 'client_name', 'user_name', 'resource', 'last_used_at', 'expires_at', 'status'])
+    .meta({ id: 'OAuthGrantSortField' });
+export const OAuthGrantSortOrderSchema = z.enum(['asc', 'desc']).meta({ id: 'OAuthGrantSortOrder' });
+/**
+ * A client's registration, without its issued id.
+ *
+ * Split from {@link OAuthClientSchema} because `OAuthClient extends OAuthClientData` in the published
+ * types and both names are exported. No `id` in its meta, so it is never a component: the document
+ * publishes these properties inline under `OAuthClient`, with `client_id` last.
+ */
+export const OAuthClientDataSchema = z.strictObject({
+    client_name: z.string(),
+    client_type: OAuthClientTypeSchema,
+    redirect_uris: z.array(z.string()),
+    grant_types: z.array(OAuthGrantTypeSchema),
+    response_types: z.array(OAuthResponseTypeSchema),
+    token_endpoint_auth_method: OAuthTokenEndpointAuthMethodSchema,
+    allowed_scopes: z.array(z.string()),
+    default_scopes: z.array(z.string()).optional(),
+    registration_source: OAuthRegistrationSourceSchema,
+    status: OAuthClientStatusSchema,
+    project_binding_mode: OAuthProjectBindingModeSchema,
+    fixed_project_id: z.string().optional(),
+    restrict_to_owner_account: z
+        .boolean()
+        .meta({
+        description: 'When true (the default for new clients), the client may only be authorized for projects in its owning account/organization. Set to false to allow authorization for any project the approving user can access, regardless of account — required for OAuth/MCP clients used across organizations. The owning account itself is internal and not exposed here.',
+    })
+        .optional(),
+    metadata: z.looseObject({}).optional(),
+    created_by: z.string().optional(),
+    client_secret_configured: z.boolean().optional(),
+    created_at: z.string(),
+    updated_at: z.string(),
+});
+export const OAuthClientSchema = OAuthClientDataSchema.extend({
+    client_id: z.string(),
+}).meta({ id: 'OAuthClient' });
+export const OAuthClientArraySchema = z.array(OAuthClientSchema).meta({ id: 'OAuthClientArray' });
+/**
+ * The create response, which is the read shape plus the one field that is never readable again.
+ *
+ * `client_secret` is returned exactly once, by the call that generates it; every later read of the
+ * same client publishes `client_secret_configured` instead. Two components rather than one optional
+ * field on `OAuthClient` is what keeps that one-time disclosure visible in the document.
+ */
+export const OAuthClientCreateResponseSchema = OAuthClientSchema.extend({
+    client_secret: z.string().optional(),
+}).meta({ id: 'OAuthClientCreateResponse' });
+export const OAuthClientScopeMetadataSchema = z
+    .strictObject({
+    supported_scopes: z.array(z.string()),
+})
+    .meta({ id: 'OAuthClientScopeMetadata' });
+export const CreateOAuthClientPayloadSchema = z
+    .strictObject({
+    client_name: z.string(),
+    client_type: OAuthClientTypeSchema.optional(),
+    redirect_uris: z.array(z.string()),
+    grant_types: z.array(OAuthGrantTypeSchema).optional(),
+    response_types: z.array(OAuthResponseTypeSchema).optional(),
+    token_endpoint_auth_method: OAuthTokenEndpointAuthMethodSchema.optional(),
+    allowed_scopes: z.array(z.string()).optional(),
+    default_scopes: z.array(z.string()).optional(),
+    project_binding_mode: OAuthProjectBindingModeSchema.optional(),
+    fixed_project_id: z.string().optional(),
+    restrict_to_owner_account: z.boolean().optional(),
+    client_secret: z.string().optional(),
+    metadata: z.looseObject({}).optional(),
+})
+    .meta({ id: 'CreateOAuthClientPayload' });
+/**
+ * Not `.partial()` of the create payload, and the difference is deliberate rather than an oversight
+ * to tidy up: an update accepts `status`, which a create does not (a new client is always `active`),
+ * and cannot accept `client_type`, which is fixed at registration because the auth method and secret
+ * are decided from it. Deriving one from the other would publish both of those wrong.
+ */
+export const UpdateOAuthClientPayloadSchema = z
+    .strictObject({
+    client_name: z.string().optional(),
+    redirect_uris: z.array(z.string()).optional(),
+    grant_types: z.array(OAuthGrantTypeSchema).optional(),
+    response_types: z.array(OAuthResponseTypeSchema).optional(),
+    token_endpoint_auth_method: OAuthTokenEndpointAuthMethodSchema.optional(),
+    allowed_scopes: z.array(z.string()).optional(),
+    default_scopes: z.array(z.string()).optional(),
+    status: OAuthClientStatusSchema.optional(),
+    project_binding_mode: OAuthProjectBindingModeSchema.optional(),
+    fixed_project_id: z.string().optional(),
+    restrict_to_owner_account: z.boolean().optional(),
+    client_secret: z.string().optional(),
+    metadata: z.looseObject({}).optional(),
+})
+    .meta({ id: 'UpdateOAuthClientPayload' });
+export const OAuthGrantSchema = z
+    .strictObject({
+    grant_id: z.string(),
+    client_id: z.string(),
+    client_name: z.string(),
+    user_id: z.string(),
+    user_name: z.string().optional(),
+    user_email: z.string().optional(),
+    account_id: z.string(),
+    project_id: z.string(),
+    resource: z.string(),
+    scope: z.array(z.string()),
+    status: OAuthGrantStatusSchema,
+    token_count: z.number(),
+    granted_at: z.string(),
+    created_at: z.string(),
+    last_used_at: z.string().optional(),
+    expires_at: z.string().optional(),
+})
+    .meta({ id: 'OAuthGrant' });
+/**
+ * What `?status=` accepts: every {@link OAuthGrantStatusSchema} member, plus `all` for "do not filter".
+ *
+ * Written out rather than composed from the status enum, because the two are published differently
+ * and have to be: a query parameter is expanded inline, so a union would reach the document as an
+ * `anyOf` of a `$ref` and a `const` — a shape no generator turns into a usable enum, and one this
+ * parameter has never had. `oauth-grant-status-filter.test.ts` pins the members to the status enum
+ * plus the sentinel so the two cannot drift apart silently.
+ */
+const OAuthGrantStatusFilterSchema = z.enum(['active', 'revoked', 'expired', 'all']);
+/**
+ * The listing filters, shared with the bulk revoke body because `BulkRevokeOAuthGrantsPayload
+ * extends ListOAuthGrantsQuery` — selecting grants to revoke is selecting grants to list, and two
+ * copies of ten filters would be two chances for the selection to mean something different from the
+ * preview the caller looked at.
+ */
+const oauthGrantFilterFields = {
+    account_id: z.string().optional(),
+    project_id: z.string().optional(),
+    user_id: z.string().optional(),
+    client_id: z.string().optional(),
+    resource: z.string().optional(),
+    status: OAuthGrantStatusFilterSchema.optional(),
+    limit: z.number().optional(),
+    offset: z.number().optional(),
+    sort_by: OAuthGrantSortFieldSchema.optional(),
+    sort_order: OAuthGrantSortOrderSchema.optional(),
+};
+export const ListOAuthGrantsQuerySchema = z.strictObject(oauthGrantFilterFields).meta({ id: 'ListOAuthGrantsQuery' });
+export const RevokeOAuthGrantQuerySchema = z
+    .strictObject({
+    include_consent: z.boolean().optional(),
+})
+    .meta({ id: 'RevokeOAuthGrantQuery' });
+export const BulkRevokeOAuthGrantsPayloadSchema = z
+    .strictObject({
+    ...oauthGrantFilterFields,
+    grant_ids: z.array(z.string()).optional(),
+    include_consent: z.boolean().optional(),
+})
+    .meta({ id: 'BulkRevokeOAuthGrantsPayload' });
+export const OAuthGrantListResponseSchema = z
+    .strictObject({
+    grants: z.array(OAuthGrantSchema),
+    total_count: z.number(),
+    limit: z.number(),
+    offset: z.number(),
+})
+    .meta({ id: 'OAuthGrantListResponse' });
+export const OAuthGrantRevokeResponseSchema = z
+    .strictObject({
+    revoked_tokens: z.number(),
+    revoked_consents: z.number(),
+})
+    .meta({ id: 'OAuthGrantRevokeResponse' });
+//# sourceMappingURL=oauth-server.js.map

package/lib/api-schemas/oauth-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../../src/api-schemas/oauth-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAExG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAExG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAElH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAEtH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAC9C,IAAI,CAAC,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,CAAC;KAC3D,IAAI,CAAC,EAAE,EAAE,EAAE,8BAA8B,EAAE,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAChC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,8CAA8C,CAAC,CAAC;KAC7F,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAE3F,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAEhH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACrC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;KACpG,IAAI,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAErG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,qBAAqB;IAClC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAChD,0BAA0B,EAAE,kCAAkC;IAC9D,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,mBAAmB,EAAE,6BAA6B;IAClD,MAAM,EAAE,uBAAuB;IAC/B,oBAAoB,EAAE,6BAA6B;IACnD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,yBAAyB,EAAE,CAAC;SACvB,OAAO,EAAE;SACT,IAAI,CAAC;QACF,WAAW,EACP,8VAA8V;KACrW,CAAC;SACD,QAAQ,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AAE/B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAElG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,iBAAiB,CAAC,MAAM,CAAC;IACpE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,2BAA2B,EAAE,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC1C,YAAY,CAAC;IACV,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACxC,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC,CAAC;AAE9C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC1C,YAAY,CAAC;IACV,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC7C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAC3D,0BAA0B,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IACzE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC9D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC1C,YAAY,CAAC;IACV,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAC3D,0BAA0B,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IACzE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,MAAM,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC1C,oBAAoB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC9D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC,CAAC;AAE9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC5B,YAAY,CAAC;IACV,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,sBAAsB;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;AAEhC;;;;;;;;GAQG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAErF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAEtH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACvC,YAAY,CAAC;IACV,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAC9C,YAAY,CAAC;IACV,GAAG,sBAAsB;IACzB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,8BAA8B,EAAE,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KACxC,YAAY,CAAC;IACV,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,wBAAwB,EAAE,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC1C,YAAY,CAAC;IACV,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC/B,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC,CAAC"}